Sharing information securely between business partners and managing large supply chains e ciently will be a crucial competitive advantage for enterprises in the near future. In this paper, we present a concept that allows for building value networks between business partners in a distributed manner. Companies are able to publish Linked Data which participants of the network can clone and subscribe to. Subscribers get noti ed as soon as new information becomes available. This provides a technical infrastructure for business communication acts such as supply chain communication or master data management. In addition to the conceptual analysis, we provide an implementation enabling companies to create such dynamic semantic value networks.
Empowering enterprises to share their data securely using
semantic vocabularies and allowing them to actively push
new information (updates) to connected business partners
is the main goal of the LUCID research project1. Being
able to create dynamic semantic value networks improves the
sharing of information between business partners as well as
enhances the management of complex supply chains.
Mastering such value-added supply chains is a critical success
factor, especially in the context of the recent Industry 4.0
movement [
For example, the SCORVoc vocabulary presented in [
In this paper, we present the concept and implementation of such a tool based on a publish-subscribe approach. It allows enterprises to publish RDF data as well as to subscribe to published data of other business partners to get noti ed as soon as new information becomes available. Authentication and authorization mechanisms are included to guarantee secure access to the published data. Furthermore, our proposed solution includes a versioning component for RDF change detection and an e cient propagation of changing data. Additionally, provenance information is added to the exchanged data assuring a minimum level of trust.
This paper is structured as follows: We give an overview of the challenges and the resulting requirements in section 2. The concept of our approach is presented in section 3, followed by the implementation in section 4. We report on related work in section 5 before we conclude with an outlook on future work in section 6. 2.
We now present the challenges we have to tackle in the context of the LUCID research project. For each challenge, we provide a set of speci c requirements demanded by busi
ness partners to enable them to share their data in dynamic value networks.
As value networks should enhance the data distribution in
terms of experience and reliance between the participants,
it is crucial to rely on open, lightweight, and in case of
the data, semantic standards. This ensures
interoperability and allows every business partner to adapt its custom
applications to be able to connect to other participants of
a value network and share its data. The Resource
Description Framework (RDF) [
Each participant of a value network should be able to act as a source of data (publisher) as well as a consumer of data (subscriber). As participants of a value network connect or disconnect to each other on demand, there must be a speci ed mechanism to subscribe to or unsubscribe from the data of a publisher. A publisher must be able to inform all subscribers that its data has changed as soon as possible. This results in the need for a tool to publish RDF data and a service to manifest one's interest in updates of an RDF data publisher.
A value network must guarantee the traceability of the published data to ful ll the notion of provenance3. All participants of a value network must be able to trace back the origin of the exchanged data. The authenticity and integrity of the data must be ensured, emphasizing the need for protection against unperceived manipulation of the data. Participants must be able to sign the exchanged data to increase the level of trust. These considerations lead to the requirements of a shared RDF vocabulary for provenance information and a tool to sign and check the validity of RDF data.
The security of the data and secure access to the data are essential in the enterprise context. A publisher must have the ability to exchange its data under restricted conditions. For this reason, authentication and authorization mechanisms with the possibility to integrate custom solutions must be provided. When two participants connect to each other, the subscriber is authenticated and authorized. Therefore, publishers of the value network need a tool to authorize access to their RDF data.
Publishers should be able to detect changes made to their
data and share the change information with their subscribers.
To enable sharing of any kind of RDF data, the change
detection must support all features of RDF. Due to the
semantics of blank nodes, special emphasis needs to be taken to
guarantee their addressability outside the original graph [
3https://www.w3.org/2005/Incubator/prov/ XGR-prov-20101214/ In detail, participants need a shared RDF vocabulary for tracking changes to RDF data and a tool to detect changes made to RDF datasets.
The RDF data model enables a diversi ed and exible representation of data. The concept of RDF named graphs allows to group parts of the data into logical units enabling di erent views on the data. Based on our experience, RDF named graphs represent the easiest manageable unit. Therefore, we only consider RDF named graphs as central view on the data regarding access, change tracking and publication. 3.
As presented before, our main motivation is the on
demand proactive noti cation of changes made to speci c sets
of RDF data in a distributed communication network. That
means, instead of asking the data source for changes in a
regular interval (pull), the interested entity is actively
notied about any change (push). To realize this approach, we
rely on PubSubHubbub [
We have designed this work ow to use the features of the eccenca DataPlatform4 as it provides the base functionality helping us to address the mentioned challenges including context-based access control for RDF graphs and versioning for arbitrary RDF data. However, as noted in the challenges, the eccenca DataPlatform can be replaced with other tools providing the needed features. In the following, we present a more detailed overview of our concept with particular references to the challenges of section 2. We thereby only consider the subscription to and propagation of changes to RDF graphs. A priori reading or importing of published data on subscriber's side is not in the scope of our concept. 3.1
To get noti ed about changes made to a speci c graph of
a dataset, the subscriber sends a subscription request to the
hub of the publisher as described in section 5 of [
To be able to validate if a subscriber has the permission to subscribe to a speci c RDF graph, it needs to authenticate itself. We rely on the eccenca DataPlatform using OAuth 2.05 for authentication with support for various authentication providers such as an LDAP6 directory server. To represent the access control rules, we use the eccenca Authorization Vocabulary7. It allows dataset publishers to de ne context-based access conditions (eccauth:AccessCondition) on the level of RDF graphs. A subscriber is authorized to read and therefore allowed to subscribe to a speci c graph if the graph URI is contained in the set of readable graphs de ned by the property eccauth:readGraph of all ful lled access conditions. An access condition is ful lled, if all required attributes attached to it (by sub-properties of eccauth:requiresAttribute) are met by the session of the authenticated subscriber. 3.2
When a dataset is updated, all designated hubs need to be
informed about the changes. For this, the publisher requires
a change detection system for RDF data that, according to
the challenges, must support any RDF dataset even in the
presence of blank nodes and a vocabulary to describe the
changes in RDF. We use the change detection system of the
eccenca DataPlatform that creates a patch for each updated
graph containing the added and removed triples and
additional meta-information. Additionally, patches created by
the system provide full blank node support by adding the
context for each added or removed triple containing blank
nodes. Blank node support plays an important role
considering that over 50% of published datasets contain blank
nodes [
To be able to notify the hub(s) about changes, the
publisher needs to detect changes made to its dataset. To achieve
this, we use the versioning functionality we have developed
as part of the eccenca DataPlatform. For each update, the
system detects the added or removed triples and creates one
patch per graph. The patches are represented as instances of
eccrev:Commit of the eccenca Revision Vocabulary9. The
vocabulary is based on the structure of the Delta ontology10
and reuses concepts of the PROV-O ontology11. By
providing the author (eccrev:commitAuthor), change reason
(eccrev:commitMessage) and a time stamp (prov:atTime)
we argue that such a patch ful lls the notion of provenance.
