Subject: [sacm] New version of the information model diagram

From: Clifford Kahn <[email-masked]>
Date: Sun, 1 Feb 2015 17:32:45 +0000

All,
I reference draft-ietf-sacm-information-model-00.

I would eliminate figure 1. It's redundant.

I would change
                "Figure 2 depicts an instance of the information model."
to
                "Figure 1 depicts the information model."

Here is a new version of the figure.  (View the figure using a fixed-width font, such as Courier.)

  +---------+ +---------+              +--------+____________________
  |Hardware | |Software |    __________|Location|*_______________    |
  |Component| |Component|   |         *+--------+*               |   |
  +---------+ +---------+   |                                    |   |
       |1          |1       |         +----------+               |   |
       |*          |*       |   ______|Credential|____________   |   |
  +---------+ +--------+    |  |     *+----------+*           |* |*  |
  |Hardware | |Software|    |  |         +---------+       +-------+ |
  |Instance | |Instance|    |  |         |Network  |_______|Account| |
  +---------+ +--------+    |  |         |Session  |*  0..1+-------+ |
       |*      |*          *| *|         |- - - - -|                *|
       |       |____1+----------+1______*|Network  |__________+-------+
       |_____________| Endpoint |_____   |Interface|*     1..*|Address|
                    1|          |0..1 |  +---------+          +-------+
                     +----------+     |      1|
          _____________|1    |*       |       |_____+-------------+
         |                   |________|            *|Authorization|
         |                    part-of>              +-------------+
  .......|..............................................................
         |            |0..1
         |            |
         |            |*
         |         +-----+            +---------+___________________
        |         | AVP |____________|Endpoint |1..*   <based-on   |
        ^|         +-----+1..*       1|Attribute|________           |
hosted-by|           *|               |Assertion|*       |          |
         |            |               +---------+        |          |
        |            |produced-using   |*    |*         |         *|
        |           1|V                |     |__________|     +-------+
        |        +--------+            |       <based-on      |Summary|
         |        | Method |            |                      +-------+
         |        +--------+            |produced-by               *|
         |____________________          |V                          |
                              |*       1|                           |
    +--------+1____________*+-----------+                          |
    |        |    guides>   | SACM      |__________________________|
    |Guidance|              | Component |1       <produced-by
    +--------+*____________1+-----------+
               <produced-by

         -------------------------------------------------------------
         ..... Above this line is the monitorable world
         -------------------------------------------------------------
The figure has additions for provenance:

*         A class "Method"

*         The produced-using relationship between an AVP and  a Method

*         The produced-by relationship between a Guidance and a SACM Component

*         The hosted-by relationship between a SACM Component and an Endpoint

The figure has other changes:

*         asserted-by and summarized-by have been renamed to produced-by.

*         "User" is now "Account". If a user has different credentials, SACM cannot know that they belong to the same user. But, per Kim W, many organizations do have accounts that associate credentials.

*         The multiplicity of the based-on relationships have been corrected.

*         More relationships now have labels, per UML convention.

*         I got rid of the causal arrows, which had become redundant and were nonstandard and clutter.

Still to come:

*         We are still discussing network sessions and network interfaces and how to model them. I left that part of the figure alone for now.

*         More provenance.

*         Should Level of Assurance be a class?

*         If an endpoint provides information about itself to an external attribute collector, which turns the information into SACM notation, how do we model the endpoint's and the collector's parts in the chain of custody?

*         Will a SACM controller ever add an AVP to an endpoint attribute assertion? If so, how will we model that?

*         Coverage. I know Kim is interested in capturing enough information so that gaps in coverage can be found. (Is this in our requirements? It should be, I think.) She has suggested something like, each SACM component should publish a description of what it covers. The "guides" relationship might look sufficient, but it isn't. If a piece of guidance says "Capture the SWID tag inventory", a SACM component can heed that, but only for some endpoints.

Clifford Kahn
Principal Engineeer, Technical Lead