-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathoac.ttl
303 lines (273 loc) · 18 KB
/
oac.ttl
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
PREFIX acl: <http://www.w3.org/ns/auth/acl#>
PREFIX bibo: <http://purl.org/ontology/bibo/>
PREFIX dcterms: <http://purl.org/dc/terms/>
PREFIX dpv: <https://w3id.org/dpv#>
PREFIX dpv-tech: <https://w3id.org/dpv/dpv-tech#>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>
PREFIX odrl: <http://www.w3.org/ns/odrl/2/>
PREFIX owl: <http://www.w3.org/2002/07/owl#>
PREFIX profile: <http://www.w3.org/ns/dx/prof/>
PREFIX rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#>
PREFIX rdfs: <http://www.w3.org/2000/01/rdf-schema#>
PREFIX role: <http://www.w3.org/ns/dx/prof/role/>
PREFIX skos: <http://www.w3.org/2004/02/skos/core#>
PREFIX sw: <http://www.w3.org/2003/06/sw-vocab-status/ns#>
PREFIX vann: <http://purl.org/vocab/vann/>
PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>
PREFIX oac: <https://w3id.org/oac#>
# ------------ Ontology Metadata ------------------ #
<https://w3id.org/oac> a owl:Ontology, profile:Profile ;
profile:isProfileOf <http://www.w3.org/ns/odrl/2/core> ;
profile:hasResource oac:oac-html, oac:oac-ttl ;
dcterms:title "ODRL Profile for Access Control"@en ;
vann:preferredNamespacePrefix "oac" ;
vann:preferredNamespaceUri "https://w3id.org/oac#"^^xsd:string ;
rdfs:label "ODRL access control policies profile"@en ;
owl:versionInfo "0.2"^^xsd:string ;
owl:versionIRI <https://w3id.org/oac/0.2> ;
owl:priorVersion <https://w3id.org/oac/0.1> ;
dcterms:created "2021-04-12"^^xsd:date ;
dcterms:modified "2023-10-09"^^xsd:date ;
dcterms:issued "2023-10-09"^^xsd:date ;
dcterms:creator "Beatriz Esteves", "Harshvardhan J. Pandit", "Víctor Rodríguez-Doncel" ;
dcterms:publisher "Beatriz Esteves" ;
dcterms:abstract "The ODRL Profile for Access Control (OAC) extends the WAC access control list mechanism by using the Open Digital Rights Language (ODRL) to define 'sticky policies' that express permissions and / or prohibitions associated with data stored in a decentralised storage environment and utilises the Data Privacy Vocabulary (DPV) as a controlled vocabulary for invoking privacy and data protection-specific terms."@en ;
dcterms:description "The ODRL Profile for Access Control (OAC) extends the WAC access control list mechanism by using the Open Digital Rights Language (ODRL) to define 'sticky policies' that express permissions and / or prohibitions associated with data stored in a decentralised storage environment and utilises the Data Privacy Vocabulary (DPV) as a controlled vocabulary for invoking privacy and data protection-specific terms."@en ;
rdfs:comment "This is the RDF ontology for the ODRL Profile for Access Control."@en ;
dcterms:bibliographicCitation "Cite this vocabulary as: Esteves, B., Pandit, H. J., & Rodrı́guez-Doncel, V. (2023). ODRL Profile for Access Control 0.2. https://doi.org/10.5281/zenodo.10247115"@en ;
bibo:doi "10.5281/zenodo.10247115"@en ;
foaf:logo <https://besteves4.github.io/odrl-access-control-profile/assets/folder.ico> ;
sw:term_status "stable"@en ;
dcterms:source <http://www.w3.org/ns/odrl/2/>, <https://w3id.org/dpv> ;
dcterms:license <https://dalicc.net/licenselibrary/CC-BY-4.0> .
