May 2018 - WG-UMA - mailman.kantarainitiative.org

FYI, IEEE SA 7012 - Standard for Machine Readable Personal Privacy Terms
by Eve Maler 23 Aug '18

23 Aug '18

Hi WGs-- This past week at IIW a session was held (I wasn't able to attend the session itself) about an IEEE project to develop "machine readable personal privacy terms": https://standards.ieee.org/develop/project/7012.html "The purpose of the standard is to provide individuals with means to proffer their own terms respecting personal privacy, in ways that can be read, acknowledged and agreed to by machines operated by others in the networked world. In a more formal sense, the purpose of the standard is to enable individuals to operate as first parties in agreements with others--mostly companies--operating as second parties. Note that the purpose of this standard is not to address privacy policies, since these are one-sided and need no agreement. (Terms require agreement; privacy policies do not.)" This seems to have potential relevance for Consent Receipts, User Submitted Terms, UMA, and UMA Legal. Joyce Searls was the one announcing the session during agenda creation, so I managed to speak with her prior to the scheduled session, and she shared this link with me afterwards. She also said "Take a look at the write up and click through to register interest. We will be having our first formal meeting within a month or so." *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

7 9

Draft minutes of UMA telecon 2018-05-31
by Eve Maler 31 May '18

31 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-31 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-05-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24>: APPROVED by unanimous consent. Pass-downs from the LC - ID Pro memberships available; let the staff know if you're interested - North America member plenary idea: 3 hours or more on Fri Oct 26 after IIW 27 in SF; potential inter-WG efforts? Early thoughts on the plenary: Mike can't make it. Decoupled flow walkthrough Client-initiated backchannel authentication (CIBA <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>) was invented by the MODRNA group. Mike observes that the OAuth password credentials grant, currently being discussed again, is sort of similar. Usage of it is discouraged but it's often a pattern of last resort. Why is it there? To provide a less-completely-horrible way to do what people would do anyway. Really? Harrumph. The grant lets you throw out the password and just deal with the token. And it lets you standardize on OAuth vs. also doing real screen-scraping. The idea in CIBA is that Bob (a call center agent or similar) wants to send a notification to the AS to authenticate Alice out of band. The phishability of both is still a big security consideration. In George's environment, the challenge is to complete the authentication loop without the call center worker party ("Bob") seeing the code or whatever. "Proof of presence" by the user seeking service ("Alice") is insufficient. A fake person pretending to be Alice shouldn't be able just to hit an Approve button. Eve has done an analysis <https://www.websequencediagrams.com/files/render?link=BKzJljUfSJShB3_no57b> attempting to map UMA to the decoupled requirements. We could dictate that request_submitted be used (See Grant Sec 3.3.6 <https://docs.kantarainitiative.org/uma/wg/rec-oauth-uma-grant-2.0.html#auth…>) and that could trigger a notification flow that requires a specific kind of authentication. Could this be done as a profile? Talking about "sessions" is weird, especially because it may not be about a browser at all, but a mobile authenticator app. What if the Bob side wanted to collect a set of claims? Could the UMA infrastructure for claims collection be leveraged, only in the other direction (by some AS acting on behalf of the RqP)? We're given to understand that polling is considered harmful by OB. CIBA has both polling and notification <http://openid.net/specs/openid-connect-modrna-client-initiated-backchannel-…>. Since UMA is so asynchronous in its outlook, would it want to make use a notification endpoint on the Bob side for the Alice side to use? Do we think this approach is interesting to keep analyzing? There's interest among Mike, Bjorn, and Maciej so far. It seems to meet the " *potentially* fit for purpose" bar if we think about request_submitted. Business model device/artifact mapping Eve reviewed the current state. Enterprise use case collection Some thoughts variously from Mike and Eve: UMA and XACML are not necessarily mutually exclusive. However, organizations are struggling to avoid vendor lock-in with XACML and some are looking for new ways to scale better; XACML has challenges with that while the OAuth architecture does better. It can be valuable to do analytics over a standard policy format. David B mentioned OpenPolicyAgent.org <http://openpolicyagent.org/> at EIC, which is a policy engine framework with a policy expression format. ANSI RBAC is a standard, whereas ABAC is not a standard. Justin says, "Yes, let's kill XACML." [image: (smile)] Mike should be ready to demo the Gluu Gateway next week. Let's continue the enterprise discussion next time. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Sal 2. Maciej 3. Eve 4. Mike 5. Cigdem Non-voting participants: - Adrian - George - Mark - Bjorn - Nancy Lush - Lush Group - is on the HEART WG - welcome to the group! - Justin Regrets: - Tim - Andi *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-05-31
by Eve Maler 30 May '18

