Encryption Metadata Ontology

FLOW ALGEBRA

Ontology: Encryption Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/encryption-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "EncryptionMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: EncryptionMetadata
  purpose:
    - represent encryption state, algorithms, keys, scopes, operations, policies, and validation
    - preserve encrypted-resource identity, cryptographic configuration, key references, events, validity, confidence, and provenance
    - support encryption at rest, in transit, field-level encryption, object encryption, database encryption, backups, archives, and secure communications
    - distinguish encryption from hashing, encoding, digital signatures, access control, and complete confidentiality
    - enable machine-readable reasoning over encryption lifecycles

# ---------- CORE ----------
entity EncryptionMetadata:
  type: SecurityMetadata
  describes: EncryptionState
  may_include:
    - encryption_identifier
    - resource_identifier
    - resource_version
    - encryption_state
    - encryption_scope
    - encryption_algorithm
    - cipher_mode
    - key_reference
    - key_type
    - key_length
    - initialisation_vector_metadata
    - nonce_metadata
    - authenticated_encryption
    - encryption_time
    - encryption_agent
    - key_management_reference
    - validity
    - confidence
    - provenance

entity EncryptionState:
  type: CryptographicState

entity EncryptedResource:
  type: SecuredResource

relationships:
  EncryptionMetadata -> DESCRIBES -> EncryptionState
  EncryptionState -> APPLIES_TO -> EncryptedResource
  EncryptionState -> USES -> EncryptionAlgorithm
  EncryptionState -> MAY_USE_MODE -> CipherMode
  EncryptionState -> REFERENCES_KEY -> EncryptionKeyReference
  EncryptionState -> MAY_USE_IV -> InitialisationVectorMetadata
  EncryptionState -> MAY_USE_NONCE -> NonceMetadata
  EncryptionState -> MAY_BE_CREATED_BY -> EncryptionEvent
  EncryptionState -> MAY_BE_REMOVED_BY -> DecryptionEvent
  EncryptionMetadata -> MAY_REFERENCE -> KeyManagementMetadata
  EncryptionMetadata -> MAY_HAVE_PROVENANCE -> EncryptionProvenance

# ---------- RESOURCE / STATE ----------
rule resource:
  EncryptedResource SHOULD preserve stable resource identifier and version

rule ciphertext_identity:
  ciphertext != plaintext resource identity

encryption_states:
  - encrypted
  - partially_encrypted
  - decrypted
  - encryption_pending
  - decryption_pending
  - failed
  - unknown

rule encrypted_claim:
  claimed encrypted state != verified encryption state
  without supporting evidence

# ---------- SCOPE ----------
entity EncryptionScope:
  type: ScopeMetadata
  may_include:
    - complete_resource
    - file
    - volume
    - disk
    - database
    - table
    - column
    - field
    - object
    - message
    - transport_session
    - backup
    - archive
    - byte_range

rule scope:
  encryption protection applies only to declared scope

rule partial:
  partial encryption != complete-resource encryption

# ---------- ALGORITHMS ----------
entity EncryptionAlgorithm:
  type: CryptographicAlgorithmMetadata
  may_include:
    - algorithm_name
    - algorithm_family
    - key_size
    - mode
    - specification
    - security_status

algorithm_families:
  - symmetric
  - asymmetric
  - hybrid
  - implementation_specific

rule algorithm:
  encryption algorithm SHOULD be explicit

rule algorithm_name:
  algorithm name alone != secure cryptographic configuration

entity SymmetricEncryption:
  type: EncryptionAlgorithm

entity AsymmetricEncryption:
  type: EncryptionAlgorithm

entity HybridEncryption:
  type: EncryptionMethod

rule private_key:
  private decryption key SHOULD NOT be exposed
  in general encryption metadata

