CBAC

来自智能法律合约
20260503（讨论 | 贡献）2026年9月3日 (四) 02:47的版本
跳到导航 跳到搜索

<meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /> <meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [1][/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector] <meta http-equiv="content-language" content="zh-cn" /> <meta http-equiv="vary" content="Accept" /> <meta charset="utf-8" />

= <meta property="mw:pageId" content="75" /> <meta property="mw:pageNamespace" content="0" />

<meta property="mw:revisionSHA1" content="d27a609efb4570c5f98236e815818dcbb1902481" /> <meta property="dc:modified" content="2026-08-30T23:12:55.000Z" /> <meta property="mw:html:version" content="2.1.0" /> [2]总体执行[/mediawiki/load.php?modules=mediawiki.skinning.content.parsoid%7Cmediawiki.skinning.interface%7Csite.styles%7Cmediawiki.page.gallery.styles%7Cext.cite.style%7Cext.cite.styles%7Cext.pygments%7Cext.pygments&only=styles&skin=vector]顺序 =

target term

    │ 只做资源级适用性判断，不引用具体 comb

    ▼ （编译器自动按 Request::Act.actionId 查找对应 comb；  （无 comb 则找同动作 rule_target））

comb term（组合入口，针对一类动作）

    │ 在 when 中 evalTerm(rule_target, Request) = Permit

    ▼

rule_target term（动作、rule级obligation、rule级target、伴随、后置）

    │ 在 when 中 evalTerm(rule_condition, Request) = Permit

  ▼

rule_condition term（condition和返回）


例1：sample6

来源：https://is.docs.wso2.com/en/6.0.0/references/extend/access-control/xacml3-sample6/

说明：多rule合并

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17" PolicyId="testOr" 
RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:first-applicable" Version="1.0">
   <Description>Test Or</Description>
   <Target></Target>
   <Rule Effect="Permit" RuleId="primary-group-emps-rule">  
      <Target>
         <AnyOf>
            <AllOf>
               <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                  <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">read</AttributeValue>
                  <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:action:action-id" 
                  Category="urn:oasis:names:tc:xacml:3.0:attribute-category:action" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
               </Match>
            </AllOf>
         </AnyOf>
      </Target>
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="group" DataType="http://www.w3.org/2001/XMLSchema#string" 
            Category="urn:oasis:names:tc:xacml:3.0:group" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin_emps</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">admin</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Permit" RuleId="primary-user-rule"> 
      <Condition>
         <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-at-least-one-member-of">
            <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:resource:resource-id" 
            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource" DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="true"/>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-bag">
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion1</AttributeValue>
               <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">http://localhost:8280/services/Customers/getVersion2</AttributeValue>
            </Apply>
         </Apply>
      </Condition>
   </Rule>
   <Rule Effect="Deny" RuleId="deny-rule"></Rule>
</Policy>

逻辑结构：

Policy (组合: first-applicable)

├── Target = 空

├── Rule1 (Permit)

│ ├── Target: action-id = read

│ └── Condition: group 属性 (类别 group)与 {admin_emps, admin} 有交集

├── Rule2 (Permit)

│ ├── Target: 无

│ └── Condition: resource-id 与 {http://localhost:8280/services/Customers/getVersion1, http://localhost:8280/services/Customers/getVersion2} 有交集

└── Rule3 (Deny) 兜底

原始请求等效json：

{
  "sub": {
    "subjectId": "anyone",
    "groups": []
  },
  "act": {
    "actionId": "read"
  },
  "obj": {
    "resourceId": "http://localhost:8280/services/Customers/getVersion1"
  }
}

转换版：

contract Sample6_RoleAccess {

    party Platform {

        name: String

        targetMatch(Request)

