Construction Patterns - By Package

click to view by priority

CP-PCN+W

Finds a Public Celluler Network, and makes it accessible to the World (adding the World if not already present).

CP-CrCcL3+NSg

Finds a core router providing a core network backhaul for a cellular network, connected to an IP subnet that is not part of the cellular network, and adds a NAT segment routing connections from the former to the latter.

CP-L3cCrC+OSg

Finds a core router providing a core network backhaul for a cellular network, connected to an IP subnet that is not part of the cellular network, and adds an open segment routing connections from the former to the latter.

CP-CcBrR+CSg

Finds a Base Station connected to a backhaul Core Network and providing a RAN, both of which are part of a Cellular Network, and adds a closed segment indicating that routing requests into a cell is not supported for a cellular network.

CP-PcCN+c

Finds a process controlling a cellular network and an associated RAN, and adds a link saying the process controls the RAN.

CP-CNHS+AN

Finds a core network implementing a cellular network accessible from a space in which there is a device connected to but not providing the cellular network. Adds a base station and a radio access network in the space, and connects the device to them.

CP-RrBcC+NSg

Finds a BaseStation providing a RAN and connected to a core network both of which are part of a cellular network, and adds a NAT Segment from the former to the latter subnet.

CP-PCNRWI+ct

Finds router providing a Public Cellular Network accessible from the World, along with the Internet which should also be accessible from the World, and connects the router to the Internet.

CP-CN-R+R

Finds a cellular network that is not provided by a router, and adds one.

CP-MPCNS+aF

Finds a Mobile Host located in a Space (or a Virtual Host running on it) that is connected to a Public Cellular Network, and makes that Network accessible from that Space.

CP-FCNS+aF

Finds a Fixed Host located in a Space (or a Virtual Host running on it) and connected to a Cellular Network, adds that the network is accessible from that Space.

CP-CNR+CN

Finds a cellular network provided by a router an adds a core network. Note that the inferred core network is not accessible from any space: this ensures that routing segments are not added by the default patterns, so they can be customised to reflect default cellular network behaviour.

CP-HuirEr-vD-cC-iHu-DS+iD

Finds Human interacting (possibly remotely) with an Editor that receives Data that is not viewed by the Human, and which is not created by any process, stored on any Host, nor input by any Human, and adds a link specifying that the Human inputs the Data.

CP-HuirPeO-ID-p+r

Finds a human interacting (possibly remotely) with a process that enables user access to some Data, but does not process the data. Adds a link to say the process receives the data.

CP-HuirIPaD+aD

Finds Human interacting remotely with a process that amends data, and adds a link to say that the Human amends the data.

CP-HuirEc-rD+iD

Finds a Human interacting (possibly remotely) with an Editor that creates but does not receive Data, and adds a link to specify that the Human enters the data.

CP-HuirPr-vD-cC-iHu-DS+iD

Finds Human interacting remotely with a Process that receives Data that is not viewed by the Human, and which is not created by any process, stored on any Host, nor input by any Human, and adds a link specifying that the Human inputs the Data.

CP-CP+hCLI

Finds a solo Control Process, and adds a self-referential link labelling it as such.

CP-HuirPc-iD-rC-vHu-DS+vD

Finds a Human interacting (possibly remotely) with a process that creates data, where the data is not stored on any host, used by any process nor viewed by any user, and the Human does not enter the Data, and adds a link to specify that the Human views the data.

CP-HuirPr-iD-cD+vD

Finds Human interacting remotely with a Process that receives Data, but does not create any output, and the Human does not enter the Data, and adds a link to specify that the Human views the data.

CP-HuirPaD+eUI-O+vD

Finds Human interacting (possibly remotely) with a process that amends (creates and receives) data, and enables user input but not output of the data, and adds a link to specify that the Human views the data.

CP-HuWES+e

Finds a Human using a web browser running on a host to access email, and tags the user as having access to email by creating a self-referential link.

CP-HuirPeI-OD-p+r

Finds a human interacting (possibly remotely) with a process that enables user entry of some Data, but does not process the data. Adds a link to say the process receives the data.

CP-HuirIPp-iD+vD

Finds Human interacting (possibly remotely) with an Interactive Process that processes Data, where the Human does not enter the Data, and adds a link to say that the Human views the Data.

CP-HuirPeUD-a+a

Finds a human interacting (possibly remotely) with a process that enables user update of some Data, but does not yet amend the data. Adds a link to say the process amends the data.

CP-HuirPeI-OD-p-cC-iHu-DS+c

Finds a human interacting (possibly remotely) with a process that enables user access to some Data, but does not process the data, and where the Data is not an input from any user, an output of any process, and is not stored, i.e., the data has no source. Adds a link to say the process creates the data for display to the user.

CP-HuirPeID+iD

Finds a human interacting (possibly remotely) with a process that enables user entry of some Data. Adds a link to say the Human enters the Data.

CP-HuirPeOD+vD

Finds a human interacting (possibly remotely) with a process that enables user access to some Data. Adds a link to say the Human views the Data.

CP-HuiCHDtS-AC+AC

Finds a human managing but not interacting directly with a host that has a desktop service, and interacting with a console host but not with a client of the desktop service. Adds a Remote Desktop client enabling remote access to manage the host.

CP-RDuHP-iPL-RAS+DtS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used by a Remote Desktop client, not mediated by a collocated remote access service. Adds an inferred mediating Desktop Service.

CP-RTuHP-iPL-RAS+LnS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used by a Remote Terminal client, not mediated by a collocated remote access service. Adds an inferred mediating Login Service.

CP-RTuRTuS-uR+uR

Finds a remote terminal using remotely another remote terminal which is using remotely a third process that is not yet remotely used by the first, adds a link specifying that the third process is used by the first.

CP-RDuRTuS-uR+uR

Finds a remote desktop using remotely a remote terminal which is using remotely a third process that is not yet remotely used by the first, adds a link specifying that the third process is used by the first.

CP-RDuRDuS-uR+uR

Finds a remote desktop using remotely another remote desktop which is using remotely a third process that is not yet remotely used by the first, adds a link specifying that the third process is used by the first.

CP-RAC+noDU

Finds a remote access client, and adds a self referential link indicating the process cannot process data.

CP-HuuD+aUD

Finds a Human interactively amending Data, where this is expressed as a single relationship. At this stage in the sequence, the relationship must have been asserted, but it is now deprecated, so a marker relationship is added.

CP-Hui-uD+aID

Finds a Human interactively entering Data, where this is expressed as a direct relationship. At this stage in the sequence, the relationship must have been asserted, but it is now deprecated, so a marker relationship is added.

CP-Huv-uD+aVD

Finds a Human interactively viewing Data, where this is expressed as a direct relationship. At this stage in the sequence, the relationship must have been asserted, but it is now deprecated, so a marker relationship is added.

CP-HuirPeUD+aD

Finds a human interacting (possibly remotely) with a process that enables user update of some Data. Adds a link to say the Human amends the Data.

CP-RAS+noDU

Finds a remote access service, and adds a self referential link indicating the process cannot process data.

CP-Hum-iSH-LnS+LnS

Finds a Human managing but not interacting with a Shell Host, where there is no process controlling the host, and adds a login service to allow remote management.

CP-DCCM-A+A

Finds a Data Centre with a Cluster on which is provisioned a Pod management Master node that is not hosting a Pod management API Server, and adds one.

CP-DCCM-P+P

Finds a Data Centre with a Cluster on which is provisioned a Pod management Master node that is not hosting a Pod management Ingress reverse proxy, and adds one.

CP-DCCMCAP+c

Finds a process controlling a data centre hosting a K8s master node running a K8s API server and Ingress proxy, and adds control links from the process to the two services.

CP-HumPC-Hu+m

Finds an unmanaged Container of a Process managed by a Human, and makes the Human manager also of the Container.

CP-VH-LnS+LnS

Adds a login service to a headless Virtual Host without one.

CP-Pc-hSHLnS+c

Finds a Process controlling a Shell Host that runs a Remote Access Service, but the Shell Host is not a Pod and not the Process host, and adds a link specifying that the Process controls the RAS.

CP-KPxCuScP+aa

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, which controls another service accessed by a client from outside the K8S cluster, and infers access by the client to the controlling service is mediated by the Ingress proxy.

CP-KPxWLnSA+uu

Finds a Remote Access Service that runs on and controls a K8s Worker node, connected via a Subnet to a Master that runs a K8s API Server, and used by a client from outside the K8S cluster, and infers access is mediated by the API Server.

CP-KPxCLnSA+uu

Finds a Pod managed by K8S or equivalent, hosting a remote access service running in and controlling a Container, and used by a client from outside the K8S cluster, and infers access is mediated by the API Server.

CP-KPxCaaSI+aa

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, accessed for authentication purposes by a client from outside the K8S cluster, and infers access is mediated by the Ingress proxy.

CP-KPxCazSI+az

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, accessed for authorization purposes by a client from outside the K8S cluster, and infers access is mediated by the Ingress proxy.

CP-KPxCuuSI+uu

Finds a Pod managed by K8S or equivalent, hosting an unprivileged service in a Container, accessed by a client from outside the K8S cluster, and infers access is mediated by the Ingress proxy.

CP-KIP-S+c

Finds an Ingress proxy mediating access to a service, but not controlled by any other process, and makes it delegate authentication to the back end service (the service controls the Ingress proxy).

CP-MWPodLS2+c

Finds a Pod running on a K8s Worker connected via a Logical Subnet to a K8s Master, which can also access an overlay on the Logical Subnet, and connects the Pod to the overlay subnet.

CP-KPxMLnSA+uu

Finds a Remote Access Service that runs on and controls a K8s Master node that runs a K8s API Server, connected via a Subnet to a K8s Worker cluster, and used by a client from outside the K8S cluster, and infers access is mediated by the API Server.

CP-MWHLS+CIP

Finds K8s Master and Worker nodes on the same (cluster) host, and connected to the same subnet, and adds an ClusterIP overlay network to which the Master is connected.

CP-Hum-iHRAS+i

Finds a human managing but not interacting with a host that is not a Pod and has a root privileged remote access service, and adds a link to say the human interacts with the desktop service.

CP-CtHhPH+hPH

Finds a Container provisioned by a Host that has a PhysicalHost, and assets that the Container has the same PhysicalHost.

CP-DCMW-LS+VX

Finds a K8s Master and Worker on the same (cluster) Host in a Data Centre, where the Master and Worker are not on any common subnet, and adds a VXLAN for this provided by the Data Centre.

CP-Ct+iC

Finds a solo Container, and adds a self-referential link marking it as such.

CP-PodMP+iP

Finds a solo Pod, and adds a self-referential link marking it as such.

