Subject: [sacm] The W3C PROV model of provenance is relevant to SACM

From: Clifford Kahn <[email-masked]>
Date: Sun, 25 Jan 2015 16:28:26 +0000

All,
Friday's Endpoint ID Design Team meeting will discuss provenance. What follows is pertinent to endpoint identity and to other parts of the information model.

W3C has come out with PROV, a set of standards for representing provenance, that I think should influence our work.

http://www.w3.org/TR/prov-overview/ is the brief overview.

http://www.w3.org/TR/2013/NOTE-prov-primer-20130430/ describes itself as "an intuitive introduction and guide to the PROV Data Model", but it actually contains the PROV information model (section 2).

The document usefully breaks down provenance:

Different people may have different perspectives on provenance, and as a result different types of information might be captured in provenance records.

*         One perspective might focus on agent-centered provenance, that is, what people or organizations were involved in generating or manipulating the information in question. For example, in the provenance of a picture in a news article we might capture the photographer who took it, the person that edited it, and the newspaper that published it.

*         A second perspective might focus on object-centered provenance, by tracing the origins of portions of a document to other documents. An example is having a web page that was assembled from content from a news article, quotes of interviews with experts, and a chart that plots data from a government agency.

*         A third perspective one might take is on process-centered provenance, capturing the actions and steps taken to generate the information in question. For example, a chart may have been generated by invoking a service to retrieve data from a database, then extracting certain statistics from the data using some statistics package, and finally processing these results with a graphing tool.
All three perspectives pertain to SACM. Whenever we say "provenance", let's make it clear which perspective(s) on provenance we mean. (Or we may want to choose more focused terms; I'll return to that.)

The reader may wish to look now at the diagram of the PROV information model, found in section 2 of http://www.w3.org/TR/2013/NOTE-prov-primer-20130430/.

Agent-Centered Provenance for SACM
In law, this perspective is called "chain of custody". [http://en.wikipedia.org/wiki/Chain_of_custody] A court wants to consider who had an opportunity to plant or tamper with evidence.

I submit that SACM components and humans also need to consider that. We cannot assume that all parts of a SACM deployment are fully intruder-proof.

The asserted-by and summarized-by relations in draft-ietf-sacm-information-model-00 capture some of the chain of custody. (They do not capture controllers, which also are in the chain of custody.)

                 +---+        +---------+______>______+-------+
                 |AVP|________|Endpoint |*           1|Summary|
                 +---+1..*   1|Attribute|_______      +-------+
                              |Assertion|0..1   |        *|
                              +---------+       |         |
                                 |*   |*        |         |
                                 |^   |____>____|        ^|
                      asserted-by|     <based-on          |summarized-by
                                 |1                       |
             ------------     +---------+                 |
             |          |__>__|SACM     |_________________|
             |Guidance  |1   *|Component|1
             ------------     +---------+

Do we also want to model the chain of custody of a Guidance instance? It seems to make sense to capture who published it.

Object-Centered Provenance for SACM
For SACM, object-centered provenance includes the assertions that an assertion or summary is based on. This kind of provenance is expressed in draft-ietf-sacm-information-model-00.  See the highlighted relationships.
                 +---+        +---------+______>______+-------+
                 |AVP|________|Endpoint |*           1|Summary|
                 +---+1..*   1|Attribute|_______      +-------+
                              |Assertion|0..1   |        *|
                              +---------+       |         |
                                 |*   |*        |         |
                                 |^   |____>____|        ^|
                      asserted-by|     <based-on          |summarized-by
                                 |1                       |
             ------------     +---------+                 |
             |          |__>__|SACM     |_________________|
             |Guidance  |1   *|Component|1
             ------------     +---------+

Process-Centered Provenance for SACM
For PROV, process-centered provenance is the series of "activities" that produced an "entity" (an object). Process-centered provenance could be the revision history, for example. Each step in the revision history would be associated with an "agent" that made the revision.

In SACM conversations we have been using the term "method". It is a simplified version of process-centered provenance. I think it is enough for SACM, for the initial set of RFCs.

Where PROV has a class Activity, I suggest that SACM have a class Method.

                        +---------+______>______+-------+
                        |Endpoint |*           1|Summary|
                        |Attribute|             +-------+
     __________________1|Assertion|                 |1
    | <was-generated-by +---------+                 |
   1|                                               |
+--------+__________________________________________|
| Method |1          <was-generated-by
+--------+

An example of Method could be "Reporting all the SWID tags found on an endpoint, but with no attempt to make sure the list is accurate or complete".

Why make Method be a class?

(a)    Because in PROV, Activity is a class, and I believe in the "use good stuff" theory of progress. In the future, Method might be extended in potent ways. One might want to keep an audit trail of who devised and revised a method.

(b)   Because if Method is a class, that suggests that the was-generated-by relations might be navigable in the reverse direction. A component might be able to ask questions like "Who is using broken method X?" or "What methods are in use?"

(c)    Because it feels right.
What do others think?

Terms
"Provenance" includes three perspectives. Maybe this has been confusing us, and maybe it will confuse our audience. To avoid ambiguity, we might want to use three terms, such as:

*         Chain of custody: the set of endpoints and components that had an opportunity to plant or tamper with an information element.

*         Basis: Inputs from which an information element was derived.

*         Method: How the first component in the chain of custody derived the information element from the basis.
I look forward to your thoughts.

Best,
                                                Cliff

Clifford Kahn
Principal Engineeer, Technical Lead

---

From: Clifford Kahn <[email-masked]>
Date: Mon, 26 Jan 2015 16:39:00 +0000

We have said that we wanted to associate provenance with individual AVPs, right?

But let's apply the three perspectives.

*         Process-centered provenance (method): Associating a method with each AVP makes sense to me.

*         Agent-centered provenance (chain of custody): Should that be associated with the endpoint attribute assertion *as a whole*?  Will different AVPs in an endpoint attribute assertion ever have *different* chains of custody?

These aren't just unrelated AVPs. Something asserts that all of these AVPs are true *of one endpoint*. In any case, that asserter should be part of the chain of custody.

*         Object-centered provenance (basis): I guess that basis should be associated with an AVP, not with the endpoint attribute assertion as a whole. But I don't want to guess. Examples would help, if anyone has real-world examples of endpoint attribute assertions derived from other endpoint attribute assertions.
Best,
                                                Cliff

From: Clifford Kahn [mailto:[email-masked]]
Sent: Sunday, January 25, 2015 11:28 AM
To: [email-masked]
Subject: [sacm] The W3C PROV model of provenance is relevant to SACM

All,

Terms

Best,
                                                Cliff

Clifford Kahn