[Paper Review] Controlled Query Evaluation for Datalog and OWL 2 Profile Ontologies

Bernardo Cuenca Grau, Evgeny Kharlamov+2 more|arXiv (Cornell University)|Apr 24, 2015

Access Control and Trust28 references22 citations

TL;DR

This paper introduces controlled query evaluation (CQE) for Datalog and OWL 2 profile ontologies, proposing two optimal censoring mechanisms—view censors and obstruction censors—that maximize information access while enforcing confidentiality. It proves that optimal censors exist for linear Datalog and OWL 2 QL when ontologies are uniformly bounded, and provides a tractable algorithm for computing optimal obstruction censors in such cases.

ABSTRACT

We study confidentiality enforcement in ontologies under the Controlled Query Evaluation framework, where a policy specifies the sensitive information and a censor ensures that query answers that may compromise the policy are not returned. We focus on censors that ensure confidentiality while maximising information access, and consider both Datalog and the OWL 2 profiles as ontology languages.

Motivation & Objective

• To address confidentiality in semantic data by enforcing policies without over-restricting query access.
• To develop censors that maximize information leakage while preventing policy violations in Datalog and OWL 2 profile ontologies.
• To ensure censors are implementable using standard reasoning infrastructure, avoiding custom reasoning extensions.
• To characterize the conditions under which optimal censors exist, particularly for OWL 2 QL and linear Datalog.
• To establish a duality between view-based and obstruction-based censors, showing their capabilities are incomparable.

Proposed method

• Introduces view censors that return answers based on a sanitized dataset with labeled nulls, ensuring only information in the view is exposed.
• Introduces obstruction censors that block answers matching forbidden query patterns, defined by a set of forbidden subgoals.
• Defines a duality between view and obstruction censors, where each specifies what information is either allowed or denied.
• Proposes a tractable algorithm to compute optimal obstruction censors for linear Datalog ontologies by analyzing proof length and subgoal homomorphisms.
• Uses proof normalization and homomorphism checks to determine minimal pseudo-obstructions for policy enforcement.
• Applies the framework to OWL 2 QL by encoding its axioms as Datalog rules and analyzing bounded proof lengths.

Experimental results

Research questions

• RQ1 Under what conditions does an optimal censor exist for Datalog and OWL 2 profile ontologies?
• RQ2 Can optimal censors be computed efficiently using off-the-shelf reasoning systems?
• RQ3 What is the relationship between view censors and obstruction censors, and how do their expressive powers compare?
• RQ4 Is the existence of an optimal view censor decidable for general Datalog ontologies?
• RQ5 What structural properties of ontologies (e.g., linearity, uniform boundedness) ensure the existence of optimal obstruction censors?

Key findings

• The existence of an optimal view censor is undecidable for general Datalog ontologies.
• Optimal view censors always exist for certain Datalog fragments, including linear and tree-shaped ontologies.
• For linear Datalog and OWL 2 QL, an optimal obstruction censor exists if and only if the ontology is uniformly bounded.
• A tractable algorithm exists to compute optimal obstruction censors for linear Datalog and OWL 2 QL when the ontology is uniformly bounded.
• The capabilities of view and obstruction censors are incomparable: neither can express all the behaviors of the other.
• The paper provides a finite pseudo-obstruction set that enables the construction of an optimal obstruction censor when the ontology is uniformly bounded.