Semantic e-Wallet to Reconcile Privacy

Slide1: 

A Semantic e-Wallet to Reconcile Privacy and Context Awareness Fabien L. Gandon andamp; Norman M. Sadeh Mobile Commerce Lab. – Carnegie Mellon University

Motivations: 

Motivations Pervasive Computing Multiple sources of contextual information e.g. calendar, location tracking, organizational info, pref. Virtual Enterprise Collaboration Selectively sharing of information with prospective and actual customers and suppliers e.g. collaborative design, supplier evaluation, available-to-promise/capable-to-promise information, order tracking Rather than exposing all these resources as individual semantic web services, organizations and individuals will want to have unified gateways to their information… 'e-Wallets' to allow resource identification andamp; enforce confidentiality logic

Vision - myCampus: 

Vision - myCampus Campus as 'everyday life microcosm' Enhance campus life through context-aware services accessible over a WLAN Approach: Involve stakeholders in the design Semantic Web and agent technologies A growing collection of context-aware agents that: Users can pull into their own personal environment Customize themselves through automated identification and access of relevant contextual resources

Slide4: 

Slide5: 

Directory Facilitator Agent (FIPA) Agent Management Agent (FIPA) e-Wallet Manager Agent Ontologist Agent Task-Specific Agents FIPA ACL messages and OWL Content JADE platform User Interaction Agent behavior behavior behavior Servlet Tomcat server HTTP Request HTTP Request HTTP Request HTTP Request session session session session

Slide6: 

e-Wallet Manager Agent Ontologist Agent Task-Specific Agents FIPA ACL messages and OWL Content JADE platform User Interaction Agent Directory Facilitator Agent (FIPA) Yellow Pages Type Service Owner … White Pages Name Address … Agent Management Agent (FIPA) HTTP Request

Slide7: 

Directory Facilitator Agent (FIPA) Agent Management Agent (FIPA) Task-Specific Agents FIPA ACL messages and OWL Content JADE platform User Interaction Agent HTTP Request e-Wallet Manager Agent Ontologist Agent XSLT edition Ontologies visualization download

Slide8: 

Directory Facilitator Agent (FIPA) Agent Management Agent (FIPA) FIPA ACL messages and OWL Content User Interaction Agent HTTP Request e-Wallet Manager Agent Ontologist Agent Task-Specific Agents JADE platform

Slide9: 

Directory Facilitator Agent (FIPA) Agent Management Agent (FIPA) Ontologist Agent Task-Specific Agents FIPA ACL messages and OWL Content JADE platform User Interaction Agent e-Wallet Manager Agent JESS XSLT OWL (ontologies, annotations) Rules (definitions, services, privacy) Queries edition results

e-Wallet: 

e-Wallet Each user has a semantic e-Wallet Automated identification and access of a user’s personal resources subject to privacy preferences Personal resources implemented as semantic Web services Needs for procedural knowledge i.e. rules Resource identification rules Privacy / confidentiality rules Access Control rules e.g. 'Only my colleagues can see my location' Obfuscation rules e.g. 'My colleagues can only see the building I am in but not the actual room' Note: The same concept applies to virtual organizations and B2B scenarios

Slide11: 

Example: Query from John inquiring about Mary’s location Step-1 The sender of the query is John. Step-2 The query requires finding Mary’s location. Step-3 (a) Is John allowed to see Mary’s location given what we currently know? (b) Checking Mary’s privacy/confidentiality preferences, e.g.: Only her colleagues can see her location – and only when she is on campus. (c) Is John a colleague of Mary? Yes. Step-4 No action in this example. Step-5 Finding Mary’s location by accessing some location tracking functionality or looking in her calendar. Step-6 Is Mary on campus? Yes. Step-7 Checking Mary’s obfuscation rules e.g. Mary is only willing to disclose the building she is in but not the specific room. Step-8 'Mary is in Smith Hall'.

Design of an e-Wallet: 

Design of an e-Wallet Three-layer architecture: security through typing Core knowledge: static andamp; dynamic knowledge of user Service Layer: invoke external sources of knowledge - web services and personal resources Privacy layer: enforce privacy rules on external requests - access control andamp; obfuscation Backward chaining migration: privacy rules, service rules, static migration rules

Design of an e-Wallet: 

Design of an e-Wallet Three-layer architecture: security through typing Core knowledge: static andamp; dynamic knowledge of user Service Layer: invoke external sources of knowledge - web services and personal resources Privacy layer: enforce privacy rules on external requests - access control andamp; obfuscation Backward chaining migration: privacy rules, service rules, static migration rules

e-Wallet and representation needs: 

e-Wallet and representation needs Static assertional knowledge: User’s static profile: OWL annotations. Static contextual knowledge: OWL annotations. Dynamic assertional knowledge: User’s dynamic profile: Rules in (R)OWL to update profile Result: entailed facts Dynamic contextual knowledge: Rules in (W)OWL to identify and invoke web services Result: facts returned by the web service Security and privacy Rules in (S)OWL to grant access and obfuscate Result: authorized facts for query solving Ontologies in OWL.

