“CBAC”的版本间的差异

来自智能法律合约
跳到导航 跳到搜索
 
（未显示同一用户的4个中间版本）
第4行： 第4行：
 
<meta property="mw:pageNamespace" content="0" />
 
<meta property="mw:pageNamespace" content="0" />
  
−
<meta property="mw:revisionSHA1" content="4c9dca79b50e053e3f7764f329c8ffbeb56d198a" />
+
<meta property="mw:revisionSHA1" content="bb6a5ee2dfaec6abb09392096a33b2bf618e9c0e" />
−
<meta property="dc:modified" content="2026-09-03T00:47:57.000Z" />
+
<meta property="dc:modified" content="2026-09-04T19:16:40.000Z" />
 
<meta property="mw:html:version" content="2.1.0" />
 
<meta property="mw:html:version" content="2.1.0" />
 
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]-->
 
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]<!--[if lt IE 9]><script src="/mediawiki/load.php?modules=html5shiv&only=scripts&skin=vector&sync=1"></script><script>html5.addElements('figure-inline');</script><![endif]-->
第11行： 第11行：
 
<meta http-equiv="vary" content="Accept" />
 
<meta http-equiv="vary" content="Accept" />
  
−
<meta property="mw:pageId" content="75" />
+
----
−
<meta property="mw:pageNamespace" content="0" />
 
  
−
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" />
+
== 概览 ==
−
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" />
+
 
−
<meta property="mw:html:version" content="2.1.0" />
+
 
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]
+
 
−
<meta http-equiv="content-language" content="zh-cn" />
+
更新时间：2026.9.5
−
<meta http-equiv="vary" content="Accept" />
+
 
−
<meta charset="utf-8" />
+
将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。
 +
 
 +
成功转换了27个从oasis官网获取的example
 +
 
 +
下一步安排：寻找一些更复杂的例子（实战，官网没更多了）（周六）
 +
 
 +
下一步安排：简单判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）
 +
 
 +
一、基本结构
 +
 
 +
PolicySet（可选；一整套策略集，此处不转化）
 +
 
 +
│  ← 策略集组合算法（deny-overrides / permit-overrides / only-one-applicable…）（此处不转化）
 +
 
 +
└── Policy（一份策略 = 一份 SPESC 合约）
 +
 
 +
    │  ← 规则组合算法 RuleCombiningAlg（permit/deny-overrides、first-applicable、t-of-n）
 +
 
 +
    │
 +
 
 +
    ├── Target（策略级过滤器 = 匹配条款，如 no0）
 +
 
 +
    │    └── AnyOf（OR） → AllOf（AND） → Match ×n（单条匹配条件）
 +
 
 +
    │
 +
 
 +
    ├── Rule ×n（一条规则 = 一个子条款，如 no1_1~no1_4）
 +
 
 +
    │    ├── Target（规则级过滤器，可选，规则如上）
 +
 
 +
    │    ├── Condition（= when 前置条件）→ Apply（and/or/not/比较）→ 叶子（值/属性）
 +
 
 +
    │    ├── Effect（= can → Permit / cannot → Deny）
 +
 
 +
    │    └──  Obligation（可选义务；SLA 阶梯「允许但限流」的挂点）
 +
 
 +
    │
  
−
=
+
    └── Obligation
−
<meta property="mw:pageId" content="75" />
 
−
<meta property="mw:pageNamespace" content="0" />
 
  
−
<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" />
 
−
<meta property="dc:modified" content="2026-08-30T23:12:55.000Z" />
 
−
<meta property="mw:html:version" content="2.1.0" />
 
−
[https://www.smartlegalcontract.cn/mediawiki/index.php/CBAC]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]顺序 =
 
  
−
target term
 
  
−
               │ 只做资源级适用性判断，不引用具体 comb
+
二、执行顺序：
  
−
               ▼  （编译器自动按 Request::Act.actionId 查找对应 comb；  （无 comb 则找同动作 rule_target））
+
（1）Target Term，只做资源级适用性判断，包含when逻辑并调用
  
−
comb term（组合入口，针对一类动作）
+
（2）Authentic  Term：在运行前临时进行变量赋值逻辑
  
−
              │ 在 when 中 evalTerm(rule_target, Request) = Permit
+
    ├── when 条件
  
−
              ▼
+
    └── while 赋值
  
−
rule_target term（动作、rule级obligation、rule级target、伴随、后置）
+
（3）rule_term
  
−
              │ 在 when 中 evalTerm(rule_condition, Request) = Permit
+
    ├── when：rule级target
  
