Glossary

Action
An action is a generated function defined in the policy language that can affect state. Actions create new commands to be evaluated by the policy and, if valid, added to the graph (DAG). When new commands arrive (from either local creation, or synced from other nodes), the policy for those commands is evaluated, which may produce fact changes and effects. Actions can be thought of as providing a contract (along with effects) to the application which is implemented by the policy.

Attribute-Based Access Control (ABAC)
A version of Identity Access Management that uses attributes over defined roles to grant an entity or group of entities’ permission(s) to interact with a graph.

Aranya Fast Channels (AFC)
A low-latency, high-throughput encryption engine that uses Aranya for key management and authorization. Find more details in the AFC spec.

Aranya
Manages distributed data by representing state as a graph, which contains commands and factDBs, that is evaluated by a policy. Aranya includes components for evaluating policy, cryptography, storage, conflict resolution and syncing. Find more details in the Aranya spec.

Abstract Syntax Tree (AST)
An abstract syntax tree, is a tree data structure that represents code. It’s used in the policy engine to parse the policy language. Learn more about the AST data structure.

Audit and Monitoring
Regularly review and monitor activities and detect suspicious behavior. Use network monitoring tools to track access patterns and machine learning algorithms to detect anomalies.

Bandwidth
How much data can be theoretically transferred over the network over a certain period of time. Read more about bandwidth.

Channel
An AFC channel facilitates one-to-one communication in either a unidirectional or bidirectional manner. Both channel types use unique symmetric AEAD key(s). A unidirectional channel uses one key to function as the seal key on one side, and the open key on the other side. While a bidirectional channel uses two unique symmetric keys as open and seal keys on both sides, allowing it to secure returned data with a unique key.

ChannelKeys
Two unique symmetric keys, (k1, k2), that enable encryption and decryption for each device in a bidirectional channel. One side of the channel uses k1 for encryption and k2 for decryption, while the other side uses k1 for decryption and k2 for encryption.

Continuous Integration and Continuous Delivery (CI/CD)
A development best practice that ensures software is tested, integrated, and deliverable/deployable with each commit and pull request against the repositories. Read more about CICD.

Command
Instruction given by a device to perform a specific task. It is the object that is sent and stored to denote individual actions by different devices, as defined possible by the policy. For example, it could be to add an entity to a team, whereby the command object itself indicates the action that was performed and other necessary information, such as the credentials of the newly added entity.

Crypto Engine
Provides a set of APIs for encryption, decryption, and key authentication.

Directed Acyclic Graph (DAG)
We use this term interchangeably with the Graph. Read more about directed acyclic graphs.

Device
Represents an instance and has an identity associated to it, as well as other crypto material which govern how it behaves on the endpoint.

Effect
Data, as defined in a policy, that may be emitted to clients when a command is processed.

Endpoint
Where the Aranya software is deployed. This can be a piece of hardware (e.g. spacecraft payload, drone, cellular device, etc.) or software (e.g. application).

Ephemeral Session
In ephemeral sessions, commands are locally processed by a policy but do not persist to the graph. An ephemeral session only lasts as long as the lifetime of the Aranya daemon that it’s running in. Once a daemon stops/restarts, the session will no longer be available. Read the sessions spec for more details.

Fact
Key-value pair that is produced by processing a command.

FactDB
Fact storage within the graph at any given command. The factDB is accessed from a perspective of the graph, therefore, its values change depending on the specific command or point-in-time the graph is evaluated.

Foreign Function Interface (FFI)
Mechanism to perform operations that are written or compiled in a different programming language. Some examples include policy code calling functions written in Rust and Rust code calling functions written in C. More details on Rust FFIs can be found in the Rust by Example Book.

FFI Module
Set of FFI operations that can be imported by a policy.

FFI Schema
Static description of the names and function signatures provided by FFI modules. This allows the policy compiler to validate the FFI is being used correctly in policy code.

Graph
Directed acyclic graph (DAG) where the nodes are commands, which represents the total ordering of commands. Each command in the graph may contain a new version of its parent’s factDB and is connected by a line to the command that occurred immediately before it, as seen from the device’s local state.

Identity and Access Management (IdAM)
A framework for controlling access to a resource based on the identity of a device. Read more about Identity and Access Management.

Instance
Individual deployment of the Aranya software. A single endpoint can have one or many instances.

