Changes between Version 10 and Version 11 of CrudgeDocs

Timestamp:

Apr 11, 2011 11:14:21 AM (14 years ago)

Author:

faber

Comment:

--

CrudgeDocs

@@ -35 +35 @@
 [[Image(crudge_first_annotated_test.png)]]
 
+=== Viewing a Graph ===
 
-=== Running A Query ===
-
-To demonstrate running a query, load an example set of credentials from http://abac.deterlab.net/examples/rockets_intersection.zip .  Select "Open a URL" from the File menu and type http://abac.deterlab.net/examples/rockets_intersection.zip into the dialog box and hit return.  (You can also get the dialog box by typing Ctrl-U).
+A credential graph represents a view of a set of ABAC credentials, for example the credentials that make up a proof or a policy.  There are several ways to load a proof (described in more detail below), but to see the basics load an example set of credentials from http://abac.deterlab.net/examples/rockets_intersection.zip .  Select "Open a URL" from the File menu and type http://abac.deterlab.net/examples/rockets_intersection.zip into the dialog box and hit return.  (You can also get the dialog box by typing Ctrl-U).
 
 A set of credentials will appear layed out roughly as a tree.  You will probably need to move the boxes around a bit to see the structure.  You can move a vertex by putting the pointer on it, holding down the left mouse button and dragging the box. You can pan around the space by putting the pointer on the background, holding the left button and dragging the whole frame. With a little moving you should see something like the image below.
@@ -44 +43 @@
 [[Image(batman.png)]]
 
-If you enter Acme.buy_rockets in the leftmost query box and Coyote in the other and hit enter, you will see the following.
+This set of credentials represents the policy of a company called Acme that is in the business of selling armaments to fictional characters.  There are four roles displayed and two principals.  The principals are the two blue circles labelled "Coyote" and "Batman".  The green rectangles are simple roles assigned by two principals not depicted ("Acme" and "WarnerBros").  A simple role is controlled by the principal to the left of the dot in the rectangle.  Acme controls Acme.preferred_customer.  WarnerBros controls WarnerBros.character.
+
+The red rectangle represents an intersection role, which is the logical conjunction of the two roles separated by the ampersand, in this case Acme.preferred_customer and WarnerBros.character.  A principal has an intersection role if it also has all of the individual roles.  When the prerequisites for an intersection role are met by a principal, crudge connects the principal to the intersection role with a dotted line.  In this example, Coyote has edges to both Acme.preferred_customer and WarnerBros.character, so it has a connection to the red role.
+
+The solid lines represent credentials, the dotted lines represent deductions.  This graph captures the idea that Acme will allow characters that are both its preferred customers and WarnerBros characters to buy rockets.
+
+There is another kind of role, a linking role, that is described in more detail in the [http://groups.geni.net/geni/wiki/TIEDABACModel ABAC description referenced above.]
+
+=== Running A Query ===
+
+The paths through this simple graph are easily traced by eye, but the query interface can be used to find the relevant paths through more tangled graphs.  We demonstrate the query interface on the graph loaded above.
+
+If a user enterd Acme.buy_rockets in the leftmost query box and Coyote in the other and hits enter, that requests a proof that Coyote has the Acme.buy_rockets role.  After that request is made (by hitting return) the query pane displays the following:
 
 [[Image(coyote_query.png)]]
@@ -50 +61 @@
 The query pane shows the smiling face icon and the part of the graph containing the path from Coyote to Acme.buy_rockets.  The credential graph encodes the idea that to buy rockets from Acme, a principal must be a preferred customer of Acme (the Acme.preferred_customer role) and be a !WarnerBros character (the !WarnerBros.character role).  The Coyote meets both conditions, but Batman meets only one in this example.
 
-To see that Batman cannot buy rockets enter Acme.buy_rockets in the leftmost query box and Coyote in the other and hit enter.  You will see an empty query with the red "X".
+To see that Batman cannot buy rockets enter Acme.buy_rockets in the leftmost query box and Coyote in the other and hit enter.  The pane will show an empty query with the red "X".
 
 [[Image(batman_query.png)]]
 
-While Batman cannot buy rockets, he is a preferred customer.
+While Batman cannot buy rockets, he is a preferred customer, demonstrated by this query:
 
 [[Image(batman_query2.png)]]
@@ -74 +85 @@
 === Editing Credential Graphs ===
 
-Editing credential graphs is fairly straightforward.  When editing, crudge created any missing but implied roles and principals, and credentials can be assigned by drawing arcs between nodes.  For example, clear the current credentials by choosing "New" from the "File" menu, and then left click on the empty graph.  A menu with an "Add Vertex entry will appear.  If you enter "test.a & test.b" and hit enter, 4 nodes will appear in the graph (after a short wait).
+Editing credential graphs is fairly straightforward.  When editing, crudge created any missing but implied roles and principals, and credentials can be assigned by drawing arcs between nodes.  For example, clear the current credentials by choosing "New" from the "File" menu, and then left click on the empty graph.  A menu with an "Add Vertex entry will appear.  Entering "test.a & test.b" and hit enter, will cause 4 nodes to appear in the graph (after a short wait).
 
 [[Image(edit1.png)]]
+
+To get all the nodes in sight, they may need to be moved by dragging them with the left mouse button 
 
 A fair amount has happened.  First because the vertex requested depended on two other roles, test.a and test.b, those roles were also created.  In order to create those roles, a principal named test was needed to assign them, so crudge also created that principal.  That principal has private and public keys known to crudge, and it can generate credentials issued by test.