CP-DCVHC+p

Finds a Virtual Host provisioned by a Data Centre but not yet by any host, and adds relationships to the Data Centre cluster.

CP-DCCt-Pod+Pod

Finds a Container managed directly by a Data Centre and not via a Pod, and inserts the missing Pod.

CP-PodP-Cn+Cn

Finds a Pod containing a Process, and inserts a Container for the Process.

CP-PodCnP+c

Finds a Process hosted by a Container provisioned by a Pod, and ensures there is a contains relationship between the Pod and the Process.

CP-PodCnD+s

Finds Data stored on a Container provisioned by a Pod, and makes the Pod store the Data.

CP-DCPS-Pod+Pod

Finds a serverless Process hosted directly on a data centre but not via a Pod, and adds a Pod managed by the Data Centre to contain the Process.

CP-PodCnPD+s

Finds a Container running a Process that handles Data stored on the associated Pod, and adds a link to say the Container stores the data. Since the Pod already stores the data, this link means a service on the Pod (or possibly its host) is used to provide a data volume accessed as local storage from the Container.

CP-DCPHM+p

Finds a K8s Master whose physical host is in a Data Centre, and asserts that it is managed by the data centre.

CP-DCPHW+p

Finds a K8s Worker whose physical host is in a Data Centre, and asserts that it is managed by the data centre.

CP-PodDCC-M+M

Finds a Pod managed by a Data Centre that has a Cluster, but there is no Cloud Master node provisioned on the Cluster, and adds the Cloud Master.

CP-PodDCMC-W-H+W

Finds a K8s Pod with no Host managed by a Data Centre that has a Cluster with a K8s Master, where the Data Centre does not yet have a K8s Worker cluster, and adds one to host the Pod.

CP-PodHaH+a

Finds a Pod provisioned by a Host that is above another Host, and asserts that the Pod is also above the second Host.

CP-PodHhPH+hPH

Finds a Pod provisioned by a Host that has a PhysicalHost, and asserts that the Pod has the same PhysicalHost.

CP-CtHaH+a

Finds a Container provisioned by a Host that is above another Host, and asserts that the Container is also above the second Host.

CP-DC1+x

Finds a solo Data Channel, and makes it an extension of itself.

CP-DSDCDD2P+DF

Finds a Data Channel for a Data Source, where the channel ends at a Data Destination, and the Data Channel is tagged by a forward link from the Data Source indicating there is a data flow forwards along the channel, plus the associated source and destination Processes and the Data. Inserts an output (forward) DataFlow from the source process to the destination process, fulfilled by the source Data Access and fulfiling the destination Data Access, and with links to the two Data Paths.

CP-FwdDFfDP2P+DS

Finds an outbound (forward) data flow from a process on a data path leading to that process. Adds a DataStep from the process to the previous process in the data path.

CP-FwdDFtDP2P+DS

Finds an outbound (forward) data flow to a process on a data path leading to that process. Adds a DataStep from the process to the previous process in the data path.

CP-FwdDFf2DP2P+DS

Finds an outbound Data Flow from one (longer) data path to a second (shorter) data path, and a data path which is a subset of the first, and of which the second is a subset, plus the last two processes at the end of that in between data path. Adds a DataStep from the process at the end of this path to the previous process in the path.

CP-RevDFfDP2P+DS

Finds an inbound (reverse) data flow to a process on a data path leading to that process. Adds a DataStep to the process from the previous process in the data path.

CP-RevDFtDP2P+DS

Finds an inbound (reverse) data flow from a process on a data path leading from that process. Adds a DataStep to the process from the previous process in the data path.

CP-HPsDPDFDS+f

Finds a Host that stores a copy of Data served by and sent to a Process on the same Host, plus the associated Data Flow and Data Pool, and adds a link to specify that the data access covers writing the stored data.

CP-RevDFf2DP2P+DS

Finds an inbound Data Flow from one (longer) data path to a second (shorter) data path, and a data path which is a subset of the first, and of which the second is a subset, plus the two adjacent processes at the end of that in between data path. Adds a DataStep to the process at the end of this path from the previous process in the path.

CP-DC3-x+x

Finds a data channel which extends a second channel which extends a third channel, but the first channel does not yet extend the third, and adds this missing link.

CP-DDDCDS2P+DF

Finds a Data Channel for a Data Destination, where the channel ends at a Data Source, and the Data Channel is tagged by a reverse link from the Data Destination indicating there is a data flow backwards along the channel, plus the associated source and destination Processes and the Data. Inserts an output (forward) DataFlow from the source process to the destination process, fulfilled by the source Data Access and fulfiling the destination Data Access, and with links to the two Data Paths.

CP-DC2xrDA2+f

Finds a reverse Data Channel from a Data Destination that extends another Data Channel to a Data Source. Adds a link to say the Data Source fulfils the Data Destination (a Data Flow for that purpose will be added by a later construction pattern).

CP-RA-fDCSDS+ch

Finds a remote access client acting as a data destination, that has no data source, but with an end-to-end data channel to a service that may act as a possible data source. Adds links specifying that the client itself or the connected data source may be the source of the data.

CP-DC2TDRrDP2+xr

Finds an active reverse (input) data channel leading to a transparent data relay from which another active channel continues along the same data path. Adds links to specify that the first channel extends the second in a forward direction, and the relay is a transparent relay.

CP-DC2xfDA2+f

Finds a forward Data Channel from a Data Source that extends another Data Channel to a Data Destination. Adds a link to say the Data Source fulfils the Data Destination (a Data Flow for that purpose will be added by a later construction pattern).

CP-DC3xf-xf+xf

Finds an active forward data channel that extends a second channel that extends a third channel (meaning there are transparent relay processes between the channels), but the first channel does not yet extend the third. This pattern adds the missing link.

CP-DC2TDRfDP2+xf

Finds an active forward (output) data channel leading to a transparent data relay from which another active channel continues along the same data path. Adds links to specify that the first channel extends the second in a forward direction, and the relay is a transparent relay.

CP-DSDAfDD-fS+fS

Finds a DataDestination with no data source but a possible data source that itself has a source, and a data channel to the possible data source from a data relay that is also a possible data source but itself has no source. Adds links activating the data channel and making the source of the identified possible source for this data destination into the source of data for the relay.

CP-DD-fDCSDS+ch

Finds a data destination, a data access from which that is a possible destination, that has a data channel to a relay process from which there is another channel back along the same data path o a source that does not yet have the same possible data destionation. Adds links specifying that the remote data source may be the source of the same data destination.

CP-DI-fDCSDS+ch

Finds a data input client acting as a data destination, that has no data source, but with an end-to-end data channel to a service that may act as a possible data source. Adds links specifying that the client itself or the connected data source may be the source of the data.

CP-HPsDPDSDF+f

Finds a Host that stores a copy of Data served by and sent from a Process on the same Host, plus the associated Data Flow and Data Pool, and adds a link to specify that the data access covers reading the stored data.

CP-PIP-S+fS

Finds a Process that uses stored data as input and the data has no other source, and adds a link saying it is the source of this data (since the data must be deployed statically).

CP-PSDP-S+fS

Finds a Process that serves stored Data that has no other source, and adds a link saying it is the source (since the data must be deployed statically).

CP-HDS2DPfDA+fS

Finds a Host with a stored copy of data at which there are two processes, one of which writes to the data, and a data source for this. Adds a link from the data pool for the reading process to this data source.

CP-PDO+fS

Finds a Process that creates Data as output, or gets it from an interactive user. Adds a link to say the associated Data Output asset is the source of its own data.

CP-DADSDCSDD-f+ch

Finds an active data channel carrying a forward flow that ends at a data destination that is itself a data source, and the channel beyond that source to another destination on the same data path that is not fulfilled by any other data access. Adds links specifying that the second channel is a complete channel from source to destination, and that data flows along the channel.

CP-DC3xr-xr+xr

Finds an active revrese data channel that extends a second channel that extends a third channel (meaning there are transparent relay processes between the channels), but the first channel does not yet extend the third. This pattern adds the missing link.

CP-HPDS-fDI-DO-DFI+f

Finds a Host with a stored Data Copy, running a Process that has a Data Input asset for the same Data that is not also a Data Output, is not yet fulfilled by the stored Data Copy, nor by an incoming data flow, and there is no collocated DataPool (i.e. no service able to provide supply the data). Adds a link saying that the Data Access is fulfilled by (i.e. reads from) the stored copy of the Data.

CP-DADU-eS+eA

Finds a service controlling access to a data access, which fulfils a data use that is not yet controlled by any process, and makes the service controller of the data use.

CP-HPDO-fDS-DA+f

Finds a Host running a Process that creates locally stored Data which it produces as output, but where the Data Output asset does not fulfil the stored copy, and is not a source of data for any other Data Access that fulfils the stored copy. This means the process is not sending updates to that stored copy, so links are added specifying that it writes directly to the stored copy..

CP-DO-fDCSDD+ch

Finds a data output process that acts as a data source, which does not yet have a source of data, but has a data channel to a service that can act as a data destination. Adds links specifying that this is a complete channel from source to destination, and that data flows along the channel.

CP-DCDFcV+c

Finds a Data Flow controlled by a key Vault for which there is a Data Cache. Adds a link specifying that the Vault also controls the cache.

CP-DCDFDF+i

Finds a Data Flow containing a Data Field for which there is a Data Cache. Adds a link to say the cache also contains the field.

CP-DAOiDADInDF-i+i-Replay

Change from: Finds an output data asset that includes a field contained in the data fulfilling (via a data access) an input data asset that needs the field, where the data is not spam, and the input data asset does not yet include the field. Adds a link to say it does include the field.

CP-PDO-gDAnDF-i+i-Replay

Change from: Finds a process creating data, the data access asset (a data output) fulfilling the output data asset, the data is not spam, the process does not ignore a data field, and the data asset needs this field but does not yet include it. Adds a link to say it does include the data field.

CP-DAO-iDADInDF-n+n-Replay

Change from: Finds an output data asset fulfilling (via a data access) an input data asset that needs a field contained in the data, where the data is not spam, and the output asset does not yet need or include this field. Adds a link to say the output asset needs the field.

CP-DAPDADF-g+n

Finds a Process receiving Data that contains a Data Field, via a Data Asset, where the data is not spam, the process does not ignore the field, and the data asset does not already include the field. Adds a link to say that the inbound data asset needs to include the field.

CP-DAOiDADInDF-i+i

Finds an output data asset that includes a field contained in the data fulfilling (via a data access) an input data asset that needs the field, where the data is not spam, and the input data asset does not yet include the field. Adds a link to say it does include the field.

