Hey all:

Painless Security has been meeting with JISC this week, which included
some discussion about how trust routers might communicate with each
other.  Sam made a proposal for the message format that trust routers
might send to each other to propagate their routing tables, and I took
some notes from that.

At a high level, the message protocol format uses a JSON array of
entries, which contains a recursive set of trust routers that were the
sources of the routing information.  I'll let Sam speak to the system
requirements that gave rise to this proposal.

I have attached a text file with a short description of the JSON and a
hand-coded imaginary example to illustrate it.  I am including the short
description of the JSON below:

Toplevel:
[ENTRIES_OBJECT, ENTRIES_OBJECT, ...]

ENTRIES_OBJECT
{
  /* Common fields */
  type:           'CoI' | 'TIDS' | 'RP Community',
  communities:    ['name1', ...],
  target_realms:  ['name1', ...],
  sources:        SOURCES,

  /* Type-dependent fields */
  'tids_addresses': ['name:port'],       /* Type TIDS */
  'apcs': ['name1', ...],                /* Type CoI */
  '???': {???}                           /* Type RP Community */
}

SOURCES:
{
  '#{trust_router_name}': true | SOURCES
}
TRUST_ROUTER_NAME: 'DNS hostname:Port' | 'IP Address:port'


Cheers,
--Mark



Toplevel:

[ENTRIES_OBJECTS]



ENTRIES_OBJECT

{

  /* Common fields */

  type:           'CoI' | 'TIDS' | 'RP Community',

  communities:    ['name1', ...],

  target_realms:  ['name1', ...],

  sources:        SOURCES,

  

  /* Type-dependent fields */

  'tids_addresses': ['name:port'],       /* Type TIDS */

  'apcs': ['name1', ...],                /* Type CoI */

  '???': {???}                           /* Type RP Community' */

}



SOURCES:

{

  '#{trust_router_name}': true | SOURCES

}

TRUST_ROUTER_NAME: 'DNS hostname:Port' | 'IP Address:port'



Example:

[ { 'type': 'TIDS',                                            /* IdP connected directly to me */

    'communities': ['apc.jisc.co.uk'],                         /* This is an APC name */

    'target_realms': ['camb.ac.uk', 'chemistry.camb.ac.uk'],   /* This is an IDP Realm */

    'tids_addresses': ['idp.camb.ac.uk:12308'],

    'sources': true    },

  { 'type': 'TIDS',                                            /* Other Trust Router or APC */

    'communities': ['ov-apc.geant.org'],

    'target_realms': ['students.mit.edu'],

    'sources': {

      'tr.geant.org:12308': {

        'tr.internet2.org:12308': true

      },

      'tr.ncsa.org:12308': true

    },

    'tids_addresses': ['tr.jisc.co.uk:12308'] },

  { 'type: 'CoI',                                               /* CoI -> APC Mapping */

    'target_realms': ['students.mit.edu'],                      /* An IdP Realm name */

    'communities': ['Earthquake-Researchers.mit.edu'],          /* CoI names */

    'apcs': ['ov-apc.jisc.co.uk', 'ov-apc.geant.org']           /* APC names */

    'sources': {  'tr.geant.org:12308': true }  },

  { 'type': 'RP Community',

    'target_realms': ['seismographs.oxford.ac.uk'],             /* RP Realm Names */

    'communities': ['Earthquake-Researchers.mit.edu'],          /* CoI names */

    'sources': true,

    'constraints?': [...] }

]