Summary on the e-Wallet implementation: 

Summary on the e-Wallet implementation OWL Meta-model in CLIPS

e-Wallet semantic engine: 

e-Wallet semantic engine RDF Triple model RDFS andamp; OWL meta-model (e.g., symmetry of properties) (deftemplate triple 'Template representing a RDF triple' (slot predicate (default '')) (slot subject (default '')) (slot object (default '')) ) Triple: (predicate, subject, object) andlt;rdfs:Class rdf:ID='SymmetricProperty'andgt; andlt;rdfs:labelandgt;SymmetricPropertyandlt;/rdfs:labelandgt; andlt;rdfs:subClassOf rdf:resource='#ObjectProperty'/andgt; andlt;/rdfs:Classandgt; (triple (predicate 'http://www.w3.org/2000/01/rdf-schema#subClassOf') (subject 'http://www.w3.org/2002/07/owl#SymmetricProperty') (object 'http://www.w3.org/2002/07/owl#ObjectProperty') ) (defrule symmetry (declare (salience 100)) (triple (predicate 'http://www.w3.org/1999/02/22-rdf-syntax-ns#type') (subject ?p) (object 'http://www.w3.org/2002/07/owl#SymmetricProperty')) (triple (predicate ?p) (subject ?x) (object ?y)) =andgt; (assert (triple (predicate ?p) (subject ?y) (object ?x))) )

e-Wallet semantic engine: 

e-Wallet semantic engine Ontologies: (e.g., declare person, location, etc.) Annotations: (e.g., Mary is in Smith Hall, etc.) Available online with XSLT translation stylesheets andlt;owl:Class rdf:ID='Person'andgt; andlt;rdfs:subClassOf rdf:resource='#Entity' /andgt; andlt;/owl:Classandgt; andlt;owl:ObjectProperty rdf:ID='location'andgt; andlt;rdfs:domain rdf:resource='#Entity' /andgt; andlt;rdfs:range rdf:resource='#Place'/andgt; andlt;/owl:ObjectPropertyandgt; (triple (predicate 'http://www.w3.org/2000/01/rdf-schema#subClassOf') (subject 'http://sadehlab.cs.cmu.edu/mycampus#Person') (object 'http://sadehlab.cs.cmu.edu/mycampus#Entity') ) ... andlt;mc:Woman rdf:ID='http://cs.cmu.edu/People/~mary'andgt; andlt;mc:location rdf:resource='http://cmu.edu/SmithHall'/andgt; andlt;/mc:Womanandgt; (triple (predicate 'http://sadehlab.cs.cmu.edu/mycampus#location') (subject 'http://cs.cmu.edu/People/~mary') (object 'http://cmu.edu/SmithHall') ) ...

e-Wallet semantic engine: 

e-Wallet semantic engine Rules: (e.g., when in I am in a meeting I am busy) andlt;rowl:Rule direction='forward'andgt; andlt;rdfs:labelandgt;Meeting means busyandlt;/rdfs:labelandgt; andlt;rowl:headandgt; andlt;mc:Person rdf:ID='andamp;variable;#person'andgt; andlt;mc:availabilityandgt;andlt;mc:Busy rdf:ID='andamp;mc;#Busy'/andgt;andlt;/mc:availabilityandgt; andlt;/mc:Personandgt; andlt;/rowl:headandgt; andlt;rowl:bodyandgt; andlt;mc:Person rdf:ID='andamp;variable;#person'andgt; andlt;mc:activityandgt; andlt;mc:Meeting rdf:ID='andamp;variable;#activity'/andgt; andlt;/mc:activityandgt; andlt;/mc:Personandgt; andlt;/rowl:bodyandgt; andlt;/rowl:Ruleandgt; (defrule Meeting-means-busy ... (triple (predicate 'http://sadehlab.cs.cmu.edu/mycampus#activity') (subject ?person) (object ?activity)) (triple (predicate 'http://www.w3.org/1999/02/22-rdf-syntax-ns#type') (subject ?activity) (object 'http://sadehlab.cs.cmu.edu/mycampus#Meeting') ) =andgt; ...(assert (triple (predicate 'http://sadehlab.cs.cmu.edu/mycampus#availability') (subject ?person)(object 'http://sadehlab.cs.cmu.edu/mycampus#Busy')

