[legal] Use cases and design patterns for resource owner/Grantor/Resource Subject
*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl
It might be helpful to consider this from an identity perspective as I've had to do in order to propose a globally unique patient ID solution. My proposal registers for Johnny, at birth, a personal domain and an associated email address for life along with email forwarding for life. At birth, the registrar is chosen and controlled by mom Alice and the forwarding address that Alice controls obviously points to Alice's notification endpoints. At some point, control of the registrar and the domain shift to Johnny. That shift is controlled by the registrar, of course, and could be based on input from Alice or a court order from Gov. I see UMA from a similar perspective. At birth, Alice can choose to share her AS with Johnny or to buy Johnny his own AS that she controls. The choice will be transparent to Johnny's RSs just like the choice of registrar for Johnny's personal ID is transparent. If Alice chooses to use her AS for one of Johnny's RSs, then, at some point later when Johnny has a different AS, the RS will be asked to point to a different AS either by Alice or by a court order from Gov. As far as the RS is concerned, the relationship between Alice and Johnny or Gov and Alice is completely abstracted out by UMA. The only thing that matters to the RS is who specifies the AS for a particular protected resource. Who controls the AS (be it Alice, Susie, Johnny, or Gov) is completely irrelevant to the RS. This delegation is the beauty of UMA. Adrian On Fri, Apr 8, 2016 at 11:01 AM, Eve Maler <eve@xmlgrrl.com> wrote:
*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma
-- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/
What you say about the RS not caring about AS/RO (Grantor) interactions is pretty much true. It's also unfortunately irrelevant to the point I'm trying to make about our Grantor and Resource Subject definitions up at the legal model clause level. :-) That is, we seem to have reason to care for our purposes about correctly referring to a Person as the Grantor even if they are not the Resource Subject, and about satisfying ourselves as to whether we can successfully solve both technical and legal versions of the use cases presented in the slide deck. While the technical pattern looks suspiciously similar each time (and as you point out the RS in particular can be blissfully unaware of any changes), it's the legal pattern that changes interestingly. The ASO ends up dealing with different parties, and the AS, in fact, ends up interacting with different digital identities. If people can take a look at the use cases and patterns with this in mind, and see if I missed anything or raise any questions, that would be great. (And it seems it's time to switch from Requesting Party to Grantee in our definitions -- yay!) *Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl On Fri, Apr 8, 2016 at 9:32 AM, Adrian Gropper <agropper@healthurl.com> wrote:
It might be helpful to consider this from an identity perspective as I've had to do in order to propose a globally unique patient ID solution.
My proposal registers for Johnny, at birth, a personal domain and an associated email address for life along with email forwarding for life. At birth, the registrar is chosen and controlled by mom Alice and the forwarding address that Alice controls obviously points to Alice's notification endpoints. At some point, control of the registrar and the domain shift to Johnny. That shift is controlled by the registrar, of course, and could be based on input from Alice or a court order from Gov.
I see UMA from a similar perspective. At birth, Alice can choose to share her AS with Johnny or to buy Johnny his own AS that she controls. The choice will be transparent to Johnny's RSs just like the choice of registrar for Johnny's personal ID is transparent. If Alice chooses to use her AS for one of Johnny's RSs, then, at some point later when Johnny has a different AS, the RS will be asked to point to a different AS either by Alice or by a court order from Gov.
As far as the RS is concerned, the relationship between Alice and Johnny or Gov and Alice is completely abstracted out by UMA. The only thing that matters to the RS is who specifies the AS for a particular protected resource. Who controls the AS (be it Alice, Susie, Johnny, or Gov) is completely irrelevant to the RS. This delegation is the beauty of UMA.
Adrian
On Fri, Apr 8, 2016 at 11:01 AM, Eve Maler <eve@xmlgrrl.com> wrote:
*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org http://kantarainitiative.org/mailman/listinfo/wg-uma
--
Adrian Gropper MD
PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/
From a legal perspective, the issue seems clear to the extent that every legal document I've seen that allows for a separate Grantor also lists the Resource Subject. How the RSO and ASO use this information seems peripheral to UMA.