oac:oac-html a profile:ResourceDescriptor ;
profile:hasRole role:specification ;
profile:hasArtifact <https://protect.oeg.fi.upm.es/odrl-access-control-profile/oac.html> ;
dcterms:title "ODRL Profile for Access Control HTML specification"@en ;
dcterms:format <https://www.iana.org/assignments/media-types/text/html> ;
dcterms:conformsTo <https://www.w3.org/TR/html/> .
oac:oac-ttl a profile:ResourceDescriptor ;
profile:hasRole role:vocabulary ;
profile:hasArtifact <https://protect.oeg.fi.upm.es/odrl-access-control-profile/oac.ttl> ;
dcterms:title "ODRL Profile for Access Control Turtle vocabulary"@en ;
dcterms:format <https://www.iana.org/assignments/media-types/text/turtle> ;
dcterms:conformsTo <https://www.w3.org/TR/turtle/> .
<https://w3id.org/oac#>
a skos:Collection ;
skos:prefLabel "ODRL Access Control profile concepts"@en ;
skos:scopeNote "ODRL Access Control profile terms based on the DPV and ACL vocabularies"@en ;
skos:member oac:Preference ;
skos:member oac:Requirement ;
skos:member oac:PersonalData ;
skos:member oac:Access ;
skos:member oac:Processing ;
skos:member oac:Purpose ;
skos:member oac:Recipient ;
skos:member oac:LegalBasis ;
skos:member oac:TechnicalOrganisationalMeasure;
skos:member oac:Technology ;
skos:member oac:IdentityProvider ;
skos:member oac:Entity ;
skos:member oac:isNotA ;
skos:member oac:subclass ;
skos:member oac:semantic ;
skos:member oac:service ;
skos:member oac:application ;
skos:member odrl:Request ;
skos:member odrl:absolutePosition ;
skos:member odrl:absoluteSpatialPosition ;
skos:member odrl:absoluteTemporalPosition ;
skos:member odrl:absoluteSize ;
skos:member odrl:count ;
skos:member odrl:dateTime ;
skos:member odrl:delayPeriod ;
skos:member odrl:deliveryChannel ;
skos:member odrl:elapsedTime ;
skos:member odrl:event ;
skos:member odrl:fileFormat ;
skos:member odrl:industry ;
skos:member odrl:language ;
skos:member odrl:media ;
skos:member odrl:meteredTime ;
skos:member odrl:payAmount ;
skos:member odrl:percentage ;
skos:member odrl:product ;
skos:member odrl:purpose ;
skos:member odrl:recipient ;
skos:member odrl:relativePosition ;
skos:member odrl:relativeSpatialPosition ;
skos:member odrl:relativeTemporalPosition ;
skos:member odrl:relativeSize ;
skos:member odrl:resolution ;
skos:member odrl:spatial ;
skos:member odrl:spatialCoordinates ;
skos:member odrl:systemDevice ;
skos:member odrl:timeInterval ;
skos:member odrl:unitOfCount ;
skos:member odrl:version ;
skos:member odrl:virtualLocation ;
skos:member odrl:policyUsage .
# ------------ Policy Concepts ------------------ #
oac:Preference a rdfs:Class , owl:Class, skos:Concept ;
rdfs:subClassOf odrl:Policy ;
owl:disjointWith odrl:Agreement, odrl:Offer, odrl:Privacy, odrl:Request, odrl:Ticket, odrl:Assertion, oac:Requirement ;
rdfs:isDefinedBy oac: ;
rdfs:label "Preference Policy"@en ;
rdfs:comment "A Preference Policy is a soft policy that expresses the assigner's preferences over an Asset which MAY not be satisfied."@en ;
skos:definition "A Preference Policy is a soft policy that expresses the assigner's preferences over an Asset which MAY not be satisfied."@en ;
skos:note "A Preference Policy MUST contain at least one Permission or Prohibition rule, an Action, a target Asset and a Party with Assigner function (in the same Permission or Prohibition). The Preference Policy MAY contain a Party with Assignee, Application and/or Service functions, but MUST not grant any privileges to those Parties."@en ;
skos:example "If a preference policy set by a party A does not match a request policy from party B, the request can still be accepted if party A accepts party B's request conditions."@en .