CP-PDO-gDAnDF-i+i

Finds a process creating data, the data access asset (a data output) fulfilling the output data asset, the data is not spam, the process does not ignore a data field, and the data asset needs this field but does not yet include it. Adds a link to say it does include the data field.

CP-DAO-iDADInDF-n+n

Finds an output data asset fulfilling (via a data access) an input data asset that needs a field contained in the data, where the data is not spam, and the output asset does not yet need or include this field. Adds a link to say the output asset needs the field.

CP-DSD-iDF+n

Finds a Data asset containing a Data Field, where the data is not spam, with a stored Data Copy that does not include the field. Adds a link to say the Data Copy needs the field.

CP-DSDDF-Hu-P+i

Finds a Data Copy of a Data asset containing a Data Field, where the data is not spam, and is not created by any process nor provided by any user. Adds a link to say the Data Copy (which must be a static copy) includes the field.

CP-ScDSPDIcD+z

Finds a Data Asset controlled by a vault which is input to a Process that creates output. Adds a link to say the Process authenticates to the vault to get keys.

CP-ScDSPDI-DD+z

Finds a Data Asset controlled by a vault which is input to a Process, but does not fulfil any outbound data asset. Adds a link to say the Process authenticates to the vault to get keys.

CP-PDOScDD-DS+z

Finds a Data Asset controlled by a vault which is output from a Process, and not fulfilled by any inbound data asset. Adds a link to say the Process authenticates to the vault to get keys.

CP-ScDDPDADS-cz+c

Finds a Data Asset controlled by a vault which is outbound from a Process and fulfilled by an uncontrolled inbound Data Asset, and where the Process does not get tokens from the vault. Inserts a link to say the inbound Data Asset is also controlled by the vault.

CP-ScDSPDADD-cz+c

Finds a Data Asset controlled by a vault which is inbound to a Process and used to fulfil an uncontrolled outbound Data Asset, and where the Process does not get tokens from the vault. Inserts a link to say the outbound Data Asset is also controlled by the vault.

CP-SDUDSDA+R

Finds a Service enabling access for a Data Use, where the Service reads from a local Data Copy. Adds a link signifying that the Data Copy can be read as a consequence of the Data Use.

CP-SDUDADS+W

Finds a Service enabling access for a Data Use, where the Service writes to a local Data Copy. Adds a link signifying that the Data Copy can be written to as a consequence of the Data Use.

CP-DSDA+R

Finds a Data Access fulfilled by a Data Copy. Adds a link signifying that the Data Copy can be read as a consequence of the Data Access.

CP-DADS+W

Finds a Data Access fulfilling a Data Copy. Adds a link signifying that the Data Copy can be written to as a consequence of the Data Access.

CP-DUDA-eS+eA

Finds a service controlling access to a data access, which is fulfilled by a data use that is not yet controlled by any process, and makes the service controller of the data use.

CP-HPDSDA-crudr+crudr

Finds a Host storing a Data Copy that fulfils a Data Access for a Process on the same Host, and adds a CRUD read relationship between Process and Data Copy if there is not already a CRUD updates.

CP-HPDADS-crudu+crudc

Finds a Host storing a Data Copy fulfilled by a local process that does not CRUD update the data copy, and adds a CRUD creates relationship bewteen process and data copy.

CP-HPeD+crudu

Finds a Host for a Process that creates and appends to locally stored Data, and asserts a CRUD update relationship from the process to the stored data copy.

CP-HPDADS2dDO+crudu

Finds a Host running a Process that writes to a local stored Data Copy, and sources data from two distinct data producers. Adds a link to specify that the process CRUD updates the data (since it must be overwriting or appending data from one producer when it gets data from another).

CP-HPDADSDU+crudu

Finds a Host storing a Data Copy fulfilled by a Data Access that sources data from a Data Update (from a process on any Host). Adds a link to specify that the Process is CRUD updating the stored data.

CP-HDSPDIfdDA-DP-f+f

Finds a data input that is a destination for data from some other source and used by a process whose host stores a copy of the data, which is not fulfilled by any Data Access with the same data source. Adds a link saying that the Process fulfils (i.e. writes to) the stored copy of the Data.

CP-RA-fDCSDD+ch

Finds a remote access client acting as a data source, which does not yet have a source of data, but has a data channel to a service that can act as a data destination. Adds links specifying that this is a complete channel from source to destination, and that data flows along the channel.

CP-PTDR+ds

Finds a Process acting as a Temporary Data Relay, and adds links to specify that it is both a source and destination for this Data.

CP-DP3-x+x

Finds a data path which extends a second path which extends a third path, but the first path does not yet extend the third. Adds a link to say it does.

CP-Pc-rDSH+S-Hu-DA+DO

Finds a Process that is creating data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, but there is at least one Data Pool at this Host associated with the Data. Adds a DataOutput (data generated at a non-interactive process).

CP-Hui-vDSPH-S-DA+DO

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is no Data Pool associated with the data at that Host and as yet no Data Access associated with this Process and Data. Adds an interactive DataOutput (stored data generated possibly by the user at an interactive process).

CP-Pc-rDSH-S-Hu-DA+DO

Finds a Process that is creating data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, and no Data Pool at this Host associated with the Data. Adds an DataOutput (data generated at a non-interactive process).

CP-HuaDPH-DS-DA+DU

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, and as yet no Data Access associated with this Process and Data. Adds a DataUpdate (data updated at a process possibly by an interactive user).

CP-PaDH-DS-Hu-DA+DU

Finds a Process that is amending data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data. Adds a DataUpdate (data update by a non-interactive process).

CP-HuaDSPH+S-DA+DU

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is a Data Pool associated with the data at that Host but as yet no Data Access associated with this Process and Data. Adds a Data Update (data updated at a process possibly by an interactive user).

CP-PaDSH+S-Hu-DA+DU

Finds a Process that is amending data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, but there is at least one Data Pool at this Host associated with the Data. Adds a non-interactive DataUpdate asset.

CP-HuaDSPH-S-DA+DU

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is no Data Pool associated with the data at that Host and as yet no Data Access associated with this Process and Data. Adds an interactive DataUpdate (stored data updated at a process possibly by an interactive user).

CP-PaDSH-S-Hu-DA+DU

Finds a Process that is amending data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, and the Process does not use a local Data Service. Adds a non-interactive DataUpdate asset.

CP-Hui-vDPH-DS-DP+OP

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, where there is as yet no Data Pool associated with the data. Adds an OutputPool.

CP-Pc-rDH-DS-Hu-DP+OP

Finds a Process that is creating data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no Data Pool associated with the Data. Adds an OutputPool (data creation by a non-interactive process which is the only source of the data).

CP-HuaDPH-DS-DP+UP

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, and as yet no Data Pool anywhere associated with this Data. Adds an UpdatePool (data update by a non-interactive process which is the only source of the data). Note that by this stage, matching data cannot be stored anywhere, so amending the data is a modelling error. However, we need an UpdatePool to avoid also creating other (misleading) errors.

CP-PaDH-DS-Hu-DP+UP

Finds a Process that is amending data of which there is no copy stored on the same host, where the Process is not enabling a user to enter the data, and there is as yet no data pool anywhere associated with this Data. Adds an UpdatePool (data update by a non-interactive process which is the only source of the data). Note that by this stage, matching data cannot be stored anywhere, so amending the data is a modelling error. However, we need to create the UpdatePool to avoid also creating other (misleading) errors.

CP-Pr-cDSH-Hu-DP+IP

Finds a Process that is receiving data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no Data Pool associated with the Data. Adds an InputPool (data used by a non-interactive process which is the only source of the data).

CP-Hui-vDSPH-DP+OP

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is as yet no Data Pool associated with the data. Adds an OutputPool (data generated or provided by the user at a process which is the only source of this data).

CP-Pc-rDSH-Hu-DP+OP

Finds a Process that is creating data of which there is a copy stored on the same host, where the Process is not enabling a user to enter the data, and there is as yet no Data Pool associated with the Data. Adds an OutputPool (data creation by a non-interactive process which is the only source of the data).

CP-HuaDSPH-DP+UP

Finds a Human amending Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is as yet no Data Pool associated with the data. Adds an UpdatePool (data updated at a process which also exchanges the data with other processes).

CP-PaDSH-Hu-DP+UP

Finds a Process that is amending data of which there is a copy stored on the same host, where the Process is not enabling a user to amend the data, and there is as yet no Data Pool associated with the Data. Adds an UpdatePool (data update by a process which is a source of the data).

CP-PsDSH-DP+DP

Finds a Process serving (but not processing) locally stored Data, and creates the corresponding Stored Data Pool (local stored copy of this data served by this process).

CP-HPrD-DS-DA+DR

Finds a host running a Process relaying but not processing Data, where there is no associated data access asset (meaning it does not serve the data as the previous pattern would then have created the data access asset), and no data copy stored on the process host. Adds a TempDataRelay asset, signifying that this data is forwarded transparently, with no filtering or re-encoding of either data or data requests as they pass through the relaying process.

CP-HPsD-DS+DR

Finds a Host running a Process serving but not processing Data, where there is no copy of the data stored on the same host. Adds a DataRelay asset, signifying that this data is forwarded between other processes by this process. In this case the process is an active relay, meaning it may filter or re-encode the data or requests for the data before forwarding it.

CP-HD-aHD-DS+DS

Adds a stored copy of Data on a Host where the Data is stored, and the Host is not in a virtualisation stack above another Host where the Data is also stored.

CP-DP1+x

Finds a solo Data Path, and makes it an extension of itself.

CP-AC+noDX

Finds a solo AuthClient, and adds a self referential link indicating the process cannot exchange data.

CP-HuWES+D

Adds a (spam) data dependency between a web browser and an email service it accesses.

CP-HHuWE+D

Adds a (spam) data dependency between a web browser and email client used by someone on the same host.

CP-HHuWSMS+D

Adds a (spam) data dependency between a web browser and SMS client used by someone on the same host.

CP-Hui-vDSPH+S-DA+DO

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is a copy on the same Host, where there is a Data Pool associated with the data at that Host but as yet no Data Access associated with this Process and Data. Adds a DataOutput (data generated at a process possibly by an interactive user).

CP-Pc-rDH-DS-Hu-DA+DO

Finds a Process that is creating data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data. Adds a DataOutput (data generated at a non-interactive process).

CP-AS+noDX

Finds a solo authentication/authorisation service, and adds a self referential link indicating the process cannot exchange data.

CP-Pr-cDSH-S-Hu-DA+DI

Finds a Process that is receiving data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, and no Data Pool at this Host associated with the Data. Adds a non-interactive DataInput (input data consumed at a non-interactive process).