5http://tools.ietf.org/html/rfc6749
6https://tools.ietf.org/html/rfc4511
7https://vocab.eccenca.com/auth/
8http://www.w3.org/ns/auth/cert#
9https://vocab.eccenca.com/revision/
10https://www.w3.org/DesignIssues/Di
11https://www.w3.org/TR/prov-o/
Moreover, the system calculates a hash value for each patch
(eccrev:sha256) using the algorithm described in [
For noti cation, we rely on the PubSubHubbub content
distribution request as described in section 7 of [
Due to space limitations, we do not discuss security issues
for the communication between the subscribers, publishers
and hubs. However, we want to refer to the usage of HTTPS
as described in [
The proposed publish-subscribe concept is integrated into the eccenca DataPlatform which is a Java Spring12 application acting as a proxy in front of one or more RDF repositories. Thus, it enables consistent publication of RDF data across various repositories according to the ve-star deployment scheme13.
In our implementation the publisher, subscriber and hub are part of the eccenca DataPlatform. The communication between these three components is realized through the use of Spring Integration14. This enables a lightweight messaging within the application and further supports the integration into external systems as well. In our case we use Apache Kafka15 as messaging server to ensure scalability, stability and backup of the communication within the application.
An architectural overview of our implementation is depicted in Figure 1. An exemplary work ow starts with a new subscription message from the subscriber to its hub (1). The 12https://projects.spring.io/spring-framework/ 13http://www.w3.org/DesignIssues/LinkedData.html 14http://projects.spring.io/spring-integration/ 15http://kafka.apache.org/ hub then authenticates itself in the name of the subscriber at the advertised hub of the publisher and sends a PubSubHubbub subscription request (2). The hub of the publisher hands over the subscription request for validation to the publisher (3) that validates the authorization of the subscriber with the help of the access control component (4). In case of success, the publisher informs its hub (5) that veri es the subscription (6) before storing it in the local RDF repository (7). If an update is made to the subscribed data (8), the versioning component creates a patch (9) and informs the publisher about the change (10). The publisher sends a change noti cation to its hub (11) that validates for each a ected subscription if it is still authorized to get updates (12). In the positive case, the hub sends a PubSubHubbub content distribution request to the a ected subscriber hubs (13), else the subscription is canceled. The subscriber hub now informs its subscriber (14) that checks the integrity of the patch before applying it to its data (15). When applying patches, especially in the presence of blank nodes, it must be ensured, with respect to non-lean graphs and isomorphism, that the correct triples get removed.
Various approaches have been presented in the area of
change propagation for RDF data. The proposed publish
and subscribe systems can be divided into two categories:
distributed peer-to-peer systems [
In general, the peer-to-peer approaches are based on broadcasting subscriptions and change noti cations between the participants of the network. Peers able to contribute to a subscription broadcast their changed data through the network, whereby changed data gradually arrives at the subscriber. Due to the requirement of a secure communication of the data, peer-to-peer systems are not rejected per se, however, all publications rely on approaches distributing the data freely readable between the network participants. Therefore this type of architecture is not advisable for enterprise value networks where sensitive data is exchanged.
In contrast to peer-to-peer systems, client-server systems
provide direct real-time noti cation allowing a secure change
propagation between the participants. RDFSync [
The work of [
By empowering enterprises to create dynamic semantic value networks based on open standards for publishing data, they are able to improve the sharing of information between their business partners and to enhance the management of complex supply chains. In this paper, we presented a concept allowing the creation of such value networks. We used the existing components for access control and versioning of RDF data of the eccenca DataPlatform and integrated the publish-subscribe approach to create a tool tackling the mentioned challenges.
However, rst system deployments have yield to issues and questions hampering a wide deployment in enterprises without any concerns. First, there is a need for a more exible solution regarding authentication, for example based on WebID16. For now business partners have to manually agree on and maintain the credentials used to authenticate among each other. Secondly, and of particular interest, is the question of how to deal with changing permissions, especially if a previous granted read access is withdrawn. Is it enough to just cancel the a ected subscriptions or do publishers want to perform additional steps? 7.
This work was partly supported by the following grants from the German Federal Ministry of Education and Research (BMBF) for the LUCID Project (GA no. 01IS14019A) as well as for the the LEDS Project (GA no. 03WKCG11A and GA no. 03WKCG11C). 8. 16https://www.w3.org/2005/Incubator/webid/spec/ eccenca Dat aPl at f or m Publ i sher 5 11 Ver si oni ng 10 3
12 Access Cont r ol
communicat ion over message channel
direct communicat ion eccenca Dat aPl at f or m Subscr i ber 1 15 RDF Reposi t or y RDF r eposi t or y