Changes between Version 9 and Version 10 of CrudgeDocs
- Timestamp:
- Apr 10, 2011 9:40:23 PM (14 years ago)
Legend:
- Unmodified
- Added
- Removed
- Modified
-
CrudgeDocs
v9 v10 3 3 == Intro == 4 4 5 Crudge is a browser for credentials implementing the RT0 logic used by ABAC. The credentials are visualized as a directed graph where principals and roles/attributes are nodes in the graph and credentials are edges. If a principal has an attribute (can act in a role) there is a path through the directed graph from principal to attribu et(role).5 Crudge is a browser for credentials implementing the RT0 logic used by ABAC. The credentials are visualized as a directed graph where principals and roles/attributes are nodes in the graph and credentials are edges. If a principal has an attribute (can act in a role) there is a path through the directed graph from principal to attribute (role). 6 6 7 Crudge uses the same visualizations for roles that [http://groups.geni.net/geni/wiki/TIEDABACModel our description of ABAC] for [http://groups.geni.net/geni/wiki/TIED TIED] uses. [http://groups.geni.net/geni/wiki/TIEDABACModel That description] is a good starting point the visuali ations and ABAC.7 Crudge uses the same visualizations for roles that [http://groups.geni.net/geni/wiki/TIEDABACModel our description of ABAC] for [http://groups.geni.net/geni/wiki/TIED TIED] uses. [http://groups.geni.net/geni/wiki/TIEDABACModel That description] is a good starting point the visualizations and ABAC. 8 8 9 9 Crudge allows a user to visualize an ABAC proof or explore a policy. One can make queries against the policy and save all or parts of the policy. It can be used to create credentials and principals, that interoperate with the rest of [wiki:WikiStart ABAC]. It can be used as a simple management interface for small systems using ABAC. … … 40 40 To demonstrate running a query, load an example set of credentials from http://abac.deterlab.net/examples/rockets_intersection.zip . Select "Open a URL" from the File menu and type http://abac.deterlab.net/examples/rockets_intersection.zip into the dialog box and hit return. (You can also get the dialog box by typing Ctrl-U). 41 41 42 A set of credentials will appear layed out roughly as a tree. You will probably need to move the boxes around a bit to see the structure. You can move a vertex by putting the pointer on it, holding do en the left mouse button and dragging the box. You can pan around the space by putting the pointer on the background, holding the left button and dragging the whole frame. With a little moving you should see something like the image below.42 A set of credentials will appear layed out roughly as a tree. You will probably need to move the boxes around a bit to see the structure. You can move a vertex by putting the pointer on it, holding down the left mouse button and dragging the box. You can pan around the space by putting the pointer on the background, holding the left button and dragging the whole frame. With a little moving you should see something like the image below. 43 43 44 44 [[Image(batman.png)]] … … 48 48 [[Image(coyote_query.png)]] 49 49 50 The query pane shows the s imiling face icon and the part of the graph containing the path from Coyote to Acme.buy_rockets. The credential graph encodes the idea that to buy rockets from Acme, a principal must be a preferred customer of Acme (the Acme.preferred_customer role) and be a !WarnerBros character (the !WarnerBros.character role). The Coyote meets both conditions, but Batman meets only one in this example.50 The query pane shows the smiling face icon and the part of the graph containing the path from Coyote to Acme.buy_rockets. The credential graph encodes the idea that to buy rockets from Acme, a principal must be a preferred customer of Acme (the Acme.preferred_customer role) and be a !WarnerBros character (the !WarnerBros.character role). The Coyote meets both conditions, but Batman meets only one in this example. 51 51 52 52 To see that Batman cannot buy rockets enter Acme.buy_rockets in the leftmost query box and Coyote in the other and hit enter. You will see an empty query with the red "X". … … 117 117 Crudge can load ABAC information from several different file formats: 118 118 119 * Individual X.509 certificates that contain either principals (in PEM format) or ABAC credentials (in derformat)120 * A directory containing X.509 certificates that contain either principals (in PEM format) or ABAC credentials (in derformat)121 * A zip file of X.509 certificates 119 * Individual X.509 certificates that contain either principals (in PEM format) or ABAC credentials (in DER format) 120 * A directory containing X.509 certificates that contain either principals (in PEM format) or ABAC credentials (in DER format) 121 * A zip file of X.509 certificates that contain either principals (in PEM format) or ABAC credentials (in DER format) 122 122 * An rt0 file that includes only a description of the credentials, but no principal keys or credentials 123 123 124 The first three are pretty straightforward. The certificates that comprise a real policy or proof can be loaded from those formats and viewed and manipulated directly in crudge. Note that if the principal key pairs are not included, or are not accessible, crudge will not be able to create new certificates signed by those principals. Such credentials can still be reasoned about, but will be drawn in red to indicate that they cannot be exported.124 The first three are pretty straightforward. The certificates that comprise a real policy or proof can be loaded from those formats and viewed and manipulated directly in crudge. Note that if the principal key pairs are not included, or are not accessible, crudge will not be able to create new certificates signed by those principals. Such credentials can still be reasoned about, but will be drawn in red to indicate that they cannot be exported. 125 125 126 126 The rt0 format is for simple debugging and testing. It consists of lines of the format: … … 138 138 Zip files and rt0 files can also be loaded from URLs. The "Open URL" and Append URL" choices in the File menu accomplish this. 139 139 140 If a principal has been loaded from one source without its key pair, the key pair can be loaded using "Load Keys" from the "File" menu. Crudge can find the principal bound to the same key in memory. Note that this cannot be used to assign a key pair to a principal created by crudge. 141 142 == Saving Credential Graphs == 143 144 Crudge can save credential graphs either in a zip file containing the relevant credentials or in rt0 files for debugging. Rt0 files do not contain any cryptographic information and cannot directly specify proofs or policies. Zip files can be used to provide policies or proofs. 145 146 To save the entire credential graph, choose "Save" from the "File" menu and pick the save file name from the chooser. That chooser will look like this: 147 148 [[Image(chooser.png)]] 149 150 If the name ends in .zip or .rt0 that format will be used. If neither of these are chosen, or the user wants to force a format, the pull-down menu in the "Format" section of the file chooser can be used (it it displaying "Use suffix" in the image above). 151 152 Below that pull down menu are two check boxes that control extra information to be saved in the zip file. If "Include Private Keys" is selected, the identity certificates of the principals will include their private keys. This means that holders of the zip file will be able to generate new credentials from those principals. This is a feature if you are generating principals to act under the policy you are exporting, but a bug if you believe your are exporting a proof. It is off by default. 153 154 Unless "Include All Identities" is checked, only identities necessary to validate the credentials are included in the output. This means that principals who only have attributes assigned to them are not included. If this box is checked, identity certificates for those principals are included as well. 155 156 Neither of those check boxes are relevant to .rt0 files, because they contain no cryptographic material. 157 158 == Conclusion == 159 160 That should be enough to get you started using crudge. If you have further questions [WikiStart contact us].