CP-Hui-vDPH-DS-DA+DO

Finds a Human entering Data by interacting (possibly remotely) with a Process that processes the Data, of which there is no copy on the same Host, and there is as yet no Data Access associated with this Process and Data. Adds a DataOutput (data generated at a process possibly by an interactive user).

CP-DDDCDP2oDS+DC

Finds a Data Desination for which there is an untried Data Channel to a next Process, which uses a Data Path that extends another Data Path to another Process, and where no previously found process is a data source. Creates a new Data Channel leading up to the old one.

CP-DDDPS+DC

Finds a Data Path from a Process that is a Data Destination to a Service. Creates a Data Channel for the Data Destination from the Process to the Service.

CP-DSDCDP2oDD+DC

Finds a Data Source for which there is a Data Channel to a next Process, which uses a Data Path that extends another Data Path to another Process, and where no previously found process is a data destination. Creates a new Data Channel leading up to the old one.

CP-DSDPS+DC

Finds a data path from a process to a service, where the process is a source of the data. Creates a data channel for that data source from the process to the service.

CP-RUODI+ds

Finds a Process that enables remote user output, and adds link to specify that the remote access client is a destination, and the enabling Process a source for this Data.

CP-RUIDO+ds

Finds a Process that enables remote user input, and adds link to specify that the remote access client is a source, and the enabling Process a destination for this Data.

CP-DADS+ds

Finds a Data Access fulfilling a Data Copy. Adds a link saying it can act as a data pool for data flow inference purposes.

CP-PDP+ds

Finds a Process that implicitly or explicitly serves Data, and adds links to specify that it is both a source and destination for this Data.

CP-PDO+s

Finds a Process that creates Data as output, or gets it from an interactive user, and adds a link to specify that it is a source for this Data.

CP-PDI-Hu+d

Finds a Process that uses Data as input and does not have an interactive user, and adds a link to specify that it is a source for this Data.

CP-PDR+ds

Finds a Process acting as a Data Relay, and adds links to specify that it is both a source and destination for this Data.

CP-PSDP+ds

Finds a Process that serves stored Data, and adds links to specify that it is both a source and destination for this Data.

CP-PDI+d

Finds a Process that uses Data as input, or displays it to an interactive user, and adds a link to specify it is a destination for this Data.

CP-SDADPDXRAC-DP+DP

Finds a service at the end of a data path that exchanges data with a remote access client from which there is no data path to the same data access. Creates a new Data Path from the remote access client extending the old one.

CP-Pr-cDSH+S-Hu-DA+DI

Finds a Process that is receiving data of which there is a copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data, but there is at least one Data Pool at this Host associated with the Data. Adds a DataInput (data consumed at a non-interactive process).

CP-Pr-cDH-DS-Hu-DA+DI

Finds a Process that is receiving data of which there is no copy stored on the same host, where the process does not enable a user to enter the data, and there is as yet no data access associated with this Process and Data. Adds a DataInput (data consumed at a non-interactive process).

CP-HuaDRAC-DA+RUA

Finds a Human amending Data remotely via a Remote Access Client, where there is no Data Access asset for access to the Data by the RAC. Adds a Remote User Update asset (data flowing via the Client to and from the Human).

CP-SDADPPDXRAC-DP+DP

Finds a service with a data access to which there is a data path from a process that exchanges data with a third process which is not the service nor already visited by this data path, and there is a remote access client using remotely the second and third processes. Creates a new Data Path from the third process extending the old one.

CP-PDO-DI+DP

Finds a Process that creates Data as output, possibly by getting it from an interactive user, but does not use the same Data as input, and creates a Data Path for the Data from the Process.

CP-HSDADPDXP-Hu-DP+DP

Finds a service with a data access at the end of a data path process that exchanges data with a second process from which there is no data path to the same data access, where both processes have the same Host. Creates a new Data Path from the second process extending the old one.

CP-PDP+DP

Finds a Process that implicitly or explicitly serves Data, and creates a Data Path for the Data from the Process.

CP-SDADPDXP-Hu-DP+DP

Finds a non-interactive service at the end of a data path that exchanges data with a second process from which there is no data path to the same data access. Creates a new Data Path from the second process extending the old one.

CP-SDADPPDXP-Hu-DP+DP

Finds a service with a data access to which there is a data path from a non-interactive process that exchanges data with a third process which is not the service nor already visited by this data path. Creates a new Data Path from the third process extending the old one.

CP-SDADPDXPRAC-DP+DP

Finds a service at the end of a data path that exchanges data with a second process from which there is no data path to the same data access, and there is a remote access client using remotely both processes. Creates a new Data Path from the second process extending the old one.

CP-SDADPPDXPRAC-DP+DP

CP-HSDADPPDXP-Hu-DP+DP

Finds a service with a data access to which there is a data path from a non-interactive process that exchanges data with a third process which is not the service nor already visited by this data path, where all three processes have the same host. Creates a new Data Path from the third process extending the old one.

CP-PpD-iDF+a

Finds a Process, processing Data which is not Spam, which contains a Data Field that is not ignored by the Process. Adds a link to say the Process does access this Field.

CP-PcSe+Rel

Finds a client Process that alters control input to an IoT Sensor, along with its onboard simple communication Process and Data, and adds relationships between the client and the onboard simple communication Process and Data.

CP-HuiSe+Rel

Finds the control input and sensed output for an IoT Sensor, which is being used interactively by a Human, plus the interactive process that creates the output, and adds relationships of the Human to the process and data.

CP-HuiCo+UI

Finds the control input for an IoT Controller, which is being used interactively by a Human, and adds a user interface process, plus relationships of the Human to this process and to the input.

CP-PuSe+Rel

Finds a client Process that reads data from an IoT Sensor, and adds relationships between the client and the onboard simple communication Process and Data.

CP-Pp-uSe+Rel

Finds a client Process that polls (but does not read) an IoT Sensor to obtain data, and adds relationships between the client and the onboard simple communication Process and Data.

CP-HumThP-m+m

Finds a Human managing a Thing with an unmanaged onboard process, and makes the manager also manage the process.

CP-PuCo+Rel

Finds a client Process that updates an IoT Controller, and adds relationships between the client and the onboard communication Process and Data.

CP-PrSe+Rel

Finds an IoT Sensor sending data to a (not really client) Process, and adds a relationship between the onboard simple IoT communication Process and the client Process.

CP-DcTh+DS

Finds each IoT Thing device and its control input Data, and adds an onboard communication process that serves the Data.

CP-SHuTh-Hu+m

Makes the Human managing a Space the manager of any unmanaged IoT Thing within the Space.

CP-IoT-cD+cD

Finds each IoT device that does not have onboard control input data and adds the onboard control input data.

CP-Pa-uCo+Rel

Finds a client Process that amends an IoT Controller, and adds relationships between the client and the onboard communication Process and control input Data.

CP-Se-sD+sD

Finds each IoT Sensor device that is not sensing data and adds the sensed output data.

CP-SesD+SP

Finds each IoT Sensor device and its sensed Data, and adds an onboard communication process that creates the Data.

CP-DcTh+s

Finds an IoT Thing and its control input Data. Adds a link to specify that the Data is stored on the Thing.

CP-JuPHS+s

Finds a host that is or runs on a physical host located in a space subject to a jurisdiction, and makes the host subject to that jurisdiction.

CP-JuHP+s

Finds a host subject to a jurisdiction that is hosting a process, and asserts that the process is also subject to the jurisdiction.

CP-StoPDA+o

Finds a Stakeholder operating a Process that accesses Data, and adds a link from the stakeholder to the inferred data access asset.

CP-JuSS+s

Finds a space subject to a jurisdiction, which is the entrance to another space, and asserts that the other space is also subject to the jurisdiction (unless it already has one).

CP-UHDSrP+u

Finds Data stored on a USB Device paired with a USB Host running a service for the Data, where the data is used by a Process running on some other host that doesn't use any other process capable of providing the data. Adds a link to say the Process uses the Service on the USB Host.

CP-UPrGc-rUP+OSg

Finds a USB hub between a USB host and a USB device (it provides the USB Pair from the USB Host, but not to the USB device), and adds a segment from the USB host to the USB device.

CP-BPcGcBP+OSg

Finds a Bluetooth device paired with two other devices, and adds a logical segment representing the route between bluetooth connections which corresponds to Bluetooth mesh routing.

CP-L3cGrL1+OSg

Finds a USB/Bluetooth device acting as a gateway, connected to an IP subnet and paired with a host in the same space, and adds an Open Segment from the former to the latter subnet. This configuration corresponds to a regular tethering connection allowing communication from the IP subnet to the USB/Bluetooth host.

CP-L3cGc-rL1+CSg

Finds a Physical Host gateway on an IP subnet with a connection from a USB or Bluetooth device, all in the same space, and adds a Closed Segment from the former to the latter subnet. The Bluetooth or USB device is not acting as the gateway, so this corresponds to a reverse tethering connection in the wrong direction for message routing to take place.

CP-L1rGcL3+OSg

Finds a Bluetooth or USB device connected from a host to an IP subnet, all in the same space, and adds an Open Segment from the former to the latter. Here the gateway is a Bluetooth or USB device, so this corresponds to a regular tethering connection.

CP-L1c-rGcL3+NSg

Finds a physical host with a pairing connection from a distinct host that is also connected to an IP subnet, all in the same space, and adds a reverse tethering segment from the paired host to the IP subnet.

CP-HpURH+U

Finds pairs of Physical Hosts paired over USB and adds the USB wired connection created between them.

CP-HpBRH+B

Finds pairs of Physical Hosts paired over Bluetooth and adds the Bluetooth radio subnet created between them.

CP-UPc-rGrUP+OSg

Finds a USB hub between a USB device and a USB host (it provides the USB Pair from the USB Host, but not to the USB device), and adds a segment from the USB host to the USB device.

CP-UHDrP-S+S

Finds Data stored on a USB Device paired with a USB Host that does not also store the data, where the data is used by a Process running on a third distinct host, and inserts a simple service on the USB Host.

CP-USBD-S+S

Finds Data stored on a USB device where there is no local process serving the data or creating it from scratch.

CP-HUSBTHS-S+l

Finds a Host in a Space that accepts pairing via USB with a TrivialHost that has no location, and adds a link saying the Trivial Host can be in the same space.

CP-HBTTHS-S+l

Finds a Host in a Space that accepts pairing via Bluetooth with a TrivialHost that has no location, and adds a link saying the Trivial Host can be in the same space.

CP-HumTHS+cA

Finds a Human managing a Trivial Host located in a space, and adds a link specifying that the human must have access to the space.

CP-HumHUSBTH-Hu+m

Finds a TrivialHost with no manager, paired via USB with another host managed by a Human, and makes that Human manager of the TrivialHost.