# ---------- CIPHER MODE / AEAD ----------
entity CipherMode:
  type: CryptographicConfiguration
  may_be:
    - GCM
    - CCM
    - CTR
    - CBC
    - XTS
    - implementation_specific

rule mode:
  cipher mode SHOULD be preserved where security semantics depend on it

entity AuthenticatedEncryption:
  type: EncryptionMethod
  may_include:
    - encryption_algorithm
    - authentication_tag
    - associated_data
    - nonce

rule AEAD:
  authenticated encryption MAY provide confidentiality and integrity
  within algorithm and validation assumptions

rule tag:
  authentication tag != digital signature

# ---------- KEY METADATA ----------
entity EncryptionKeyReference:
  type: KeyMetadata
  may_include:
    - key_identifier
    - key_type
    - key_length
    - key_status
    - key_version
    - key_management_system

key_status:
  - active
  - inactive
  - expired
  - revoked
  - compromised
  - destroyed
  - unknown

rule key_reference:
  metadata SHOULD reference key identity
  without exposing secret key material

entity KeyManagementMetadata:
  type: SecurityMetadata
  may_include:
    - key_identifier
    - key_version
    - generation_time
    - activation_time
    - expiry_time
    - rotation_time
    - revocation_time
    - destruction_time
    - custodian
    - storage_system
    - policy

rule key_lifecycle:
  encryption metadata SHOULD preserve relevant key lifecycle context

rule destroyed_key:
  destroyed decryption key MAY render ciphertext unrecoverable

# ---------- KEY ROTATION / NONCE / IV ----------
entity KeyRotationEvent:
  type: SecurityEvent
  may_include:
    - old_key_reference
    - new_key_reference
    - affected_resources
    - rotation_time
    - re_encryption_state

rule rotation:
  key rotation != automatic re-encryption

entity InitialisationVectorMetadata:
  type: CryptographicMetadata
  may_include:
    - value_reference
    - length
    - generation_method

entity NonceMetadata:
  type: CryptographicMetadata
  may_include:
    - value_reference
    - length
    - uniqueness_context

rule nonce:
  nonce requirements depend on encryption algorithm and mode

rule nonce_reuse:
  unsafe nonce reuse MAY undermine encryption security
  for affected algorithms

# ---------- EVENTS ----------
entity EncryptionEvent:
  type: SecurityEvent
  may_include:
    - event_identifier
    - resource
    - resource_version
    - algorithm
    - mode
    - key_reference
    - scope
    - event_time
    - agent
    - tool
    - result

entity DecryptionEvent:
  type: SecurityEvent
  may_include:
    - event_identifier
    - encrypted_resource
    - key_reference
    - decryption_time
    - agent
    - result
    - output_resource

rule encryption_event:
  EncryptionEvent SHOULD preserve algorithm, key reference, scope, time, and result

rule decryption:
  successful decryption != authorisation to access plaintext

# ---------- ENCRYPTION CONTEXTS ----------
entity EncryptionAtRest:
  type: EncryptionContext

entity EncryptionInTransit:
  type: EncryptionContext

entity FieldLevelEncryption:
  type: EncryptionContext

entity DatabaseEncryption:
  type: EncryptionContext

entity BackupEncryption:
  type: EncryptionContext

entity EnvelopeEncryption:
  type: HybridEncryption
  may_include:
    - data_encryption_key_reference
    - key_encryption_key_reference
    - wrapped_key
    - wrapping_algorithm

rule at_rest:
  encryption at rest protects stored data within declared context

rule in_transit:
  transport encryption != encryption at rest

rule field:
  field-level encryption != full-dataset encryption

rule backup:
  encrypted backup requires valid decryption capability for restoration

rule envelope:
  data-encryption key and key-encryption key roles SHOULD remain distinct

# ---------- KEY WRAPPING ----------
entity KeyWrappingMetadata:
  type: CryptographicMetadata
  may_include:
    - wrapped_key_identifier
    - wrapping_key_identifier
    - wrapping_algorithm
    - wrap_time

rule wrapping:
  key wrapping != content encryption

# ---------- CRITICAL DISTINCTIONS ----------
rule encoding:
  encryption != encoding

rule base64:
  Base64 representation != encryption

rule hashing:
  encryption != hashing

rule signature:
  encryption != digital signature

rule access_control:
  encryption != authorisation

rule authorised_decryption:
  possession of decryption capability != policy authorisation
  unless access policy grants it

