CONTEXT-AWARE ACCESS CONTROL AND PRESENTATION OF LINKED DATA
Luca COSTABELLO 29 November 2013
PhD Thesis Defence
2
Mobile Guide Museum triplestore
“Paintings metadata accessible only to on-site visitors.”
“Is it optimized for my tablet?”
“Does it provide practical information when I am on my way?”
“Does it have a visually-impaired mode?”
“Museum Data accessible this week only”
“Metadata can be edited by employers only”
3
How Does Mobile Context Influence Linked Data Access?
Context-Aware Linked Data Presentation
Context-Aware Linked Data
Access control
Mobile Context Model
Outline
4
Mobile Context Model 1 Presentation Model
Enforcing Access Control with Web Standards
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
Outline
5
Mobile Context Model 1 Presentation Model
Enforcing Access Control with Web Standards
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
Mobile Context Model • PRISSMA Ontology
6
7
Context Ontologies
SOU
PA
CoO
L
CON
ON
CoD
aMoS
Korp
ipää
Her
vás
DCO
Domain independence ✓ ✓ ✓ ✓ ✓ ✓ ✓ Coverage ✓ ✓ ✓ ✓ Variable Context Granularity ✓ Extensibility ✓ ✓ ✓
PRIS
SMA
✓ ✓
✓ ✓ ✓ ✓ ✓
Core ontology approach ✓ ✓ ✓ ✓ ✓ Lightweight Ontology
Reuse of Existing Terms
Availability on the Web ✓
The PRISSMA vocabulary
8
http://ns.inria.fr/prissma
Example: at the museum
9
:atTheMuseum a prissma:Context ;! prissma:environment :museumEnv .!!:museumEnv a prissma:Environment ;! prissma:poi :museumGeo.!!:museumGeo geo:lat "48.86034" ;! geo:long "2.337599" ;! prissma:radius ”200" .!!
prissma:environment
2.337599
48.86034
200
:museumGeogeo:lat
geo:long
prissma:radius
prissma:poi
prissma:Environment
prissma:Context:atTheMuseum
:museumEnv
Outline
10
Mobile Context Model 1 Presentation Model
Enforcing Access Control with Web Standards
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
Presentation Model • Extending Fresnel with PRISSMA
11
12
NA
C
Laak
ko
Chen
Zhan
g
Cham
aleo
n
Butt
er
Pate
rnò
MIM
OSA
CAM
B
Adi
pat
COIN
CSS
Med
ia
Que
ries
PRIS
SMA
Linked Data support ✓ Context-awareness ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ Standard Languages ✓ ✓ ✓ ✓ ✓ ✓ ✓ Runtime adaptation ✓ ✓ ✓ ✓ Multimodality ✓ Client-side only ✓ ✓ ✓ ✓ ✓ Evaluation ✓ ✓ ✓ ✓ ✓
Adaptive Presentation Frameworks for the Web
13
Presentation Frameworks for the Semantic Web
Hay
stac
k
Noa
dste
r
Surr
ogat
es
Declarative approach ✓ ✓ Domain Independence ✓ ✓ ✓ Standard Languages ✓ ✓ Context Awareness
Automatic stylesheets
Evaluation
Distribution
Multimodality ✓
Xeno
n
Tal4
Rdf
LESS
Hid
e th
e St
ack
LDVM
✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓
✓ ✓
Fres
nel
✓ ✓ ✓
✓
PRIS
SMA
✓ ✓ ✓ ✓
✓
✓
Fresnel [Pietriga et al. 2006]
14
Retrieved from [Pietriga et al. 2006]
Content formatting and additional
content!
Content selection and ordering!
Styling instructions for fonts, colors, and
borders!
15
:paintingGroup a fresnel:Group ;! fresnel:stylesheetLink <http://example.org/style.css> .!!!:paintingLens a fresnel:Lens;! fresnel:group :paintingGroup ;! fresnel:classLensDomain art:Painting ;! fresnel:showProperties (dc:title! dc:creator) .!!!:titleFormat a fresnel:Format ;!
!fresnel:group :paintingGroup ;!!fresnel:propertyFormatDomain dc:title ;!!fresnel:valueStyle ”title"^^fresnel:styleClass .!
!!!!!!!!!
