1. Dr. Bhavani Thuraisingham February 2010 Building Trustworthy Semantic Webs Lecture #14 : OWL (Web Ontology Language) and Security

2. 2 10/28/2015 14:35 Outline of the Unit 0 What are ontologies 0 Why is RDF not sufficient? 0 What are the security issues for ontologies 0 What is OWL? 0 OWL Syntax and Semantics 0 Security Issues with Examples 0 Example: Semantic Access Control 0 Ontology Engineering 0 Summary and Directions

3. 3 10/28/2015 14:35 Ontology 0 Common definitions for any entity, person or thing 0 Several ontologies have been defined and available for use 0 Defining common ontology for an entity is a challenge 0 Mappings have to be developed for multiple ontologies 0 Specific languages have been developed for ontologies

4. 4 10/28/2015 14:35 Why RDF is not sufficient? 0 RDF was developed as XML is not sufficient to specify semantics -E.g., class/subclass relationship 0 RDF has issues also -Cannot express several other properties such as Union, Interaction, relationships, etc 0 Need a richer language 0 Ontology languages were developed by the semantic web community for this purpose 0 Essentially RDF is not sufficient to specify ontologies

5. 5 10/28/2015 14:35 Security and Ontology 0 Ontologies used to specify security policies -Example: OWL to specify security policies -Choice between XML, RDF, OWL, Rules ML, etc. 0 Security for Ontologies -Access control on Ontologies =Give access to certain parts of the Ontology

6. 6 10/28/2015 14:35 OWL: Background 0 It’s a language for ontologies and relies on RDF 0 DARPA (Defense Advanced Research Projects Agency) developed early language DAML (DARPA Agent Markup Language) 0 Europeans developed OIL (Ontology Interface Language) 0 DAML+OIL combines both and was the starting point for OWL 0 OWL was developed by W3C

7. 7 10/28/2015 14:35 OWL Features 0 Subclass relationship 0 Class membership 0 Equivalence of classes 0 Classification 0 Consistency (e.g., x is an instance of A, A is a subclass of B, x is not an instance of B) 0 Three types of OWL: OWL-Full, OWL-DL, OWL-Lite 0 Automated tools for managing ontologies -Ontology engineering

8. 8 10/28/2015 14:35 OWL Specification (e.g., Classes) Faculty and Academic Staff Member are the same Associate Professor is not a professor Associate professor is not an Assistant professor

9. 9 10/28/2015 14:35 OWL Specification (e.g., Property) Courses are taught by Academic staff members

10. 10 10/28/2015 14:35 OWL Specification (e.g., Property Restriction) All first year courses are taught only by professors

11. 11 10/28/2015 14:35 Example 0 Before we discuss security for OWL and specify policies in OWL, we need to provide an example of an OWL ontology. 0 The following example describes the University Ontology. The different properties shown are DatatypeProperty (hasCredits) and ObjectProperty (hasTaught, isTaughtBy etc). Sub properties are also shown (‘hasCompleted’ is a sub property of ‘hasRegistered’). The ‘disjointWith’ property ensures that two classes do not have any individuals in common. For example, an individual from the ‘Faculty’ class cannot be an individual of the ‘Student’ class. Using sub properties, policies can be specified. In the following example, a faculty member can access the ‘AnnualReports’ only is she/he is the Dean. 0 Note that OWL uses RDF and hence XML syntax. Furthermore, OWL has more powerful reasoning capabilities. 0 The following example and subsequent security examples will make this clear.

12. 12 10/28/2015 14:35 Example 0 0 <!DOCTYPE rdf:RDF [ 0 0 ]> 0 <rdf:RDF xmlns="http://www.owl-ontologies.com/Ontology1178660130.owl#" 0 xml:base="http://www.owl-ontologies.com/Ontology1178660130.owl" 0 xmlns:xsd="http://www.w3.org/2001/XMLSchema#" 0 xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#" 0 xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" 0 xmlns:owl="http://www.w3.org/2002/07/owl#">

13. 13 10/28/2015 14:35 Example 0

14. 14 10/28/2015 14:35 Example 0

15. 15 10/28/2015 14:35 Example 0

16. 16 10/28/2015 14:35 Example 0

17. 17 10/28/2015 14:35 Example 0

18. 18 10/28/2015 14:35 Example 0 0 <rdfs:comment rdf:datatype="&xsd;string" 0 >This class represents the non-teaching, non-student members of the 0 department 0

19. 19 10/28/2015 14:35 Example 0

20. 20 10/28/2015 14:35 Example 0

21. 21 10/28/2015 14:35 Policies in OWL 0 How can policies be specified? 0 Should policies be specified as shown in the examples, extensions to OWL syntax? 0 Should policies be specified as OWL documents? 0 Is there an analogy to XPath expressions for OWL policies? -

22. 22 10/28/2015 14:35 Policies in OWL: Example Level = L1 Level = L2

23. 23 10/28/2015 14:35 Example 0 “Only those attending a class from a professor has read access to the lecture notes of the professor” 0 Below we specify this policy in OWL. 0

24. 24 10/28/2015 14:35 Example Policies 0 Temporal Access Control -After 1/1/05, only doctors have access to medical records 0 Role-based Access Control -Manager has access to salary information -Project leader has access to project budgets, but he does not have access to salary information -What happens is the manager is also the project leader? 0 Positive and Negative Authorizations -John has write access to EMP -John does not have read access to DEPT -John does not have write access to Salary attribute in EMP -How are conflicts resolved?