CP-HumHBTTH-Hu+m

Finds a TrivialHost with no manager, paired via Bluetooth with another host managed by a Human, and makes that Human manager of the TrivialHost.

CP-HuiHUSBTH-Hu+m

Finds a TrivialHost with no manager, paired via USB with another host used by a Human, and makes that Human the manager of the TrivialHost.

CP-HuiHBTTH-Hu+m

Finds a TrivialHost with no manager, paired via Bluetooth with another host used by a Human, and makes that Human the manager of the TrivialHost.

CP-UHDpP-S+S

Finds Data stored on a USB Device paired with a USB Host which is running a process using the Data, where the Data is not also stored on the USB Host, and adds a usage link between the process and the onboard data service on the USB device.

CP-LPLRTSg-f+b

Finds path traversing a route between subnets through a gateway which also has a tethering connection to the source subnet, but this does not route to the destination subnet, and the destination subnet is not provided by the gateway. Adds self referential relationships marking the route and the logical path as blocked by default.

CP-LPLS2NSg2+b

Finds a route between subnets through a gateway where NAT is used on the return path, and a logical path traversing the forward segment. Adds self referential relationships marking the route and the logical path as blocked by default.

CP-NP2LSg+t

Adds a traverses relationship from a network path to a logical segment traversed by a subpath.

CP-NP2LS+v

Adds a visits relationship from a network path used by a service channel to a logical subnet visited by a subpath.

CP-LPsLS+v

Finds a Logical Subnet at the start of a Logical Path, and adds a link specifying that the path visits the subnet.

CP-NP3+x

Iteratively inserts relationships between a network path and all its subpaths.

CP-OPPS2+PP

Finds a Physical Path and terminator (PPE) to a destination Physical Subnet, where there is a Logical Route into the Subnet at the start of the Path via a Gateway, from a Physical Subnet not visited by any shorter physical path to the destination, where the Path is routed via at least one Host but not via the Gateway, and creates a new Physical Path by pre-pending the Logical Route to the previous path.

CP-OPPS1+PP

Finds a zero-length Physical Path and a Path Terminator (PPE) to a Physical Subnet, where there is a Logical Route via a Physical Gateway Host to the Subnet from some other Physical Subnet, and creates a new Physical Path by pre-pending the Logical Route to the previous path.

CP-PS-iH+PPE

Finds a solo Physical Subnet, and creates a zero length physical network path for comms within the subnet, plus a PPE to generate paths finishing at that subnet.

CP-OPLS2+NP

Finds a Network Path and terminator (NPE) to a destination Logical Subnet, where there is a Logical Route into the Subnet at the start of the Path via a Gateway, from a Subnet not visited by any shorter path to the destination, where the Path is routed via at least one Host but not via the Gateway, and creates a new Network Path by pre-pending the Logical Route to the previous path.

CP-ILSA+c

Finds an Interface to a Logical Subnet that implements an Abstract Subnet, and makes the Interface also connect to the Abstract Subnet.

CP-LS-iH+NPE

Finds a solo Logical Subnet that is not a hotspot, and creates a zero length network path for comms within the subnet, plus an NPE to generate paths finishing at that subnet.

CP-SgHtILS+t

Adds a relationship between a Logical Segment and the Interface between its gateway Host and the Logical Subnet it routes to.

CP-SgHfILS+f

Adds a relationship between a Logical Segment and the Interface between its gateway Host and the Logical Subnet it routes from.

CP-L3rGrL3+OSg

Finds a Host providing two distinct IP subnets both in the same space, and adds an Open Segment from one to the other.

CP-L3rGc-rL3+NSg

Finds a Host connected from an IP subnet to a distinct IP subnet, the former but not the latter being provided by the Host, and both in the same space, and adds a NAT Segment from the former to the latter subnet.

CP-L3c-rGrL3+DSg

Finds a Host connected from an IP subnet it does not provide to a second, distinct IP subnet that is provided by the Host, both in the same space, where neither subnet is a hotspot. Adds a DeNat Segment (public to private) from the former to the latter subnet.

CP-L3c-rGc-rL3+OSg

Finds a Host connected from an IP subnet to a second distinct IP subnet, both in the same space, where neither is a hotspot and neither is provided by the gateway, and adds an Open Segment from the former to the latter subnet.

CP-OPLS1+NP

Finds a zero-length Network Path and a Path Terminator (NPE) to a Logical Subnet, where there is a Logical Route via a Gateway Host to the Subnet from some other Logical Subnet, and creates a new Network Path by pre-pending the Logical Route to the previous path.

CP-HLS+I

Adds an Interface between a Host and a LogicalSubnet it is connected to, unless the subnet is a hotspot.

CP-CuSHS+SL

Finds a Host that is not a Cluster running both a Client and a Service used by the Client, in a Space, and adds an internal subnet representing internal (socket or API) connectivity within the Host.

CP-PcWH+c

Finds a WiFiLAN and its local implementation, plus a controlling process, and makes the process also controller of the local implementation.

CP-HcWHS+c

Finds a WiFiLAN hotspot and its local implementation in a Space, and a host connected to the hotspot in that space, and adds a connection to the local implementation.

CP-WpHSH-aF+WH

Finds a mobile host or virtual host running on it providing a WiFi LAN which is a hotspot, a space where the host could be where it has no explicit provision or connection to any other WiFiLAN. In that space it is assumed the host provides a local WiFiLAN hotspot implementation, which is then added to the model.

CP-WS-H+I

Finds a solo WiFiLAN that is not an abstract hotspot, and adds a link to say it is its own local implementation.

CP-MHcIS+aF

Finds a Mobile Console Host in a Public Space connected to the Internet, and makes the Internet accessible from that space.

CP-MHC+iMHC

Finds a solo Mobile Console Host, and labels it as such using a self-referential link.

CP-FpLSS+aF

Finds a Fixed Host located in a Space (or a Virtual Host running on it) and providing a Logical Subnet, adds that the subnet is accessible from that Space.

CP-InternetMP+W

Finds an Internet class network, and makes it accessible to the World (adding the World if not already present).

CP-WpHS-aF+iH

Finds a mobile host or virtual host running on it, in a space, providing a WiFi LAN which is not accessible from any space, and providing no other WiFiLAN accessible in its space. Adds a link indicating that the first WiFiLAN is an abstract hotspot.

CP-HprLS+c

Adds a connection from a gateway Host to a LogicalSubnet provided by that Host, unless it is an abstract hotspot.

CP-Rr+iR

Finds a solo Router, and labels it as such using a self-referential link.

CP-InternetMP+ii

Finds an Internet class network, and labels it as such using a self-referential link.

CP-FcLSS+aF

Finds a Fixed Host located in a Space (or a Virtual Host running on it) and connected to a Logical Subnet, adds that the subnet is accessible from that Space.

CP-PHHS+AC

Finds a host that directly is or indirectly has a physical host in a space, and adds an inferred context for access to the host when it (or its physical host) is in that space.

CP-HACPmNC+p

Finds a process running on a host in a space and the host location access context, with all related process network access contexts, and links the host context to the process network contexts.

CP-HCHLSS+NC

Finds a Host location access context and the related host and space and one related subnet, and creates a HostNetContext asset linked to them all.

CP-TP+iT

Finds a solo trivial process, and adds an isTrivial self-referential link so the process can be selectivly included or excluded in later patterns.

CP-HuE+e

Finds a human interacting with an email client, and tags the user as having access to email by creating a self-referential link.

CP-HuwStmP-St+o

Finds a Human with an Employer managing a Process with no other operator, and makes the Employer of the Human the Process operator.

CP-HumP-StSt+o

Finds a Human managing a Process, where the Human is not an employee, and the Process has no operator, and makes the Human its operator.

CP-StS-St+c

Finds a Private Space operated by a Stakeholder where access is not controlled by any stakeholder, and adds this relationship from the first Stakeholder.

CP-StSPH-St+o

Finds a Fixed Host with no operator in a Private Space operated by a Stakeholder, and makes the Stekeholder the operator of the Fixed Host.

CP-PHLSS+aV

Finds a host that directly is or indirectly has a physical host in a space and is connected to a logical subnet that is not a VXLAN or a Hotspot and is accessible from that space, and creates a link from the context for accessing the host in that space and the subnet.

CP-HuwStmH-St+o

Finds a Human with an Employer managing a Host with no other operator, and makes the Employer of the Human the Host operator.

CP-HuiHP-m+m-Replay1

Finds a user of an unmanaged interactive process and makes the user the manager of the process. This is a repeat of a previous pattern, needed to pick up processes added by inference after its previous use.

CP-HumHP-im+m

Finds a Human managing a host running a process which has neither a manager nor an interactive user, and makes the host manager the manager of the process (service).

CP-HmNCPAC+p

Finds a process running on a host in a space and an associated process location access context, plus related process network access contexts, and adds a link from the location to the network contexts.

CP-HuSP+SMS

Finds a human user interacting with a smartphone which is a personal device with no other users, and adds an SMS client used by that user.

CP-PCPHLSS+NC

Finds a Process location access context and the related process, host and space and one related subnet to which the Host is connected. Creates a ProcNetContext asset for the process, host and subnet, and links both the location and network access contexts with the subnet.

CP-PHHPS+AC

Finds a process running on a host that directly is or indirectly has a physical host in a space, and adds an inferred context for access to the process when its host is in the space.

CP-HumH-StSt+o

Makes the Human managing a Host its operator if the Human does not work for anyone else, and the Host has no other operator.

CP-RACuRHRASP-iPL+uRAS

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, where both are used remotely by a remote access client. Adds links to specify that the remote access client has remote access to the process via the RAS.

CP-StHP+o

Makes the operator of a Host into the operator of any Process on the Host.

CP-RACuP-iP+uR

Finds a Remote Access Client using a Process that is not a reverse proxy. Adds a link to say the Remote Access Client can use the Process remotely.

CP-RAS+iL

Finds a solo Remote Access Service (one providing access to the shell on its Host), and adds an isLnS self-referential link so the Service can be selectivly included or excluded in later patterns.

CP-HuPCH+i

Finds a Human interacting with a Process that is not a Remote Access Service on an Interactive Host, and creates a link specifying that they are also interacting with its Host.

CP-RACuHRASP-iPL+uR

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, and is used by a remote access client. Adds links to specify that the remote access client has remote access to the service.

CP-HuoH-m+m

Finds any unmanaged Host operated by a Human, and inserts a link specifying the Human is also its manager.

CP-HuiPH-Hu+m

Finds a Human interacting with an unmanaged Personal Host, and makes the Human its manager.

CP-HuiHP-m+m

Finds a user of an unmanaged interactive process and makes the user the manager of the process.

