Use of OWL and SWRL for Semantic Relational Database Translation
SWRL-based Access Policies for Linked Data
-
Upload
hannes-muehleisen -
Category
Technology
-
view
743 -
download
0
description
Transcript of SWRL-based Access Policies for Linked Data
SWRL-Based Access Policies for Linked Data
Hannes Mühleisen, Martin Kost and Johann-Christoph Freytag
Databases and Information SystemsDepartment of Computer Science
Humboldt-Universität zu Berlin
“Social Web”
What about the system operator?
2
Overview
1. Linked Data principles (short)
2. Access policies / data classification
3. “Policy enabled Linked Data Server” concept
4. PeLDS implementation and evaluation
3
http://example.com/bob
http://example.com/bob
ex:spouse
http://example.com/alice
ex:phoneex:name
“Bob Ross” “+4930123456”
Literal
Resource
asdf Property
Legende
Graph
“a”
http://example.com/alice
“42° 21′ 32″ N 71° 5′ 34″ W”
“Alice Ross”
http://example.com/alice
ex:pos ex:name
HT
TP R
eq.
Linked Data: URLs as identifiers / dereferencing
4
Access Policies
• Set of rules, its evaluation determines whether a user can access certain information
• Different types: DAC, MAC, RbAC
• Generic system should support many types
• Data classification required
• Linked Data: classify protected parts of a graph
• Different levels of classification conceivable: syntax, model, concepts
5
Resource == http://example.com/bobProperty == ex:nameValue == *
Model-based Classification
• Data classification on a structure-preserving decomposition of the graph (set of triples)
• Resource, property and value of triples can be specified, wildcards select unknown entries.
• Example:http://
example.com/bob
ex:name“Bob Ross”
6
Concept == http://example.com/per#Person
Concept-based Classification
• Data classification on a structure of concepts and properties
• Resources and their properties can be classified using their affiliation with a concept
• Example:http://
example.com/bob
ex:name“Bob Ross”
rdf:type http://example.com/per#Person
7
ConceptPolicy enabled Linked Data Server
• Policy language PsSF
• Policy evaluation algorithms
• Data and policy management operations
• Secure authentication
8
• Description Logic (DL) expressions based on the Semantic Web Rule Language (SWRL)
• Prolog-style syntax for concise notation
• Additional predicates for model- and concept-based data classification:
• permit_triple(...), permit_instance(...)
Policy Language PsSF
9
BobPosRule:QueryAction(?action) && actor(?action, http://example.com/bob)=>permit_triple(http://example.com/alice,ex:pos,*);
“42° 21′ 32″ N 71° 5′ 34″ W”
“Alice Ross”
http://example.com/alice
ex:pos ex:name
PsSF Policy Language: Example
10
Policy evaluation - Query
• For each rule contained in the policy, check whether their preconditions are met
• Approve graph elements classified by matching rules by adding them to a temporary RDF graph for the current user only containing authorized graph elements
• Evaluate queries or dereferencing requests exclusively on those temporary graphs
11
Secured Graph
H
W
Asp
psZwp
“Bob”
nm
Temporary Graph
H
Asp
“Bob”
nm
Access Policy
Rule 1
H *sp
* *nm
✔
✔
Step 1
Query
H *nm
?
Query Result
R1nm
“Bob”
Step 2
12
Required Operations
• Definition & modification of access policies
• Publication & modification of RDF graphs
• Querying RDF graphs
• URL dereferencing
13
Authentication
• Username/password-combinations are unpractical for Linked Data
• Central authority would violate the decentralization principle inherent in the WWW
• FOAF+SSL enables password-free authentication based on SSL certificates
14
PeLDS Implementation
• Linked-Data-Server with HTTP API
• Supports PsSF policy language
• FOAF+SSL for user authentication
• Demo: Distributed Address Book
15
16
Demo Application: Distributed Address Book
Alice’s View
Bob’s View
12,5
25
37,5
50
450 1462,5 2475 3487,5 4500
R! = 0,9959
R! = 0,9943
Pro
cess
ing
tim
e (s)
Triple count
PeLDSJoseki / TDBJoseki / TDB / Pellet
PeLDS prototype - Performance
17
Conclusion
• Access policies and comprehensive data classifications are possible for Linked Data
• PeLDS enables distributed applications with support for access policies
• PeLDS-Implementation is available as open source software from www.pelds.org
18