−
            ▼
+
    ├── where：condition
  
−
rule_condition term（condition和返回）
+
    └── while：rule级obligation
  
 +
(4)  obligation_term：policy级的义务，在最后执行
  
 +
    └── 使用while调用platform的函数
 
=例1：sample6=
 
=例1：sample6=
 
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/
 
来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/
−
 
−
说明：多rule合并
 
 
==原文：==
 
==原文：==
 
<syntaxhighlight lang="xml">
 
<syntaxhighlight lang="xml">
第136行： 第164行：
 
contract Sample6_RoleAccess {
 
contract Sample6_RoleAccess {
  
−
    party Platform {
+
    party Sub {
  
−
        name: String
+
        subjectId: String
  
−
        targetMatch(Request)
+
        groups: set String
  
 
    }
 
    }
第160行： 第188行：
 
    }
 
    }
  
−
    ## Type(match)
+
    addition fn {
  
−
    term policy_target: Platform must targetMatch(Request)
+
        regexpMatch(value: String, pattern: String): Boolean
  
−
        when true
+
    }
  
−
        where return Permit
+
    combineAlgorithm = first-applicable
  
 +
    ## Type(target)
  
−
    ## Type(comb)
+
    term policy_target: Platform must targetMatch(Request)
  
−
    term policy_comb: Sub can access Resource
+
    term primaryGroupEmpsRule: Sub can read Resource
−
 
 
−
        when some of(evalTerm(rule_target_1, Request),
 
−
 
 
−
                     evalTerm(rule_target_2, Request)) = Permit
 
−
 
 
−
        where return Permit
 
−
 
 
−
 
 
−
    term rule_target_1: Sub can read Resource
 
  
 
        when ATTR(Request::Act, actionId) = "read"
 
        when ATTR(Request::Act, actionId) = "read"
  
−
          and evalTerm(rule_condition_1, Request) = Permit
+
        where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}
  
−
        where return Permit
+
    term primaryUserRule: Sub can access Resource
  
−
 
+
        where ATTR(Request::Obj, resourceId) belong {
−
    term rule_condition_1:
 
−
 
 
−
        when some g in ATTR(Request::Sub, groups)
 
−
 
 
−
            such that g = "admin_emps" or g = "admin"
 
−
 
 
−
        where return Permit
 
−
 
 
−
 
 
−
    term rule_target_2: Sub can access Resource
 
−
 
 
−
        when evalTerm(rule_condition_2, Request) = Permit
 
−
 
 
−
        where return Permit
 
−
 
 
−
 
 
−
    term rule_condition_2:
 
−
 
 
−
        when ATTR(Request::Obj, resourceId) in {
 
  
 
            "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",
 
            "<nowiki>http://localhost:8280/services/Customers/getVersion1</nowiki>",
第215行： 第216行：
 
        }
 
        }
  
−
        where return Permit
+
    term denyRule: Sub cannot access Resource
  
 
}
 
}
第397行： 第398行：
 
==转换版：==
 
==转换版：==
  
 +
contract CopyrightApprove {
  
 +
    party Sub {
  
−
contract CopyrightApprove {
+
        organization: String
  
−
    party Owner {
+
        agreementId: String
−
 
 
−
        name: String
 
  
 
    }
 
    }
第409行： 第410行：
 
    party Platform {
 
    party Platform {
  
−
        name: String
+
        marking(trigger: OrderState, text: String)
  
−
        targetMatch(Request)
+
        encrypt(trigger: OrderState)
−
 
 
−
        marking(text: String)
 
−
 
 
−
        encrypt()
 
  
 
    }
 
    }
  
 
    asset Resource {
 
    asset Resource {
−
 
−
        resourceId: String
 
  
 
        copyright: Boolean
 
        copyright: Boolean
第457行： 第452行：
 
    }
 
    }
  
 +
    enum OrderState {
  
−
    ## Type(match)
+
        Permit, Deny
 +
 
 +
    }
 +
 
 +
    combineAlgorithm = deny-overrides
 +
 
 +
    ## Type(target)
  
 
    term policy_target: Platform must targetMatch(Request)
 
    term policy_target: Platform must targetMatch(Request)
第466行： 第468行：
 
          and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"
 
          and ATTR(Request::Obj, agreementType) = "<nowiki>urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</nowiki>"
  
−
        where return Permit
+
    term rightsToUse: Sub can use Resource
−
 
 
−
 
 
−
    ## Type(comb)
 
−
 
 
−
    term policy_comb: Sub can access Resource
 
−
 
 
−
        when evalTerm(rule_target, Request) = Permit
 
−
 
 
−
        where evalTerm(obligation_mark, Request)  AND evalTerm(obligation_encrypt, Request)  return Permit
 