I believe we've already agreed that under no circumstances do we want to encourage impersonation of Resource Subject by the Grantor either at the RS or the AS. Impersonation of the Grantor by the Resource Subject is allowed and trivial. If we choose to design the model clauses to separate out the ASO to RSO registration from the Resource registration then neither the Resource Subject nor the Grantor are accessible to that registration. Later, when the Resource is registered, both the Resource Subject and the Grantor are identified and either the ASO to RSO registration is included or it's referenced. I don't see much of a difference from a privacy perspective because if the RSO were to block the registration, they could do it anytime. Allowing prior ASO to RSO registration could improve the user experience if the registration was a time-consuming process. I'm mindful of how bank transfers work today. Transfers among banks and with individuals are handled differently. Bank-to-bank transfers presume prior federation in ACH. Bank to individual transfers will mail a check to anyone anywhere. The user experience is similar and the initial registration delay is days in either case. The big difference are the kinds of errors that can creep in. Adrian On Tuesday, April 12, 2016, Eve Maler <eve@xmlgrrl.com> wrote:
What you say about the RS not caring about AS/RO (Grantor) interactions is pretty much true. It's also unfortunately irrelevant to the point I'm trying to make about our Grantor and Resource Subject definitions up at the legal model clause level. :-)
That is, we seem to have reason to care for our purposes about correctly referring to a Person as the Grantor even if they are not the Resource Subject, and about satisfying ourselves as to whether we can successfully solve both technical and legal versions of the use cases presented in the slide deck. While the technical pattern looks suspiciously similar each time (and as you point out the RS in particular can be blissfully unaware of any changes), it's the legal pattern that changes interestingly. The ASO ends up dealing with different parties, and the AS, in fact, ends up interacting with different digital identities.
If people can take a look at the use cases and patterns with this in mind, and see if I missed anything or raise any questions, that would be great.
(And it seems it's time to switch from Requesting Party to Grantee in our definitions -- yay!)
*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl
On Fri, Apr 8, 2016 at 9:32 AM, Adrian Gropper <agropper@healthurl.com <javascript:_e(%7B%7D,'cvml','agropper@healthurl.com');>> wrote:
It might be helpful to consider this from an identity perspective as I've had to do in order to propose a globally unique patient ID solution.
My proposal registers for Johnny, at birth, a personal domain and an associated email address for life along with email forwarding for life. At birth, the registrar is chosen and controlled by mom Alice and the forwarding address that Alice controls obviously points to Alice's notification endpoints. At some point, control of the registrar and the domain shift to Johnny. That shift is controlled by the registrar, of course, and could be based on input from Alice or a court order from Gov.
I see UMA from a similar perspective. At birth, Alice can choose to share her AS with Johnny or to buy Johnny his own AS that she controls. The choice will be transparent to Johnny's RSs just like the choice of registrar for Johnny's personal ID is transparent. If Alice chooses to use her AS for one of Johnny's RSs, then, at some point later when Johnny has a different AS, the RS will be asked to point to a different AS either by Alice or by a court order from Gov.
As far as the RS is concerned, the relationship between Alice and Johnny or Gov and Alice is completely abstracted out by UMA. The only thing that matters to the RS is who specifies the AS for a particular protected resource. Who controls the AS (be it Alice, Susie, Johnny, or Gov) is completely irrelevant to the RS. This delegation is the beauty of UMA.
Adrian
On Fri, Apr 8, 2016 at 11:01 AM, Eve Maler <eve@xmlgrrl.com <javascript:_e(%7B%7D,'cvml','eve@xmlgrrl.com');>> wrote:
*Eve Maler*Cell +1 425.345.6756 | Skype: xmlgrrl | Twitter: @xmlgrrl
_______________________________________________ WG-UMA mailing list WG-UMA@kantarainitiative.org <javascript:_e(%7B%7D,'cvml','WG-UMA@kantarainitiative.org');> http://kantarainitiative.org/mailman/listinfo/wg-uma
--
Adrian Gropper MD
PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/
-- Adrian Gropper MD PROTECT YOUR FUTURE - RESTORE Health Privacy! HELP us fight for the right to control personal health data. DONATE: http://patientprivacyrights.org/donate-2/
participants (2)
-
Adrian Gropper -
Eve Maler