1. Copyright © 2004, Epok, Inc. Extensible Resource Identifiers (XRIs) XDI Face to Face 28 April 2004

2. Copyright © 2004, Epok, Inc. What are XRIs Extensible Resource Identifier (XRIs) are abstract identifiers - broadly useful but include features especially well suited to identity and web services Based on URIs as defined by RFC2396 and can be downcast into conventional URIs Resolvable to concrete endpoints via standard resolution protocol defined by XRI Specification.

3. Copyright © 2004, Epok, Inc. XRIs: True Unified Identifiers XRIs can provide a uniform layer of abstract identifiers for any resource on any network IP Address DNS Names Phone NumbersEmail Address Future Addresses XRIs The Web

4. Copyright © 2004, Epok, Inc. XRI Goals A unified syntax for abstract identifiers providing –Abstraction and independence –Persistence and reassignability –Human-friendliness and machine-friendliness –Internationalization –Cross-context identification A standard Internet-based resolution protocol, including support for trusted resolution

5. Copyright © 2004, Epok, Inc. Absolute and relative persistent identifiers URNs require absolute persistent identifiers –The entire identifier is persistent –It will never be reassigned for all time This can be difficult to meet operationally –Requires a persistent ID for all higher-level domains Many uses require only relative persistence –Only part of the identifier is persistent –This portion is persistent for a relative period (i.e. the lifetime of its potentially reassignable id space)

6. Copyright © 2004, Epok, Inc. Examples of relative and absolute persistence Absolute persistent URNs urn:isbn:0-395-36341-1 urn:ietf:rfc:2141 urn:us:gov:usdoj:ins:somedata Note that this is now “broken” because the DOJ has transitioned to Department of Homeland Security and INS now has a new title of BCIS. To be semantically accurate this should therefore be changed to urn:us:gov:bcis:someschema ). Example of the problem of “semantic reflection” in persistent identifiers. Absolute persistent XRIs xri://:isbn:0-395-36341-1 xri://:ietf:rfc:2141 xri://:us:gov:bcis/:somedata xri://:34F2:A98E:B8FC/:somedata Relative persistent XRIs xri://www.bookstore.com/:isbn:0-395-36341-1 xri://ietf.org/rfc/:2141 xri://www.bcis.gov/:somedata

7. Copyright © 2004, Epok, Inc. Human-friendly identifiers A longtime goal of computing in general –Character-based interfaces  GUIs –8 char DOS filenames  Macintosh file names Providing HFIs for machine-friendly IP addresses was a key motivation for DNS Machine-friendly Identifier i.e., 192.168.10.134 Human-friendly Identifier i.e., epok.com IP Addresses DNS Names

8. Copyright © 2004, Epok, Inc. XRI Naming XRIs supports a layer of reassignable names that resolve (potentially) to persistent identifiers Global Context Symbols –“=” indicates a natural person –“@” indicates any legal entity other than a natural person –“+” indicates a generic noun, concept or name IP Addresses DNS Names E Numbers E Names Physical Network

9. Copyright © 2004, Epok, Inc. XRI Naming Examples Individual Human Friendly Identifiers (any natural person) xri:=JohnDoe xri:=MaryVincentSmith Organizational Human Friendly Identifiers (any legal mark) xri:@BarnesAndNoble xri:@bcis Zri:@gsa General Human Friendly Identifiers (any generic term) xri:+us xri:+books xri:+music/rock xri:+geology/rock xri:+someschema xri:+someschema/FirstName

10. Copyright © 2004, Epok, Inc. Cross-context identifiers A cross-context identifier identifies the same logical resource in different physical contexts English-language example: –John’s car –Mary’s car HTTP URI example: –http://www.wines.com/index.html –http://www.books.com/index.html

11. Copyright © 2004, Epok, Inc. Cross-context Example The same publication xri://www.bcis.gov/(xri://gsa.gov/:somepublication) xri://www.dod.gov/(xri://gsa.gov/:somepublication) xri://www.gsa.gov/(xri://gsa.gov/:somespublication) xri:@gsa/(xri://gsa.gov/:somepublication) The same type of web page xri://www.bcis.gov/(+faq) xri://www.gsa.com/(+faq) The same type of directory attribute xri:=JohnSmith/(+email) xri:@gsa/(=JohnSmith)/(+email)

