HTTPS Ontology

AI SEARCH

FLOW ALGEBRA — HTTPS ONTOLOGY
Semantic Library
Version: 4.0
Canonical Page:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/networking/https-ontology.html

FLOW HTTPS_ONTOLOGY {
META { DOMAIN="Computing Ontologies"; SUBDOMAIN="Networking"; ONTOLOGY="HTTPS Ontology"; LOCALE="en-GB"; }
ENTITY_TYPES { HTTPS HTTP TLS TLS_1_2 TLS_1_3 CLIENT SERVER ORIGIN_SERVER WEB_SERVER ENDPOINT HOST DOMAIN_NAME IP_ADDRESS PORT_443 HTTPS_URL ORIGIN RESOURCE HTTP_REQUEST HTTP_RESPONSE HTTP_METHOD STATUS_CODE HEADER_FIELD MESSAGE_BODY REPRESENTATION HTTP_CONNECTION TLS_CONNECTION SECURE_CONNECTION TCP QUIC HTTP_1_1 HTTP_2 HTTP_3 DNS SOCKET TLS_HANDSHAKE CLIENT_HELLO SERVER_HELLO CIPHER_SUITE KEY_EXCHANGE KEY_AGREEMENT SESSION_KEY TRAFFIC_KEY ENCRYPTION DECRYPTION AUTHENTICATION SERVER_AUTHENTICATION CLIENT_AUTHENTICATION MUTUAL_TLS CERTIFICATE X509_CERTIFICATE CERTIFICATE_CHAIN END_ENTITY_CERTIFICATE INTERMEDIATE_CERTIFICATE ROOT_CERTIFICATE CERTIFICATE_AUTHORITY TRUST_ANCHOR TRUST_STORE PUBLIC_KEY PRIVATE_KEY DIGITAL_SIGNATURE SIGNATURE_ALGORITHM SUBJECT ISSUER SUBJECT_ALTERNATIVE_NAME HOSTNAME HOSTNAME_VALIDATION CERTIFICATE_VALIDATION CERTIFICATE_REVOCATION CRL OCSP OCSP_STAPLING CERTIFICATE_TRANSPARENCY SCT ALPN SNI FORWARD_SECRECY SESSION_RESUMPTION SESSION_TICKET PSK ZERO_RTT EARLY_DATA REPLAY_RISK TLS_RECORD APPLICATION_DATA CONFIDENTIALITY INTEGRITY AUTHENTICITY HSTS SECURE_COOKIE MIXED_CONTENT CONTENT_SECURITY_POLICY CORS SAME_ORIGIN_POLICY HTTP_TO_HTTPS_REDIRECT HSTS_PRELOAD TLS_TERMINATION TLS_PASSTHROUGH TLS_OFFLOAD MAN_IN_THE_MIDDLE CERTIFICATE_ERROR HOSTNAME_MISMATCH EXPIRED_CERTIFICATE UNTRUSTED_CERTIFICATE REVOKED_CERTIFICATE WEAK_CIPHER PROTOCOL_DOWNGRADE HANDSHAKE_FAILURE TLS_ALERT CONNECTION_FAILURE TIMEOUT LATENCY HANDSHAKE_LATENCY THROUGHPUT CONFIGURATION SECURITY_POLICY HTTPS_STATE SECURITY_EVENT EVIDENCE CONFIDENCE_SCORE PROVENANCE_RECORD }