Fresnel Example
Lens
Format
16
Extending Fresnel with PRISSMA
Context
PRISSMA Prism
Context Description
PRISSMA Context
Prism
fresnel:Purposeowl:equivalentClass
Extending Fresnel with PRISSMA
17
Context
Prism
Prismfresnel:Groupowl:equivalentClass
fresnel:purpose
fresnel:Lens
fresnel:Format
fresnel:group
fresnel:group
[ISWC DC, 2011]
18
:PaintingPrism a prissma:Prism, fresnel:Group ;! fresnel:stylesheetLink <http://example.org/style.css> ;!
!fresnel:purpose :atTheMuseum .!!:foaflens a fresnel:Lens;! fresnel:group :foafPrism;! fresnel:classLensDomain art:Painting ;! fresnel:showProperties (foaf:name! dcn:author) .!!:depictionFormat a fresnel:Format ;!
!fresnel:group :foafPrism ;!!fresnel:propertyFormatDomain foaf:name ;!!fresnel:valueStyle "depiction"^^fresnel:styleClass .!
!:atTheMuseum a prissma:Context ;! prissma:environment :museumEnv .!!:museumEnv a prissma:Environment ;! prissma:poi :museumGeo .!!:museumGeo geo:lat "48.86034" ;! geo:long "2.337599" ;! prissma:radius ”200" .!
Prism, Example
Lens
Format
Context
Prism
ExamplesPRISSMA Browser for Android
19
Smartphone, user walking in museum town. Tablet, user at home.
Outline
20
Mobile Context Model 1 Presentation Model
Enforcing Access Control with Web Standards
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
Error-Tolerant RDF Matching • Prism Selection Algorithm
21
Presentation Metadata Selection
22
Prism
:actualContext
Prism
:smartphoneMoving
Prism
:tabletAtHome
:maleVisitorAtTheMuseum
23
Ambiguity Incompleteness
The Problem of Context Imprecision
Sensor Noise
2.32434
48.843453
:poigeo:lat
geo:long
10
prissma:radius
2.337599
48.86034 5
:poigeo:lat
geo:long
prissma:radius
:user1
"computers"
foaf:interest
:user1
"computer science"
foaf:interest
:user1
:Karl :Anita
prissma:nearbyEntity
:John
:user1
:Karl :Anita
prissma:nearbyEntity
24
Error-tolerant matching for RDF Graphs
iSPA
RQL
Silk
Zou
RDF-specific ✓ ✓ ✓ Data Heterogeneity
Client-side Execution
Incremental index updates ✓ Selective matching cache
PRIS
SMA
✓ ✓ ✓ ✓
Mes
smer
and
Bu
nke
✓
Adapting Messmer to RDF and Mobile Context Optimal error-tolerant subgraph isomorphism algorithm
based on graph edit distance.
25
• Atomic element might be a graph: Context Units
• Core Classes • Entities • Literals • Geo • Time
• Customized Cost Functions • Strings (Monge-Elkan) • Geographic (Haversine distance + Decay) • Temporal (Interval Inclusion + Decay) • Missing nodes
2.32434
48.843453
:poigeo:lat
geo:long
10
prissma:radius
Extensions:
Prism Selection: Decomposition
26
prissma:environment
2.337599
48.86034
200
:museumGeogeo:lat
geo:long
prissma:radius
prissma:poi
prissma:Environment
prissma:Context:atTheMuseum
:museumEnv
prissma:Context
0 48.86034-2.337599
200
geo:latgeo:lon
prissma:radius
1
:museumGeo
prissma:Environment
2
{3,1,2,{prissma:poi}}
{4,0,3,{prissma:environment}}
:atTheMuseum
Context Units
Prism Selection: Search Algorithm!
1 foreach context unit S in D do!
2 compute_subgraph_isomorphisms(S,GI)!3 !
4 while C(fcheapest)< T { !
5 if S1 is Prism then!
6 R.add(S1)!7 !
8 foreach child of S1 do!
9 fchild= combine(fS1,fS2)!
10 }!11 return R!
27
prissma:Context
0 48.86034-2.337599
200
geo:latgeo:lon
prissma:radius
1
:museumGeo
prissma:Environment
2
{3,1,2,{prissma:poi}}
{4,0,3,{prissma:environment}}
:atTheMuseum
prissma:environment
2.3243448.843453
:actualPOI
geo:latgeo:long
prissma:poi
:ActualCtx:actualEnv
10
prissma:radius
C=0 ! C=0.34! C=0 !