30 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-02-31 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes: Approve minutes of UMA telecon 2018-05-24 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24> - Decoupled flow walkthrough - Business model device/artifact mapping - Gluu Gateway demo and enterprise use case collection - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 1

UMA-related EIC presentations uploaded
by Eve Maler 24 May '18

24 May '18

Hi folks-- You can find my EIC presentations on the wiki: - Kantara pre-conference showcase WG update <https://kantarainitiative.org/confluence/download/attachments/17760302/UMA%…> - Leveraging UMA's Power for Compliance and User Control <https://kantarainitiative.org/confluence/download/attachments/17760302/EIC1…> (this was the one requested during today's call) Both are currently highlighted on the wiki home page. Please feel free to use them and to spread the word. (If you need original PowerPoint versions for some reason, please get in touch with me -- however, I have tried to eliminate fancy animations so that they're easy to print.) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Draft minutes of UMA telecon 2018-05-24
by Eve Maler 24 May '18

24 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24 MinutesRoll call Quorum was reached. Approve minutes MOTION: Andi moves: Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29>, UMA telecon 2018-04-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12>, UMA telecon 2018-05-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-10>: APPROVED by unanimous consent. Business model and use cases - - RUFADAA <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20…>++ scenarios – Eve will have some visual representations – how to "spec" all this? Is IRM a new concept? Who invented it? Kantara has an IRM WG <https://kantarainitiative.org/confluence/display/irm>; it produces Reports and isn't super-active at the moment. The notion is that something like "IRM" is needed to distinguish higher-order changes than the UMA protocol can detect, e.g., in sub-scenario 3, when Johnny is able to manage his own resources; Alice's PATs for managing Johnny resources (and any associated downstream artifacts) should be killed but not her PATs for managing her own resources. Only some repository that tracks the distinction can do that. It doesn't have to be a graph DB. A 40th state has just enacted RUFADAA! Our theory is that these are all variously painful problems for which UMA-enabled services would be valuable solutions. The visualizations should help us start to have the conversations to figure out how painful/valuable. How would consents be managed? What would the "Online Tool" do to enable the solution? Kathleen notes that HL7 has a project around FHIR and are planning to reach out to Kantara. ONC has an Informed Consent pilot, where they're recruiting children and young adults and trying to figure out this "children aging-in" piece. There's a Resource type call Questionnaire Question Response, and there's a Compound Consent. The Origo <https://www.origo.com/news/PensionsDashboardArchitecture.aspx> use case seems to be applicable to a bunch of other financial areas, and potentially to healthcare as well, but in the US, the challenge is discoverability, and HEART doesn't touch the third rail of discovery. Would an "opt-in" discovery service that Alice permissions the use of be viable? (This is for HEART to take up, perhaps.) How would the legal devices and technical artifacts interact? The tokens wouldn't contain the devices; they probably need to point to them through URLs. We aren't talking about NEW contracts in addition to ones that (say) the end-user resource owner would agree to. However, there might be additional clauses we recommend they contain to be protective of privacy rights. AIs: - Tim: Reach out to Uniform Law Commission contacts - Eve: Finish all known business model scenarios to date - Eve: Reach out to Origo to share status - Eve: Share EIC slides with the WG (DONE) - Kathleen: Share links to HL7 work UMA and Open Banking - Analyze relevance of UMA for "decoupled" use cases (deferred again) Next time - Gluu Gateway demo - Brainstorm on enterprise UMA use cases Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Andi 3. Eve 4. Mike Non-voting participants: - Kathleen - Nancy - Tim Regrets: - Thomas - Mark *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Agenda for UMA telecon 2018-05-24
by Eve Maler 23 May '18

23 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-24 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29>, UMA telecon 2018-04-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12>, UMA telecon 2018-05-10 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-10> - Business model and use cases - RUFADAA <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20…>++ scenarios – Eve will have some visual representations – how to "spec" all this? - UMA and Open Banking - Analyze relevance of UMA for "decoupled" use cases - AOB *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Additional news I forgot to mention on today's call: OpenMedReady
by Eve Maler 10 May '18