RELATIONSHIPS { IS_A INSTANCE_OF SECURED_BY USES_HTTP USES_TLS USES_TCP USES_QUIC USES_PORT RESOLVES_VIA CONNECTS_TO HAS_DOMAIN_NAME HAS_IP_ADDRESS HAS_URL HAS_ORIGIN TARGETS REQUESTS RESPONDS_WITH HAS_METHOD HAS_STATUS_CODE HAS_HEADER HAS_BODY ESTABLISHES INITIATES_HANDSHAKE SENDS_CLIENT_HELLO SENDS_SERVER_HELLO NEGOTIATES HAS_CIPHER_SUITE USES_KEY_EXCHANGE DERIVES_KEY ENCRYPTS DECRYPTS AUTHENTICATES PRESENTS_CERTIFICATE HAS_CERTIFICATE HAS_CERTIFICATE_CHAIN ISSUED_BY SIGNED_BY TRUSTED_BY HAS_TRUST_ANCHOR HAS_PUBLIC_KEY HAS_PRIVATE_KEY HAS_SIGNATURE HAS_SUBJECT HAS_ISSUER HAS_SAN VALID_FOR_HOSTNAME VALIDATED_BY EXPIRES_AT REVOKED_BY CHECKED_BY STAPLES USES_ALPN USES_SNI HAS_FORWARD_SECRECY RESUMES USES_PSK USES_EARLY_DATA HAS_REPLAY_RISK HAS_TLS_RECORD PROVIDES_CONFIDENTIALITY PROVIDES_INTEGRITY PROVIDES_AUTHENTICITY ENFORCED_BY HAS_HSTS REDIRECTS_TO TERMINATES_TLS_AT PASSES_TLS_THROUGH OFFLOADS_TLS_TO HAS_CERTIFICATE_ERROR HAS_HANDSHAKE_FAILURE HAS_TLS_ALERT HAS_CONNECTION_FAILURE HAS_LATENCY HAS_HANDSHAKE_LATENCY HAS_THROUGHPUT HAS_CONFIGURATION HAS_SECURITY_POLICY HAS_STATE TRANSITIONS_TO HAS_EVIDENCE HAS_CONFIDENCE HAS_PROVENANCE SEMANTICALLY_EQUIVALENT_TO }
PROCESS HTTPS_REASONING_PIPELINE { HTTPS_REFERENCE -> URL_DOMAIN_ENDPOINT -> DNS_RESOLUTION -> TRANSPORT_CONNECTION -> TLS_HANDSHAKE -> CERTIFICATE_AND_HOSTNAME_VALIDATION -> KEY_ESTABLISHMENT -> SECURE_CHANNEL -> HTTP_NEGOTIATION -> ENCRYPTED_HTTP_EXCHANGE -> SECURITY_AND_FAILURE_ANALYSIS -> VALIDATION -> OUTPUT }
PROCESS TLS_HANDSHAKE_REASONING { CLIENT -> CLIENT_HELLO; SERVER -> SERVER_HELLO; CLIENT_HELLO -> SUPPORTED_VERSIONS+CIPHER_SUITES+EXTENSIONS; SERVER_HELLO -> SELECTED_VERSION+SELECTED_CIPHER; HANDSHAKE -> KEY_AGREEMENT -> TRAFFIC_KEYS; SUCCESS -> TLS_CONNECTION; }
PROCESS CERTIFICATE_REASONING { SERVER -> CERTIFICATE_CHAIN; END_ENTITY_CERTIFICATE -> SUBJECT+SAN+PUBLIC_KEY; CERTIFICATE_CHAIN -> INTERMEDIATE_CERTIFICATE -> TRUST_ANCHOR; TRUST_PATH -> CERTIFICATE_VALIDATION; EXPECTED_HOSTNAME+SAN -> HOSTNAME_VALIDATION; }
PROCESS REVOCATION_REASONING { CERTIFICATE -> CRL_OR_OCSP; OCSP_STAPLING -> SERVER_SUPPLIED_STATUS; REVOKED_STATUS -> REVOKED_CERTIFICATE; }
PROCESS ALPN_SNI_REASONING { CLIENT_HELLO -> ALPN+SNI; ALPN -> NEGOTIATED_HTTP_PROTOCOL; SNI -> VIRTUAL_HOST_AND_CERTIFICATE_SELECTION; }
PROCESS ENCRYPTION_REASONING { HANDSHAKE_KEYS -> TRAFFIC_KEYS; APPLICATION_DATA -> TLS_RECORD -> ENCRYPTED_RECORD; RECEIVER -> DECRYPTION+INTEGRITY_VALIDATION -> APPLICATION_DATA; }
