@prefix :      <https://www.w3.org/2019/wot/security#> .
@prefix schema: <http://schema.org/> .
@prefix owl:   <http://www.w3.org/2002/07/owl#> .
@prefix xsd:   <http://www.w3.org/2001/XMLSchema#> .
@prefix rdfs:  <http://www.w3.org/2000/01/rdf-schema#> .
@prefix rdf:   <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix xml:   <http://www.w3.org/XML/1998/namespace> .
@prefix dcterms: <http://purl.org/dc/terms/> .
@prefix vann:  <http://purl.org/vocab/vann/> .
@prefix vs:    <http://www.w3.org/2003/06/sw-vocab-status/ns#> .
@prefix prov:  <http://www.w3.org/ns/prov#> .
@prefix foaf:  <http://xmlns.com/foaf/0.1/> .
@prefix dc:    <http://purl.org/dc/elements/1.1/> .

:authorization  a              owl:ObjectProperty ;
        rdfs:comment           "URI of the authorization server."@en ;
        rdfs:label             "authorization" ;
        schema:domainIncludes  :OAuth2SecurityScheme , :PoPSecurityScheme , :BearerSecurityScheme .

:in     a                      owl:DatatypeProperty ;
        rdfs:comment           "Specifies the location of security authentication information."@en ;
        rdfs:label             "in" ;
        schema:domainIncludes  :PoPSecurityScheme , :BearerSecurityScheme , :APIKeySecurityScheme , :DigestSecurityScheme , :BasicSecurityScheme .

:BasicSecurityScheme  a  owl:Class , rdfs:Class ;
        rdfs:comment     "Basic authentication security configuration identified by the term <code>basic</code> (i.e., <code>\"scheme\": \"basic\"</code>), using an unencrypted username and password.  This scheme should be used with some other security mechanism providing confidentiality, for example, TLS."@en ;
        rdfs:label       "BasicSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:SecurityScheme  a    owl:Class , rdfs:Class ;
        rdfs:comment  "Metadata describing the configuration of a security mechanism.  <span class=\"rfc2119-assertion\" id=\"td-security-scheme-name\">The value assigned to the name <code>scheme</code> MUST be defined within a vocabulary included in the Thing Description, either in the present vocabulary or in a TD context extension." ;
        rdfs:label    "SecurityScheme" .

:PoPSecurityScheme  a    owl:Class , rdfs:Class ;
        rdfs:comment     "Proof-of-possession (PoP) token authentication security configuration identified by the term <code>pop</code> (i.e., <code>\"scheme\": \"pop\"</code>). Here <code>jwt</code> indicates conformance with !RFC7519, <code>jws</code> indicates conformance with !RFC7797, <code>cwt</code> indicates conformance with !RFC8392, and <code>jwe</code> indicates conformance with RFC7516, with values for <code>alg</code> interpreted consistently with those standards. <span class=\"rfc2119-assertion\" id=\"td-security-pop-format-extensions\">Other formats and algorithms for PoP tokens MAY be specified in vocabulary extensions.</span>" ;
        rdfs:label       "PoPSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:format  a                     owl:DatatypeProperty ;
        rdfs:comment           "Specifies format of security authentication information."@en ;
        rdfs:label             "format" ;
        schema:domainIncludes  :PoPSecurityScheme , :BearerSecurityScheme .

:scopes  a                     owl:DatatypeProperty ;
        rdfs:comment           "Set of authorization scope identifiers provided as an array.  These are provided in tokens returned by an authorization server and associated with forms in order to identify what resources a client may access and how.  The values associated with a form should be chosen from those defined in an <code>OAuth2SecurityScheme</code> active on that form.  <br/>This feature is at risk."@en ;
        rdfs:label             "scopes" ;
        schema:domainIncludes  :OAuth2SecurityScheme .

:CertSecurityScheme  a   owl:Class , rdfs:Class ;
        rdfs:comment     "Certificate-based asymmetric key security configuration conformant with X509V3 identified by the term <code>cert</code> (i.e., <code>\"scheme\": \"cert\"</code>)." ;
        rdfs:label       "CertSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:       a                              owl:Ontology ;
        dc:title                       "Security mechanisms for the Web of Things"@en ;
        dcterms:contributor            <https://vcharpenay.link/#me> ;
        dcterms:creator                <mailto:michael.mccool@intel.com> ;
        dcterms:license                <http://purl.org/NET/rdflicense/cc-by4.0> ;
        vann:preferredNamespacePrefix  "wotsec" ;
        vann:preferredNamespaceUri     "https://www.w3.org/2019/wot/security#" ;
        owl:versionInfo                "0.0.1" .

:qop    a                      owl:DatatypeProperty ;
        rdfs:comment           "Quality of protection.  <br/>This feature is at risk." ;
        rdfs:label             "qop" ;
        schema:domainIncludes  :DigestSecurityScheme .

:alg    a                      owl:DatatypeProperty ;
        rdfs:comment           "Encoding, encryption, or digest algorithm."@en ;
        rdfs:label             "alg" ;
        schema:domainIncludes  :PoPSecurityScheme , :BearerSecurityScheme .