    }

    asset Resource {

        resourceId: String

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    ## Type(match)

    term policy_target: Platform must targetMatch(Request)

        when true

        where return Permit


    ## Type(comb)

    term policy_comb: Sub can access Resource

        when some of(evalTerm(rule_target_1, Request),

                     evalTerm(rule_target_2, Request)) = Permit

        where return Permit


    term rule_target_1: Sub can read Resource

        when ATTR(Request::Act, actionId) = "read"

          and evalTerm(rule_condition_1, Request) = Permit

        where return Permit


    term rule_condition_1:

        when some g in ATTR(Request::Sub, groups)

            such that g = "admin_emps" or g = "admin"

        where return Permit


    term rule_target_2: Sub can access Resource

        when evalTerm(rule_condition_2, Request) = Permit

        where return Permit


    term rule_condition_2:

        when ATTR(Request::Obj, resourceId) in {

            "http://localhost:8280/services/Customers/getVersion1",

            "http://localhost:8280/services/Customers/getVersion2"

        }

        where return Permit

}



例2：OASIS 3-4

来源：https://docs.oasis-open.org/xacml/3.0/ipc/v1.0/os/xacml-3.0-ipc-v1.0-os-en.html#_Toc323564502

语法：双target，有obligation

原文：

<Policy xmlns="urn:oasis:names:tc:xacml:3.0:core:schema:wd-17"
    PolicyId="copyright-approve"
    RuleCombiningAlgId="urn:oasis:names:tc:xacml:1.0:rule-combining-algorithm:deny-overrides"
    Version="1">
    <Description>Example copyright material policy</Description>

    <!-- 策略级 Target：资源必须是 copyright=true 且协议类型为 copyright-grant -->
    <Target>
        <AnyOf>
            <AllOf>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:boolean-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#boolean">true</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:copyright"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#boolean" MustBePresent="false"/>
                </Match>
                <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:anyURI-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#anyURI">urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant</AttributeValue>
                    <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type"
                        Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                        DataType="http://www.w3.org/2001/XMLSchema#anyURI" MustBePresent="false"/>
                </Match>
            </AllOf>
        </AnyOf>
    </Target>

    <!-- 规则级 Target：资源 ip-owner = Acme -->
    <Rule Effect="Permit" RuleId="Right to use copyrighted material match">
        <Description>Allow if subject's association to the designated custodian of the copyright agrees</Description>
        <Target>
            <AnyOf>
                <AllOf>
                    <Match MatchId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                        <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Acme</AttributeValue>
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-owner"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Match>
                </AllOf>
            </AnyOf>
        </Target>

        <!-- Condition：以下 5 个条件全部成立才 Permit -->
        <Condition>
            <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:and">
                <!-- ① 请求方组织 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:organization"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ② 主体协议号 = 资源协议号 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:subject:agreement-id"
                            Category="urn:oasis:names:tc:xacml:1.0:subject-category:access-subject"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-id"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ③ 资源被许可方 = Wiley Corp -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-equal">
                    <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Wiley Corp</AttributeValue>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:string-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:ip-licensee"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#string" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ④ 当前时间 >= 生效时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-greater-than-or-equal">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:effective-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
                <!-- ⑤ 当前时间 < 过期时间 -->
                <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-less-than">
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:1.0:environment:current-dateTime"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:environment"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                    <Apply FunctionId="urn:oasis:names:tc:xacml:1.0:function:dateTime-one-and-only">
                        <AttributeDesignator AttributeId="urn:oasis:names:tc:xacml:3.0:ipc:resource:expiration-date"
                            Category="urn:oasis:names:tc:xacml:3.0:attribute-category:resource"
                            DataType="http://www.w3.org/2001/XMLSchema#dateTime" MustBePresent="false"/>
                    </Apply>
                </Apply>
            </Apply>
        </Condition>
    </Rule>

