From eb7c9991633ab7e491f103fc052bef08c283519e Mon Sep 17 00:00:00 2001 From: Dmitri Zagidulin Date: Thu, 16 Sep 2021 15:52:44 -0400 Subject: [PATCH 1/3] Add example authorization capabilities for operations. --- index.html | 284 +++++++++++++++++++++++++++++++++++++++++++---------- 1 file changed, 230 insertions(+), 54 deletions(-) diff --git a/index.html b/index.html index 510bebc..6363fb7 100644 --- a/index.html +++ b/index.html @@ -528,12 +528,15 @@

- Operations + Operations and Authorization Structure

Data vaults allow for the classic set of CRUD (Create, Read, Update and Delete) operations on its data models. +All operations performed by an Encrypted Data Vault must carry appropriate +authorization. This section considers the structure (data model) of +authorizations in the context of operations they're authorizing.

@@ -541,18 +544,58 @@

Create Operation

-
    -
  • -Create Vault: Creates/provisions an Encrypted Data Vault by specifying a -DataVaultConfiguration structure. This includes Replication configuration. -
    • -
  • -Create Index: Creates an Index for a particular Vault. -
    • -
  • -Create Resource (Document or Stream): Creates a Resource in a given Vault. -
    • -
+
+

+ Create Vault +

+ +

+This operation creates/provisions an Encrypted Data Vault instance by specifying +a DataVaultConfiguration structure (see the Encrypted Data Vault +Data Model section). This includes Replication configuration. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "write",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
+ +
+

+ Create Resource +

+ +

+This operation creates an encrypted resource (a Document with or without an +associated Stream), in a given vault instance. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "write",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
@@ -560,18 +603,51 @@

Read Operation

-
    -
  • -Read Vault Configuration: Returns the DataVaultConfiguration object -for a given Vault. -
    • -
  • -Read Index: Returns the Index configuration object. -
    • -
  • -Read Resource (Document or Stream): Returns the given resource. -
    • -
+
+

Read Vault Configuration

+ +

+Returns the DataVaultConfiguration object for a given Vault. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "read",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
+ +
+

Read Resource (Document or Stream)

+ +

+Returns the requested encrypted resource. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "read",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents/zMbxmSDn2Xzz",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
@@ -579,23 +655,52 @@

Update Operation

-

-Does an Update Index operation make sense? -

+
+

Update Vault Configuration

-
    -
  • -Update Vault Configuration: Modifies the DataVaultConfiguration -object for a given Vault. -
    • -
  • -Update Index: Modifies the Index configuration object. -
    • -
  • -Update Resource (Document or Stream): Updates the encrypted resource (note that -this is a "full replace" operation). -
    • -
+

+ Modifies the DataVaultConfiguration object for a given Vault. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "write",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
+ +
+

Update Resource (Document or Stream)

+ +

+Updates the encrypted resource (note that this is a "full replace" operation), +and any corresponding encrypted indexes. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "write",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents/zMbxmSDn2Xzz",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
@@ -603,20 +708,91 @@

Delete Operation

-

+
+

Delete Vault

-
    -
  • -Delete Vault Configuration: Deletes a Vault. -
    • -
  • -Delete Index: Deletes an Index. -
    • -
  • -Delete Resource (Document or Stream): Deletes the encrypted resource (note that -a tombstone object should remain behind for replication purposes). -
    • -
+

+ +

+Deletes a vault. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "write",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
+ +
+

Delete Resource (Document with or without an associated Stream)

+ +

+ +

+Deletes the encrypted resource (note that a tombstone object should remain +behind for replication purposes). +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "write",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents/zMbxmSDn2Xzz",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
+
+ +
+

+ Query Operation +

+ +
+

Query all Resources in a Vault

+ +

+ Requests all resources in a vault. +

+ +
+{
+  "@context": ["https://w3id.org/security/v2"],
+  "allowedAction": "read",
+  // entity on which the operation is performed
+  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/query",
+  // DID used to prove possession (invoke the capability)
+  "controller": "did:example:abcd",
+  "proof": {
+    // ...
+  }
+}
+
+
+ +
+

