source: doc/usage_scenario @ 8c76b45

abac0-leakabac0-meicompt_changesgec13mei-idmei-rt0-nmei_rt0mei_rt2mei_rt2_fix_1meiyap-rt1meiyap1rt2tvf-new-xml
Last change on this file since 8c76b45 was 4918535, checked in by Mike Ryan <mikeryan@…>, 14 years ago

top-level build

  • Property mode set to 100644
File size: 1.5 KB
Line 
1You (Acme, Inc.) are running a service and you would like to use ABAC to
2authenticate users before they can buy rockets from you. Abstractly,
3your local set of credentials (as encoded by X509 attribute
4certificates) looks like this:
5
6    Acme.buy_rockets <- Acme.preferred_customer
7
8When you launch your service, you will create an ABAC context and load
9your identity certificate and the attribute certificate that encodes the
10above credential.
11
12You have issued the following attribute (encoded in an X509 attribute
13cert), which is held by a user of your service:
14
15    Acme.preferred_customer <- Coyote
16
17The Coyote will begin an SSL session to your service using his
18self-signed X509 identity certificate and will present this X509
19attribute certificate in the body of his message. You will clone the
20ABAC context and add the Coyote's identity certificate and the attribute
21certificate asserting that he is a preferred customer.
22
23You then issue a query asking:
24
25    Acme.buy_rockets <-?- Coyote
26
27The prover will return that this is in fact true and will return the set
28of credentials that proves this, namely:
29
30    Acme.buy_rockets <- Acme.preferred_customer
31    Acme.preferred_customer <- Coyote
32
33NOTES
34
35The credentials above are abstract representations. In actual
36credentials, 'Acme' and 'Coyote' would be represented by the SHA1 of
37their public keys.
38
39Given the above scenario, you can feel secure in selling rockets to the
40Coyote because he has established an SSL session using his certificate,
41indicating that he holds its private key.
Note: See TracBrowser for help on using the repository browser.