# ---------- CONFIDENTIALITY / INTEGRITY ----------
entity EncryptionConfidentialityAssessment:
  type: SecurityAssessment
  may_include:
    - algorithm_strength
    - key_strength
    - key_management_state
    - scope
    - implementation_state
    - threat_context
    - assessment_time

rule confidentiality:
  encryption MAY support confidentiality
  but complete confidentiality depends on implementation, keys, endpoints, and scope

rule integrity:
  unauthenticated encryption does_not necessarily provide integrity protection

# ---------- VALIDITY / RISK ----------
entity EncryptionValidity:
  type: ValidityMetadata
  may_include:
    - valid_from
    - valid_until
    - algorithm_status
    - key_status
    - policy_version

entity EncryptionRisk:
  type: RiskMetadata
  may_include:
    - weak_algorithm
    - weak_key
    - compromised_key
    - expired_key
    - unsafe_mode
    - nonce_reuse
    - incomplete_scope
    - missing_key_backup
    - implementation_error
    - risk_level
    - assessment_time

rule risk:
  EncryptionRisk SHOULD preserve evidence and assessment time

# ---------- CONFIDENCE / PROVENANCE ----------
entity EncryptionConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity EncryptionProvenance:
  type: ProvenanceMetadata
  may_include:
    - resource
    - resource_version
    - encryption_event
    - decryption_events
    - algorithm
    - mode
    - key_reference
    - key_version
    - key_rotation_events
    - policy
    - agents
    - tools

rule provenance:
  EncryptionMetadata SHOULD preserve cryptographic lifecycle history
  without exposing secret key material

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_encrypted_resource
    - encryption_state

  reject:
    - plaintext_secret_key_in_general_metadata
    - encryption_claim_without_scope_or_evidence
    - algorithm_name_presented_as_secure_configuration
    - partial_encryption_presented_as_complete_resource_encryption
    - encryption_presented_as_hashing
    - encoding_presented_as_encryption
    - encryption_presented_as_digital_signature
    - encryption_presented_as_authorisation
    - decryption_capability_presented_as_access_permission
    - authenticated_encryption_tag_presented_as_digital_signature

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "encryption metadata" ~= "metadata describing cryptographic encryption state and configuration"
  "data encryption" ~= "cryptographic transformation of plaintext into ciphertext"
  "encryption at rest" ~= "encryption protecting stored data"
  "encryption in transit" ~= "encryption protecting data during communication"
  "field-level encryption" ~= "encryption applied to selected data fields"
  "envelope encryption" ~= "content encryption combined with protected content-key wrapping"

  PRESERVE distinctions:
    plaintext != ciphertext
    encryption != hashing
    encryption != encoding
    encryption != digital_signature
    encryption != authorisation
    encryption_at_rest != encryption_in_transit
    field_encryption != complete_resource_encryption
    key_wrapping != content_encryption
    authentication_tag != digital_signature
    decryption_capability != access_permission
    algorithm_name != secure_configuration
    encrypted_state != complete_confidentiality

# ---------- CONFIDENCE MODEL ----------
CONFIDENCE:
  explicit_encryption_metadata:
    score: 1.00
  verified_encryption_state:
    score: 0.99
  explicit_algorithm_mode_and_key_reference:
    score: 0.99
  validated_authenticated_encryption:
    score: 0.99
  verified_key_management_context:
    score: 0.98
  algorithm_name_only:
    score: <= 0.70
  claimed_encryption_without_verification:
    score: <= 0.65
  unknown_key_status:
    score: <= 0.60
  incomplete_encryption_provenance:
    score: <= 0.55
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_encryption:
    - identify resource and version
    - define encryption scope
    - record algorithm and mode
    - reference key identifier and version
    - record nonce or IV metadata where applicable
    - create EncryptionEvent
    - initialise provenance

