diff --git a/AAI/implementations.md b/AAI/implementations.md index 5038ac4..b9fee71 100644 --- a/AAI/implementations.md +++ b/AAI/implementations.md @@ -12,6 +12,10 @@ permalink: aai-implementations ![this](AAI/nih-ras.drawio.svg) +## Trust + +![this](AAI/trust.drawio.svg) + ## GA4GH driver projects implementing AAI and Passports As of November 2023, the following driver projects implement AAI / Passports: diff --git a/AAI/trust.drawio.svg b/AAI/trust.drawio.svg new file mode 100644 index 0000000..8bd60ed --- /dev/null +++ b/AAI/trust.drawio.svg @@ -0,0 +1,4 @@ + + + +

Passport Ecosystem

Passport Ecosystem

Visa issuer

Visa issuer

Visa issuer

Visa issuer

Visa issuer(s)

Visa issuer(s)

Identity Providers

Identity Providers
AAF IdP
AAF IdP
Google
IdP
Google...

Passport Broker

Passport Broker

Passport Clearinghouse

Passport Clearinghouse
trusted by the passport ecosystem to
securely perform authentication and
provide OIDC access token with
stable subject identifiers
trusted by the passport ecosystem to...
specific two way trust
relationship established
between each IdP and
broker
(one off)
specific two way trust...
...
...
Garvan
auth
Garvan...
Melb Uni auth
Melb Uni au...
two way trust 
relationship established
between each institute and AAF
(legal and technical)
two way trust...

Data

Data

DNS & SSL & HTTP

DNS & SSL & HTTP
There is a base infrastructure to the internet that is trusted by all elements of the ecosystem. For instance - that DNS entries can only be created by the organisation that owns them, and that SSL certificates are only issued to organisations that own / prove their ownership of domains
There is a base infrastructure...
trusted to make
 decisions
 about the
responsible sharing
 of data
trusted to make...
dataset
trusts to safely look
 after their data
(human trust)
trusts to safely look...
Data AccessCommitteeresearcher
e.g. DRS
e.g. DRS
passport broker must know the
source of all its visa issuers - and
must confirm the validity of all visas - but
it does not need to examine/trust their content
(established technically by configuration
of the brokers and issuers - out of specification)
(will also include legal/policy agreement)
passport broker must know the...
the clearing house must
trust each visa issuer before
it can use the information
from a visa for authorisation
decisions
(established by configuration
see JWKS in FAQ)
the clearing house must...
the clearing house must
trust the passport broker
in order to accept the passport
as valid
(established by configuration
see JWKS in FAQ)
the clearing house must...
every application that exists in
the passport ecosystem must be
registered with the passport broker
(one off technical registration)
(legal?)
every application that exists in...
uses
uses
passport token
flowing through an
application, and downstream
to a passport clearinghouse
in order to access data
passport token...
trusted by the data custodian
to make authorisation
decisions and give access
to the data
(establish technical sharing
outside of
passport specification e.g. giving AWS
access secrets to DRS endpoint)
(legal and policy?)
trusted by the data custodian...
e.g. REMS
e.g. REMS
e.g. CAVATICA
e.g. CAVATICA
implicit technical trust - unlikely to have
meaningful legal liability
arrangements with DNS or
SSL providers
implicit technical trust - unlikely to have...
decisions about data access
decisions...
consentsdata custodiandata donor(s)
Text is not SVG - cannot display
\ No newline at end of file