Label
An identifier that binds an AFC channel to a set of Aranya policy rules, ensuring the devices on either side of the channel are authorized to transmit data via the channel according to rules defined by the policy.

Latency
Amount of time it takes data to travel from one point to another. Read more about latency.

Least Privilege Access
This IDAM policy cornerstone gives devices and systems only the minimal access needed to perform their tasks, reducing the risk of unauthorized access or activities.

Linear Storage
An implementation of the storage APIs using a file-like byte storage interface that is suitable for many different systems without making many assumptions on the underlying storage.

Memory Storage
An implementation of the storage APIs that relies on the system’s global allocator. This is a simpler implementation that is meant to be easy to verify its correctness. This is mostly useful for testing purposes.

Model
Simulates aranya by providing a library with functionality to construct clients, execute actions and sync. Read the model spec for more details.

OpenKey
The key used to decrypt on either side of a bidirectional channel.

OpenOnlyKey
The key used by the side that decrypts in a unidirectional channel.

Peer to Peer
Allows computers to share access by acting as a server for each other.

Perspective
In storage, a version of the graph from a specific command, or point-in-time.

Policy
Defines rules for evaluating actions to publish commands on the graph, resulting in effects emitted to Aranya clients. The policy can be thought of as the execution and validation of business logic in Aranya. More information on the Aranya policy language can be found in the specification.

Policy Compiler
Compiles policy code into a module to be consumed by the policy VM.

Policy Document
Markdown file that describes and implements the objects and operations used to create, update, and delete state, including a graph and factDB.

Policy Engine
An implementation used as part of Aranya client state to store and retrieve policies.

Policy Module
A policy module consists of compiled policy code.

Policy VM
Policy virtual machine. Consumes a compiled policy module to execute and perform policy decisions.

QUIC
A general-purpose transport layer network protocol, that utilizes several multiplexed UDP connections and encrypts traffic with TLS. Read more about the QUIC protocol.

Role-Based Access Control (RBAC)
A version of Identity Access and Management that uses roles to grant a device or group of devices permission(s) to interact with a graph.

Revocation
Removal of access to a specific data set.

Role
Defines capabilities a device or group of devices may be assigned to perform operations in a policy that uses an RBAC system.

Round-Trip Time (RTT)
How long it takes data to travel from one point to another and back. Read more about round-trip delay.

SealKey
The key used to encrypt on either side of a bidirectional channel.

SealOnlyKey
The key used by the side that encrypts in a unidirectional channel.

Segment
In storage, a nonempty sequence of commands that has been persisted to the graph.

Secure Authentication and Authorization:
Implement strong authentication methods and control what authenticated devices can do. Consider multi-factor authentication and digital certificates to ensure only authorized individuals have access.

Segmentation
Data segmentation is the process of organizing data into groups based on shared characteristics or access/sensitivity levels.

Segregation of Duties
Responsibilities should be distributed among different individuals to prevent fraud or error. This is especially important in mesh networks, where one error can have significant consequences.

Shared memory (Shm)
Shared memory or shared local memory allows processes to communicate information by sharing a region of memory. It’s used to store channel keys for ephemeral sessions and APS channels in Aranya.

State
All the information that defines how the software platform is currently functioning, how it can change, and how it should behave in different scenarios.

Sync
Implementations that allow remote Aranya clients to share state. More details on syncing in Aranya can be found in the sync specification.

Transmission Control Protocol (TCP)
Transport that supports resending dropped packets. Read more about tcp.

Team
A group of devices that interact over a graph. Sometimes used interchangeably with graph, as a team is associated with a single graph.

Throughput
The amount of data that can actually be transferred over the network over a certain period of time. This is a measurement rather than a theoretical estimate. Read more about throughput.

Time To Live (TTL)
This value is set to the number of hops a packet should exist on the network before it is dropped. Read more about ttl.

User Datagram Protocol (UDP)
A simple connectionless protocol that prioritizes speed over error checking and correction. Read more about udp.

Unix Domain Socket (UDS)
An endpoint for exchanging data. Read more about UDS.

Weave
The weave algorithm enforces deterministic ordering while merging two DAGs, or sets of commands.

Zero-Trust
A cybersecurity approach that requires all entities and devices to be authenticated and authorized before accessing data, endpoints, applications, and services.