oac:Requirement a rdfs:Class , owl:Class, skos:Concept ;
rdfs:subClassOf odrl:Policy ;
owl:disjointWith odrl:Agreement, odrl:Offer, odrl:Privacy, odrl:Request, odrl:Ticket, odrl:Assertion, oac:Preference ;
rdfs:isDefinedBy oac: ;
rdfs:label "Requirement Policy"@en ;
rdfs:comment "A Requirement Policy is a hard policy that expresses the assigner's preferences over an Asset which MUST be satisfied."@en ;
skos:definition "A Requirement Policy is a hard policy that expresses the assigner's preferences over an Asset which MUST be satisfied."@en ;
skos:note "A Requirement Policy MUST contain at least one Permission or Prohibition rule, an Action, a target Asset and a Party with Assigner function (in the same Permission or Prohibition). The Requirement Policy MAY contain a Duty, Party with Assignee, Application and/or Service functions, but MUST not grant any privileges to those Parties."@en ;
skos:example "If a requirement policy set by a party A does not match a request policy from party B, the request must be denied even if party A accepts party B's request conditions."@en .
# ------------ Asset Concepts ------------------ #
oac:PersonalData a odrl:Asset, skos:Concept ;
rdfs:subClassOf dpv:PersonalData ;
rdfs:isDefinedBy oac: ;
rdfs:label "Personal data"@en ;
rdfs:comment "Data directly or indirectly associated or related to an individual."@en ;
skos:definition "Data directly or indirectly associated or related to an individual."@en ;
skos:example "Data assets related to an individual include financial data such as credit card or account numbers, social data such as marital status or friends, health data such as health records or blood type and so on."@en .
# ------------ Party Concepts ------------------ #
oac:Entity a odrl:Party, skos:Concept ;
rdfs:subClassOf dpv:Entity ;
rdfs:isDefinedBy oac: ;
rdfs:label "Entity"@en ;
rdfs:comment "A human or non-human party that constitutes an entity."@en ;
skos:definition "A human or non-human party that constitutes an entity."@en ;
skos:example "Entities can refer to individuals, organisations, institutions, or authorities."@en .
# ------------ Action Concepts ------------------ #
oac:Access a odrl:Action, skos:Concept ;
rdfs:subClassOf acl:Access ;
rdfs:isDefinedBy oac: ;
rdfs:label "Access"@en ;
rdfs:comment "Modes used to access resources, e.g., stored in Solid Pods."@en ;
skos:definition "Modes used to access resources, e.g., stored in Solid Pods."@en ;
skos:example "The ACL vocabulary includes Read, Write, Append and Control access modes."@en .
oac:Processing a odrl:Action, skos:Concept ;
rdfs:subClassOf dpv:Processing ;
rdfs:isDefinedBy oac: ;
rdfs:label "Processing"@en ;
rdfs:comment "Processing operations performed on personal data."@en ;
skos:definition "Processing operations performed on personal data."@en ;
skos:example "DPV includes processing operations such as use, collect, adapt or infer."@en .
# ------------ Left Operand Concepts ------------------ #
oac:Purpose a odrl:LeftOperand, owl:NamedIndividual, skos:Concept ;
rdfs:subClassOf dpv:Purpose ;
rdfs:isDefinedBy oac: ;
rdfs:label "Purpose"@en ;
rdfs:comment "Constraint on the purpose for which the processing of personal data is permitted or prohibited."@en ;
skos:definition "Constraint on the purpose for which the processing of personal data is permitted or prohibited."@en ;
skos:example "DPV includes purposes such as academic research, customer care or identity verification."@en ;
skos:note '''Only the odrl:isA, odrl:eq, odrl:neq, oac:isNotA, oac:subclass or oac:semantic operators SHOULD be used. Example:
<https://example.com/purposeConstraint> a odrl:Constraint ;
odrl:leftOperand oac:Purpose ;
odrl:operator odrl:isA ;
odrl:rightOperand dpv:ResearchAndDevelopment .