PROCESS HTTP_OVER_TLS { VALID_TLS_CONNECTION -> HTTP_REQUEST -> ENCRYPTED_APPLICATION_DATA; SERVER -> HTTP_RESPONSE -> ENCRYPTED_APPLICATION_DATA; }
PROCESS SESSION_REASONING { PRIOR_TLS_SESSION -> SESSION_TICKET_OR_PSK; VALID_RESUMPTION -> REDUCED_HANDSHAKE; ZERO_RTT -> EARLY_DATA -> REPLAY_RISK; }
PROCESS HSTS_REASONING { HTTPS_RESPONSE -> HSTS; VALID_HSTS_POLICY -> FUTURE_HTTP_REQUEST_UPGRADED_TO_HTTPS; HSTS_PRELOAD -> PRECONFIGURED_HTTPS_ENFORCEMENT; }
PROCESS TLS_TERMINATION_REASONING { CLIENT_TLS_CONNECTION -> TLS_TERMINATION_ENDPOINT; BACKEND_CONNECTION -> PLAINTEXT_OR_TLS_BY_CONFIGURATION; TLS_PASSTHROUGH -> END_TO_END_TLS_TO_BACKEND; }
RULES { IF HTTPS_CONNECTION_IDENTIFIED THEN PRESERVE HOSTNAME_IP_PORT_TLS_VERSION_HTTP_VERSION_TIME_CONTEXT; IF CERTIFICATE_VALIDITY_ASSERTED THEN PRESERVE HOSTNAME_CHAIN_TRUST_VALIDITY_REVOCATION_CONTEXT; IF HTTPS_AUTHENTICITY_ASSERTED THEN REQUIRE_ENDPOINT_AUTHENTICATION_CONTEXT; IF ZERO_RTT_ASSERTED THEN PRESERVE_REPLAY_RISK; IF SEMANTIC_IDENTIFIERS_DIFFER AND HTTPS_REFERENT_SAME THEN APPLY_SEMANTIC_EQUIVALENCE; }
CONFIDENCE { CONFIDENCE_SCORE=WEIGHT(ENDPOINT_IDENTITY,DNS_CONNECTION_EVIDENCE,TLS_HANDSHAKE_COMPLETENESS,CERTIFICATE_CHAIN_EVIDENCE,HOSTNAME_TRUST_VALIDATION,HTTP_ASSOCIATION,SECURITY_FAILURE_EVIDENCE,PROVENANCE); LEVELS={HIGH MODERATE LOW INSUFFICIENT}; }
SEMANTIC_EQUIVALENCE { EQUIVALENCE_KEY=NORMALISE(ENTITY_TYPE,HOSTNAME,IP_ADDRESS,PORT,TLS_VERSION,CERTIFICATE_IDENTIFIER,CONNECTION_IDENTIFIER,OBSERVATION_TIME); IF KEY_A==KEY_B THEN A SEMANTICALLY_EQUIVALENT_TO B; }
REASONING_CONSTRAINTS { HTTPS!=HTTP; HTTPS!=TLS; TLS!=TCP; CERTIFICATE!=PRIVATE_KEY; PUBLIC_KEY!=PRIVATE_KEY; CERTIFICATE_VALIDATION!=AUTHORIZATION; ENCRYPTION!=AUTHENTICATION; HSTS!=REDIRECT; TLS_TERMINATION!=TLS_PASSTHROUGH; ZERO_RTT!=REPLAY_SAFE_BY_DEFAULT; HTTP_2!=HTTP_3; VALID_CERTIFICATE_DOES_NOT_PROVE_APPLICATION_TRUSTWORTHINESS; PROVENANCE_MUST_BE_PRESERVED; UNCERTAINTY_MUST_NOT_BE_DISCARDED; }