    <!-- Permit 时要求 PEP：加标记 + 加密 -->
    <ObligationExpressions>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:marking" FulfillOn="Permit">
            <AttributeAssignmentExpression AttributeId="urn:oasis:names:tc:xacml:3.0:example:attribute:text">
                <AttributeValue DataType="http://www.w3.org/2001/XMLSchema#string">Copyright 2011 Acme</AttributeValue>
            </AttributeAssignmentExpression>
        </ObligationExpression>
        <ObligationExpression ObligationId="urn:oasis:names:tc:xacml:3.0:ipc:obligation:encrypt" FulfillOn="Permit"/>
    </ObligationExpressions>
</Policy>

逻辑结构：

Policy copyright-approve (deny-overrides)

├── Target: resource:copyright = true

│           AND resource:agreement-type = urn:...:copyright-grant

└── Rule "Right to use copyrighted material match" (Permit)

|   ├── Target: resource:ip-owner = "Acme"

|   └── Condition (AND):

|       ├── subject:organization = "Wiley Corp"

|       ├── subject:agreement-id = resource:agreement-id

|       ├── resource:ip-licensee = "Wiley Corp"

|       ├── current-dateTime >= resource:effective-date

|       └── current-dateTime 小于 resource:expiration-date

└── Obligations (Permit):

    ├── marking(text = "Copyright 2011 Acme")

    └── encrypt

原始请求等效json：

 {
  "sub": {
    "organization": "Wiley Corp",
    "agreementId": "A-001"
  },
  "obj": {
    "copyright": true,
    "ipOwner": "Acme",
    "ipLicensee": "Wiley Corp",
    "agreementType": "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant",
    "agreementId": "A-001",
    "effectiveDate": "2020-01-01T00:00:00",
    "expirationDate": "2030-01-01T00:00:00"
  },
  "act": {
    "actionId": "use"
  },
  "env": {
    "currentDateTime": "2024-06-01T12:00:00"
  }
}

转换版：

contract CopyrightApprove {

    party Owner {

        name: String

    }

    party Platform {

        name: String

        targetMatch(Request)

        marking(text: String)

        encrypt()

    }

    asset Resource {

        resourceId: String

        copyright: Boolean

        agreementType: String

        ipOwner: String

        ipLicensee: String

        agreementId: String

        effectiveDate: dateTime

        expirationDate: dateTime

    }

    addition Request {

        Sub: Subject

        Obj: Resource

        Act: Action

    }

    addition fn {

        fn::string::oneAndOnly(x: String): String

        fn::dateTime::oneAndOnly(x: dateTime): dateTime

    }


    ## Type(match)

    term policy_target: Platform must targetMatch(Request)

        when ATTR(Request::Obj, copyright) = true

          and ATTR(Request::Obj, agreementType) = "urn:oasis:names:tc:xacml:3.0:ipc:resource:agreement-type:copyright-grant"

        where return Permit


    ## Type(comb)

    term policy_comb: Sub can access Resource

        when evalTerm(rule_target, Request) = Permit

        where evalTerm(obligation_mark, Request) AND evalTerm(obligation_encrypt, Request) return Permit


    term rule_target: Sub can use Resource

        when ATTR(Request::Obj, ipOwner) = "Acme"

          and evalTerm(rule_condition, Request) = Permit

        where return Permit


    term rule_condition:

        when ATTR(Request::Sub, organization) = "Wiley Corp"

          and fn::string::oneAndOnly(ATTR(Request::Sub, agreementId)) =

              fn::string::oneAndOnly(ATTR(Request::Obj, agreementId))

          and ATTR(Request::Obj, ipLicensee) = "Wiley Corp"

          and now >= fn::dateTime::oneAndOnly(ATTR(Request::Obj, effectiveDate))

          and now < fn::dateTime::oneAndOnly(ATTR(Request::Obj, expirationDate))

        where return Permit


    term obligation_mark: Platform must marking("Copyright 2011 Acme")

        when true


    term obligation_encrypt: Platform must encrypt()

        when true

}

取自“https://www.smartlegalcontract.cn/mediawiki/index.php?title=CBAC&oldid=542”