:DigestSecurityScheme
        a                owl:Class , rdfs:Class ;
        rdfs:comment     "Digest authentication security configuration identified by the term <code>digest</code> (i.e., <code>\"scheme\": \"digest\"</code>). This scheme is similar to basic authentication but with added features to avoid man-in-the-middle attacks." ;
        rdfs:label       "DigestSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:APIKeySecurityScheme
        a                owl:Class , rdfs:Class ;
        rdfs:comment     "API key authentication security configuration identified by the term <code>apikey</code> (i.e., <code>\"scheme\": \"apikey\"</code>).  This is for the case where the access token is opaque and is not using a standard token format."@en ;
        rdfs:label       "APIKeySecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:refresh  a                    owl:ObjectProperty ;
        rdfs:comment           "URI of the refresh server."@en ;
        rdfs:label             "refresh" ;
        schema:domainIncludes  :OAuth2SecurityScheme .

:token  a                      owl:ObjectProperty ;
        rdfs:comment           "URI of the token server."@en ;
        rdfs:label             "token" ;
        schema:domainIncludes  :OAuth2SecurityScheme .

:name   a                      owl:DatatypeProperty ;
        rdfs:comment           "Name for query, header, or cookie parameters." ;
        rdfs:label             "name" ;
        schema:domainIncludes  :PoPSecurityScheme , :BearerSecurityScheme , :APIKeySecurityScheme , :DigestSecurityScheme , :BasicSecurityScheme .

:proxy  a                      owl:ObjectProperty ;
        rdfs:comment           "URI of the proxy server this security configuration provides access to.  If not given, the corresponding security configuration is for the endpoint.  <br/>This feature is at risk."@en ;
        rdfs:label             "proxy" ;
        schema:domainIncludes  :SecurityScheme .

:OAuth2SecurityScheme
        a                owl:Class , rdfs:Class ;
        rdfs:comment     "OAuth2 authentication security configuration for systems conformant with !RFC6749 and !RFC8252, identified by the term <code>oauth2</code> (i.e., <code>\"scheme\": \"oauth2\"</code>).  <span class=\"rfc2119-assertion\" id=\"td-security-oauth2-implicit-flow\">For the <code>implicit</code> flow <code>authorization</code> MUST be included.</span>  <span class=\"rfc2119-assertion\" id=\"td-security-oauth2-password-client-flow\">For the <code>password</code> and <code>client</code> flows <code>token</code> MUST be included.</span>  <span class=\"rfc2119-assertion\" id=\"td-security-oauth2-code-flow\">For the <code>code</code> flow both <code>authorization</code> and <code>token</code> MUST be included.</span>  If no <code>scopes</code> are defined in the <code>SecurityScheme</code> then they are considered to be empty."@en ;
        rdfs:label       "OAuth2SecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:flow   a                      owl:DatatypeProperty ;
        rdfs:comment           "Authorization flow."@en ;
        rdfs:label             "flow" ;
        schema:domainIncludes  :OAuth2SecurityScheme .

:NoSecurityScheme  a     owl:Class , rdfs:Class ;
        rdfs:comment     "A security configuration corresponding to identified by the term <code>nosec</code> (i.e., <code>\"scheme\": \"nosec\"</code>), indicating there is no authentication or other mechanism required to access the resource."@en ;
        rdfs:label       "NoSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:identity  a                   owl:DatatypeProperty ;
        rdfs:comment           "Identifier providing information which can be used for selection or confirmation." ;
        rdfs:label             "identity" ;
        schema:domainIncludes  :PublicSecurityScheme , :PSKSecurityScheme , :CertSecurityScheme .

:BearerSecurityScheme
        a                owl:Class , rdfs:Class ;
        rdfs:comment     "Bearer token authentication security configuration identified by the term <code>bearer</code> (i.e., <code>\"scheme\": \"bearer\"</code>).  This scheme is intended for situations where bearer tokens are used independently of OAuth2.  If the <code>oauth2</code> scheme is specified it is not generally necessary to specify this scheme as well as it is implied.  For <code>format</code>, the value <code>jwt</code> indicates conformance with RFC7519, <code>jws</code> indicates conformance with RFC7797, <code>cwt</code> indicates conformance with RFC8392, and <code>jwe</code> indicates conformance with !RFC7516, with values for <code>alg</code> interpreted consistently with those standards. <span class=\"rfc2119-assertion\" id=\"td-security-bearer-format-extensions\">Other formats and algorithms for bearer tokens MAY be specified in vocabulary extensions.</span>" ;
        rdfs:label       "BearerSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:PSKSecurityScheme  a    owl:Class , rdfs:Class ;
        rdfs:comment     "Pre-shared key authentication security configuration identified by the term <code>psk</code> (i.e., <code>\"scheme\": \"psk\"</code>)." ;
        rdfs:label       "PSKSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .

:PublicSecurityScheme
        a                owl:Class , rdfs:Class ;
        rdfs:comment     "Raw public key asymmetric key security configuration identified by the term <code>public</code> (i.e., <code>\"scheme\": \"public\"</code>)." ;
        rdfs:label       "PublicSecurityScheme" ;
        rdfs:subClassOf  :SecurityScheme .