25. 25 10/28/2015 14:35 Privacy Policies 0 Privacy constraints processing -Simple Constraint: an attribute of a document is private -Content-based constraint: If document contains information about X, then it is private -Association-based Constraint: Two or more documents taken together is private; individually each document is public -Release constraint: After X is released Y becomes private 0 Augment a database system with a privacy controller for constraint processing

26. 26 10/28/2015 14:35 Access Control Strategy 0 Subjects request access to OWL documents under two modes: Browsing and authoring -With browsing access subject can read/navigate documents -Authoring access is needed to modify, delete, append documents 0 Access control module checks the policy based and applies policy specs 0 Views of the document are created based on credentials and policy specs 0 In case of conflict, least access privilege rule is enforced 0 Works for Push/Pull modes 0 Query Modification?

27. 27 10/28/2015 14:35 System Architecture for Access Control User Pull/Query Push/result OWL Documents RDF- Access RDF-Admin Admin Tools Policy base Credential base

28. 28 10/28/2015 14:35 OWL Databases 0 Data is presented as OWL documents 0 Query language? OWL=QL? 0 Query optimization (depends on query language) 0 Managing transactions on OWL documents 0 Metadata management: OWL schemas? 0 Access methods and index strategies 0 OWL security and integrity management

29. 29 10/28/2015 14:35 Inference/Privacy Control Policies Ontologies Rules OWL Data Management OWL Documents Web Pages, Databases Inference Engine/ Rules Processor (Reasoning in OWL?) Interface to the Semantic Web Technology By UTD

30. 30 10/28/2015 14:35 Semantic Access Control Ashraful Alam Dr. Bhavani Thuraisingham

31. 31 10/28/2015 14:35 Semantic Access Control (SAC) Traditional Access Control Traditional Access Control Semantic Web Semantic Access Control

32. 32 10/28/2015 14:35 Motivation 0 Shortcomings of Traditional Access Control -Proprietary systems -Lack of modularity -Changes in access control schemas break the system -Changes in data schemas break the system -Path to resources (e.g., XPATH) is clumsy //school/department/professor/personal/ssn – LONG! -Non-optimal for distributed/federation environment

33. 33 10/28/2015 14:35 Modularity Problem People this policy applies to Resources this policy applies to Actions allowed for this policy Target Box

34. 34 10/28/2015 14:35 SAC Ontology 0 Written in OWL ( Web Ontology Language ) 0 User-centric 0 Modular 0 Easily extensible 0 Available at : http://utd61105.campus.ad.utdallas.edu/geo/voc/newaccessonto

35. 35 10/28/2015 14:35 SAC Components 0 Subjects: Software Agents or Human clients 0 Resources: Assets exposed through WS 0 Actions: Read, Write, Execute 0 Conditions: Additional constraints (e.g., geospatial parameters) on policy enforcement Resources Subjects Actions Condition Policy Set

36. 36 10/28/2015 14:35 Application: Geo-WS Security 0 Data providers (e.g., geospatial clearinghouses, research centers) need access control on serviceable resources. 0 Access policies have geospatial dimension -Bob has access on Building A -Bob does NOT have access on Building B -Building A and B have overlapping area 0 Current access control mechanisms are static and non-modular.

37. 37 10/28/2015 14:35 Geo-WS Security: Architecture Client DAGISDAGIS DAGISDAGIS Geospatial Semantic WS Provider Enforcement Module Decision Module Authorization Module Semantic-enabled Policy DB Web Service Client SideWeb Service Provider Side

38. 38 10/28/2015 14:35 Geo-WS Security: Semantics 0 Policy rules are based on description logic (DL). 0 DL allows machine-processed deductions on policy base. 0 Example 1: -DL Rule: ‘Stores’ Inverse ‘Is Stored In’ -Fact: Airplane_Hanger(X) ‘stores’ Airplane(Y) 0 Example 2: -DL Rule: ‘Is Located In’ is Transitive. -Fact: Polygon(S) ‘Is Located In’ Polygon(V) Polygon(V) ‘Is Located In’ Polygon(T)

39. 39 10/28/2015 14:35 Secure Inferencing Geospatial Data Store Semantic-enabled Policy DB Inferencing Module Obvious facts Deduced facts

