ULI Resolution Protocol

[darnjo]

The ULI project was sent to Transport to create a resolution protocol.

When new licensees are added or updated, broadcasts need to be made on certified networks of ULI providers, which will either confirm a match within a given confidence threshold (70% or greater was requested by the ULI Pilot) or reply with a confirmation that they don't have information on the given licensee.

ActivityPub can be used to make ULI broadcasts on a network of nodes and resolvers in the network can subscribe to each others' feeds and reply to ULI requests by replying to the note they were created with along with a confirmation of either a match or no match found.

Some related questions:

• How do network users know who the resolvers are?
  • Resolvers would be certified to be on the network so we know they're following the protocol correctly. Certified resolvers could be found there.
  • Resolvers that haven't been certified yet can supply local resolver lists in the same format.
• Are ULIs created first or after an appropriate number of confirmations?
  • Creating them first is more flexible for each provider, but if other matches are found can result in excess ULIs being created and removed.
  • Another option is to create ULIs only after a certain number of confirmations (consensus in the network), but an issue is that unknown or unavailable resolvers could find information on their nodes for a given licensee. Therefore, there may be batch processes for catching up when onboarding a new resolver or resuming service after significant downtime.
• Consensus in the network
  • Participants of the network will agree on a consensus threshold.
  • Some interesting use cases come up in the calculation of this threshold, consider 2/3 of 7, which is 4.7. One answer is to just round up in this case, meaning 5 confirmations of 7 would be needed.
  • Can't wait forever for all nodes to resolve. We have a protocol to resolve any issues when hosts were away and couldn't respond in time.
• Authentication and Authorization
  • Access to networks can be behind a login that does authentication and grants authorization tokens using OAuth2.
  • There is no data stored on the ULI resolver network itself. Instead, URLs to external services protected by OAuth2 is used.