Query on an Encrypted Index Value

+ +

+
From ad4a44795e2d83046b9e12962df3fd2abe53c9ed Mon Sep 17 00:00:00 2001 From: Dmitri Zagidulin Date: Thu, 11 Nov 2021 15:44:56 -0500 Subject: [PATCH 2/3] Update vault crud zCaps, remove others. --- index.html | 142 +++++++++++++++++++++-------------------------------- 1 file changed, 56 insertions(+), 86 deletions(-) diff --git a/index.html b/index.html index 6363fb7..79971ce 100644 --- a/index.html +++ b/index.html @@ -558,14 +558,25 @@ 

 {
-  "@context": ["https://w3id.org/security/v2"],
+  "@context": [
+    "https://w3id.org/security/v2",
+    "https://w3id.org/security/suites/ed25519-2020/v1"
+  ],
+  "id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs",
   "allowedAction": "write",
   // entity on which the operation is performed
   "invocationTarget": "https://example.com/edvs",
   // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
+  "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
   "proof": {
-    // ...
+    "type": "Ed25519Signature2020",
+    "created": "2021-11-11T20:30:40Z",
+    "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
+    "proofPurpose": "capabilityInvocation",
+    "capabilityChain": [
+      "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs"
+    ],
+    "proofValue": "z3sLGvhHU..."
   }
 }
@@ -580,21 +591,6 @@

This operation creates an encrypted resource (a Document with or without an associated Stream), in a given vault instance.

- -
-{
-  "@context": ["https://w3id.org/security/v2"],
-  "allowedAction": "write",
-  // entity on which the operation is performed
-  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents",
-  // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
-  "proof": {
-    // ...
-  }
-}
-

@@ -613,14 +609,25 @@

Read Vault Configuration

 {
-  "@context": ["https://w3id.org/security/v2"],
+  "@context": [
+    "https://w3id.org/security/v2",
+    "https://w3id.org/security/suites/ed25519-2020/v1"
+  ],
+  "id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy",
   "allowedAction": "read",
   // entity on which the operation is performed
   "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
   // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
+  "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
   "proof": {
-    // ...
+    "type": "Ed25519Signature2020",
+    "created": "2021-11-11T20:30:40Z",
+    "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
+    "proofPurpose": "capabilityInvocation",
+    "capabilityChain": [
+      "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy"
+    ],
+    "proofValue": "z3sLGvhHU..."
   }
 }
@@ -632,21 +639,6 @@

Read Resource (Document or Stream)

Returns the requested encrypted resource.

- -
-{
-  "@context": ["https://w3id.org/security/v2"],
-  "allowedAction": "read",
-  // entity on which the operation is performed
-  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents/zMbxmSDn2Xzz",
-  // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
-  "proof": {
-    // ...
-  }
-}
-
@@ -665,14 +657,25 @@

Update Vault Configuration

 {
-  "@context": ["https://w3id.org/security/v2"],
+  "@context": [
+    "https://w3id.org/security/v2",
+    "https://w3id.org/security/suites/ed25519-2020/v1"
+  ],
+  "id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy",
   "allowedAction": "write",
   // entity on which the operation is performed
   "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
   // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
+  "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
   "proof": {
-    // ...
+    "type": "Ed25519Signature2020",
+    "created": "2021-11-11T20:30:40Z",
+    "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
+    "proofPurpose": "capabilityInvocation",
+    "capabilityChain": [
+      "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy"
+    ],
+    "proofValue": "z3sLGvhHU..."
   }
 }
@@ -685,21 +688,6 @@

Update Resource (Document or Stream)

Updates the encrypted resource (note that this is a "full replace" operation), and any corresponding encrypted indexes.

