Subject: RE: Example with sub-attributes,was Re: Attribute certificate li fetimes

From: Ron Ramsay <[email-masked]>
Date: Wed, 19 May 1999 16:30:22 +1000

David's reasoning still seems to represent the real world. I have some
trouble with your 'nominal' rates. Only two values are really relevant,
Td and Tm. I don't see that Td is 1/3. If everyone changes positions at
3 years, Td should be handled as for phone and effectively ignored.
Hence

1/T ~ Td

That is,

T ~ 3 years.

> -----Original Message-----
> From:	Ed Gerck [SMTP:[email-masked]]
> Sent:	Wednesday, May 19, 1999 3:07 PM
> To:	[email-masked]
> Subject:	Example with sub-attributes,was  Re: Attribute
> certificate lifetimes
> 
> 
> List:
> 
> I received some private requests to work out the example provided
> by David Kemp, using sub-attributes to calculate the certificate
> lifetime.
> 
> The example, regrouped for its parts, is:
> 
> >Assume that a company has a policy of reassigning its employees
> > every three years.  A certificate might have the following
> > collection of attributes:
> >
> >    eye color (lifetime = 72 years)
> >    department (lifetime = 3 years)
> >    telephone  (lifetime = 3 years)
> >    manager    (lifetime = 3 years)
> >
> > Assume that everyone is happy at this company, so that turnover is
> very
> > low (<1%) and unexpected changes in assignment are rare.
> ...
> > The probability that the phone number remains valid does not decay
> > exponentially with time, it remains nearly constant (perhaps
> decaying
> > slightly) for three years, at which point it falls abruptly to near
> zero.
> 
> 
> The lifetime calculation has the following steps:
> 
> 1. Modelling of effective attributes
> 
> 1.1 eye color (lifetime = 72 years), single exponential decay
>       Te = 1/72
> 
> 1.2 department (lifetime = 3 years), single exponential decay
>        Td = 1/3
> 
> 1.3 telephone  (lifetime = 3 years), nearly constant for 3 years, then
> falls
>       abruptly to zero. The "telephone" attribute has then two
> sub-attributes,
>       ts and tf:
> 
> ts. a very slow decay for three years, which corresponds to a very
> large
>     lifetime, so that Tts >> 1 and 1/Tts ~ 0
> 
> tf. a very fast decay if the certificate is more than three years old,
> which
>     corresponds to a very short lifetime, so that Ttf ~ 0 and 1/Ttf >>
> 1
> 
> 1.4 manager    (lifetime = 3 years), single exponential decay
>       Tm = 3
> 
> 1.5 certificate holder turnover of < 1% is neglected in period, Th >>
> 1
>       and 1/Th ~ 0.
> 
> There are then 7 effective attributes (N = 7) and 5 original
> attributes (M =  5).
> 
> 
> 2. Lifetime calculation:
> 
> The average certificate lifetime, with calculation valid before three
> years are
> passed from issuance, is:
> 
> 1/T =  1/72 + 1/3 + 0 + 1/3 + 0 =  1/1.47
> 
> So, the average certificate lifetime is 1.47 years. Since the limit of
> three years
> has not been exceeded, the fast Ttf rate is not used. The certificate
> should
> be invalid due to the other reasons before the telephone changes.
> 
> This result can now be compared with the two answers tentatively
> supplied by
> David:
> 
> - "I contend that the expected lifetime of this certificate is closer
> to the minimum
>     attribute lifetime (3 years)". This is not so -- the expected
> lifetime of 1.47 years
>     is nearly 50% the minimum attribute lifetime of 3 years.
> 
> - "the value indicated by your formula (1/3+1/3+1/3+1/72 = .986
> years)". This
>    is not so, since the value indicated by the formula is actually
> 1.47 years when
>    Ttf is correctly taken into account.
> 
> 
> Comments?
> 
> 
> Cheers,
> 
> Ed Gerck
> ______________________________________________________________________
> Dr.rer.nat. E. Gerck                                 [email-masked]
> 
>

---

From: Ed Gerck <[email-masked]>
Date: Wed, 19 May 1999 05:06:39 -0700

Ron Ramsay wrote:

> David's reasoning still seems to represent the real world.

What you apparently miss is that what you call the "real-world" is defined
by you in this case because it all depends what you assume the "real-world"
to be -- you are the design engineer. You must choose the decay rates as
well as the validity periods -- and, as I wrote in my original posting, they can
be empirically defined (by experience), they can be defined using heuristics
(for example, from some simulation you have performed) or by using theory
(for example, from a failure model). This is the first step in enginering: design.

Then, afterwards, you do the second step: calculate the expected average
certificate lifetime using your design and ...deploy your design.

Later on, you verify your design in practice -- how it rates in the real-world
"out there". Which is the third step in engineering, but just prior to the fourth:
feedback -- you may need to change your design according to how it
actually performs.

But, I am sure I am not saying anything new -- just saying that engineering
can now be applied to an area where before you only had guesss-work
and a bad formula ;-)

> I have some

Fine and good -- I meant to exemplify and followed David's example without
adding anything to it. Where he wrote "lifetime" I supposed *one* exponential
decay; where he wrote that two decay rates were used I consistently used
*two* exponential decay rates. You may note that, efffectively, the telephone
validity function was modeled as a square function -- both by David as well as
so represented by myself. Thus, if David was careful enough (that is, as careful
as a loose example may allow)  to point out that the telephone validity function
had two decay rates and was actually very close to a square function, then this
implies by a logical construct called negative pregnant that he did NOT intend to
make the same distinction for the other rates -- so, I justifiedly, employed just
one rate for each one of them.

But, if you read more information between the lines, please use it ;-) the
tool is there to allow it.

Cheers,

Ed Gerck