## 4 Prototype Implementation
### The IIP Prototype
#### 4.1.1 Information Channel Access Management  
Information channels are managed internally by the IIP, and they can be created (registered), modified (updated) and deleted (removed) dynamically through the provided REST interfaces without having to recompile and redeploy the application. In the current prototype, the representation of an information channel can be retrieved in extensible markup language (XML) format, as depicted in Figure 6b. Each information channel maintains its own allowed user list, and the HTTP basic authentication's credentials are directly used for accessing information channels. As described in the previous section, these credentials are used by client applications to authenticate themselves when communicating with the IIP. IIP users are categorized into three groups, namely _admin_, _provider_ and _consumer_. Admin users are mainly responsible for adding, removing and assigning groups to users of the IIP. Users in the provider group are by default added to the consumer group, since information providers should be able to consume their own information (acting as information consumers). When an information provider creates (registers) a new information channel, its own username is added by default to the information channel's allowed user list as the first information consumer that is allowed to access the information in the information channel. Users in the consumer group that are not included in the provider group are strictly information consuming-only users, and they cannot create (register) new information channels. Information consumers can retrieve a list of available information channels through the information channel catalog service provided by the IIP at URL  
Figure 6: **(a)** The IIP prototype implementation architecture; **(b)** Information channel representation example in extensible markup language (XML) format.  
https://root/consumer/catalog/, which can be requested by using HTTP GET, as shown in Figure 7a. Only the _infold_, _name_ and _description_ of information channels are returned in the catalog, while the ownerships are not revealed. Information consumers can request access to information channels (read-only) by sending HTTP POST to URL https://root/consumer/authorization/{infold}/, where _infold_ is a unique ID of an information channel. Figure 7b shows a sequence diagram of an information consumer requesting access to an information channel.  
Access requests to information channels are stored by the IIP, and a resource for listing pending access requests is made available to information providers through URL https://root/provider/authorization/, which can be accessed via an HTTP GET request. This resource will return all pending access requests to information channels belonging to the caller (_i.e._, the information provider that accesses this resource) in XML format, as shown in Figure 8a. Information providers can add information consumer users to their information channels' allowed user lists (for read access) by sending HTTP POST request to a resource provided by the IIP at URL https://root/provider/authorization/{infold}/. The content of this request should be of type application/x-www-form-urlencoded and contains a parameter called _username_, which refers to the information consumer user being added to the allowed user list. This resource will return a representation of the affected information channel in XML format, as shown in Figure 8b.