- -
-{
-  "@context": ["https://w3id.org/security/v2"],
-  "allowedAction": "write",
-  // entity on which the operation is performed
-  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents/zMbxmSDn2Xzz",
-  // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
-  "proof": {
-    // ...
-  }
-}
-
@@ -720,14 +708,25 @@

Delete Vault

 {
-  "@context": ["https://w3id.org/security/v2"],
+  "@context": [
+    "https://w3id.org/security/v2",
+    "https://w3id.org/security/suites/ed25519-2020/v1"
+  ],
+  "id": "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy",
   "allowedAction": "write",
   // entity on which the operation is performed
   "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy",
   // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
+  "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
   "proof": {
-    // ...
+    "type": "Ed25519Signature2020",
+    "created": "2021-11-11T20:30:40Z",
+    "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF",
+    "proofPurpose": "capabilityInvocation",
+    "capabilityChain": [
+      "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy"
+    ],
+    "proofValue": "z3sLGvhHU..."
   }
 }
@@ -742,21 +741,6 @@

Delete Resource (Document with or without an associated Stream)

Deletes the encrypted resource (note that a tombstone object should remain behind for replication purposes).

- -
-{
-  "@context": ["https://w3id.org/security/v2"],
-  "allowedAction": "write",
-  // entity on which the operation is performed
-  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/documents/zMbxmSDn2Xzz",
-  // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
-  "proof": {
-    // ...
-  }
-}
-
@@ -772,20 +756,6 @@

Query all Resources in a Vault

Requests all resources in a vault.

-
-{
-  "@context": ["https://w3id.org/security/v2"],
-  "allowedAction": "read",
-  // entity on which the operation is performed
-  "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy/query",
-  // DID used to prove possession (invoke the capability)
-  "controller": "did:example:abcd",
-  "proof": {
-    // ...
-  }
-}
-
From 9c8330d22ad1f8bae58ca442dd92f0c2040a6d9d Mon Sep 17 00:00:00 2001 From: Dmitri Zagidulin Date: Thu, 11 Nov 2021 16:37:06 -0500 Subject: [PATCH 3/3] Remove unneeded capabilityChain property. --- index.html | 20 ++++---------------- 1 file changed, 4 insertions(+), 16 deletions(-) diff --git a/index.html b/index.html index 79971ce..d487761 100644 --- a/index.html +++ b/index.html @@ -567,15 +567,12 @@

// entity on which the operation is performed "invocationTarget": "https://example.com/edvs", // DID used to prove possession (invoke the capability) - "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", + "controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proof": { "type": "Ed25519Signature2020", "created": "2021-11-11T20:30:40Z", "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proofPurpose": "capabilityInvocation", - "capabilityChain": [ - "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs" - ], "proofValue": "z3sLGvhHU..." } } @@ -618,15 +615,12 @@

Read Vault Configuration

// entity on which the operation is performed "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy", // DID used to prove possession (invoke the capability) - "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", + "controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proof": { "type": "Ed25519Signature2020", "created": "2021-11-11T20:30:40Z", "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proofPurpose": "capabilityInvocation", - "capabilityChain": [ - "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy" - ], "proofValue": "z3sLGvhHU..." } } @@ -666,15 +660,12 @@

Update Vault Configuration

// entity on which the operation is performed "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy", // DID used to prove possession (invoke the capability) - "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", + "controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proof": { "type": "Ed25519Signature2020", "created": "2021-11-11T20:30:40Z", "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proofPurpose": "capabilityInvocation", - "capabilityChain": [ - "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy" - ], "proofValue": "z3sLGvhHU..." } } @@ -717,15 +708,12 @@

Delete Vault

// entity on which the operation is performed "invocationTarget": "https://example.com/edvs/z4sRgBJJLnYy", // DID used to prove possession (invoke the capability) - "invoker": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", + "controller": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proof": { "type": "Ed25519Signature2020", "created": "2021-11-11T20:30:40Z", "verificationMethod": "did:example:abcd#z6Mkje7QZCEUGCxTsxQjq4V37YGZoUrUc9cwJZ3gLHRTrixF", "proofPurpose": "capabilityInvocation", - "capabilityChain": [ - "urn:zcap:root:https%3A%2F%2Fexample.com%2Fedvs/z4sRgBJJLnYy" - ], "proofValue": "z3sLGvhHU..." } }