  on_decryption:
    - identify encrypted resource
    - resolve authorised key reference
    - record DecryptionEvent
    - preserve output-resource relationship
    - preserve distinction between decryption and access authorisation

  on_key_rotation:
    - preserve old key reference
    - assign new key reference
    - record KeyRotationEvent
    - identify resources requiring re-encryption or re-wrapping
    - update provenance

  on_key_compromise:
    - update key status
    - identify affected encrypted resources
    - increase EncryptionRisk
    - trigger re-encryption or key rotation according_to policy
    - preserve incident provenance

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - encryption_entities
    - relationships
    - resource_rules
    - scope_rules
    - algorithm_rules
    - key_rules
    - mode_rules
    - validation
    - semantic_equivalence
    - confidence_model
    - update_model

  canonicalisation:
    - preserve_encryption_identifiers
    - preserve_resource_identifiers_and_versions
    - preserve_encryption_scope
    - preserve_algorithm_and_mode_identifiers
    - preserve_key_identifiers_without_secret_material
    - preserve_event_order
    - preserve_policy_versions
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security metadata ontology
    - encryption state and cryptographic configuration model
    - key-reference, scope, event, risk, and provenance structure
    - confidentiality-support metadata model

  operations:
    - identify encrypted resources
    - resolve encryption state and scope
    - resolve algorithms and cipher modes
    - inspect key references without exposing secret material
    - inspect IV, nonce, and authenticated-encryption metadata
    - distinguish encryption at rest and in transit
    - inspect field, database, backup, and envelope encryption
    - trace encryption, decryption, and key-rotation events
    - evaluate algorithm and key validity
    - assess encryption risk
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_expose_secret_keys
    - do_not_equate_encryption_with_hashing
    - do_not_equate_encoding_with_encryption
    - do_not_equate_encryption_with_digital_signature
    - do_not_equate_encryption_with_authorisation
    - do_not_equate_decryption_capability_with_access_permission
    - do_not_equate_algorithm_name_with_secure_configuration
    - preserve_resources_scopes_algorithms_keys_events_validity_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - encryption_identifier
    - resource_identifier
    - resource_version
    - encryption_state
    - encryption_scope
    - encryption_algorithm
    - cipher_mode
    - key_identifier
    - key_status
    - assessment_time

  resolve:
    1. identify EncryptedResource
    2. resolve EncryptionState
    3. resolve encryption scope
    4. inspect algorithm and cipher mode
    5. resolve key reference and key version
    6. inspect nonce, IV, or authenticated-encryption metadata
    7. traverse encryption, decryption, and rotation events
    8. inspect validity and risk
    9. trace provenance and confidence
    10. return encryption assessment

  output:
    - encrypted_resource
    - resource_version
    - encryption_state
    - scope
    - algorithm
    - mode
    - key_reference
    - key_status
    - authenticated_encryption
    - validity
    - risk
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF encryption state is verified
  AND algorithm, mode, key status, and scope are acceptable
  THEN infer encryption_protection_candidate
  according_to policy and threat context

  IF key is compromised
  THEN reduce confidentiality confidence
  AND identify affected encrypted resources

  IF encryption covers only selected fields
  THEN do_not infer complete-resource encryption

  IF decryption succeeds
  THEN infer cryptographic recoverability
  BUT do_not infer access authorisation

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: EncryptionMetadata
  resource_identity: machine_interpretable
  encryption_state: explicit
  scope: explicit
  algorithms_and_modes: configuration_aware
  key_references: secret_safe
  key_lifecycle: traceable
  nonce_and_IV_metadata: explicit
  authenticated_encryption: distinguishable
  encryption_contexts: explicit
  encryption_hash_signature_authorisation_distinctions: preserved
  confidentiality_assessment: evidence_based
  validity_and_risk: reportable
  provenance: preserved
  uncertainty: explicit
  security_reasoning: enabled

end flow