12. Copyright © 2004, Epok, Inc. Attribute and version identifiers Standardizing cross-context data exchange requires more than just object-level identifiers Attributes must be addressable relative to a containing object –Must support nested attributes Versions must be addressable relative to an object or attribute –Must support nested versions

13. Copyright © 2004, Epok, Inc. Attribute and version Examples Attributes xri:=John Smith/(+email)/work xri:@gsa/(=JohnSmith)/(+email)/work xri:@gsa/:someschema/FirstName Versions xri:=JohnSmith/(+email)/work/($v/3) xri:=JohnSmith/(+email)/work/($d/2001-06-21T07:33:48Z) xri:@gsa/:someschema/($v/1)/FirstName

14. Copyright © 2004, Epok, Inc. Forms of an XRI Well defined transforms for various “normal forms” –XRI normal form – Native XRI –IRI normal form – Identifier in the form expected by the IRI draft. Primarily involves obfuscation of cross- references. –anyURI normal form – Appropriate for anyURI as defined by XML schema. Transforms URI-authority component into legal DNS name. –URI normal form – Pure 2396-style URI. Mainly normalizes international characters.

15. Copyright © 2004, Epok, Inc. XRI Resolution Spec defines resolution for GCS-based XRI Authorities –Local Path resolution is not defined Resolution is based on HTTP Gets. –Series of HTTP Gets to subsequent XRIAuthorities –Last subsegment points to a Local Access or AlternativeXRI Returns XML as an XRIDescriptor element XRIDescriptor has well defined elements for XRIAuthority, LocalAccess, Mapping and AlternativeXRI Benefit: Extensible via XML, but server doesn’t have to parse XML during resolution. Each XRI Authority is considered to be unaware of what other subsegments are pointing to it. –Extremely flexible –Makes sanity checking difficult

16. Copyright © 2004, Epok, Inc. XRI Resolution (cont.) Describes the result of resolving an XRI subsegment XRIAuthority element indicates URI for resolving an additional subsegment LocalAccess element indicates URIs to use for various MIME types Resolved element indicates what subsegment was resolved Nothing indicates what authority resolved it –Client is responsible for keeping XRI Descriptors in context Sample descriptor :3 http://x.customer.com/xri/resolve?ns=hostid application/vnd.epok.xns http://x.customer.com/eis/XNSRequest https://x.customer.com/eis/XNSRequest

17. Copyright © 2004, Epok, Inc. Example of Resolution Client wants to resolve “xri:@:1010:3/:6” Client disregards everything after the first “/”. This part (Local Path) is not globally resolvable. Client knows URI for “@” beforehand. –http://gcs.xriroot.com/xri/resolve?ns=at Client asks “@” about “:1010” –http://gcs.xriroot.com/xri/resolve/:1010?ns=at –Client parses XRIDescriptor for XRIAuthority http://xns.epok.com/xri/resolve?ns=hostid Client asks “@:1010” about “:3” –http://xns.epok.com/xri/resolve/:3?ns=hostid –Client parses XRIDescriptor for appropriate local access Client can now interact with resource :6 in the context of @:1010:3 via local access protocol identified in XRID

18. Copyright © 2004, Epok, Inc. Trusted Resolution XRID is signed by the providing XRI Authority Moves metadata like TTL out of HTTP headers so they can be included in the signed data Backward compatible with standard resolution Contains a SAML assertion with a new kind of attribute statement that points back to the enclosing XRID (like an enveloped signature) :3 http://x.customer.com/xri/resolve?ns=hostid application/vnd.epok.xns http://x.customer.com/eis/XNSRequest https://x.customer.com/eis/XNSRequest..

19. Copyright © 2004, Epok, Inc. Misconceptions about XRIs Spaces are legal in XRIs –xri:=john smith – The XRI is =john –xri:=john%20smith – legal –xri:=(john.smith) – legal (though not equivalent to previous) The spec allows multiple @ and = authorities xri:@example/=dave is equivalent to @example/(=dave) Resolution requires HTTP / HTTPS eNames resolve to eNumbers / has implied semantics –Do. and : imply delegated authority, while / implies organization within the same authority? No –=john/addresses/work/city –=john/addresses.work/city XRIs must be rooted on @, =, + or // XRIs have a canonical form There is an authority for +