CP-DCH+l

Finds a Physical Host resourced by a Data Centre, and adds the fact that the Host is located in the Data Centre. This is a workaround for an SSM bug that prevented resourcedBy being detected as a case of locatedIn.

CP-SHuPH-Hu+m

Makes the Human managing a Space the manager of any unmanaged fixed host within the Space.

CP-HumPH-m+m

Finds an unmanaged host running a process that has a manager, and makes the process (service) manager the manager of the host.

CP-HuiH-Hu+m

Finds a Human interacting with an unmanaged Host, and makes the Human its manager.

CP-Hui2H+iD

Finds a physical Host with two distinct interactive users, and adds a link labelling it as an impersonal host.

CP-HuiPH-iD+iP

Finds a Human interacting with a Personal Host, where there is no self-referential link indicating that the device is shared with other users, and adds a self-referential link indicating that this is a personal device.

CP-HuiHS+cA

Finds a Human that interacts with a Host located in a Space, adds that they must have access to the Space.

CP-PH-S+W

Finds a physical host that is not located in any space, and specifies that it is located in the World.

CP-C+iC

Finds a Host that represents a Cluster, and marks it as such by adding a self-referential link.

CP-HuiPDaS-S+l

Finds a Human that has access to a space and uses a personal device which has no asserted location, and adds a link saying that the device may be located in the space accessed by the Human.

CP-DC-C+C

Finds a Data Centre with no server cluster, and adds one.

CP-HuiCHLnS-AC+AC

Finds a human managing but not interacting directly with a host that has a login service, and interacting with a console host but not with a client of the login service. Adds a Remote Terminal client enabling remote access to manage the host.

CP-Sv-LnS+LnS

Adds a login service to a headless Server without one.

CP-Rr-LnS+LnS

Adds a login service to a headless Router without one.

CP-PC-LnS+LnS

Adds a login service to a physical cluster if not already present.

CP-HuiHRAC+i

Adds the interaction between a human and a remote access client running on their client device.

CP-DC-R+RW

Finds a Data Centre without its own Router, and adds the Router and WiredLAN to the Data Centre, plus a link from the Data Centre manager (if any).

CP-Hc-pN-hP+AC

Finds a Host connected to but not providing an Abstract Subnet, which controlled by a Process not running on the Host, and adds an authentication client on the host which uses the process.

CP-HuiHAC+i

Adds the interaction between a human and an authentication client running on their client device.

CP-DCVHWS-H+p

Finds a Host that is physically in a DataCentre and connected to a wired LAN that is not provided by any host, and makes the DataCentre provider of the wired LAN.

CP-DCVHRS-H+p

Finds a Host that is physically in a DataCentre and connected to a WiFi LAN that is not provided by any host, and makes the DataCentre provider of the WiFi LAN.

CP-PH+hPH

Finds a solo physical host and marks it as its own physical host.

CP-DCLS+RWS

Finds each connection from a DataCentre to an Abstract Subnet, and adds the relationship with its internal router.

CP-DCWH-LS+c

Finds a Data Centre with its Router and Wired LAN, in which is located another distinct Host not connected to or providing any subnet, and connects this host to the Data Centre wired LAN.

CP-SHuPH-Hu+m-Replay1

Makes the Human managing a Space the manager of any unmanaged fixed host within the Space. This is a repeat of a previous pattern designed to add relationships consequent on other inferred elements since the original pattern was applied.

CP-DCpLS+RWS

Finds each LogicalSubnet provided by a Data Centre, and adds the relationship with its internal router.

CP-PPS-E+W

Finds a Private Space that is not accessible from any other Space, and makes it accessible from the World.

CP-HuaSaE+cA

Finds a human with access to a space that has an entrance from a public space, and asserts that the human can also access the entrance space.

CP-HuwStrH-St+o

Finds a Human working for some other stakeholder with a related personal device that has no other operator, and makes the employer of the Human the device operator.

CP-DHuDF+r

Finds a data asset relating to a human along with a flowing copy of the data, and asserts that the latter also relates to the human.

CP-DHuDC+r

Finds a data asset relating to a human along with a stored copy of the data, and asserts that the stored copy relates to the human.

CP-HurH-StSt+o

Makes the Human with a related personal device its operator if the Human does not work for anyone else, and the device has no other operator.

CP-HuiThaS-S+r

Finds a Human that has access to a space and uses an IoT Thing which has no asserted location, and adds a link saying that the device relates to the Human.

CP-HurSesD+Rel

Finds Data produced as output by a Sensor related to a Human, and adds the relationship of the Data to the Human.

CP-HurTh-S-m+m

Finds a Thing relating to a Human with no Manager and no specified location, and makes the Human its manager.

CP-HurThcD+Rel

Finds control input to an IoT Thing related to a Human, and adds the relationship of the Data to the Human.

CP-DFDSCS+f

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction client to service. Adds a link from the DataFlow to the ClientChannel specifying this.

CP-DFDSSC+f

Finds a DataFlow via a DataStep that flows via a ClientChannel in the direction service to client. Adds a link from the DataFlow to the ClientChannel specifying this.

CP-NP2CCAPSC+pT

Finds a service channel via a closed subnet (before a subsequent NAT gateway) with a nework path to the channel via this subnet, and an extension via an unblocked logical segment from a subnet not in the service channel. Adds a pathTo link signifying the extended network path is from a possible attacker subnet.

CP-CSCCAPNP4+CCAP

Finds a service channel from a client to a service with a network path from an attacker subnet into the channel via a closed subnet, where the path there is consistent with an extensiono of the on-channel subpath. Creates a closed client attack path from the attacker subnet via the network path and channel.

CP-SSClIAP+ch

Finds a service channel from a last interface to a service process via an attack path, and adds links between the attack path and the service and last interface.

CP-CCSCAP+ch

Finds a Client Channel via a Service Channel that goes via an Attack Path, and creates the direct link from the Client Channel to the Attack Path.

CP-CCCCAP+ch

Finds a Client Channel via a proxy Client Channel that goes via a Client Attack Path, and creates the direct link from the Client Channel to the Client Attack Path.

CP-CAPNPSAP+pV

Finds a Client Attack Path via a Service Attack Path and a Network Path, and adds a link from the Service Attack Path to the Network Path.

CP-SOCAP+OSAP

Finds an Open Client Attack Path from a logical subnet to a service process, and creates a related Open Service Attack Path from the subnet to the service.

CP-CAPlISAP+lI

Finds a client attack path via a service attack path where the former has a last interface, and adds this interface to the latter.

CP-SCsAPtI+tI

Finds a Service Attack Path from the start of a Service Channel and going via a subnet to a logical segment via an interface. Adds links from the Service Attack Path to the interface and subnet.

CP-SCxAPtI+tI

Finds a Service Attack Path starting in a Service Channel and going via a subnet to a logical segment via an interface. Adds links from the Service Attack Path to the interface and subnet.

CP-APxSCtI+tI

Finds a Service Attack Path starting off a Service Channel and going via a subnet to a logical segment via an interface. Adds links from the Service Attack Path to the interface and subnet.

CP-SCCAP+CSAP

Finds a Closed Client Attack Path from a logical subnet to a service process, and creates a related Closed Service Attack Path from the subnet to the service.

CP-NP1CCAPSC+pT

Finds a service channel via a closed subnet (before a subsequent NAT gateway) and a network path into the channel via this subnet traversing an unblocked logical segment from a subnet not in the service channel. Adds a pathTo link signifying this network path is from a possible attacker subnet.

CP-CSCsdLS+OCAP

Finds a Service Channel from a client process to a service, and a logical subnet from which source addresses are unaltered by NAT, and creates an open client attack path from subnet to service.

CP-CCSCCP+ch

Finds a client channel via a service channel that is via a client path, and makes the client channel also via the client path.

CP-SCNP2CPtI+vt

Finds a service channel via a client path from a subnet in the channel to an interface on a subnet at or after the start of the client path, and adds links from the client path to the visited subnet and interface.

CP-CSCvLS+CP

Finds a Service Channel from a client process to a service, and a logical subnet visited by it, and creates a client path from that subnet to the service.

CP-CCCSPSFSC+f

Finds a client receiving a flow of data from a service via a credential forwarding/sharing chain, and the associated client channel, and adds a link to say the data flow depends on the client channel.

CP-CCCvCCvLS+vLS

Finds a Client Channel from a Client process that goes via a Logical Subnet and also via another Client Channel (i.e. the client and service communicate via a credential sharing/forwarding chain). Adds a link specifying that the indirect Client Channel also goes via the same subnet.

CP-CCCSPSFCS+f

Finds a client sending a flow of data to a service via a chain of intermediaries, over which the client communications authentication or authorization credentials, and adds a link to say the data flow depends on the end-to-end channel.

CP-SCDS+fV

Finds a client and service plus the associated client channel where there is a data step from the service to the client, and adds a link saying the data flows via the client channel.

CP-CSDS+fV

Finds a client and service plus the associated client channel where there is a data step from the client to the service, and adds a link saying the data flows via the client channel.

CP-CAC-pPzAC-pS+cvc

Finds a client providing indirect authorization credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes, where the Client, Process and Service are not in a credential sharing chain. Adds links between the channels to indicate their dependencies.

CP-CAC-pPaAC-pS+cvc

Finds a client providing authentication credentials to a process which uses a service to validate those credentials, along with the channels between each pair of processes, where the Client, Process and Service are not in a credential sharing chain. Adds links between the channels to indicate their dependencies.

CP-CAC-pScAC-pP+cc

Finds a client and process connected via a channel, where the client also uses another service that controls the process, along with the associated channels, where the Client, Process and Service are not in a credential sharing chain. Adds links between the channels to indicate their dependencies.

CP-SCAPvLS+v

Finds a service channel linked with a closed client attack path from a logical subnet to the service process.

CP-CSCscLS+CCAP

Finds a Service Channel from a client process to a service, and a logical subnet from which source addresses are obscured by NAT, and creates a closed client attack path from subnet to service.

CP-SSCLS+aTS

Finds a service and its host connected to a subnet with the associated network access context, and a service channel from the client via the subnet, and adds a link to say the service can be accessed by this client via this network access context.

CP-H-sDFcCr-aAC+DS

Finds a Process that creates data in a context that is not stored on its host, and sends it to a service over a channel that cannot be accessed in this context. Adds a cache copy of the data flow on the host. This data is cached because it is created when the service is inaccessible, so transmission must be delayed.

CP-CCCtCCS+aTS+aTS

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel from the last Proxy, the client and service hosts, and a service context in which the service can be accessed via the proxy channel, and adds a link to say the service can also be accessed via the end-to-end channel in this context.