40. 40 10/28/2015 14:35 Geo-WS Security: Example 0 Resource := Washington, Oregon, California, West Coast 0 Rule:= West Coast = WA Union OR Union CA 0 Policy:= -Subject:= Bob - Resources:= WA, OR, CA - Action:=Read 0 Query: Retrieve Interstate Highway topology of West Coast

41. 41 10/28/2015 14:35 SAC in Action 0 Environment: University Campus 0 Campus Ontology http://utd61105.campus.ad.utdallas.edu/geo/voc/campusonto 0 Main Resources -Computer Science Building -Pharmacy Building -Electric Generator in each Building

42. 42 10/28/2015 14:35 SAC in Action 0 User Access: -Bob has ‘execute’ access to all Building Resources -Bob doesn’t have any access to CS Building -Bob has ‘modify’ access to Building resources within a certain geographic extent 0 Policy File located at http://utd61105.campus.ad.utdallas.edu/geo/voc/policyfile1

43. 43 10/28/2015 14:35 SAC Improvements 0 Subjects, Resources, Actions and Conditions are defined independently 0 Reduced policy look-up cost -- only policies related to the requester is processed 0 No long path name!

44. 44 10/28/2015 14:35 Distributed Access Control Travel SiteReimbursement SiteBank Site Travel Data & Ontology Reimbursement Data Bank Site & Ontology Client Query Interface Middleware

45. 45 10/28/2015 14:35 Semantic web technologies discussed so far 0 XML, XML Schema 0 RDF, RDF Schema 0 Ontology, OWL 0 Logic, Rules, Inference 0 Some discussion of security issues for each technology -Policy specification, Securing documents

46. 46 10/28/2015 14:35 Types of Application 0 Horizontal Information Products at Elsevier: Integration 0 Data integration at Audi: Integration 0 Skill finding at Swiss Life: Search 0 Think Tank Portal at EnterSearch: Knowledge man agent 0 E-Learning: Knowledge management 0 Web Services: Web services (for any of the other applications discussed) 0 Multimedia Collection at Scotland Yard: Searching 0 Online Procurement at Daimler Chrysler: E-Business 0 Device Interoperability at Nokia: Interoperability

47. 47 10/28/2015 14:35 Revisiting Ontology 0 Common definitions for any entity, person or thing 0 Several ontologies have been defined and available for use 0 Defining common ontology for an entity is a challenge 0 Mappings have to be developed for multiple ontologies 0 Specific languages have been developed for ontologies -RDF, OWL, DAML+OIL, etc.

48. 48 10/28/2015 14:35 What is Ontology Engineering? 0 Tools and Techniques to -Create Ontologies -Specify Ontologies -Maintain Ontologies -Query Ontologies -Evolve Ontologies -Reuse Ontologies -Incorporate features such as security, data quality, integrity

49. 49 10/28/2015 14:35 Manual Construction of Ontologies 0 Determine Scope 0 Consider Reuse 0 Enumerate Terms 0 Define Taxonomy 0 Define Properties 0 Define facets 0 Define Instances 0 Check for Anomalies

50. 50 10/28/2015 14:35 Reusing Existing Ontologies 0 The goal is not to reinvent the wheel 0 Several ontologies have been developed for different domains 0 Codieid Bodies of Expert Knowledge 0 Integrated Vocabularies 0 Upper Level Ontologies 0 Topic Hierarchies 0 Linguistic Resources 0 Ontology Libraries

51. 51 10/28/2015 14:35 Semi/Automatics Methods for Ontology Generation 0 Much of the research is focusing on developing ontologies using tools from multiple heterogeneous data sources 0 Essentially extracting concepts and expanding on concepts from the data sources 0 Uses combination of data integration, metadata extraction, and machine learning techniques 0 E.g. Clustering of concepts, Classification of concepts etc. 0 Text Book describes Semantic Web Knowledge Management Architecture

52. 52 10/28/2015 14:35 What is Knowledge Management? 0 Knowledge management, or KM, is the process through which organizations generate value from their intellectual property and knowledge-based assets 0 KM involves the creation, dissemination, and utilization of knowledge 0 Ontologies are a form of Knowledge? 0 Reference: http://www.commerce-database.com/knowledge- management.htm?source=google

53. 53 10/28/2015 14:35 Summary and Directions 0 Ontologies are a necessity for the web 0 OWL is getting recognition; several other ontology languages (DAML, OIL, etc.) 0 Very little work on security and ontologies? 0 How can we specify the policies in OWL? 0 How can query modification be carried out for OWL documents? 0 Design access control for OWL databases 0 Need tools for developing semantic web technologies -XML documents, RDF documents, Ontologies, etc. 0 How to integrate the multiple ontologjes and tools? 0 Security and Ontologies 0 Security engineering and ontology engineering