indicates that the purpose for the processing of personal data is an instance of dpv:ResearchAndDevelopment.'''@en .
oac:Recipient a odrl:LeftOperand, owl:NamedIndividual, skos:Concept ;
rdfs:subClassOf dpv:Recipient ;
rdfs:isDefinedBy oac: ;
rdfs:label "Recipient"@en ;
rdfs:comment "Constraint on the recipients that may receive the results of the processing of personal data."@en ;
skos:definition "Constraint on the recipients that may receive the results of the processing of personal data."@en ;
skos:example "A recipient can be any entity receiving personal data, including data subjects, controllers, non profit organisations or non governmental organisations."@en ;
skos:note '''Only the odrl:isA, odrl:eq, odrl:neq, oac:isNotA, oac:subclass or oac:semantic operators SHOULD be used. Example:
<https://example.com/recipientConstraint> a odrl:Constraint ;
odrl:leftOperand oac:Recipient ;
odrl:operator odrl:neq ;
odrl:rightOperand ex:UniversityA .
indicates that the recipient of the personal data cannot be ex:UniversityA.'''@en .
oac:LegalBasis a odrl:LeftOperand, owl:NamedIndividual, skos:Concept ;
rdfs:subClassOf dpv:LegalBasis ;
rdfs:isDefinedBy oac: ;
rdfs:label "Legal Basis"@en ;
rdfs:comment "Constraint on the legal basis for which the processing of personal data is permitted or prohibited."@en ;
skos:definition "Constraint on the legal basis for which the processing of personal data is permitted or prohibited."@en ;
skos:example "A legal basis can be consent, legitimate interest or contract perfomance or jurisdiction specific legal basis such as the ones provided in GDPR Article 6."@en ;
skos:note '''Only the odrl:isA, odrl:eq, odrl:neq, oac:isNotA, oac:subclass or oac:semantic SHOULD be used. Example:
<https://example.com/legalBasisConstraint> a odrl:Constraint ;
odrl:leftOperand oac:LegalBasis ;
odrl:operator odrl:isA ;
odrl:rightOperand dpv:Consent .
indicates that the legal basis for the processing should be an instance of dpv:Consent.'''@en .
oac:TechnicalOrganisationalMeasure a odrl:LeftOperand, owl:NamedIndividual, skos:Concept ;
rdfs:subClassOf dpv:TechnicalOrganisationalMeasure ;
rdfs:isDefinedBy oac: ;
rdfs:label "Technical and Organisational Measure"@en ;
rdfs:comment "Constraint on the technical and/or organisational measures used to ensure a secure processing of personal data."@en ;
skos:definition "Constraint on the technical and/or organisational measures used to ensure a secure processing of personal data."@en ;
skos:example "Technical measures include access control methods, encryption and other security protocols. Organisational measures include notices, guidelines, policies, agreements and other organisational procedures."@en ;
skos:note '''Only the odrl:isA, odrl:eq, odrl:neq, oac:isNotA, oac:subclass or oac:semantic SHOULD be used. Example:
<https://example.com/tomConstraint> a odrl:Constraint ;
odrl:leftOperand oac:TechnicalOrganisationalMeasure ;
odrl:operator odrl:eq ;
odrl:rightOperand dpv:AccessControlMethod .
indicates that an access control method should be implemented for the processing to occur.'''@en .
oac:Technology a odrl:LeftOperand, owl:NamedIndividual, skos:Concept ;
rdfs:subClassOf dpv:Technology ;
rdfs:isDefinedBy oac: ;
rdfs:label "Technology"@en ;
rdfs:comment "Constraint on the technologies used for the processing of personal data."@en ;
skos:definition "Constraint on the technologies used for the processing of personal data."@en ;
skos:example "Technologies include communication mechanisms such as WiFi or Bluetooth, security technologies such as PETS, data technologies, operational technologies, identity technologies, and so on."@en ;
skos:note """Only the odrl:isA, odrl:eq, odrl:neq, oac:isNotA, oac:subclass or oac:semantic SHOULD be used. Example:
<https://example.com/technologyConstraint> a odrl:Constraint ;
odrl:leftOperand oac:Technology ;
odrl:operator odrl:isA ;
odrl:rightOperand dpv-tech:PET .
