This extended abstract summarizes our recent work [4] about Controlled Query Evaluation over Ontology-based data access systems. Controlled Query Evaluation (CQE) is an approach to privacy-preserving query answering that recently has gained attention in the context of ontologies [2,6,8,9,12]. In our work, we consider the more general Ontology-based Data Access (OBDA) framework, where an ontology is coupled to external data sources via a declarative mapping [14,15], and extend OBDA with CQE features. In this new framework, which we call Policy-Protected Ontology-based Data Access (PPOBDA), a data protection policy is speci ed over the ontology of an OBDA speci cation in terms of logical statements declaring con dential information that must not be revealed to the users. As an example, consider the following formula (expressed as a denial assertion): 8x; y:OilComp(x) ^ IssuesLic(x; y) ^ Comp(y) ! ?; which says that the existence of an oil company issuing a license to another company (to operate over its properties) is a private information. More formally, we de ne a PPOBDA speci cation E as a quadruple hT ; S; M; Pi, where: { T is a Description Logic (DL) TBox [1], formalizing intensional domain knowledge;
{ S is the relational schema at the sources; { M is the mapping between T and S, i.e., a set of logical assertions de ning the semantic correspondence between the TBox and the source schema; { P is the data protection policy (i.e., a set of formulas) expressed over T .
The components T , S, and M are exactly as in OBDA speci cations, and, as in standard OBDA, a user can only ask queries over the TBox T . Then, query answering is ltered through a censor, i.e., a function that alters the answers to queries, in such a way that no data are returned that may lead a malicious user to infer knowledge declared con dential by the policy, even in case she/he accumulates the answers she/he gets over time. Among all possible censors, optimal ones are preferred, i.e., those altering query answers in a minimal way.
Within this framework, we initially consider two di erent notions of censor,
called censor in CQ and censor in GA, previously de ned for CQE over DL
ontologies [
Our basic idea to solve query answering under censors is to transform a
PPOBDA speci cation E into a classical OBDA speci cation J (i.e., without
policies), in such a way that, whatever database D instantiates the source schema
S, query answering under censors in E over D is equivalent to standard query
answering in J over D. In this transformation, we require that J has the same
TBox of E , so that this reduction is transparent to the user, and the same source
schema as E , since, as typical in OBDA, the data sources to be accessed are
autonomous. We aim at a transformation independent from the underlying data,
so that it can be computed at design-time. This enables us to use o -the-shelf
OBDA engines, like Mastro4 [
The problem we study can be thus summarized as follows: Given a
PPOBDA speci cation E = hT ; M; S; Pi, construct an OBDA speci cation
J = hT ; S; M0i such that, for any database D for S, conjunctive query
answering under optimal censors in E over D is equivalent to standard conjunctive
query answering in J over D. We investigate this problem for the relevant case
in which the TBox is expressed in DL-LiteR, the DL underpinning owl 2 ql [
On Information Disclosure in Ontology-based Data Access (i) We show that the above problem has in general no solution when censors in either CQ or GA are considered, whatever is the DL adopted for expressing the TBox. (ii) To overcome this issue, we propose a further, semantically well-founded approximated notion of censor, named IGA (Intersection GA) censor, which intuitively, for a PPOBDA speci cation E and any database D, returns the intersection of the sets of ground atoms computed by the optimal censors in GA for E applied to D. (iii) We provide an algorithm that solves our problem for every DL-LiteR
PPOBDA speci cations under IGA censors.
(iv) We carried out an experimental evaluation of our approach on (the
approximation [
We are currently working on enriching our CQE framework to improve its
abilities in the enforcement of con dentiality. In particular, we are investigating
more expressive forms of policy, which go beyond denial assertions, and the
possibility of expressing preferences that a ect the way in which secret information
is obfuscated, as in [
Acknowledgements. This work was partly supported by the ANR AI Chair INTENDED (ANR-19-CHIA-0014), by the EU within the H2020 Programme under the grant agreement 834228 (ERC Advanced Grant WhiteMec) and the grant agreement 825333 (MOSAICrOWN), by Regione Lombardia within the Call Hub Ricerca e Innovazione under the grant agreement 1175328 (WATCHMAN), and by the Italian MUR (Ministero dell'Universita e della Ricerca) through the PRIN project HOPE (prot. 2017MMJJRE), and by Sapienza (project CQEinOBDM).