Subject: Re: [decade] Remaining issue: meta data issue

From: "Mcdysan, David E" <[email-masked]>
Date: Fri, 2 Sep 2011 08:47:08 -0400

Hi Rahman,

In your point 2 below is it actually an "Access Control List" or some form
of authentication token?

Thanks,

Dave

On Tuesday8/23/11 11:44 AM, "Rahman, Akbar"
<[email-masked]> wrote:

>Hi Haibin,
>
>
>From the Quebec city minutes
>
>http://www.ietf.org/proceedings/81/minutes/decade.txt
>
>
>I understood that the following issues were open for DECADE metadata:
>1) Do we make metadata immutable?
>2) What is contained in the metadata?
>
>
>My feedback is as follows:
>1) Yes, make metadata immutable
>2) Define a minimum set of information for the metadata.  So far, Time
>To Live (TTL) and Access Control List (ACL) were discussed and seem to
>be two items that are logical to include in the metadata
>
>
>I would be interested in hearing feedback from other members of the WG.
>
>
>Akbar
>
>
>-----Original Message-----
>From: [email-masked] [mailto:[email-masked]] On Behalf
>Of Songhaibin
>Sent: Monday, August 22, 2011 4:50 AM
>To: [email-masked]
>Subject: [decade] Remaining issue: meta data issue
>
>Dear all,
>
>I would suggest to have more discussion about the remaining issue from
>the past IETF meeting. We may continue the discussion about meta data.
>If we can solve it here in the list, we can update the architecture
>draft (maybe the reqs draft as well) and start the WGLC for them.
>
>BR,
>-Haibin
>_______________________________________________
>decade mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/decade
>_______________________________________________
>decade mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/decade

---

From: "Rahman, Akbar" <[email-masked]>
Date: Fri, 2 Sep 2011 10:58:07 -0400

Hi Dave,

My understanding is that the DECADE authentication token will be passed
separately from the metadata by the DECADE Resource Protocol (DRP).  So
I am proposing that the ACL would be a separate item from the
authentication token, and that the ACL would be included as part of the
metadata (which would be sent on the SDT).  My thinking is that a lot of
VoD type content today has some sort of ACL type data associated with it
today and that philosophy should carry forward in DECADE.

I would be interested to hear any counter arguments though.

Akbar

-----Original Message-----
From: Mcdysan, David E [mailto:[email-masked]] 
Sent: Friday, September 02, 2011 8:47 AM
To: Rahman, Akbar; Songhaibin
Cc: [email-masked]
Subject: Re: [decade] Remaining issue: meta data issue

Hi Rahman,

In your point 2 below is it actually an "Access Control List" or some
form
of authentication token?

Thanks,

Dave

---

From: "Yingjie Gu(yingjie)" <[email-masked]>
Date: Tue, 06 Sep 2011 22:35:03 +0800

First of all, I think the ACL is a good use case for metadata. 
But since the ACL could change with time, e.g. Client A can access now but
is denied after a while, the metadata couldn't be immutable.
If I understand correctly, ACL and token are two ways to get to the same
purpose: access control. You can either use ACL by metadata or use Token
transferred by DRP, or even use them at the same time(I don't see the reason
for doing this for now). 
If we want to support both, at least one of them should be mandatory. 

Best Regards
Gu Yingjie

-----邮件原件-----
发件人: [email-masked] [mailto:[email-masked]] 代表
Rahman, Akbar
发送时间: 2011年9月2日 乐乐22:58
收件人: Mcdysan, David E
抄送: [email-masked]
主题: Re: [decade] Remaining issue: meta data issue

Hi Dave,

Akbar

-----Original Message-----
From: Mcdysan, David E [mailto:[email-masked]] 
Sent: Friday, September 02, 2011 8:47 AM
To: Rahman, Akbar; Songhaibin
Cc: [email-masked]
Subject: Re: [decade] Remaining issue: meta data issue

Hi Rahman,

Thanks,

Dave

---

From: "Rahman, Akbar" <[email-masked]>
Date: Wed, 7 Sep 2011 14:26:39 -0400

Hi Yingjie,

Thanks for the comment.  With regards to your comment on the potential for ACL to change over time.  I think that Haibin made a similar comment for TTL (i.e. only take the hash over the data and do NOT include metadata):

http://www.ietf.org/mail-archive/web/decade/current/msg00483.html

Akbar

-----Original Message-----
From: Yingjie Gu(yingjie) [mailto:[email-masked]] 
Sent: Tuesday, September 06, 2011 10:35 AM
To: Rahman, Akbar; 'Mcdysan, David E'
Cc: [email-masked]
Subject: RE: [decade] Remaining issue: meta data issue

Best Regards
Gu Yingjie

-----邮件原件-----

Hi Dave,

Akbar

-----Original Message-----
From: Mcdysan, David E [mailto:[email-masked]] 
Sent: Friday, September 02, 2011 8:47 AM
To: Rahman, Akbar; Songhaibin
Cc: [email-masked]
Subject: Re: [decade] Remaining issue: meta data issue

Hi Rahman,

Thanks,

Dave

---

From: "Rahman, Akbar" <[email-masked]>
Date: Tue, 13 Sep 2011 10:06:49 -0400

Hi Haibin,

We have had some discussion on this topic on the list.  Do you consider
the issue resolved, and can we update the architecture draft to start
the WGLC?

