Privacy-preserving semantic interoperation and access control of heterogeneous databases

ABSTRACT

Today, many applications require users from one organization to access data belonging to organizations. While traditional solutions offered for the federated and mediated databases facilitate this by sharing metadata, this may not be acceptable for certain organizations due to privacy concerns. In this paper, we propose a novel solution -- Privacy-preserving Access Control Toolkit (PACT) -- that enables privacy-preserving secure semantic access control and allows sharing of data among heterogeneous databases without having to share metadata. PACT uses encrypted ontologies, encrypted ontology-mapping tables and conversion functions, encrypted role hierarchies and encrypted queries. The encrypted results of queries are sent directly from the responding system to the requesting system, bypassing the mediator to further improve the security of the system. PACT provides semantic access control using ontologies and semantically expanded authorization tables at the mediator. One of the distinguishing features of the PACT is that it requires very little changes to underlying databases. Despite using encrypted queries and encrypted mediation, we demonstrate that PACT provides acceptable performance.

REFERENCES

• 1: Resource description framework(rdf) model and syntax specification, w3c recommendation http://www.w3.org/tr/rec-rdf-syntax. 1999.
• 2: Sudhir Agarwal , Barbara Sprick, Access Control for Semantic Web Services, Proceedings of the IEEE International Conference on Web Services (ICWS'04), p.770, June 06-09, 2004 [doi>10.1109/ICWS.2004.17]
• 3: S. Agarwal, B. Sprick, and S. Wortmann. Credential based access control for semantic web services. In 2004 AAAI Spring Symposium Series, March 2004.
• 4: Rakesh Agrawal , Alexandre Evfimievski , Ramakrishnan Srikant, Information sharing across private databases, Proceedings of the 2003 ACM SIGMOD international conference on Management of data, June 09-12, 2003, San Diego, California [doi>10.1145/872757.872771]
• 5: G-J. Ahn and B. Mohan. Secure sharing role-based delegation. Journal of Network and Comp. Applications, 2004.
• 6: S. Bechhofer, F. van Harmelen, J. Hendler, I. Horrocks, D.L. McGuinness, P.F. Patel-Schneider, and L.A. Stein. Owl web ontology language reference. Technical report, W3C.
• 7: E. Damiani, S. De Capitani di Vimercati, C. Fugazza, and P. Samarati. Extending policy languages to the semantic web. In ICWE, pages 330--343, 2004.
• 8: Steven Dawson , Shelly Qian , Pierangela Samarati, Providing Security and Interoperation of HeterogeneousSystems, Distributed and Parallel Databases, v.8 n.1, p.119-145, Jan. 2000 [doi>10.1023/A:1008787317852]
• 9: Sabrina De Capitani di Vimercati , Pierangela Samarati, Authorization specification and enforcement in federated database systems, Journal of Computer Security, v.5 n.2, p.155-188, Jan. 1997
• 10: Hector Garcia-Molina , Yannis Papakonstantinou , Dallan Quass , Anand Rajaraman , Yehoshua Sagiv , Jeffrey Ullman , Vasilis Vassalos , Jennifer Widom, The TSIMMIS Approach to Mediation: Data Models and Languages, Journal of Intelligent Information Systems, v.8 n.2, p.117-132, March/April 1997 [doi>10.1023/A:1008683107812]
• 11: Li Gong , Xiaolei Qian, The Complexity and Composability of Secure Interoperation, Proceedings of the 1994 IEEE Symposium on Security and Privacy, p.190, May 16-18, 1994
• 12: Li Gong , Xiaolei Qian, Computational Issues in Secure Interoperation, IEEE Transactions on Software Engineering, v.22 n.1, p.43-52, January 1996 [doi>10.1109/32.481533]
• 13: Hakan Hacigümüş , Bala Iyer , Chen Li , Sharad Mehrotra, Executing SQL over encrypted data in the database-service-provider model, Proceedings of the 2002 ACM SIGMOD international conference on Management of data, June 03-06, 2002, Madison, Wisconsin [doi>10.1145/564691.564717]
• 14: Murat Kantarcioglu , Chris Clifton, Privacy-Preserving Distributed Mining of Association Rules on Horizontally Partitioned Data, IEEE Transactions on Knowledge and Data Engineering, v.16 n.9, p.1026-1037, September 2004 [doi>10.1109/TKDE.2004.45]
• 15: Peng Liu, Prasenjit Mitra, and Chi-Chun Pan. Privacy-preserving semantic access control across heterogeneous information sources. available at http://ist.psu.edu/s2/paper/sace.pdf. Technical report, Pennsylvania State University, Nov. 2004.
• 16: P. Mitra, P. Liu, and C-C. Pan. Privacy-preserving ontology matching. In AAAI Workshop on Context and Ontologies, July 2005.
• 17: Li Qin , Vijayalakshmi Atluri, Concept-level access control for the Semantic Web, Proceedings of the 2003 ACM workshop on XML security, October 31-31, 2003, Fairfax, Virginia [doi>10.1145/968559.968575]
• 18: Yuzhong Qu , Xiang Zhang , Huiying Li, OREL: an ontology-based rights expression language, Proceedings of the 13th international World Wide Web conference on Alternate track papers & posters, May 19-21, 2004, New York, NY, USA [doi>10.1145/1013367.1013457]
• 19: Erhard Rahm , Philip A. Bernstein, A survey of approaches to automatic schema matching, The VLDB Journal — The International Journal on Very Large Data Bases, v.10 n.4, p.334-350, December 2001 [doi>10.1007/s007780100057]
• 20: Mariemma I. Yagüe , Antonio Maña , Javier López , José M. Troya, Applying the Semantic Web Layers to Access Control, Proceedings of the 14th International Workshop on Database and Expert Systems Applications, p.622, September 01-05, 2003
• 21: M. Yague and J.M. Troya. A semantic approach for access control in web services. In Euroweb 2002 Conference. The Web and the GRID: from e-science to e-business, British Computer Society, W3C, pages 483--494, December 2002.
• 22: A. C. Yao. How to generate and exchange secrets. In Proc. 24th Annual Symposium on Foundations of Computer Science, Oct. 1986.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.5 Heterogeneous Databases

Additional Classification:
  E. Data
  E.3 DATA ENCRYPTION
  E.4 CODING AND INFORMATION THEORY

  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Algorithms, Security