Systemns Architecture for Authentic Data Supply Chains with DAD (Decentralized Autonomic Data) and Zero Trust Samuet . st o,
Authentic Data Supply Chain Distributed verifiable data structure (signed hash-chained) that provides chain-of-custody (provenance) of the data. AlIDs and signatures link transformation steps. Changes in control or value or both. Provides integrity and non-repudiation.
Authentic Data Supply Chain = Provenance Mechanism for tracing data item content and control (chain-of-custody) through a processing system including any transformations to the data item or its governance.
Includes flows with multiple sources and sinks of data, independently and in combination.
Includes verifying the end-to-end integrity of every data flow including any transformations (additions, deletions, modifications, and combinations).
An entity's influence on an application is solely based on the digital data flows that move between the entity and the other components of the distributed application. These data flows are the entity's projection onto the distributed application.
If those projections consist of DADis and every interaction of internal components consists of DADIs then we have a universal approach for implementing decentralized applications with total provenance of control and data within the application.
i = Jr———
e e ot ot E»« - —‘.. i =5 == o o) || | o S =
o o B = M= T = ‘ e ] T‘ |G| v | =5 | v s == e | = ’?‘ == = =} G | | G = e = aset - - o (|
General Case Architecture: Decentralized Distributed Data Streaming Applications
Decentralized = controlled by multiple entities Distributed = spread across multiple compute nodes Establish and maintain provenance (chain-of-custody) for distributed data under decentralized control undergoing various processing stages that follows end-verified perimeter-less diffuse trust (zero-trust) security principles.
Zero-Trust Computing? Resources: NIST: Developing a Framework to Improve Critical Infrastructure Cybersecurity 04/08/2013 Zero Trust Model for Information Security, Forrester Research. http://csre.nist.gov/cyberframework/rfi_comments/040813_forrester_research.pdf https:/jwww.nist.gov/cyberframework Zero Trust Networks 2017 Gilman & Barth https:/jwww.amazon.com/Zero-Trust-Networks-Building-Untrusted/dp/1491962194/ref=sr_1_12 s=books&ie=UTF8&qid=1499871379&sr=11&keywords=zerostrust+networks Never trust always verify No such thing truly as zero trust Really composition of end-verification and diffuse trust End verified diffuse trust perimeter-less security model (EVDTPL)
; Security Models Locality Trust y Zero Trust Hard shells around Soft bodies Hard bodies everywhere Remore Remte Untnstes | Internet Tusted femole emole e Gient Untusted Tusted £ Gt [ Lol eI ouz Bl Internet Hopiction Ptz e Gateway Sner | Trusted Sener Hoplcaton Sever 3 Sever Tanert gy et | Privileged e S sener
Identity Planes and Flows
Authoritative Control loci-of-control = who controls what Control Statements Establish and Maintain control over an identifier. Control over creation or issuance of an identifier. This may include designations of support infrastructure or pre-commitments to future transfers of control. Control over operations on an identifier.
Control Establishment Operations Establishment and maintenance of control authority: Transfer of control (non-revokable).This means transfer of control of the identifier to a different key-pair or set of key-pairs and different signing schemes such as multi- signature (AKA rotation). This may also include transfer designations of support infrastructure. A transfer/rotation operation revokes the current set of key-pairs and replaces them with a new set. Delegation of identifier (revokable). This creates a new identifier with its own set of keys and authorizes (revokable) some degree of control authority.
Authorization Operations
Communication authorizations:
Encryption keys
Routing Service authorizations:
Service endpoints Credential issuance authorizations:
Delegation
Six diffuse trust perimeter-less security principles The network is always hostile, internally & externally; Locality is not trustworthy. Inter-host communication must be end-to-end signed/encrypted and data must be stored signed/ encrypted. Data is signed/encrypted in motion and at rest. Data flow transformations must be end-to-end provenanced using verifiable data items (DADs or VCs). Provenance every change. Every network interaction or data flow must be authenticated and authorized using best practice cryptography. Verify every-time for every-thing. Policies for authentication and authorization must be dynamically modified based on behavior (reputation). Authorization is behavioral. Policies must be governed by end-verified diffuse-trust distributed consensus. Policy is protected by diffuse trust.
Summary end-verifiable diffuse trust perimeter-less security principles Locality is not trustworthy.
