>
> Jim> I have decided that while I have a good idea of what a COR is
> Jim> (but not necessarily what you had previously labeled as one), I
> Jim> have absolutely no idea what the actual definition of an APC
> Jim> is. Please tell me the difference between an APC and a
> Jim> federation.
>
>Thinking of an APC as a federation is not entirely wrong. I could
>imagine a federation operating two APCs at different levels of
>assurance. I think of a federation as a legal entity like thing and as
>an APC as a business/technical entity belonging to a federation. Josh
>would certainly argue I'm over-simplifying and urge we never use the
>term federation.
My problem with the F word is that it is hopelessly overloaded, and this
results in confusion.
The 'technical' and 'behavioural' trust distinction is well-known (where
'technical trust' refers to the classic security assurances from which we
derive a level of confidence in that we know who we're talking to and that
our communications are secure and so forth; and 'behavioural' trust
relates to our expectations of how the other party is likely to behave,
e.g., we have this contract in place with certain promises).
The APC (a.k.a. CoR) and CoI are terms that describes operational
instantiations of these, respectively. There may be legal entities
associated with these, but this is clearly not a technical requirement.
To put this more tangibly, in the short term I suspect that Janet is
likely to operate a single APC (making technical trust assertions about
the organisations that connect to us) and possibly a small number of CoIs
(making broad statements such as, e.g., this is a university or a school).
I believe that the overwhelming majority of CoIs will be operated by other
actors (research projects, service providers, etc), either through our
managed service or Trust Routers that they choose to operate themselves.
What is particularly satisfying about the 'all the way down' validation,
which started this thread, is that it demonstrates that an APC is 'just' a
very terse CoI. And from this singularity we construct a rather rich
system... At least in theory, running code in a few weeks :-)
HTH, Josh.
Janet(UK) is a trading name of Jisc Collections and Janet Limited, a
not-for-profit company which is registered in England under No. 2881024
and whose Registered Office is at Lumen House, Library Avenue,
Harwell Oxford, Didcot, Oxfordshire. OX11 0SG. VAT No. 614944238
|