indicates that a PET should be used for the processing to occur."""@en .
oac:IdentityProvider a odrl:LeftOperand, owl:NamedIndividual, skos:Concept ;
rdfs:isDefinedBy oac: ;
rdfs:label "Identity Provider"@en ;
rdfs:comment "Constraint on the identity provider service used to authenticate a user."@en ;
skos:definition "Constraint on the identity provider service used to authenticate a user."@en ;
skos:example "<https://solidweb.me> or <https://login.inrupt.com> are examples of Solid identity providers."@en ;
skos:note """Only the odrl:eq, odrl:neq, odrl:isAnyOf or odrl:isNoneOf SHOULD be used. Example:
<https://example.com/idpConstraint> a odrl:Constraint ;
odrl:leftOperand oac:IdentityProvider ;
odrl:operator odrl:isAnyOf ;
odrl:rightOperand <https://solidweb.me>, <https://login.inrupt.com> .
indicates that used identity provider should be either the <https://solidweb.me> or <https://login.inrupt.com> services."""@en .
# ------------ Operator Concepts ------------------ #
oac:isNotA a odrl:Operator, owl:NamedIndividual, skos:Concept ;
rdfs:isDefinedBy oac: ;
rdfs:label "Is not a"@en ;
rdfs:comment "Indicates that a given Left Operand is not an instance of the Right Operand of the Constraint."@en ;
skos:definition "Indicates that a given Left Operand is not an instance of the Right Operand of the Constraint."@en ;
skos:example "The purpose constraint of a rule can not be an instance of academic research purpose."@en .
oac:subclass a odrl:Operator, owl:NamedIndividual, skos:Concept ;
rdfs:isDefinedBy oac: ;
rdfs:label "Subclass"@en ;
rdfs:comment "Indicates that a given Left Operand is a subclass of the Right Operand of the Constraint."@en ;
skos:definition "Indicates that a given Left Operand is a subclass of the Right Operand of the Constraint."@en ;
skos:example "The purpose constraint of a rule can be a subclass of DPV's research and development purpose such as academic research, non-commercial research or commercial research."@en .
oac:semantic a odrl:Operator, owl:NamedIndividual, skos:Concept ;
rdfs:isDefinedBy oac: ;
rdfs:label "Semantic"@en ;
rdfs:comment "Indicates that a given Left Operand is equal to, an instance or a subclass of the Right Operand of the Constraint."@en ;
skos:definition "Indicates that a given Left Operand is equal to, an instance or a subclass of the Right Operand of the Constraint."@en ;
skos:example "The purpose constraint of a rule can be research and development, an instance of research and development or one of its subclasses such as academic research, non-commercial research or commercial research."@en .
# ------------ App & Service Concepts ------------------ #
oac:service a rdf:Property, owl:ObjectProperty, skos:Concept ;
rdfs:isDefinedBy oac: ;
rdfs:label "Service"@en ;
rdfs:comment "Service used by the recipient of the Rule."@en ;
skos:definition "Service used by the recipient of the Rule."@en ;
skos:example "Method used to interact with the data, e.g., identity verification service, query service."@en ;
rdfs:domain odrl:Rule, odrl:Policy ;
rdfs:range dpv-tech:Service .
oac:application a rdf:Property, owl:ObjectProperty, skos:Concept ;
rdfs:isDefinedBy oac: ;
rdfs:label "Application"@en ;
rdfs:comment "Application used by the recipient of the Rule."@en ;
skos:definition "Application used by the recipient of the Rule."@en ;
skos:example "Application used by the assignee to interact with the data, e.g., address book, game."@en ;
rdfs:domain odrl:Rule, odrl:Policy ;
rdfs:range dpv-tech:Application .