Akbar

-----Original Message-----

Dear all,

BR,
-Haibin

---

From: Richard Alimi <[email-masked]>
Date: Sun, 18 Sep 2011 13:30:49 -0700

> If we want to support both, at least one of them should be mandatory.

It was probably a poor choice for us to refer to "ACL" in the past for
this as an abstract way to refer to the entities that may potentially
access an object at any point of time.  Understandably, the
connotation of "ACL" was that there was an explicit set of
users/groups configured at the server with permissions for a
particular object.  The latest revisions of the architecture and
requirements should have be much more clear that an ACL is an
alternative approach, but the token-based mechanism to be used in
DECADE.

I would agree that we should stick with token-based for now, but I
would be hesitant to mention an explicit ACL as a potential future
improvement because of how that might force us to complicate the
protocol (it requires identifying users and administrative domains).

How does that sound?

Rich

---

From: Richard Alimi <[email-masked]>
Date: Sun, 18 Sep 2011 13:36:32 -0700

On Wed, Aug 24, 2011 at 7:48 PM, Songhaibin <[email-masked]> wrote:
> Hi Akbar,
>
> IMO, even the metadata is immutable, the content publisher may still change it with new metadata, for example, refresh the TTL. In this case, if the object itself is not changed, both the content publisher and content requester do not need a new hash string for the object, and the content publisher does not need to redistribute the new object identity to the content requester. Does that make sense?
>

I agree with the sentiment, but it might be clearer to word the
document along these lines (in order to be more specific about what we
mean and don't mean by the word "metadata"):
(1) DECADE does not allow clients to attach user-defined metadata to
an object. If clients wish to do this, they may use a mechanism such
as storing their desired metadata inside the data object itself, or
within a different data object.
(2) There may be additional DECADE-layer or storage-layer attributes
associated with a data object.  The protocol may be defined such that
additional attributes can be added in the future.  These attributes
have a scope that is local to a single DECADE server -- these
attributes will not be transmitted when a data object is copied to
another DECADE server or client.

How does that sound?  If it sounds good, then we can go ahead and
update the document and post a new version.

Thanks,
Rich

>> From: Rahman, Akbar [mailto:[email-masked]]
>> Sent: Thursday, August 25, 2011 10:36 AM
>> To: Songhaibin
>> Cc: [email-masked]
>> I agree with your point to allow the metadata to be extensible in the future. On
>> your suggestion for taking the hash, I have a question. If the metadata is
>> immutable, why would you not include it for the hash calculation?
>>
>> Akbar
>>
>>
>>
>> From: Songhaibin [[email-masked]]
>> Sent: Wednesday, August 24, 2011 09:52 PM Eastern Standard Time
>> To: Rahman, Akbar
>> Cc: [email-masked]
>> Hi Akbar,
>> Speak as an individual, I agree with you on 1). For 2), we should make a
>> minimum set of metadata at the beginning, but I think we should allow
>> extensibility.
>>
>> I think that the hash should NOT be made over the metadata, but only over the
>> object itself. Because the metadata may change.
>>
>> BR,
>> -Haibin
>>
>> > From: Rahman, Akbar [mailto:[email-masked]]
>> > Sent: Tuesday, August 23, 2011 11:44 PM
>> > To: Songhaibin
>> > Cc: [email-masked]

---

From: "Rahman, Akbar" <[email-masked]>
Date: Sun, 18 Sep 2011 22:11:05 -0400

Hi Rich,

I think your suggestions are very well worded.

+1

Akbar

-----Original Message-----
From: Richard Alimi [[email-masked]]
Sent: Sunday, September 18, 2011 04:36 PM Eastern Standard Time
To: Songhaibin
Cc: Rahman, Akbar; [email-masked]
Subject: Re: [decade] Remaining issue: meta data issue

Thanks,
Rich

---

From: Songhaibin <[email-masked]>
Date: Tue, 20 Sep 2011 02:00:34 +0000

The description also looks good to me.

BR,
-Haibin

> Sent: Monday, September 19, 2011 10:11 AM
> To: [email-masked]; Songhaibin
> Cc: [email-masked]
> > IMO, even the metadata is immutable, the content publisher may still change
> it with new metadata, for example, refresh the TTL. In this case, if the object
> itself is not changed, both the content publisher and content requester do not
> need a new hash string for the object, and the content publisher does not need
> to redistribute the new object identity to the content requester. Does that
> make sense?
> >
>

---

From: Songhaibin <[email-masked]>
Date: Fri, 23 Sep 2011 07:22:58 +0000

Hi Akbar,

Yes. In the architecture level, I think we solved the issue. The details can be done in the next step protocol work IMO.

BR,
-Haibin

> Sent: Tuesday, September 13, 2011 10:07 PM
> To: Songhaibin
> Cc: [email-masked]