Subject: Nationality / country of citizenship attribute question

From: "Miklos, Sue A." <[email-masked]>
Date: Fri, 1 Oct 1999 14:51:01 -0400

All,

I have a requirement for an attribute to represent nationality (country of
citizenship) with two constraining factors.  First, it must be multi-valued,
as many nations permit dual-citizenship and second, it must be extensible to
use the ISO-3166-1 trigraphs.  

Several multinational security policies expressly state that the Release To
fields contain, in alphabetical order, a trigraph indication of those
countries to which the information may be released.

I have looked at the nationality attribute in ACP 133 as well as the
countryOfCitizenship attribute in the Qualified Certificates. They are both
single valued and constrained to digraph usage only.

I would ask assistance in either modifying the existing attributes, or,
creating (yet another) new one.  

Additionally, I have a requirement for an attribute that can represent the
employment status of a given individual.  While initially thinking that a
bit map would work, I quickly realized that although that would support
access control processing more easily, it is not extensible.  I would like
to propose a new attribute type that is (short sighted?) single valued and a
Directory string, that indicates the status of one's employment.  For
example, it woould contain a corporate name or country government
affiliation.

Sandi Miklos

---

From: [email-masked] (Peter Gutmann)
Date: Wed, 6 Oct 1999 10:48:41 (NZDT)

[email-masked] writes:

>MIIj6QYJKoZIhvcNAQcCoIIj2jCCI9YCAQExCzAJBgUrDgMCGgUAMIIXiAYJKoZIhvcNAQcBoIIX
>eQSCF3VGcm9tOiBCSlVFTkVNQU5Abm92ZWxsLmNvbQ0KU3ViamVjdDogUmFN0RdhdGlvbmFsaXR5
>IC8gY291bnRyeSBvZiBjaXRpemVuc2hpcCBhdHRyaWJ1dGUgcXVlc3Rpb24NClRvOiAic2FtaWts
>b0BtaXNzaS5uY3NjLm1pbCIsIGlldGYtcGtpeEBpbDRinKCoCAcOlA50ZW50LVR5cGU6IG11bHRp
>cGFydC9taXhlZDsgYm91bmRhcnk9Il9fX19GVldIWlpLQ0VCTFlUQ0FFRkZBWV9

JvdXQgaXQsIHlvJlIGFyZSByZWFsbHkgdHdvIHF1ZXN0a.  ZSB0b28gbWFueSBleGNlcHRpb25zI
GNhdXNlIG - BhIGhvc3BpdGFsLCBiZSBhIG.  YXBhY2l0eT8iDQoNClRoZSBFbnRlcnByaXNlIE
lEIGlzIHV?

>LS1fX19fRlZXSFpaS0NFQkxZVENBRUZGQVlfX19fDQpDb250ZW50LVR5cGU6IHRleHQvcGxhaW47
>IGNoFNOrDXQ9aXNvLTg4NTktMQ0KQ29udGVudC1UcmFuc2Zlci1FnoRdZGluZzogcXVvdGVkLXBy
>aW50YWJsZQ0KDQpTYW5keSwNCg0KUmVnYXJkaW5nIHRoZSBlbXBsb3ltZW50IHN0YXR1cyBhbmQg
>c2ltaWxhciBpc3N1ZXMgcmVsYXRlZCB0byAicmlnaH

BwYXRoIG9mID0NCmRlcGVuZGl!!!

>b2YgdGhlIEVudGVycHJpc2UgSUQgYXMgdXNlZCBpbiB0aGUgTm92ZWxsIFNlY3VyaXR5ID0NCkF0
>dHJpYnV

RzIiwgPQ0KY2hlY2sgb3V0IHRoZSB1c2Ug.  wZXIubm92ZWxsLmNvbS9yZXBvc2l0b3J5L2F0dHJ
pYnV0, 0ZXMgKGh0dHA6Ly9kZXZlbG9.

>ZXMvY2VydGF0dHJzX3YxMD0NCi5odG0pLiA9MjANCg0KVGhlcmUgYXJlIGxvdHMgb2YgcG9zc2li
>bGUgYWIloVewINDowS4gcmVsYXRpb25zaGlwcyB0aGF0IG1pZ2h0IGV2ZW50dWFsbHkgPQ0KaGF2
>ZSB0byBiZSBleHByZXNzZWQuICBFbXBsb3ltZW50IGl

YmNvbnRyYWN0b3Igd29ya2luZ, zIG1lcmVseSBvbmUgb2YgdGhlbS4gIHNv, N1cml0eSBndWFyZ
CwgY2FmZXRlcmlhIHdvcmtlciwgdHJhdmVsIGFnZW5je.  gdGhlID0NClVuaXRlZCBTdGF0ZXMuI
CBXaGVu.

iB5b3UgdG,
Peter.