1. Compute context units isomorphisms costs
Prism Selection: Search Algorithm!
1 foreach context unit S in D do!
2 compute_subgraph_isomorphisms(S,GI)!3 !
4 while C(fcheapest)< T { !
5 if S1 is Prism then!
6 R.add(S1)!7 !
8 foreach child of S1 do!
9 fchild= combine(fS1,fS2)!
10 }!11 return R!
28
prissma:Context
0 48.86034-2.337599
200
geo:latgeo:lon
prissma:radius
1
:museumGeo
prissma:Environment
2
{3,1,2,{prissma:poi}}
{4,0,3,{prissma:environment}}
:atTheMuseum
prissma:environment
2.3243448.843453
:actualPOI
geo:latgeo:long
prissma:poi
:ActualCtx:actualEnv
10
prissma:radius
C=0 ! C=0.34! C=0 !
C=0.17 !
C=0.09 !
T=0.6 !
✓ ✓ ✓
✓
✓ 2. Combine costs
Evaluation: Memory Consumption
29
0
50
100
150
200
250
300
0.1 0.3 0.5 0.7 0.9
Dec
ompo
siti
on It
ems
Percentage of common context units
Total decomposition Items Context Units (decomposition) Context Units (raw prisms)
0
5
10
15
20
25
0.1 0.3 0.5 0.7 0.9
Mem
ory
[KB]
Percentage of common context units
PRISSMA decomposition Jena Models
Evaluation: Response Time
30
If prisms are completely different if prisms are highly similar
→
Outline
31
Mobile Context Model 1 Presentation Model
Enforcing Access Control with Web Standards
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
Access Control Model
32
33
WA
C
Prot
eus
Abe
l
Fini
n
Flou
ris
PPO
ubiC
osm
Shi3
ld
HTTP Operations ✓ ✓ ✓ ✓ ✓ SPARQL ✓ ✓ Attribute-Based AC Model ✓ ✓ ✓Policies in RDF/SPARQL ✓ ✓ ✓ ✓ ✓ Resource-level Granularity ✓ ✓ ✓ ✓ Context Awareness ✓ ✓ ✓ ✓ Conflict Verification ✓ ✓ ✓ Evaluation ✓ ✓ ✓ ✓ ✓
Access Control Frameworks
Context-Aware Access Control Model [ECAI 2012]
34
UserDevice
Environment
Context
environment
device user
AccessConditionSet
AccessCondition
DisjunctiveACS
ConjunctiveACSsubClassOf
subClassOf
AccessPolicy
hasAccessCondition
AccessPrivilege
hasAccessPrivilegeappliesTo
hasAccessConditionSet
hasContexthasQueryAsk
s4ac:[Villata 2011]
Sample Access Policy
35
:policy1 a s4ac:AccessPolicy; ! s4ac:appliesTo :resource; ! s4ac:hasAccessPrivilege s4ac:Read;! s4ac:hasAccessConditionSet :acs1.!!:acs1 a s4ac:AccessConditionSet; ! s4ac:hasAccessCondition :ac1.!!:ac1 a s4ac:AccessCondition;!
! s4ac:hasQueryAsk !!"""ASK !! !{?ctx a prissma:Context; !! ! prissma:environment ?env;!! ! prissma:user <http://example.org/john.rdf#me>. !! !?env prissma:currentPOI ?poi. !! !?poi prissma:based_near ?p.!! !?p geo:lat ?lat;geo:lon ?lon.!! !FILTER(((?lat-45.8483) > 0 && (?lat-45.8483) < 0.5!! !|| (?lat-45.8483) < 0 && (?lat-45.8483) > -0.5)!! !&& ((?lon-7.3263) > 0 && (?lon-7.3263) < 0.5 !! !|| (?lon-7.3263) < 0 && (?lon-7.3263) > -0.5 ))}""".!
Protected resource
Access Condition to be verified: «User must be John and request must come from a specific location»
36
Policy Manager New Named Graph creation
Access Privileges assignment
Policy Manager
37
Time-based access condition
Location-based access condition
Outline
38
Mobile Context Model 1 Presentation Model
Enforcing Access Control
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
Enforcing Access Control • The Shi3ld Framework
39
40
SELECT … !WHERE {…}!
