A presentation by Robin Upton ( ) ‏ Latest version at Attribution – NonCommercial - ShareAlike FF 10 : Access Control Recommended Pre-requisite: FF9: Filters V

Identity relies on Digital Signatures soft-system Public Key Soft-systems have a cryptographic key-pair soft-system Public Key soft-system Public Key Soft-systems identify incoming packets by their digital signature. Soft-systems use their private key to sign outgoing packets & their friends’ public keys. Private Key Public Key

Incoming Packets External packets arrive at the root signed with / f2f f2f/guests f2f/guests /jim /f2f/lib /f2f/lib /demo f2f/guests /tom /f2f/lib top The root node has a list of all friends’ keys... Soft-nodes track identity & a filter to signed data.key.xml

Outgoing Messages Outgoing messages arrive at the root tagged / f2f f2f/guests f2f/guests /jim /f2f/lib /f2f/lib /demo f2f/guests /tom /f2f/lib top The send-by-uid service manages cryptography & addressing. The root node has a list of all friends’ keys... & a filter to signed data.key.xml

@uid The root node’s filters maintain 2 datastores, indexed The send-by-uid service abstracts away cryptography & addressing from the programmer data.key.xml XSL templates access the caller of a service as $_f2f-thread-uid data.address.xml is at the heart of the soft-system’s access control.

/f2f/example Controlling Access to Services Each soft-node has its own set of access control lists * Although required, the F2F namespace is omitted for brevity. It has either a whitelist (default=“deny”) or a blacklist (default=“allow”)‏ Each service has a list defining may access it ($_f2f-thread-uid)‏......

Subsequent processing has the original Privileged Services A service is processed up to N times in a child thread with a usually that of its module. /f2f/example this If this service The first time it is processed, it has a

Permanent Privilege A service continues with a until processing terminates. /f2f/example this Care should be taken to avoid privileging arbitrary s.

Module Requirements F2F modules’ signature’s public-keys are mapped These identities are given to the module’s privileged services. A may always access its own services, but must list the other services it uses, as follows: This is used to check of dependencies and to grant permissions when a module is added to a soft-system.

Additional Access Considerations Services with admin=“1” may only be used from the administrator’s soft-server. Services with visibility=“private” are hidden from other soft-nodes, so requests from outside will not resolve. F2F basic access control is an XML-based system, on which more advanced layers can be built. Soft-nodes have a wildcard access list that controls can executing any threads. The core services access-get & access-set provide hooks for integration with scripts.

Summary Recommended Follow-up: FF11: Modules Soft-systems allocate uids to signed packets. signed The root node stores keys & addresses in databases. Soft-nodes have a separate ACL for each service.