Ubiquitous

"Ubiquitous"

• Something that is common place
• Something that is taken for granted and fades into the background
• Something that so familiar it takes little conscious effort to use

Ubiquitous computing

• The pervasiveness of networked computing devices in everyday life

  "Everything from the family fridge to the office coffee pot—as well as heating, cooling, and security systems—will be managed through the Internet, possibly using souped-up mobile phones doubling as universal remote controls", Vint Cerf, co-designer of TCP/IP

  Today’s devices will disappear. Electronics will instead be embedded in our environment, woven into our clothing, and written directly to our retinas from eyeglasses and contact lenses, predicts inventor, entrepreneur, author, and futurist Ray Kurzweil. “Devices will no longer be spokes on the Internet—they will be the nodes themselves,” he says.

  From Red Herring, April 10, 2006

• The success of the Web as a pervasive technology
• The opportunities for the Web to include a much wider range of devices and applications

Introduction to the Ubiquitous Web

• Making it easier to develop distributed applications
• Applications involving multiple devices with widely varying capabilities
• Reaching out into the physical world of sensors and effectors
  • Increasing range of networked devices in everyday environments
• Context awareness - dynamically adapting to the users, devices and environment
• Based upon familiar Web technologies such as markup and scripting
• Providing clean abstractions on top of other technologies
  • Events instead of raw access to HTTP
  • Using hierarchy of DOM nodes to represent the device context (DCI)
• Declarative models encompassing clients and servers
  • Blurring the distinction between the two
• Importance of the Semantic Web for describing resources
  • Discovery and binding into application sessions
  • Trust/identity relationships
• Security requirements, more questions than answers at this stage

Device Coordination

• The means for discovering and binding resources into application sessions

  You are in a meeting room and will be using your smart phone to drive the projector as part of an application running on a remote Web server. During the meeting you are asked to print a key document.

• The phone could perhaps discover the projector and printer via Bluetooth
• In a large room this might not be practical
• The phone could ask the application server to help with finding the resources
• The server, might be able to do this based upon details of the meeting, e.g. the room, its equipment, what presentatations are on the agenda, etc.
• What are the security implications?

Browser Sandbox Model

• Constrains what is possible from web page scripts
• Provides limited access to the device capabilities
• This includes networking capabilities
• XMLHttpRequest limits you to the site the page was downloaded from
• But what if there are multiple devices that need to communicate with each other?
• Could ask the user for permission, but this is awkward
• Better to provide higher level communication mechanism based upon events
• We want a means to safely add new capabilities dynamically
  • Access to local device capabilities, e.g. battery level, signal strength, device characteristics, calendar, camera, contacts, and the means to send messages and make calls
  • Access to remote capabilities, e.g. printing, GPS location, speech services, projectors, embedded sensors and effectors, etc.

Discovery and Binding

• How does the application describe what it is looking for?
• How is the resource described to enable its discovery?
• Does the resource involve adding a software or hardware component into the application?
• Which such component is appropriate to this context?
• Is the component trusted to behave safely?
• Is the user/application permitted to use it?
• Binding the resource into the session should constrain how it is accessed, as according to its description
• To what extent are these issues dealt with by the server on behalf of the client?
• The role of policies set by employers (corporate IT) or by network operators?

Remote User Interfaces

• Where the application server drives the user interface via an exchange of events
• UI described in XML (e.g. XHTML, SVG, ...)
• UI events are forwarded to the server
• Server responds with events that update the UI
• Implications for the Web browser sandbox model?
• DOM mutation events could be used to execute client-side scripts supplied by the server
• Suggests needs for constraints on which servers can act in this way

Delegating Control to the Server

• Mobile devices are often disconnected from the network, e.g. out of range or turned off
• Always on servers can act as agents on behalf of users or organizations
• How do I control what the server can do on my behalf?
• Controlling who can see my photos (e.g. Flickr)
• Web-based calendar information
• Web-based directories of contact information
• Who has access to my current whereabouts (GPS)?
• Family, friends, Work colleagues, Doctors, Teachers, ...

Trust, Identity, Privacy and Security

• Relationships between trust, identity, privacy and security
• W3C's work on privacy preferences (P3P)
• Identity systems
  • must only reveal information with the user's consent
  • should only reveal the minimum information necessary
  • must support requirements for audit trails
• The Ubiquitous Web will bring new requirements beyond those being discussed in the context of today's concerns over phishing and identity theft
• Will digitally signed RDF be useful as part of the solution?
  • An ontology for statements about trust, identity, privacy and security
  • Simple rule-based inference
  • Policy Aware Web project
• What about SAML and other current identity systems?
• The role of two factor authentication systems
  • Involving two independent ways to establish identity
    • Conventional password/PIN
    • Possession of smart card/phone SIM card
    • Biometric tokens (voice, fingerprint, iris scan)

Security Assertion Markup Language (SAML)

• OASIS defined XML language for exchanging authentication and authorization data
• Primary goal is to enable single sign-on across participating websites
• Three kinds of assertion statements covering authentication, attributes and authorization decisions

  <saml:Assertion 
   xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"
   MajorVersion="1" MinorVersion="1"
   Issuer="https://idp.edu/saml/" ...>
   <saml:Conditions NotBefore="..." NotAfter="..."/>
   <saml:AuthenticationStatement
     AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:X509-PKI"
     AuthenticationInstant="...">
     <saml:Subject>...</saml:Subject>
   </saml:AuthenticationStatement>
   <saml:AttributeStatement>
     <saml:Subject>...</saml:Subject>
     <saml:Attribute 
       AttributeName="urn:mace:dir:attribute-def:eduPersonScopedAffiliation"
       AttributeNamespace="urn:mace:shibboleth:1.0:attributeNamespace:uri">
       <saml:AttributeValue Scope="idp.edu">
         member
       </saml:AttributeValue>
       <saml:AttributeValue Scope="idp.edu">
         student
       </saml:AttributeValue>
     </saml:Attribute>
   </saml:AttributeStatement>
  </saml:Assertion>
  

Some Current Solutions

• Microsoft's Infocard
  • Identity system based upon WS-* Web Services including WS-SecurityPolicy, WS-Trust and WS-MetadataExchange
  • Brokers identity between different identity systems, e.g. Kerberos, X.509, SAML, ...
• Liberty Alliance
  • Formed in 2001 to develop standards for identity and identity-based Web services
  • Federated single sign-on based on SAML
  • Provides means to mask personal data from Identity Providers
• OpenID
  • Your identity is given by a URI which can be verified by any server running the OpenID protocol
  • Based upon browser redirection and cookies
    Login with your blog URI:
    For example: happygirl.bloghost.com
  • This submits a form to the website with the URI for a page that includes a link element naming your identity server

    <link rel="openid.server" href="http://bob.com/openid-server.app">

  • The server-side script gets that page and returns a HTTP redirect to the identity server
  • The identity server verifies your identity via a cookie or login in form
  • The identity server then redirects to the browser back to the original website with the necessary credentials

Policy Aware Web

Rule based policy management system for access control, a research initiative between MindSwap and the Decentralized Information Group.