CP-CvPvSCC+c

Finds a client accessing a service via at least two intermediaries, and two intermediaries that are adjacent, and the channels between client and service and between these two intermediary processes. Adds dependency links between the channels.

CP-DFtCCCtS+ff-Replay

Finds a client-service channel, the client and service, and an access context at the service where it can be accessed via the channel, plus a data flow over the channel from service to client. Adds a link to say the data flows from the service in that context. This pattern was used before, but contexts in which stolen devices may reconnect were added after that, so it is used again to create links to the stolen device reconnection contexts.

CP-DFtCCCfS+ft-Replay

Finds a client-service channel, the client and service, and an access context at the client where it can access the channel, plus a data flow over the channel from service to client. Adds a link to say the data flows to the client in that context. This pattern was used before, but contexts in which stolen devices may reconnect were added after that, so it is used again to create links to the stolen device reconnection contexts.

CP-DFfCCCfS+ff-Replay

Finds a client-service channel, the client and service, and an access context at the client where it can access the channel, plus a data flow over the channel from client to service. Adds a link to say the data flows from the client in that context. This pattern was used before, but contexts in which stolen devices may reconnect were added after that, so it is used again to create links to the stolen device reconnection contexts.

CP-CCCfCCS+aFC+aFC-Replay

Finds a Client accessing a Service via a Proxy, with the channel between the Client and Service, the channel to the first Proxy, and the client and service hosts, plus a client context in which the client can access the proxy channel, and adds a link to say the service can also be accessed via the end-to-end channel in this context. This is a repeated application of a previous pattern to fill in the access links for reconnection contexts.

CP-CSCLS+ii+PNC

Finds a client and its host and a service channel to the service via the Internet to which the host need not be connected, accessible from the World in which the host need not be located, and adds a process network access context with connections including the fact that the client can access the service via this subnet from this space.

CP-CSCLS-ii+PNC

Finds a client and its host and a service channel to the service via a logical subnet (not the Internet) to which the host need not be connected, accessible from a space in which the host need not be located, and adds a process network access context with connections including the fact that the client can access the service via this subnet from this space.

CP-IDFfCCCftS-s+rI

Finds a client-service channel to a service, and a location context at the service where it can be accessed via the channel, plus a data flow over the channel from client to service which flows to the service in that context, is used as input and not stored on the service host. Adds a link to say that the service must run (compute output) in that context.

CP-H-sDFcCaiAC+DS

Finds a Process that creates data not stored on its host, which it sends to a service, and has a location access context where it can connect to the service but where access to the service may be interrupted. Adds a cache copy of the data flow on the host. This data is cached because by the time it is processed, the service may have moved out of range, so transmission may be delayed.

CP-H-sDFuCudDFdS-ACau+DS

Finds a Process that reads (needs) data not saved on its host sent from a service over one channel, and reads (needs) different data not saved on its host from a different service over a second channel, plus the process host, where the Process has no location context in which it can access the first service and access cannot be interrupted to the second service. Adds a cache copy of the first data flow on the host. This data is cached because the process must delay processing until the second (necessary) input can be accessed.

CP-H-sDFrSACdDFiaS+DS

Finds a Process that receives a data flow not saved on its host from a client over one channel, and reads (needs) different data also not saved on its host in a data flow from a service over a second channel, plus an associated process location context in which the process can be accessed via the first channel but access to the service over the second may be interrupted. Adds a cache copy of the first data flow on the host. This data is cached because the process must delay processing the first client request until the second (necessary) input can be accessed.

CP-H-sDFuSdC+DS

Finds a process that reads (needs) data sent over a channel from a client and not saved on its host, and a second channel to the process from a distinct client, plus the process host. Adds a cache copy of the data flow on the host. The data need not be forwarded to the second client, but it still has to be saved because it is a necessary input that must be available when next processing requests for the second client.

CP-H-sDFCFdS-ACau+DS

Finds a Process that receives a data flow not saved on its host from a service over one channel, and sends the same data in a data flow to a different service over a second channel, where the Process has no location context in which it can access the first service and access cannot be interrupted to the second service. Adds a cache copy of the data flow on the host.

CP-H-sDFSACaiFS+DS

Finds a Process that receives a data flow not saved on its host from a client over one channel, and sends the same data in a data flow to a service over a second channel, plus an associated process location context in which the process can be accessed via the first channel but access to the service over the second may be interrupted. Adds a cache copy of the data flow on the host.

CP-H-sDFSFdC+DS

Finds a process that receives data over a channel from a client, and sends the data over a channel from a different client, plus the process host which does not store the data. Adds a cache copy of the data flow on the host.

CP-DFfCCCtS+ft

CP-DFtCCCtS+ff

CP-DFtCCCfS+ft

CP-DFfCCCfS+ff

CP-CCCfS+aFC-aI+aU

Finds a client-service channel, the client and service, and an access context at the client in which the client can access the channel, and the service cannot be in a context where access to it would be interrupted. Adds a link to say access from the client cannot be interrupted in this sense.

CP-CCCftS+aFC-aTS+aI

Finds a client-service channel, the client and service, and an access context on each side, where the channel can be accessed from the client in its context, but the service cannot be accessed in its context. Adds a link to indicate that access to the service is interrupted when the client is in this context.

CP-CCCfS-aFC+aI

Finds a client-service channel, the client and service, and an access context at the client, where the client cannot access the channel in that context. Adds a link to indicate that access to the service is interrupted when the client is in this context.

CP-CCCfCCS+aFC+aFC

CP-PCaFCSCCC+aFC

Finds a client channel via a service channel which is accessible to a client in a process context, and adds that the client channel is accessible in that context.

CP-CSCLS+aFC

Finds a client and its host and a service channel to the service via a logical subnet to which the host is connected, plus the associated network context, and adds a link to say the service can be accessed from this client via this network access context.

CP-PCaTSSCAP+aTS

Finds an attack path via a service channel which gives access to a service in a process context, and adds that the attack path gives access in that context.

CP-DFfCCCtS+ft-Replay

Finds a client-service channel, the client and service, and an access context at the service where it can be accessed via the channel, plus a data flow over the channel from client to service. Adds a link to say the data flows to the service in that context. This pattern was used before, but contexts in which stolen devices may reconnect were added after that, so it is used again to create links to the stolen device reconnection contexts.

CP-PCaTSSCCC+aTS

Finds a client channel via a service channel which gives access to a service in a process context, and adds that the client channel gives access in that context.

CP-CvPuSCC+c

Finds a client accessing a service via more than one intermediary, plus the last intermediary adjacent to the service, and channels between client and service and between this intermediary process and the service. Adds dependency links between the channels.

CP-CCDFCDAScDA-c+a

Finds a data flow from a service to an indirect client, where the client encrypts the data flow to create an outbound data asset controlled by a vault, which does not control the inbound data flow. Adds links to say the Client authenticates to the vault to get a key.

CP-CuPuSCC+c

Finds a client accessing a service indirectly, via one intermediary which communicates directly with both, plus the auth channels between client and service and between each and the intermediary process. Adds dependency links between the channels.

CP-CCDFSDAScDA-c+z

Finds a data flow to a service from an indirect client, where the service encrypts the data flow to create an outbound data asset controlled by a vault, which does not control the inbound data flow. Adds links to say the Client authenticates to the vault to get a token, and the Service exchanges this for keys, verifying rights of the indirect client.

CP-ScDASDACCDF-c+z

Finds a data flow from a service requested by an indirect client, where the service creates the data flow by decrypting an inbound data asset controlled by a vault, which does not control the outbound data flow. Adds links to say the Client authenticates to the vault to get a token, and the Service exchanges this for keys, verifying rights of the indirect client.

CP-CS-SP+DX

Finds a client using a service, both of which are able to exchange data, and having at least one service channel indicating they are communicating with each other directly (not via a proxy), and creates a Data Exchange between them.

CP-CuPnS-U+U

Finds a client accessing a process that directly or indirectly uses a service, where the process shares or forwards client credentials and sends them to the service, and there is no link saying the client is sending shared credentials to the service. Adds this link.

CP-PnPnS-U+U

Finds a client using a service with shared or forwarded credentials, where the service uses another service in the same way, and there is no link yet indicating that the client and the second service are in a credential sharing chain. Adds this missing link.

CP-PccCuS+N

Finds a client using a service for application or authentication, not via a remote access service, where both client and service are controlled by the same process. Adds a link to specify that the client is sharing or forwarding credentials used at the service.

CP-CuScS+N

Finds a client using a service for application or authentication and also controlled by the service. Adds a link to say that the first process uses forwarded or shared credentials to authenticate with the second.

CP-CucSaP+c

Finds a Client using a Service with forwarded or shared credentials, and also using a third Process for authentication which controls the Service without being used by it. Adds a link to specify that the Client forwards credentials also to the authenticator Process.

CP-HRASuPScS+c

Finds a host running a remote access service that launches a process which uses a service, where the service and the process are controlled by the same authenticator, implying that the process accesses the service using a token shared with it by a client. Adds a link indicating the token is passed via the remote access service from its client.

CP-CuPvSCC+c

Finds a client accessing a service indirectly, where there is more than one intermediary, plus the first intermediary adjacent to the client, and channels between client and service and between the client and this intermediary process. Adds dependency links between the channels.

CP-HRASuPcS+c

Finds a host running a remote access service that launches a process which uses a service by which it is also controlled, implying that the process uses forwarded credentials to access the service. Adds a link indicating the credentials are forwarded via the remote access service from its client.

CP-HRASuPcC+c

Finds a host running a remote access service that launches a process which is used by a client that it also controls, implying the client forwards credentials to the process. Adds a link indicating credential forwarding goes via the remote access service.

CP-ScDACDACCDF-c+a

Finds a data flow to a service from an indirect client, where the client creates the data flow from an inbound data asset controlled by a vault, which does not control the outbound data flow. Adds links to say the Client authenticates to the vault to get a key.

CP-HuRACP+i

Finds a human interacting with a remote access client on a local host that is remotely using a process that is not a proxy, adds a link specifying that the human can interact remotely with the process.

CP-RTvSPHP-iPL-RAS+LnS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used via a reverse proxy chain by a Remote Terminal client, not mediated by a collocated remote access service. Adds an inferred mediating Login Service.

CP-RDvSPHP-iPL-RAS+DtS

Finds a Host running a Process that is neither a remote access service nor a reverse proxy, but is used via a reverse proxy chain by a Remote Desktop client, not mediated by a collocated remote access service. Adds an inferred mediating Desktop Service.

CP-RTvSPCP+uR

Finds a remote terminal client using a reverse proxy chain that provides access to a console (command line interactive) process. Adds links specifying that the client accesses the proxy and process remotely.