Shi3ld Framework
GET /data/resource HTTP/1.1!
SPARQL (Shi3ld-SPARQL)
HTTP Operations (Shi3ld-HTTP) • SPARQL Graph Store Protocol (GSP) • Linked Data Platform (SPARQL-less)
[ECAI 2012]
[ESWC 2013]
INSERT DATA { !GRAPH :ctx1{…}}!
Authorization Procedure
41
UserDeviceEnvironment
Context
environmentdeviceuser
<http://carl-johnson.org#me>:env_AC1
<http://alice.org#me>
p:nearbyEntity
p:user p:environment
p:nearbyEntity
:ctx_AC1
foaf:gender"male"
1. Adding Client Attributes to the Query (SPARQL)
SELECT … !WHERE {…}! +
Authorization Procedure
42
Authorization: Shi3ld <...>!
UserDeviceEnvironment
Context
environmentdeviceuser
<http://carl-johnson.org#me>:env_AC1
<http://alice.org#me>
p:nearbyEntity
p:user p:environment
p:nearbyEntity
:ctx_AC1
foaf:gender"male"
1. Adding Client Attributes to the Query (HTTP)
GET /data/resource HTTP/1.1!Host: example.org!!
43
ASK {?context a prissma:Context; ! prissma:user ?u;! prissma:environment ?e.! ?u rel:employedBy :Louvre_Museum.! ?e prissma:nearbyEntity :Director. !} !
="false"
VALUES (?context) {(:client_attributes)}!
GET /data/resource HTTP/1.1!Host: example.org!Authorization: Shi3ld <...>!
Authorization Procedure
2. Access Conditions Execution
INSERT DATA { !GRAPH :ctx1{…}}!
Authorization Procedure
44
3. Response Construction (SPARQL)
SELECT …!FROM :ng2,:ng3!WHERE {…}!
SELECT … !WHERE {…}!
:ng2!
:ng1!
:ng3!
Authorization Procedure
45
401 Unauthorized!
3. Response Construction (HTTP)
Response Time Evaluation (Shi3ld-SPARQL)
46
Corese-KGRAM SPARQL Engine 3.0.14 with Berlin SPARQL Benchmark Dataset 3.1
Dataset size still predominant Small fraction access granted → Faster
More context updates, more consumers → Slower
Response Time Evaluation (Shi3ld-HTTP)
47
Jena Fuseki 0.2.6 (Shi3ld-GSP), Corese-KGRAM 3.0.14 (Shi3ld-LDP)
• Response time linear w/ AC number
• Shi3ld-HTTP SPARQL-less: 25% faster
• AC complexity does not affect response time
Conclusions
48
49
Mobile Context Model 1 Presentation Model
Enforcing Access Control with Web Standards
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
How Does Mobile Context Influence Linked Data Access?
50
Mobile Context Model 1 Presentation Model
Enforcing Access Control with Web Standards
2
5
Error-Tolerant Subgraph Matching for Context Graphs 3
Access Control Model 4
Limitations and Open Issues
Machine learning to optimize cost functions parameterization.
Prisms Distribution: Linked Presentation-level Metadata.
User acceptability evaluation campaign.
Trustworthiness of Client Context
Explanation mechanism for “access denied” responses.
Deeper privacy-preserving mechanism.
Perspectives
51
Enhanced Information Retrieval for mobile users
Context-based Linked Data Discovery
Web of Data interlinking
Thanks
52
• L. Costabello. PRISSMA, Towards Mobile Adaptive Presentation of the Web of Data. Doctoral Consortium, ISWC 2011.
• L. Costabello, S. Villata, N. Delaforge and F. Gandon. Linked Data Access Goes Mobile: Context-Aware Authorization for Graph Stores, LDOW 2012.
• L. Costabello, S. Villata and F. Gandon. Context-Aware Access Control for RDF Graph Stores. ECAI 2012.
• S. Villata, L. Costabello, N. Delaforge and F. Gandon. A Social Semantic Web Access Control Model. Journal on Data Semantics, Springer, 2013.
• L. Costabello, S. Villata. O. Rodriguez-Rocha and F. Gandon. Access Control for HTTP Operations on Linked Data, ESWC 2013.
PRISSMA Shi3ld
wimmics.inria.fr/projects/prissma wimmics.inria.fr/projects/shi3ld
http://luca.costabello.info
Top Related