Background

This was ported from https://unifiedcyberontology.atlassian.net/jira/software/projects/OC/issues/OC-208

Allow relationship between a uco-observable:X509Certificate and an uco-observabe:ObservableObject that was signed by that certificate.

Requirements

Requirement 1

Add a new Signed_By property to the uco-vocabulary:ObservableObjectRelationshipVocab

Risk / Benefit analysis

Benefits

Identify unsigned objects that may be more risky or home-grown as targets of an investigation.
Identify the signing information to determine the integrity of an object.

Risks

The submitter is unaware of risks associated with this change as this is an additive change

Competencies demonstrated

Competency 1

Competency Question 1.1

Was this application digitally signed, and if so, what certificate digitally signed it?

Result 1.1

[
    {
        "@id": "kb:application-1",
        "@type": "uco-observable:Application",
        "uco-core:hasFacet": [
            {
                "@type": "uco-observable:ApplicationFacet",
                "uco-observable:applicationIdentifier": "com.google.package",
                "uco-observable:version": "1.0"
            },
            {
                "@type": "uco-observable:FileFacet",
                "uco-observable:filePath": "/path/to/application.apk",
                "uco-observable:fileName": "application.apk",
                "uco-observable:extension": "apk",
                "uco-observable:isDirectory": false,
                "uco-observable:accessedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2009-01-15T17:59:43.25Z"
                },
                "uco-observable:observableCreatedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2009-01-15T17:59:43.25Z"
                },
                "uco-observable:modifiedTime": {
                    "@type": "xsd:dateTime",
                    "@value": "2009-01-15T17:59:43.25Z"
                }
            },
            {
                "@type": "uco-observable:ContentDataFacet",
                "uco-observable:sizeInBytes": 23000,
                "uco-observable:dataPayload": "<base 64 encoded data of the file>",
                "uco-observable:hash": [
                    {
                        "@type": "uco-types:Hash",
                        "uco-types:hashMethod": {
                            "@type": "uco-vocabulary:HashNameVocab",
                            "@value": "SHA256"
                        },
                        "uco-types:hashValue": {
                            "@type": "xsd:hexBinary",
                            "@value": "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3"
                        }
                    }
                ]
            }
        ]
    },
    {
        "@id": "kb:signing-certificate-1",
        "@type": "uco-observable:X509Certificate",
        "uco-core:hasFacet": [
            {
                "@type": "uco-observable:X509CertificateFacet",
                "uco-observable:issuer": "ISSUER",
                "uco-observable:serialNumber": "ABCDEF",
                "uco-observable:subject": "SUBJECT",
                "uco-observable:subjectHash": "HASH",
                "uco-observable:version": "VERSION"
            }
        ]
    },
    {
        "@id": "kb:application-signing-relationship-1",
        "@type": "uco-observable:ObservableRelationship",
        "uco-core:source": {
            "@id": "kb:application-1"
        },
        "uco-core:target": {
            "@id": "kb:signing-certificate-1"
        },
        "uco-core:kindOfRelationship": "Signed_By"
    }
]

Solution suggestion

Contained in !334

Add the following to the uco-vocabulary:ObservableObjectRelationshipVocab:

"Signed_By"^^vocabulary:ObservableObjectRelationshipVocab

Coordination

Tracking in Jira ticket OC-208
[x] Administrative review completed, proposal announced to Ontology Committees (OCs) on TODO-date
[x] Requirements development phase skipped - fast-track proposal.
[x] Solution announced to OCs on 2023-03-23
[x] Solutions Approval to be discussed in OC meeting, 2023-03-23
[x] Solutions Approval vote occurred, passing, on 2023-03-23
[x] Solutions development phase completed.
[x] Backwards-compatible implementation merged into develop for the next release
[x] develop state with backwards-compatible implementation merged into develop-2.0.0
[x] Backwards-incompatible implementation merged into develop-2.0.0 (N/A)
[x] Milestone linked
[x] Documentation logged in pending release page

ucoProject / UCO

Add "Signed_By" Vocab entry #525