−
 
 
−
 
 
−
    term rule_target: Sub can use Resource
 
  
 
        when ATTR(Request::Obj, ipOwner) = "Acme"
 
        when ATTR(Request::Obj, ipOwner) = "Acme"
  
−
          and evalTerm(rule_condition, Request) = Permit
+
        where ATTR(Request::Sub, organization) = "Wiley Corp"
  
−
        where return Permit
+
          and oneAndOnly(ATTR(Request::Sub, agreementId)) =
  
−
 
+
              oneAndOnly(ATTR(Request::Obj, agreementId))
−
    term rule_condition:
 
−
 
 
−
        when ATTR(Request::Sub, organization) = "Wiley Corp"
 
−
 
 
−
          and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =
 
−
 
 
−
              fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))
 
  
 
          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"
 
          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"
  
−
          and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))
+
          and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))
  
−
          and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))
+
          and now < oneAndOnly(ATTR(Request::Obj, expirationDate))
  
−
        where return Permit
+
    ## Type(obligation)
  
 +
    term policy_obligation: Platform must fulfillObligations(Request)
  
−
    term obligation_mark: Platform must marking("Copyright 2011 Acme")
+
        while marking(Permit, "Copyright 2011 Acme")
  
−
        when True
+
          and encrypt(Permit)
−
 
 
−
 
 
−
    term obligation_encrypt: Platform must encrypt()
 
−
 
 
−
       when True
 
  
 
}
 
}
−
 
 
*
 
*

2026年9月5日 (六) 10:55的最新版本

 <meta charset="utf-8" /> <meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="bb6a5ee2dfaec6abb09392096a33b2bf618e9c0e" /> <meta property="dc:modified" content="2026-09-04T19:16:40.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [1]<title>CBAC</title><base href="https://www.smartlegalcontract.cn/mediawiki/index.php/" />[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] <meta http-equiv="content-language" content="zh-cn" /> <meta http-equiv="vary" content="Accept" />

概览

更新时间：2026.9.5

将语言最简化，去除了将combination逻辑中，使用evalterm和逻辑谓词表达的方法。理由：在没有ifelse的情况下，无法表达其中某种组合逻辑。obligation的选取完全无法脱离if-else完成。

成功转换了27个从oasis官网获取的example

下一步安排：寻找一些更复杂的例子（实战，官网没更多了）（周六）

下一步安排：简单判决测试，完善例子的输入，寻找xacml执行器并进行对比，在确认正确后进行效率测试（周六）

一、基本结构

PolicySet（可选；一整套策略集，此处不转化）

│  ← 策略集组合算法（deny-overrides / permit-overrides / only-one-applicable…）（此处不转化）

└── Policy（一份策略 = 一份 SPESC 合约）

    │  ← 规则组合算法 RuleCombiningAlg（permit/deny-overrides、first-applicable、t-of-n）

    │

    ├── Target（策略级过滤器 = 匹配条款，如 no0）

    │    └── AnyOf（OR） → AllOf（AND） → Match ×n（单条匹配条件）

    │

    ├── Rule ×n（一条规则 = 一个子条款，如 no1_1~no1_4）

    │    ├── Target（规则级过滤器，可选，规则如上）

    │    ├── Condition（= when 前置条件）→ Apply（and/or/not/比较）→ 叶子（值/属性）

    │    ├── Effect（= can → Permit / cannot → Deny）

    │    └──  Obligation（可选义务；SLA 阶梯「允许但限流」的挂点）

    │

    └── Obligation


二、执行顺序：

（1）Target Term，只做资源级适用性判断，包含when逻辑并调用

（2）Authentic Term：在运行前临时进行变量赋值逻辑

    ├── when 条件

    └── while 赋值

（3）rule_term

    ├── when：rule级target

    ├── where：condition

    └── while：rule级obligation

(4) obligation_term：policy级的义务，在最后执行

    └── 使用while调用platform的函数

例1：sample6

来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" 
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Test Or</Description>
   <Target></Target>
   <Rule Effect="Permit" RuleId="primary-group-emps-rule">  
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
                  Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" 
            Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Permit" RuleId="primary-user-rule"> 
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>

逻辑结构：

Policy (组合: first-applicable)

├── Target = 空

├── Rule1 (Permit)

│ ├── Target: action-id = read

│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集

├── Rule2 (Permit)

│ ├── Target: 无

│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集

└── Rule3 (Deny) 兜底

原始请求等效json：

{
  "sub": {
    "subjectId": "anyone",
    "groups": []
  },
  "act": {
    "actionId": "read"
  },
  "obj": {
    "resourceId": "http://localhost:8280/services/Customers/getVersion1"
  }
}