10 May '18

Some news (in which my company is involved) came out last Thursday regarding a new effort called OpenMedReady. The headline on its website, openmedready.org, is: "Data provenance, security, privacy and consent in remote patient monitoring", and UMA is mentioned as one of the key specs underlying it. One way to think of it is as a healthcare IoT initiative layered on top of existing standards and profiles. *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

Draft minutes of UMA telecon 2018-05-10
by Eve Maler 10 May '18

10 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-10 MinutesRoll call Quorum was reached. Approve minutes Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29>, UMA telecon 2018-04-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12>: Deferred. Business model and use cases - RUFADAA <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20…> scenarios from Tim R ("life stage 4") Looking at the new (very collapsed) breakout explanation of how a Data Subject can delegate two kinds of authority to a separate RRA, does using the word "delegation" make sense if a child is delegating to a parent? We do have the child-to-party use case right afterwards. In that case, it's typically by law (guardianship). If delegation happens by law, in essence automatically, it has a sort of passive effect in the case of newborn Johnny – he doesn't literally "delegate-perm-authority-to" mother Alice, it just...happens. So maybe in modeling the graph, we need to think about wording the edge label a little more carefully. Just like "Data Subject Agent" was a little odd as terminology, currently "Requesting Party Agent" maps oddly next to "requesting party" (the lowercase technical entity terminology). Let's think on a better substitute. The "RUFADAA use case" feels like "life stage *n*"/scenario *n*: 1. The Data Subject is too young to use digital assets at all. 2. The DS is old enough to use assets but too young to consent to their use, so they have a legal guardian. 3. The DS is old enough to consent to their use. They manage their digital assets themselves. 4. The DS jointly manages digital assets with one or more others (e.g. online bank accounts). 5. (RUFADAA) The DS becomes mentally incapacitated or dies. (Obviously this can happen at earlier life stages as well.) See the design patterns below. RUFADAA is now enacted in 39 states of the union, and 6 more states are considering it, so we can expect it to be truly uniform/blanketing the US soon. Probate used to deal only with tangible assets. Not it's starting to deal with digital assets. It's key that our definitions in the draft business model report have incorporate "digital asset" terminology. The challenges of fiduciary (US term)/personal representative/executor handling of someone's estate in a world where we have social media and even online bank accounts have become clearer. There have been concerns about terms of service language and differential powers reserved by the services in question. The "Revised" UFADAA has accounted for more of these challenges. One key revision is to use the word "User" to allow our "resource owner" to designate who can manage digital assets after we're dead. It also clarifies what to do in the case of a conflict in instructions: the user's express instructions take precedence of the terms of service. The issue of the RRA is very relevant to all this. The law uses the term Online Tool for a solution that implements the law. We discovered that Google makes available an Online Tool for its own accounts, and Facebook has a more limited one. The idea is that, once we figure out the mappings to UMA legal roles and technical entities, we can help UMA-enabled services offer The possible scenario "design patterns" are as follows: - Alice doesn't designate anyone to manage her digital assets (in this case the Custodian's terms of service are in force) - The terms of service she agreed to with the Resource Server Operator *make the Custodian* the Designated Recipient - She makes a disclosure permission plan that designates her fiduciary/personal representative/executor to manage her digital assets - She designates her fiduciary/personal representative/executor to manage her digital assets - Inter vivos, she designates a Trustee who is the Designated Recipient *who is not* her fiduciary/personal representative/executor to manage her digital assets - The Trustee *grants access* to her fiduciary/personal representative/executor - The Trustee *does not grant access* to her fiduciary/personal representative/executor - She makes a disclosure permission plan that designates a Designated Recipient *who is not* her fiduciary/personal representative/executor to manage her digital assets – this could be the Authorization Server Operator, making her a special offer of an agreement that would count as express instructions - The Designated Recipient *grants access* to her fiduciary/personal representative/executor - The Designated Recipient *does not grant access* to her fiduciary/personal representative/executor Other laws in other jurisdictions may have different patterns. For this set of patterns, the theory is that if the fiduciary/personal representative/executor is the Designated Recipient, they become the RRA. If someone else is, then they *may or may not* grant access to the fiduciary/personal representative/executor, where the latter would be a RqP/RqPA. In email, John mentioned: More grist for the mill, or possibly water already under the bridge. See page 21 of the attached document on the ‘capacity to consent and assent’. This is about consent for research at SickKids hospital. What the scenarios elide, perhaps because its out of scope [likely true], is who gets to make the decision about the capacity of the data subject to give consent. It may not simply be a matter of age, and if there is someone acting for the data subject for a limited time, should they have the authority to grant a license that will last longer than their authority? BTW, references to TCPS are to this: http://pre.ethics.gc.ca/eng/policy-politique/initiatives/tcps2-eptc2/Defaul… UMA and Open Banking - Analyze relevance of UMA for "decoupled" use cases Deferred. Other news and updates - Implementation news RedHat Keycloak's 4.0 beta release documentation shows that it has UMA2 support. This is now on our Implementations <https://kantarainitiative.org/confluence/display/uma/UMA+Implementations> page. Who is going to EIC? Eve, Mike, George, Domenico. Eve has a keynote (that she's stressing about). Who is going to Identiverse? Eve, Mike, George, Sal, Justin. Mike and Eve have an UMA2 masterclass. We can probably work in a couple of demos. Sal, Mark, and Eve have a Privacy 2.0 masterclass. Justin has two talks. Sal is thinking about having an open house on Cape Cod (Buzzard's Bay – pretty close, "75 minutes on a bus") anytime starting Thursday prior. ZZ Auth is playing on the Wednesday night. Attendees As of 7 Mar 2017, quorum is 4 of 7. (Domenico, Sal, Andi, Maciej, Eve, Mike, Cigdem) 1. Domenico 2. Sal 3. Eve 4. Mike Non-voting participants: - Scott - Tim - George - Justin - Bjorn - Colin Regrets: - Maciej - Cigdem - Andi - John *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0