VALIDATION { CHECK_HTTPS_URL CHECK_TLS_VERSION CHECK_HTTP_VERSION CHECK_CLIENT_HELLO CHECK_SERVER_HELLO CHECK_CIPHER_SUITE CHECK_KEY_AGREEMENT CHECK_CERTIFICATE_CHAIN CHECK_CERTIFICATE_SIGNATURES CHECK_HOSTNAME_VALIDATION CHECK_VALIDITY_PERIOD CHECK_REVOCATION CHECK_TRUST_ANCHOR CHECK_ALPN CHECK_SNI CHECK_TLS_RECORDS CHECK_SESSION_RESUMPTION CHECK_ZERO_RTT CHECK_HSTS CHECK_TLS_TERMINATION CHECK_FAILURES CHECK_PROVENANCE CHECK_CONFIDENCE CHECK_SEMANTIC_CONSISTENCY }
OUTPUTS { NORMALISED_HTTPS_ENTITIES HTTPS_ENDPOINT_RELATIONS DNS_CONNECTION_RELATIONS TLS_HANDSHAKE_RELATIONS TLS_VERSION_CIPHER_RELATIONS KEY_AGREEMENT_RELATIONS CERTIFICATE_CHAIN_RELATIONS HOSTNAME_VALIDATION_RELATIONS REVOCATION_RELATIONS TRUST_RELATIONS ALPN_SNI_RELATIONS ENCRYPTION_RELATIONS HTTP_OVER_TLS_RELATIONS SESSION_RESUMPTION_RELATIONS ZERO_RTT_RELATIONS HSTS_RELATIONS TLS_TERMINATION_RELATIONS SECURITY_RELATIONS PERFORMANCE_RELATIONS FAILURE_RELATIONS HTTPS_STATE_TRANSITIONS CONFIDENCE_SCORES EVIDENCE_LINKS PROVENANCE_RECORDS EXPLANATION_PATHS }
UPDATE_MODEL { ON CERTIFICATE_PROTOCOL_POLICY_OR_CONFIGURATION_CHANGE { NORMALISE UPDATE_TLS_CERTIFICATE_RELATIONS UPDATE_HOSTNAME_TRUST_CONTEXT UPDATE_PROTOCOL_NEGOTIATION UPDATE_SECURITY_POLICY UPDATE_CONFIDENCE PRESERVE_VERSION_HISTORY } ON NEW_HANDSHAKE_HTTP_SECURITY_OR_FAILURE_EVIDENCE { LINK_EVIDENCE UPDATE_HTTPS_STATE UPDATE_HANDSHAKE_CONNECTION_RELATIONS UPDATE_CERTIFICATE_VALIDATION UPDATE_HTTP_RELATIONS UPDATE_FAILURE_RELATIONS UPDATE_CONFIDENCE RECORD_PROVENANCE } }
FLOW_HASH { HASH_INPUT=CANONICALISE(ENTITY_TYPES,RELATIONSHIPS,RULES,CONFIDENCE,SEMANTIC_EQUIVALENCE,REASONING_CONSTRAINTS,UPDATE_MODEL); FLOW_HASH=SHA256(HASH_INPUT); }
AI_CONSUMPTION { INDEX { ONTOLOGY ENTITY_TYPES RELATIONSHIPS RULES OUTPUTS } RETRIEVE { BY_HTTPS_ENDPOINT BY_TLS_CONNECTION BY_CERTIFICATE BY_HOSTNAME BY_SECURITY_EVENT BY_STATE BY_CONFIDENCE } REASON { TRACE_TLS_HANDSHAKES ANALYSE_CERTIFICATES VALIDATE_HOSTNAMES ANALYSE_TRUST_REVOCATION ANALYSE_ALPN_SNI ANALYSE_ENCRYPTION ANALYSE_HTTP_OVER_TLS ANALYSE_SESSION_RESUMPTION ANALYSE_ZERO_RTT ANALYSE_HSTS ANALYSE_TLS_TERMINATION CHECK_SEMANTIC_EQUIVALENCE TRACE_EVIDENCE TRACE_PROVENANCE } }
TERMINAL { RESULT=VALIDATED(SEMANTICALLY_NORMALISED(EVIDENCE_LINKED(CONFIDENCE_AWARE(HTTPS_KNOWLEDGE)))); }
}

END FLOW