Computing Compliant Anonymisations of Quantified ABoxes w.r.t. $$\mathcal {EL} $$ Policies

Abstract

We adapt existing approaches for privacy-preserving publishing of linked data to a setting where the data are given as Description Logic (DL) ABoxes with possibly anonymised (formally: existentially quantified) individuals and the privacy policies are expressed using sets of concepts of the DL EL. We provide a chacterization of compliance of such ABoxes w.r.t. EL policies, and show how optimal compliant anonymisations of ABoxes that are non-compliant can be computed. This work extends previous work on privacy-preserving ontology publishing, in which a very restricted form of ABoxes, called instance stores, had been considered, but restricts the attention to compliance. The approach developed here can easily be adapted to the problem of computing optimal repairs of quantified ABoxes.

Safety of quantified ABoxes w.r.t. singleton ε L policies

“…First, instead of making the data public, one can provide only restricted access through queries, whose answers are monitored by a "censor", which may decide not to give an answer or even lie if needed to satisfy the constraints [7][8][9]. Second, one can publish the data in an appropriately anonymized form, while keeping as much information about individuals as is allowed by the policy available [2,4,6,10,13,14].…”

“…The works in this area differ from each other in several aspects. The papers [2,4,6] and this one allow for arbitrary modifications of the original data set, as long as the new data is logically implied by the original one. In contrast, the work from [10,13,14] restricts modifications to the application of certain anonymization operations.…”

“…While in the work described in [10,13,14] RDF graphs are used to represent the data and conjunctive queries to describe the policy, the papers [2,4,6] consider the setting where DL ABoxes represent the data and concepts of the DL EL describe the policy. More precisely, a restricted form of ABoxes, called instance store, is considered in [2,6], whereas in [4] and in the present paper so-called quantified ABoxes are employed. Basically, quantified ABoxes extend traditional DL ABoxes by allowing for anonymized individuals, which from a logical point of view are represented as existentially quantified variables.…”

“…Finally, one can distinguish approaches according to whether and which kind of attacker's knowledge is assumed to exist. Of the mentioned papers, only [4] does not allow for attacker's knowledge, i.e., restricts the attention purely to achieving compliance with the policy. Here, we employ the same formal setup as [4] but addresses safety.…”

“…Of the mentioned papers, only [4] does not allow for attacker's knowledge, i.e., restricts the attention purely to achieving compliance with the policy. Here, we employ the same formal setup as [4] but addresses safety. The only work where the formalisms for representing the attacker's knowledge and formalizing the data differ is [6].…”