CP-RDvSPIP+uR

Finds a remote desktop client using a reverse proxy chain that provides access to an interactive process. Adds links specifying that the client accesses the proxy and process remotely.

CP-RTvSPRAS+uR

Finds a remote terminal client using a reverse proxy chain that provides access to a remote access service. Adds links specifying that the client accesses the proxy and service remotely.

CP-RDvSPDtS+uR

Finds a remote desktop client using a reverse proxy chain that provides access to a remote desktop service. Adds links specifying that the client accesses the proxy and service remotely.

CP-CuPiS-i+i

Finds a client process using a service indirectly using another service, where there is no link yet indictating that the client could communicate indirectly with the second service. Adds the missing link.

CP-CuPuS-i+i

Finds a client process using a service using another service, where there is no link yet indictating that the client could communicate indirectly with the second service. Adds the missing link.

CP-CuSPvS-U+U

Finds a client directly using a reverse proxy that uses a service, where the client has as yet no link indicating that the client is indirectly using the service. Adds the missing links.

CP-SPvSPvS-U+U

Finds a reverse proxy using a second reverse proxy that uses a service, but with no link indicating that the first proxy may indirectly use the service. Adds the missing link.

CP-SPuS+U

Finds a reverse proxy directly using a service, and adds a link marking the relationship as service use as a proxy.

CP-SP+iP

Finds a solo reverse proxy process, and adds an isProxy self-referential link so the process can be selectivly included or excluded in later patterns.

CP-RACvSPHRASP-iPL+uR

Finds a host running a process that is not a reverse proxy or a remote access service, and a remote access service that uses the process, and is used via a reverse proxy chain by a remote access client. Adds links to specify that the remote access client has remote access to the service via the proxy and the RAS.

CP-DFDSfP+fVP

Finds a DataFlow via a DataStep from a Process, and adds a link to say the DataFlow goes via the Process.

CP-HRASuPCcS+c

Finds a host running a remote access service that launches a process which is used by a client where both it and the client are controlled by the same authenticator, implying the client forwards credentials obtained from the authenticator to the process. Adds a link indicating the credentials are forwarded via the remote access service.

CP-DFuCuS-C-P+u

Finds a data flow via two processes, one of which is indirectly a client of the other via a chain of credential sharing/forwarding intermediaries, and the Client has no other client in the same chain, and the service has no other service in the same chain. Adds a uses relationship from the client to the service, since the client must access the service via the chain in order to exchange data.

CP-CzS-CC+AC

Finds a client providing authorization claims to a remote service, where there is no client channel linking the two. Adds an Auth Channel to represent the indirect relationship.

CP-DFtP+fVP

Finds a DataFlow to a Process, and adds a link to say the DataFlow goes via the Process.

CP-CCSCtSg+tSg

Finds a Client Channel via a Service Channel that goes via a Logical Segment, and inserts the same relationship from the Client Channel.

CP-CCSCvI+vI

Finds a Client Channel via a Service Channel that goes via an Interface, and inserts the same relationship from the Client Channel.

CP-CCSCtI+tI

Finds a Client Channel via a Service Channel that goes to an Interface, and inserts the same relationship from the Client Channel.

CP-CCSCfI+fI

Finds a Client Channel via a Service Channel that goes from an Interface, and inserts the same relationship from the Client Channel.

CP-CCSCvLS+vLS

Finds a Client Channel via a Service Channel that visits a Logical Subnet, and inserts the same relationship from the Client Channel.

CP-CCSC+ch

Adds a relationship between client and service channels between the same pair of processes.

CP-SCCHNPLS-lI+lI

Finds a Service Channel via a Logical Path from a Client, the Client Host, Subnet and Interface, where the Service Channel has no last interface, and sets this to the client interface.

CP-SCLSgfTS+lI

Finds a Service Channel traversing a NAT segment (with its interfaces) after which source addresses can be distinguished from a client, and adds the outbound interface from the segment as the last interface for the Service Channel

CP-SCvLS-vS+fS

Finds a service channel that visits a Logical Subnet, and there is no relationship indicating that source addresses cannot be distinguished from a client, and adds a relationship indicating that they can.

CP-SCLSgvTS-vS+vS

Finds a service channel traversing a logical segment, where the subnet after the segment has source addresses that cannot be distinguished from a client source address, and adds a link to indicate the same must be true of the subnet before the segment.

CP-SCNSg+vS

Finds a Service Channel that traverses a NAT segment, and adds a link to specify that source addresses in the subnet before the segment cannot be distinguished from the client source address.

CP-CuvS+CC

Finds a client indirectly accessing a process via a credential sharing/forwarding chain, and adds a client channel representing their trust relationship.

CP-SCLSg+vf

Finds a service channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host, and adds dependencies on the outbound interface to the service channel.

CP-SCLSg+vt

Finds a service channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host, and adds dependencies on the inbound interface to the service channel.

CP-CuPvnS+n

Finds a client accessing a process that is in a credential forwarding chain with a service used indirectly by the client (i.e., the service is at the end of the chain). Adds links to say the back end service handles authentication for former.

CP-CScP-v+AA

Finds a client using a service, where the service is controlled by another process that is not itself used by the service, i.e. the process is an OIDC-style authenticator. Adds relationships specifying that the client is redirected to the authenticator by the service, and does not authenticate directly with the service.

CP-CaS-SP+CC

Adds a Client Channel between a Client and Service that communicate directly (not via a proxy).

CP-CSL0H+SC

Finds a client channel whose client and service are collocated on a host that is not a cluster, and an internal (socket) LAN provided by the host accessible in a space, and inserts a service channel between client and service via the socket LAN.

CP-CzSzP+AA

Finds a client sending an authorization token to a service which uses a separate OAuth-style process to validate and exchange the token.

CP-CSL1H2+SC

Finds a client and service whose hosts are paired, and creates a service channel via the pair.

CP-CSLSH2-SC+SC

Finds a client and service on different hosts connected to the same subnet that is not a hotspot, and adds a service channel on the zero-length path via the common subnet.

CP-CSLS2H2-SC+SC

Finds a client and service between which there is as yet no service channel, running on different unpaired hosts connected to different logical subnets that are not hotspots, connected by a network path in which neither host is a gateway, and adds a service channel between client and service.

CP-SCLPLSg+t

Finds a service channel via a logical path that traverses a logical segment, and adds the dependency to the service channel.

CP-CSL3H+SC

Finds a client channel whose client and service are collocated on a cluster host that is accessible in a space, and an L3 Subnet connecting to the cluster, and inserts a service channel between client and service via the Subnet.

CP-SCLPvLS+v

Finds a service channel via a logical path that visits a subnet, adds a link to say the service channel also visits that subnet.

CP-A+iA

Finds a solo Adult, and adds a self referential link marking them as such.

CP-VSVCHC+v

Finds a Virtual Subnet via a Virtual Channel via a Host Channel, and makes the subnet also go via the Host Channel.

CP-HCLPLSg+t

Finds a host channel via a physical path that traverses a logical segment, and adds the dependency to the host channel.

CP-HCLPvLS+v

Finds a host channel via a physical path that visits a subnet, and adds the dependency to the host channel.

CP-VSVCHCLS+uPS

Finds a Virtual Subnet over which interprocess communication goes on a Host Channel via a physical subnet, and adds a link denoting the dependency of the virtual subnet on the physical.

CP-HCLSg+vt

Finds a host channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host, and adds dependencies on the inbound interface to the host channel.

CP-SC4HVSVC+vVC

Finds a Service Channel crossing a Virtual Subnet between two Hosts, and the Virtual Channel representing the physical connectivity requirement to support this communication, and adds a dependency between the Service Channel and this Virtual Channel.

CP-SC4HVSHC+vHC

Finds a Service Channel crossing a Virtual Subnet between two Hosts, and the Host Channel representing a physical network path supporting this communication, and adds a dependency between the Service Channel and this Host Channel.

CP-VCH2LS2PP+HC

Finds a virtual subnet communication path between physical hosts, including the virtual channel, path generator and the start and end subnets, and inserts a host channel linked with this network path.

CP-HCLSg+vf

Finds a host channel that traverses a logical segment, along with the inbound and outbound interfaces to the segment host, and adds dependencies on the outbound interface to the host channel.

CP-H2dPH2+VC

Finds two hosts on a virtual subnet that are on the path of a service channel, with their interfaces and their (distinct) physical hosts, and creates a virtual channel representing a dependency on physical communication between the physical hosts.

CP-VHHsD-HsS-S+S

Finds a Virtual Host above another Host in a virtualisation stack where both store the same Data, there is no lower level host in the stack that also stores the data, and the second host does not run a Process that serves the Data, and adds such a service.

CP-HumHVH-Hu+m

Finds an unmanaged VirtualHost provisioned at a Host managed by a Human, and makes the Human manager also of the Virtual Host.

CP-HVHS+VS

Finds a virtual host provisioned by another host in a physical location, and adds a HostLAN providing connectivity to the virtual host, provided by its host, and accessible in that location.

CP-DCCVH-LS+LS

Finds a Data Centre with a Cluster on which is provisioned a Virtual Host that is not connected to any logical subnet, and adds a virtual subnet provided by the Data Centre to enabled access.

CP-DCVHVS-H+p

Finds a Host that is physically in a DataCentre and connected to a virtual subnet that is not provided by any host, and makes the DataCentre provider of the virtual subnet.

CP-VHPhDHS-HsS-S+u

Finds a Virtual Host running a Process that handles Data but does not access it via a service, where its host is in a virtualisation stack above a second Host running a service for the Data, and there is no host between the two in the virtualisation stack running a Process that Serves the Data. Adds a link specifying the the Process uses the data service on the second Host.

CP-VHPH+hPH

Finds a VirtualHost that is above a Physical Host in the virtualisation stack, and adds a hasPhysicalHost link between them.

CP-VH2H-a+a

Finds three hosts with relationships indicating they are related in the virtualisation stack, and adds a relationship connecting the highest to the lowest.

CP-HVH-a+a

Finds a virtual host provisioned by another host and inserts a relationship indicating which is higher up the virtualisation stack.

CP-EH+iS

Finds a (virtual) Host that is scalable (replicable), and marks it as such by adding a self-referential link.

CP-CCSCVC+ch

Finds a Client Channel via a Service Channel via a Virtual Channel, and adds the Virtual Channel dependency to the Client Channel.

CP-HL+iH

Finds a solo HostLAN and marks it as such by adding a self-referential relationship. This is used later to exclude HostLAN assets in a construction pattern that refers to a base class.

CP-CCSCHC+ch

Finds a Client Channel via a Service Channel via a Host Channel, and adds the Host Channel dependency to the Client Channel.