---

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 05 Oct 1999 15:51:36 -0600

I inadvertently clicked on the "sign" button, and compounded the 
problem because my default was set for base64 encoding.

Here is the message unencumbered, for those who are 
S/MIME challenged.

Bob

>>> <[email-masked]> 10/05/99 03:12PM >>>
Sandy,

Regarding the employment status and similar issues related to "rights", 
check out the use of the Enterprise ID as used in the Novell Security Attributes (http://developer.novell.com/repository/attributes/certattrs_v10.htm).  

There are lots of possible affiliation relationships that might eventually 
have to be expressed.  Employment is merely one of them.  Someone 
might be a visiting professor, have staff privileges at a hospital, be a 
contract or contingent worker, a subcontractor working on the 
premises (such as a security guard, cafeteria worker, travel agency employee).

So there are really two questions that have to be answered:  
(1) "Affiliated with whom?" and (2) "in what capacity?"

The Enterprise ID is unique to the given Enterprise, which 
answers the question "related to whom".

(If you think about it, you really don't want to go down the 
path of depending on the uniquely encoded name of the 
organization to represent the Enterprise -- there are too many 
exceptions cause by holding companies, Doing Business As 
and Trading As names, etc.  And that's just here in the 
United States.  When I was with GTE, for example, their 
corporate organization chart filled an 8-1/2x11 page with
blocks so small you could scarcely read the labels.  Because 
of state PUC requirements against cross-subsidization between 
states, every telephone company in every state was a 
separate corporation.)

(In  reality, most of the telco employees worked for say 
"GTE of Pennsylvania".  A relatively small number worked 
for the GTE Corporate staff, which had a "Group" (really an 
OU) called "GTE Telephone Operations".  Yet almost 
everyone who worked for the telephone side of the 
business had a business card that identified them as
 been "employed(?)" by "GTE Telephone Operations"
Is that sufficiently confusing? )

(The point is that the legal NAME of some organizations 
may be subject to legal and intellectual property constraints 
that aren't particularly meaningful or useful in answering 
other kinds of questions.  And I haven't even brought up the 
issue of multinational companies that have different legal 
names depending on what country they are operating in, or 
even dual or multiple names, as in Canada, Belgium, or 
(worst case) India, with 14 official languages and who 
knows how many dialects.)

The other bits in the Enterprise label, either at the 
Registry level or the Enterprise level, can answer 
the question of capacity, in the form of secrecy and 
integrity (read and write) levels and categories.]

If you stop to think about it, citizenship is merely another t
ype of affiliation.  It's really a pretty blunt instrument -- 
the real question is one of loyalty and national interest, 
not citizenship. But there is no reason in principle why 
the same type of encoding scheme could not be used.  
The Enterprise that one is affiliated with is a country, and 
the affiliation could take multiple forms -- citizen, permanent 
resident, student or work visa, temporary visitor, etc.

Bob

>>> "Miklos, Sue A." <[email-masked]> 10/01/99 12:51PM >>>

All, 
I have a requirement for an attribute to represent nationality (country of citizenship) with two constraining factors.  First, it must be multi-valued, as many nations permit dual-citizenship and second, it must be extensible to use the ISO-3166-1 trigraphs.  
Several multinational security policies expressly state that the Release To fields contain, in alphabetical order, a trigraph indication of those countries to which the information may be released.
I have looked at the nationality attribute in ACP 133 as well as the countryOfCitizenship attribute in the Qualified Certificates. They are both single valued and constrained to digraph usage only.
I would ask assistance in either modifying the existing attributes, or, creating (yet another) new one.  
Additionally, I have a requirement for an attribute that can represent the employment status of a given individual.  While initially thinking that a bit map would work, I quickly realized that although that would support access control processing more easily, it is not extensible.  I would like to propose a new attribute type that is (short sighted?) single valued and a Directory string, that indicates the status of one's employment.  For example, it woould contain a corporate name or country government affiliation.
Sandi Miklos

---

From: "Bob Jueneman" <[email-masked]>
Date: Tue, 05 Oct 1999 16:38:58 -0600

I could translate it for you, but then I'd have to shoot you. :-)

>>> Peter Gutmann <[email-masked]> 10/06/99 10:48AM >>>

iB5b3UgdG,
Peter.