S4AC Vocabulary Specification 0.1

Namespace Document 28 June 2011

logo edelweiss
This version:
http://ns.inria.fr/s4ac/v1/ (rdf)
Latest version:
http://ns.inria.fr/s4ac/ (rdf)
Status:
Work in progress
Authors:
Serena Villata
Nicolas Delaforge
Fabien Gandon
Amelie Gyrard

Abstract

S4AC (Social Semantic SPARQL Security for Access Control) is a lightweight vocabulary to create fine-grained access control policies for Linked Data. The vocabulary has the aim to design and share security information specifying the access control conditions under which the data is accessible. Implementations are free to extend S4AC to add further functionalities.

S4AC Vocabulary at a Glance

The following figure provides a schematic representation of S4AC vocabulary. Dashed boxes represent external classes.

S4AC Overview

Introduction

Linked Open Data refers to a set of best practices for the publication and interlinking of structured data on the Web. For ensuring that the resources featured in a dataset are richly described and, at the same time, protected against malicious users, the conditions under which a dataset is accessible need to be provided. This is important in order to encourage as many data providers as possible to publish data in their own terms, and not only fully public data.

The definition of access control policies for the Web has been addressed by the Web Access Control vocabulary (WAC), which allows the user to specify access control lists (ACL). This vocabulary grants the access to a whole RDF document. The aim of the S4AC vocabulary is to supply the data providers with means to define fine-grained access control polices which grant the access to specific RDF data, e.g., restrict the access to single named graphs.

S4AC allows the data provider to specify the access privilege he wants to grant, i.e., Read, Update, Create, and Delete. The main component of the vocabulary is the Access Condition which is a SPARQL 1.1. ASK clause that specifies the condition to be satisfied in order to grant the access. Data providers can define Access Tagging Rules where the set of Access Conditions is applied only to the data tagged with the specific tags (AccessTag), and the Access Conditions can be bound on specific values to provide an Access Evaluation Context. The Access Condition is associated also with a temporal validity. A graphical representation of the S4AC vocabulary is visualised below.

S4AC Ontology

S4AC Description

Classes

Class: s4ac:Condition

This class is used to manage the Access Condition, and the Exception Access.

Subclass Ofsioc:Item

Class: s4ac:AccessCondition

The Access Condition (AC) allows the users to access specific resources. An AC is a SPARQL 1.1 ASK query. If a solution exists, the ASK query returns true, and the AC is said to be verified. If no solution exists, the ASK query returns false, and the AC is said not to be verified.

Subclass Ofs4ac:Condition
In Domain Ofs4ac:hasCategoryLabel,s4ac:hasValidity,s4ac:hasSpatialValidity,s4ac:hasQueryAsk,s4ac:isAccessConditionOf,s4ac:hasParameter

Class: s4ac:AccessPrivilege

This class represents the kind of access privileges which is granted to the user (Create, Read, Update, Delete).

Subclass Ofsioc:Item

Class: s4ac:Create

This class represents a create access on the resource. This class is equivalent to acl:Append.

Subclass Ofs4ac:AccessPrivilege
Is Equivalent Toacl:Append

Class: s4ac:Read

This class represents a read access on the resource. This class is equivalent to acl:Read.

Subclass Ofs4ac:AccessPrivilege
Is Equivalent Toacl:Read

Class: s4ac:Update

This class represents an update access on the resource.

Subclass Ofs4ac:AccessPrivilege

Class: s4ac:Delete

This class represents an update access on the resource.

Subclass Ofs4ac:AccessPrivilege

Class: s4ac:Variable

This class is used to describe the variables used in the Access Condition.

In Domain Ofs4ac:hasName,s4ac:hasComment

Class: s4ac:AccessConditionSet

An Access Condition Set (ACS) represents a set of Access Conditions which can be either Conjunctive or Disjunctive.

Subclass Ofs4ac:Condition
In Domain Ofs4ac:hasAccessCondition,s4ac:scopedBy

Class: s4ac:DisjunctiveAccessConditionSet

A Disjunctive ACS (DACS) is a logical disjunction of Access Conditions, and it is said to be verified if and only if at least one Access Condition it contains is verified.

Subclass Ofs4ac:AccessConditionSet

Class: s4ac:ConjunctiveAccessConditionSet

A Conjunctive ACS (CACS) is a logical conjunction of Access Conditions, and it is said to be verified if and only if every Access Condition it contains is verified.

Subclass Ofs4ac:AccessConditionSet

Class: s4ac:AccessTag

This class is used to define the set of tags such that the Access Conditions apply to any resource tagged with one or more tags form AccessTag.

Subclass Ofscot:Tag
In Domain Ofs4ac:scopes

Class: s4ac:ExceptionAccess

This class is used to forbid or authorize a specific user to access a resource.

Subclass Ofs4ac:AccessCondition

Class: s4ac:PositiveExceptionAccess

This class is used to add an exception to an Access Condition Set, in order to authorize a specific user to access.

Subclass Ofs4ac:ExceptionAccess

Class: s4ac:NegativeExceptionAccess

This class is used to add an exception to an Access Condition Set, in order to unauthorize a specific user to access.