转换版：

contract Sample6_RoleAccess {

    party Sub {

        subjectId: String

        groups: set String

    }

    asset Resource {

        resourceId: String

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        regexpMatch(value: String, pattern: String): Boolean

    }

    combineAlgorithm = first-applicable

    ## Type(target)

    term policy_target: Platform must targetMatch(Request)

    term primaryGroupEmpsRule: Sub can read Resource

        when ATTR(Request::Act, actionId) = "read"

        where ATTR(Request::Sub, groups) overlaps {"admin_emps", "admin"}

    term primaryUserRule: Sub can access Resource

        where ATTR(Request::Obj, resourceId) belong {

            "http://localhost:8280/services/Customers/getVersion1",

            "http://localhost:8280/services/Customers/getVersion2"

        }

    term denyRule: Sub cannot access Resource

}



例2：OASIS 3-4

来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502

语法：双target，有obligation

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="copyright-approve"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
    Version="1">
    <Description>Example copyright material policy</Description>

    <!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
    <Target>
        <AnyOf>
            <AllOf>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
                </Match>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
                </Match>
            </AllOf>
        </AnyOf>
    </Target>

    <!-- 规则级 Target：资源 ip-owner = Acme -->
    <Rule Effect="Permit" RuleId="Right to use copyrighted material match">
        <Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
        <Target>
            <AnyOf>
                <AllOf>
                    <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Match>
                </AllOf>
            </AnyOf>
        </Target>

        <!-- Condition：以下 5 个条件全部成立才 Permit -->
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <!-- ① 请求方组织 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ② 主体协议号 = 资源协议号 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ③ 资源被许可方 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ④ 当前时间 >= 生效时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ⑤ 当前时间 < 过期时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>

    <!-- Permit 时要求 PEP：加标记 + 加密 -->
    <ObligationExpressions>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
            </AttributeAssignmentExpression>
        </ObligationExpression>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
    </ObligationExpressions>
</Policy>

逻辑结构：

Policy copyright-approve (deny-overrides)

├── Target: resource:copyright = true

│           AND resource:agreement-type = urn:...:copyright-grant

└── Rule "Right to use copyrighted material match" (Permit)

|   ├── Target: resource:ip-owner = "Acme"

|   └── Condition (AND):

|       ├── subject:organization = "Wiley Corp"

|       ├── subject:agreement-id = resource:agreement-id

|       ├── resource:ip-licensee = "Wiley Corp"

|       ├── current-dateTime >= resource:effective-date

|       └── current-dateTime 小于 resource:expiration-date

└── Obligations (Permit):

    ├── marking(text = "Copyright 2011 Acme")

    └── encrypt

原始请求等效json：

 {
  "sub": {
    "organization": "Wiley Corp",
    "agreementId": "A-001"
  },
  "obj": {
    "copyright": true,
    "ipOwner": "Acme",
    "ipLicensee": "Wiley Corp",
    "agreementType": "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant",
    "agreementId": "A-001",
    "effectiveDate": "2020-01-01T00:00:00",
    "expirationDate": "2030-01-01T00:00:00"
  },
  "act": {
    "actionId": "use"
  },
  "env": {
    "currentDateTime": "2024-06-01T12:00:00"
  }
}

转换版：

contract CopyrightApprove {

    party Sub {

        organization: String

        agreementId: String

    }

    party Platform {

        marking(trigger: OrderState, text: String)

        encrypt(trigger: OrderState)

    }

    asset Resource {

        copyright: Boolean

        agreementType: String

        ipOwner: String

        ipLicensee: String

        agreementId: String

        effectiveDate: dateTime

        expirationDate: dateTime

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        oneAndOnly(x: String): String

        oneAndOnly(x: dateTime): dateTime

    }

    enum OrderState {

        Permit, Deny

    }

    combineAlgorithm = deny-overrides

    ## Type(target)

    term policy_target: Platform must targetMatch(Request)

        when ATTR(Request::Obj, copyright) = true

          and ATTR(Request::Obj, agreementType) = "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant"

    term rightsToUse: Sub can use Resource

        when ATTR(Request::Obj, ipOwner) = "Acme"

        where ATTR(Request::Sub, organization) = "Wiley Corp"

          and oneAndOnly(ATTR(Request::Sub, agreementId)) =

              oneAndOnly(ATTR(Request::Obj, agreementId))

          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"

          and now >= oneAndOnly(ATTR(Request::Obj, effectiveDate))

          and now < oneAndOnly(ATTR(Request::Obj, expirationDate))

    ## Type(obligation)

    term policy_obligation: Platform must fulfillObligations(Request)

        while marking(Permit, "Copyright 2011 Acme")

          and encrypt(Permit)

}

取自“https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&oldid=549”