In recent years, knowledge graphs (KGs) have gained more and more importance. As a consequence of that, the number of publicly accessible KGs is increasing. Due to their adoption in many areas, KGs are used in numerous diferent applications. However, these knowledge graph applications are not developed by the data owners and they might collect data from several linked KGs. It is therefore essential that systems accessing KGs are certified, i.e., each component is certified for a specific use by an entity or agency. In addition, a trace of the performed operations and used data is needed in order to verify that all requirements were met, e.g., some data cannot be transferred from the source to any other component due to privacy restrictions. This work describes the vision of certified distributed querying in the context of an analytics platform. Challenges for such systems are identified and discussed.
In the context of this paper, a system is called a distributed query system if the system answers queries from several data sources. These data sources might be heterogeneous and hosted in diferent physical locations. An alternative term is federated querying. It is assumed that a distributed query system is empowered with the means to control the access to the data sources available to the system. A distributed (or federated) query engine is part of the system and responsible for query decomposition, source selection, and planning the execution of the query. Depending on the user request, the necessary data is collected from several sources and combined to form the final answer within the system. While these two steps are usually performed by a query engine, they are explicitly mentioned as the data collection and answer generation component, respectively. The data sources accessible via the system are also considered to be a component of said system. A distributed query system is called certified if it meets the following requirements. (i) Each component of the system is certified by a third party, i.e., another entity or agency. These certifications may impose restrictions, e.g., a query engine might only be certified to work on medical data. (ii) Each component has to document the performed actions in a way that any third party is able to trace what the component did and verify that the component is working correctly, i.e., the result is sound, and is meeting all further restrictions, e.g., no private data was presented to the user. Throughout this paper, systems of this kind are called certified distributed query system .
Given an online platform for analytics as presented in Figure 1 which retrieves data from several
KGs through a SPARQL [
Creating a certified system for distributed querying brings challenges in all the components of such a system. Not only the certification of the components is challenging but also the verification. As described above, for the verification, each component needs to document what it is doing so that another entity or agency can trace back all the performed steps and verify that all restrictions have been met and the result is correct.
In terms of access control in a certified distributed query system, a big challenge is the validation
of access control policies. The Open Digital Rights Language (ODRL) [
Distributed query processing is an active research area. While the main focus is on performance
improvements through new algorithms for source selection, query planing, and optimizing
the operators, privacy is considered more and more in recent work [
The data collection in a certified distributed querying system needs to document which data in which data source has been accessed and transferred. While the data collection could be documented by storing the query plan, there is no guarantee that the query engine actually executed that plan. This needs to be certified and verified in order to ensure the correct use of the data. At the point of writing, there is no standard for representing the query plan of a distributed SPARQL query. While the previously discussed issue deals with the correct use of the data, in a certified distributed querying system, also the data sources that are accessed need to be certified so that the retrieved data can be trusted. This is crucial especially when collecting external data for the evaluation of an access control policy since the use of not certified and manipulated data might lead to granted access even though the access should have been denied. The distributed query engine should only consider certified and verified data sources.
The component that generates the final query result needs to ensure that the answer is correct. Hence, the answer generation component needs to be certified stating that indeed only correct results are generated. Additionally, privacy restrictions have to be ensured since it might be the case that specific data is allowed to be transferred to the answer generation component but cannot be presented to the user. Adding metadata to the query result as a trace of how the answer was generated could help in the verification of the correctness of the result. Such a trace would have to include the information about the source data that was used for generating the answer as well as the operators that produced the output. However, since the answer generation might include private data, not all triples contributing to the answer can be included in the trace. So far, privacy-preserving verifiable query results are an open challenge.
While the previous sections describe technical challenges for certified distributed query systems, there are also ethical and legal aspects that need to be considered. Obviously, the systems need to adhere to the GDPR. While technical solutions for preserving privacy might be in place, it is not clear how the compliance with the GDPR can be enforced. Another open question regarding the GDPR is about who is responsible in the case of a violation of the GDPR; is it the entity who certified the violating component, the entity who deployed the component, or maybe the entity who developed the component. The certification process also must be regulated in order to prevent entities from issuing wrong certifications. Assume there are two entities A and B that are tightly coupled. Entity A developed an answer generation component that respects the privacy in the context of the generated answer but stores all the private data in a database owned by entity A. Since entity B profits from the malicious acts of entity A, entity B issues a certification for the answer generation component stating that is respects all regulations. In case like this, there needs to be a regulation so that entities A and B can be sued and sentenced. The presented ethical and legal challenges are only two examples to raise awareness for this non-technical aspect of certified distributed query systems, e.g., usage control and certification.
This paper describes the vision of certified distributed querying and analyses the challenges of such systems as access control, operators for distributed query processing, data collection, and answer generation. Ethical and legal challenges are also discussed briefly using usage control and certification as two examples for these aspects of certified systems. A well-defined standard for expressing and validating access control policies is needed in terms of access control. Distributed query engines need to implement privacy policies, and privacy-aware distributed query optimization has to deal with the impact of privacy on the query execution performance. Data collection presents the challenge of documenting the data access and use as well as certifying and verifying the data sources in order to eliminate the risk of retrieving manipulated data. When it comes to query answer generation, privacy-preserving metadata about how the query result was generated is mandatory to achieve the vision.