Subclass Ofs4ac:ExceptionAccess

Class: s4ac:AccessTaggingRule

An Access Tagging Rule (ATR) is a triple (ACS, TagSet, Binding) where ACS is an Access Condition Set, TagSet is as set of Access Tags, and Binding is an Access Evaluation Context.

In Domain Ofs4ac:hasAccessConditionSet,s4ac:hasTag,s4ac:hasAccessEvaluationContext,s4ac:hasAccessPrivilege

Class: s4ac:AccessEvaluationContext

An Access Evaluation Context (AEC) is a list L of predetermined bound variables names of the form (var1, val1) for which a SPARQL 1.1 Binding Clause constrains the ASK query evaluation when verifying the Access Conditions.

In Domain Ofs4ac:hasVariable,s4ac:hasValue

Class: s4ac:MaxResource

This class defines a maximum number of accesses on one or more resources.

In Domain Ofs4ac:hasMaxResource

Properties

Property: s4ac:hasAccessPrivilege

This property adds the access privileges to the access tagging rules.

Domain:s4ac:AccessTaggingRule
Range:s4ac:AccessPrivilege

Property: s4ac:hasParameter

The property defines the variables used in the Access Condition, and a comment explaining their use.

Domain:s4ac:AccessCondition
Range:s4ac:Variable

Property: s4ac:hasName

This property associates a name to the variable used in the Access Condition.

Domain:s4ac:Variable
Range:rdfs:Literal

Property: s4ac:hasComment

This property associates a comment to the variable used in the Access Condition to explain their use in the definition of the policies.

Domain:s4ac:AccessEvaluationContext
Range:rdfs:Literal

Property: s4ac:hasPriorityOn

This property represents the pre-order among the access privileges.

Domain:s4ac:AccessPrivilege
Range:s4ac:AccessPrivilege

Property: s4ac:hasCategoryLabel

This property is used to add a label in natural language to the Access Condition.

Domain:s4ac:AccessCondition
Range:skos:prefLabel

Property: s4ac:hasValidity

The property defines the temporal constraints under which an Access Condition is valid. The validity can be expressed as a specific date, or as a time interval.

Domain:s4ac:AccessCondition
Range:time:TemporalEntity

Property: s4ac:hasSpatialValidity

The property defines the location constraints under which an AccessCondition is valid.

Domain:s4ac:AccessCondition
Range:geo:SpatialThing

Property: s4ac:hasAccessCondition

This property adds an Access Condition to an Access Condition Set.

Domain:s4ac:AccessConditionSet
Range:s4ac:AccessCondition

Property: s4ac:isAccessConditionOf

This property says that an Access Condition is part of an Access Condition Set.

Domain:s4ac:AccessCondition
Range:s4ac:AccessConditionSet

Property: s4ac:scopedBy

This property defines when an Access Condition Set is scoped by a tag.

Domain:s4ac:AccessConditionSet
Range:s4ac:AccessTag

Property: s4ac:scopes

This property defines when a tag scopes an Access Condition Set.

Domain:s4ac:AccessTag
Range:s4ac:AccessConditionSet

Property: s4ac:hasQueryAsk

This property defines the SPARQL 1.1 ASK queries of the Access Conditions.

Domain:s4ac:AccessCondition
Range:rdfs:Literal

Property: s4ac:hasNegativeException

This property associates an Access Condition Set with a Negative Exception Access.

Domain:s4ac:AccessConditionSet
Range:s4ac:NegativeExceptionAccess

Property: s4ac:hasPositiveException

This property associates an Access Condition Set with a Positive Exception Access.

Domain:s4ac:AccessConditionSet
Range:s4ac:PositiveExceptionAccess

Property: s4ac:hasAccessConditionSet

This property defines whether the ACS of an Access Tagging Rule is a Conjunctive ACS, or a Disjunctive ACS.

Domain:s4ac:AccessTaggingRule
Range:s4ac:AccessConditionSet

Property: s4ac:hasTag

This property associates an Access Tagging Rule with the set of Access Tags which constrain it.

Domain:s4ac:AccessTaggingRule
Range:s4ac:AccessTag

Property: s4ac:hasAccessEvaluationContext

This property associates an Access Tagging Rule with an Access Evaluation Context.

Domain:s4ac:AccessTaggingRule
Range:s4ac:AccessEvaluationContext

Property: s4ac:hasVariable

This property associates a name of the variable used in the SPARQL 1.1 Bindings to an Access Evaluation Context.

Domain:s4ac:AccessEvaluationContext
Range:rdfs:Literal

Property: s4ac:hasValue

This property associates the value associated to the variable used in the SPARQL 1.1 Bindings to an Access Evaluation Context.

Domain:s4ac:AccessEvaluationContext
Range:rdfs:Literal

Property: s4ac:hasMaxResource

This property provides the number of times a user can consult one or all the resources.

Domain:s4ac:MaxResource
Range:rdfs:Literal

Property: s4ac:maxOnResource

This property is used to precise which resource is accessible by a limited number of accesses.

Domain:s4ac:MaxResource

External Classes and Properties

Classes
sioc:Item,acl:Append,acl:Read,scot:Tag,skos:prefLabel,time:TemporalEntity,rdfs:Literal