|
|
@@ -5,10 +5,7 @@ vocabulary <http://msdl.uantwerpen.be/vafl/vocabulary/actor#> as actor {
|
|
|
|
|
|
@rdfs:comment "The class of entities that perform activities"
|
|
|
aspect Actor :> resource:NamedElement
|
|
|
-
|
|
|
- @rdfs:comment "The class of entities that are performed by actors to result in a desired outcome"
|
|
|
- aspect Activity :> resource:NamedElement
|
|
|
-
|
|
|
+
|
|
|
@rdfs:comment "The set of relations of permission between resources"
|
|
|
relation entity ResourcePermissionResource [
|
|
|
from resource:Resource
|
|
|
@@ -19,14 +16,17 @@ vocabulary <http://msdl.uantwerpen.be/vafl/vocabulary/actor#> as actor {
|
|
|
transitive
|
|
|
]
|
|
|
|
|
|
- @rdfs:comment "The set of relations between actor-resource permissions and the permitted activity"
|
|
|
- relation entity PermissionTypeActivity [
|
|
|
- from ResourcePermissionResource
|
|
|
- to Activity
|
|
|
- forward isPermittedPerformActivity
|
|
|
- reverse isActivityOfPermission
|
|
|
- irreflexive
|
|
|
- asymmetric
|
|
|
+ @rdfs:comment "Enumeration for the access level of a permission"
|
|
|
+ enumerated scalar AccessType [
|
|
|
+ "Execute",
|
|
|
+ "Read",
|
|
|
+ "Write"
|
|
|
+ ]
|
|
|
+
|
|
|
+ @rdfs:comment "The set of AccessType properties of permissions"
|
|
|
+ scalar property hasAccessType [
|
|
|
+ domain ResourcePermissionResource
|
|
|
+ range AccessType
|
|
|
]
|
|
|
|
|
|
@rdfs:comment "The set of relations between actors and resources they are permitted to"
|
|
|
@@ -35,36 +35,15 @@ vocabulary <http://msdl.uantwerpen.be/vafl/vocabulary/actor#> as actor {
|
|
|
to resource:Resource
|
|
|
forward hasActorPermissionToResource
|
|
|
reverse isPermittedToActor
|
|
|
- irreflexive
|
|
|
- asymmetric
|
|
|
- transitive
|
|
|
- ]
|
|
|
-
|
|
|
- // Access levels
|
|
|
-
|
|
|
- @rdfs:comment "The concrete class of activities that are the performance of an instruction or program (black box)"
|
|
|
- concept ExecuteActivity :> Activity
|
|
|
-
|
|
|
- @rdfs:comment "The concrete class of activities that are interpretation of data within a resource (white box)"
|
|
|
- concept ReadActivity :> Activity
|
|
|
-
|
|
|
- @rdfs:comment "The concrete class of activities that are modification of the contents of a resource"
|
|
|
- concept ModifyActivity :> Activity
|
|
|
-
|
|
|
- rule ReadPermissionImpliesExecutePermission [
|
|
|
- ResourcePermissionResource(p1) ^ ReadActivity(a1) ^ isPermittedPerformActivity(p1,a1) ^ ExecuteActivity(a2) -> isPermittedPerformActivity(p1,a2)
|
|
|
- ]
|
|
|
-
|
|
|
- rule ModifyPermissionImpliesReadPermission [
|
|
|
- ActorPermissionResource(p1) ^ ModifyActivity(a1) ^ isPermittedPerformActivity(p1,a1) ^ ReadActivity(a2) -> isPermittedPerformActivity(p1,a2)
|
|
|
- ]
|
|
|
+ ]
|
|
|
|
|
|
// Role-based Access Control
|
|
|
//TODO: refer to INCITS 359-2012 (R2022) standard
|
|
|
|
|
|
@rdfs:comment "The class of job functions or titles which defines an actors level of authority"
|
|
|
- concept Role
|
|
|
+ concept Role :> resource:IdentifiedElement
|
|
|
|
|
|
+ @rdfs:comment "The set of relations between actors and their roles"
|
|
|
relation entity ActorHaveRole [
|
|
|
from Actor
|
|
|
to Role
|
|
|
@@ -74,6 +53,7 @@ vocabulary <http://msdl.uantwerpen.be/vafl/vocabulary/actor#> as actor {
|
|
|
asymmetric
|
|
|
]
|
|
|
|
|
|
+ @rdfs:comment "The set of relations between roles and and the resources they are permitted to"
|
|
|
relation entity RolePermissionResource :> ResourcePermissionResource [
|
|
|
from Role
|
|
|
to resource:Resource
|
|
|
@@ -84,14 +64,17 @@ vocabulary <http://msdl.uantwerpen.be/vafl/vocabulary/actor#> as actor {
|
|
|
transitive
|
|
|
]
|
|
|
|
|
|
- rule ActorRolePermission [
|
|
|
- Actor(a1) ^ Role(ro1) ^ resource:Resource(r1) ^ hasRole(a1,ro1) ^ RolePermissionResource(ro1,rp1,r1) ^ isPermittedPerformActivity (rp1,ac1) ->
|
|
|
- ActorPermissionResource(ro1,rp2,r1) ^ isPermittedPerformActivity (rp2,ac1)
|
|
|
- ]
|
|
|
+ @rdfs:comment "Rule to specify that an actor inherits the permissions of their role"
|
|
|
+ rule ActorRolePermission [
|
|
|
+ Actor(a1) ^ Role(ro1) ^ resource:Resource(r1) ^ hasRole(a1,ro1) ^ RolePermissionResource(ro1,rp1,r1) ^ hasAccessType(rp1,al) -> ActorPermissionResource(ro1,rp2,r1) ^ hasAccessType (rp2,al)
|
|
|
+ ]
|
|
|
|
|
|
// Capability-based Security
|
|
|
- concept Capability
|
|
|
|
|
|
+ @rdfs:comment "The class of capabilities of actors"
|
|
|
+ concept Capability :> resource:Resource
|
|
|
+
|
|
|
+ @rdfs:comment "The set of relations between actors and capabilities they have"
|
|
|
relation entity ActorHaveCapability [
|
|
|
from Actor
|
|
|
to Capability
|
|
|
@@ -101,11 +84,11 @@ vocabulary <http://msdl.uantwerpen.be/vafl/vocabulary/actor#> as actor {
|
|
|
asymmetric
|
|
|
]
|
|
|
|
|
|
- relation entity CapabilityPerformActivity [
|
|
|
+ @rdfs:comment "The set of relations between capabilities and their resource"
|
|
|
+ relation entity CapabilityHaveResource :> ResourcePermissionResource [
|
|
|
from Capability
|
|
|
- to Activity
|
|
|
- forward toPerformActivity
|
|
|
- reverse isPerformedByCapability
|
|
|
- ]
|
|
|
-
|
|
|
+ to resource:Resource
|
|
|
+ forward isCapableToResource
|
|
|
+ reverse isPartOfCapability
|
|
|
+ ]
|
|
|
}
|