Component Interaction

Scrambling Content

Within the context of, say, a user posting content to Facebook, where the user wants to scrambl that content, the following operations occur:

1. the user clicks into the “Update Status” textarea field on the Facebook page
2. the browser extension gets notified of a a focus event in the field and initiates the creation of an XID. The browser extension is responsible for creating the key, so a key is generated and is passed, along with the ID of the currently selected policy, to the policy server via the server APIs.
3. the policy server receives the XID creation request; it creates a globally unique XID and associates the key and the policy ID with it and persists the tuple to the data storage system and then returns the XID.
4. the browser extension asynchronously receives the XID from the policy server. It is only after a valid XID is received that the extension will use the client APIs to scrambl the content
5. the user enters content and (eventually) hits “Post” to submit the content
6. the browser extension intercepts the submit request and uses the client APIs to scrambl the content. The key previously generated and the XID received from the policy server are used by the client APIs
7. the browser extension replaces the content of the textarea with the scrambld content and passes control to the normal submit processing code and the scrambld content is posted to Facebook.

There are a couple of integration points possible in the above scenario. The first one is at operation #2, where the XID creation request is issued to the policy server. It should be clear that any HTTP-enabled client can issue the same request to get back an XID that can later be used to check for access rights. The second integration point is at operation #6, where the posted content is scrambld using the client APIs. As before, it should be obvious that any JavaScript (at this point in time) client can perform actual scrambling of content.

Descrambling Content

1. the user views a page with protected content
2. the browser extension performs background scanning for protected content and finds some on that page
3. the browser extension extracts the XID from the content and sends a request for the key for that XID to the policy server
4. the policy server receives the request and looks up the XID in the data store. If it exists it retrieves the policy associated with the XID.
5. the policy server then iterates through the policy terms of the policy and evaluates them in turn. The policy server provides the term evaluation code with information about the current user and the creation time of the XID
6. if all policy terms allow access, then the key associated with the XID is returned to the client, otherwise a failure code is returned
7. the browser extension asynchronously receives the request results and if access is allowed, it uses the returned key and the client APIs to descrambl the content and replace the scrambld content with the descrambld content.

If one of the terms evaluated is of type “external list check” then an HTTP-based call is made to the configured server with the email address of the user asking if that email address is allowed access.

next Using the API's