Data is signed/encrypted /provenanced in motion & at rest. Verify every-time for every-thing. Authorization is behavioral.
Policy is protected by diffuse trust.
Identity System Layers
Early 2015 began designing decentralized reputation systems with data and algorithm provenance.
Needed decentralized identity infrastructure (2016+) ttpsilthub.comiSmihSamuelPapersfbloblmaster whitepapers/dentity-System ssentials pf
Which led to decentralized identifiers (DIDs) (W3C) (2016+)
hitpsilwac.ceg github.iofdidspec httpsiliwsc ccg ghthubloldid primer]
https:fidentity.foundation (68 Organizations) https:/fwww.hyperledger.orgiprojects Indy Aries Ursa
Followed by verifiable credentials (VCs) (W3C) (2017+)
ttpsilhwvew.v3 orgITRIve data model]
Combined with zero-trust computing (2017+) hitpsilgithub.com/SmithSamuelMJPapers/blobjmasterfwhitepapers/ManyCubed.pdf
Which led to decentralized autonomic data (DAD) (2018+)
(RWOTE)
Which resulted in data flow chains with data & algorithm provenance (2018+) ttpslgthub.comSmichSamuelPapers/bloblmasterfshitepapersiA_DID_for_sverything pdf (RWOT)
Distributed and Decentralized Computing Systems distributed = computation happens at multiple sites non-distributed = computation happens at one site distributed distributed centralized = computation controlled by a single entity contalzad decentralized decentralized = computation controlled by more than one entity computing system may be some combination of centralized . (decentralized) and distributed (non-distributed). 52 decentralization may occur to a degree. § 2 system decentralization may lie on a spectrum of strongly 1 decentralized to weakly decentralized. non-distributed non-distributed centralized decentralized Number of Controlling Entities Decentralization
DID = UNIFIED IDENTIFIER https://w3c-ccg.github.io/did-spec, Scheme - did:example:123456789abcdefghijk s DID Method DID Method Specific String did: method: idstring did:dad:Xq5YqaL6L48pfofu7IUhL@IRaU2_RXFPOAL43wYn148= did:dad:Xq5Yqal6L48pf@fu7IUnL@IRaU2_RxFPOAL43wYn148=:blue did:dad:Xq5Yqal6L48pfefu7IUhL@IRaU2_RxFPOAL43wYn148=?who=me did:dad:Xq5YqaL6L48pfefu7IUhLeIRaU2_RxFPOALA3WYN148=:blue/my/stuff2name=sam#/foo/@ DDo = DID Document. Resolver lookup provides meta-data about DID.
Diffuse trust perimeter-less security principles: 1 The network is always hostile both internally and externally. Locality is not trustworthy.
Diffuse trust perimeter-less security principles: 2 By default, inter-host communication must be end-to-end signed/ encrypted and data must be stored signed/encrypted using best practices cryptography. Data is signed/encrypted in motion & at rest.
Diffuse trust perimeter-less security principles: 3 By default, every network interaction or data flow must be authenticated and authorized using best practices cryptography. Verify every time for every thing.
Diffuse trust perimeter-less security principles: 4 By default, each data flow including all transformations must be end-to-end provenanced using decentralized identifiers (DIDs) and hence decentralized autonomic data items (DADis). Dadify everything.
Diffuse trust perimeter-less security principles: 5 Policies for authentication and authorization must be dynamically modified based on behavior (reputation).
Behavioral authorization rules.
Diffuse trust perimeter-less security principles: 6 Policies must be governed by diffuse-trust distributed consensus. Decentralized control policies.
DID = UNIFIED IDENTIFIER: 1
UUID: Universally Unique Identifier RFC 4122: UUID type1-5 ‘9866eb78-1376-11€9-babs-58ef68134€82" 16 byte collision resistant decentralized identifier generated with random number generator and optional name spacing data. Enables distributed applications to create unique identifiers without central authority Prefixed name spacing allows for sorting and searching properties such as:
time order, lexical order, nesting etc.
DID = UNIFIED IDENTIFIER: 2 URI: Uniform Resource Identifier, URI: Uniform Resource Locator, URN: Uniform Resource Name RFC 3986 scheme: [//[user| :password]€Jhost[:port]][/path][?query][#£ragment] Enables specifying derived resources from central root. Mini language for performing operations on resources (ReST).