The Revised Uniform Fiduciary Access to Digital Assets Act
by Eve Maler 09 May '18

09 May '18

http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20… In our last call (now a month past), we discussed this use case a bit, and Tim has sent me some scenarios so that we dig into it a bit more deeply in this week's call; see below. The "parent-child resource management use case has three life stages (little Johnny is too young to use digital resources; old enough to use them but too young to consent; and finally old enough to consent and thus kick his legal guardian out of being in the resource owner/Resource Rights Administrator role). The RUFADAA use case is "life stage 4", if you will... It would be cool if we could get enough understanding/consensus on the call to be able to construct clean slide diagrams for all this (like we have for little Johnny and Alice now). Oh, and if anyone knows of any similar laws in other jurisdictions, that would be great too. ==== 3 Scenarios: 1) User (Alice) creates a disclosure permission plan (for future event of death or mental incapacity) 2) User (Alice) creates a Trust and makes an inter vivos (i.e. during Alice's lifetime) transfer of digital assets to the Trust for administration by Trustee (as, in effect, a successor User); Alice may or may not create a disclosure permission plan 3) User (Alice) does not create a disclosure permission plan for digital assets; fiduciaries create the disclosure permission plan after their appointment Scenario 1 User = Data Subject Custodian = Resource Server Operator Designated Recipient = AS Fiduciary = Resource Owner (or administrator) Scenario 2 User = Data Subject or Successor User (Trustee) = Resource Owner (or administrator) Designated Recipient = AS Custodian = Resource Server Operator Scenario 3 User (Fiduciary) = Resource Owner Designated Recipient = AS Custodian = Resource Server Operator Keep in mind that RUFADAA desines "User" as the person that creates the account with the Custodian *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

2 1

Agenda for UMA telecon 2018-05-10
by Eve Maler 08 May '18

08 May '18

https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-05-10 Date and Time - *Thursdays 9am PT* - Screenshare and dial-in: https://global.gotomeeting.com/join/857787301 - See UMA calendar for additional details: http://kantarainitiative.org/confluence/display/uma/Calendar Agenda - Roll call - Approve minutes - Approve minutes of UMA telecon 2018-03-01 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-01>, UMA telecon 2018-03-29 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-03-29>, UMA telecon 2018-04-12 <https://kantarainitiative.org/confluence/display/uma/UMA+telecon+2018-04-12> - Business model and use cases - RUFADAA <http://www.uniformlaws.org/shared/docs/Fiduciary%20Access%20to%20Digital%20…> scenarios from Tim R ("life stage 4") - UMA and Open Banking - Analyze relevance of UMA for "decoupled" use cases - Other news and updates - Implementation news - AOB - *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl

1 0