Service rules: 

Service rules andlt;wowl:ServiceRule wowl:salience='50'andgt; andlt;rdfs:labelandgt;provide location for IP Addressandlt;/rdfs:labelandgt; andlt;wowl:outputandgt; andlt;mc:Entity rdf:ID='andamp;variable;#entity'andgt; andlt;mc:location rdf:resource='andamp;variable;#location' /andgt; andlt;/mc:Entityandgt; andlt;/wowl:outputandgt; andlt;wowl:preconditionandgt; andlt;mc:Entity rdf:ID='andamp;variable;#entity'andgt;andlt;mc:ipandgt;andamp;variable;#ipandlt;/mc:ipandgt; andlt;/mc:Entityandgt; andlt;/wowl:preconditionandgt; andlt;wowl:callandgt; andlt;wowl:Service wowl:name='call-web-service'andgt; andlt;wowl:qnameandgt;http://mycampus/WiFiService#andlt;/wowl:qnameandgt; andlt;wowl:endpointandgt;http://128.2.68.34:7788andlt;/wowl:endpointandgt; andlt;wowl:methodandgt;GetLocationandlt;/wowl:methodandgt; andlt;wowl:ipandgt;andamp;variable;#ipandlt;/wowl:ipandgt; andlt;/wowl:Serviceandgt; andlt;/wowl:callandgt; andlt;/wowl:ServiceRuleandgt; (defrule provide-location-for-IP-Address (declare (salience 50)) … (need-dynamic_triple (predicate 'http://sadehlab.cs.cmu.edu/mycampus#location') (subject ?entity) (object ?location) ) … =andgt; (call-web-service 'qname' 'http://mycampus/WiFiService#' (…) 'ip' ?ip) )

Privacy rules: 

Privacy rules andlt;sowl:ReadAccessRuleandgt; andlt;rdfs:labelandgt;people can only know I am on or off campusandlt;/rdfs:labelandgt; andlt;sowl:targetandgt; andlt;mc:Person rdf:ID='andamp;variable;#owner'andgt; andlt;mc:location rdf:resource='andamp;variable;#location'/andgt; andlt;/mc:Personandgt; andlt;/sowl:targetandgt; andlt;sowl:checkandgt; andlt;rowl:Andandgt; andlt;rowl:conditionandgt; andlt;mc:E-Wallet rdf:ID='andamp;variable;#e-Wallet'andgt; andlt;mc:ownerandgt; andlt;mc:Person rdf:ID='andamp;variable;#owner'/andgt; andlt;/mc:ownerandgt; andlt;/mc:E-Walletandgt; andlt;/rowl:conditionandgt; andlt;rowl:not-conditionandgt; andlt;qowl:Query rdf:ID='andamp;variable;#query'andgt; andlt;qowl:sender rdf:resource='andamp;variable;#owner' /andgt; andlt;/qowl:Queryandgt; andlt;/rowl:not-conditionandgt; andlt;rowl:conditionandgt; andlt;mc:Place rdf:ID='http://www.cmu.edu'andgt; andlt;mc:include rdf:resource='andamp;variable;#location' /andgt; andlt;/mc:Placeandgt; andlt;/rowl:conditionandgt; andlt;/rowl:Andandgt; andlt;/sowl:checkandgt; andlt;sowl:revisionandgt; andlt;mc:Person rdf:ID='andamp;variable;#owner'andgt; andlt;mc:location rdf:resource='http://www.cmu.edu'/andgt; andlt;/mc:Personandgt; andlt;/sowl:revisionandgt; andlt;/sowl:ReadAccessRuleandgt;

Query: 

Query andlt;qowl:Query rdf:ID=''andgt; andlt;qowl:sender rdf:resource='http://cs.cmu.edu/~john'/andgt; andlt;/qowl:Queryandgt; andlt;mc:Person rdf:ID='http://cs.cmu.edu/~mary'andgt; andlt;mc:location rdf:resource='andamp;variable;#location' /andgt; andlt;/mc:Personandgt; (defrule query (declare (salience 0)) … (authorized_triple (predicate 'http://sadehlab.cs.cmu.edu/mycampus#location') (subject 'http://cs.cmu.edu/~mary') (object ?location)) =andgt; (store-result location ?location) ) Query context assertion: query sent by John Query rule definition Body: request for authorized triples Head: storage andamp; pretty printing function (triple (predicate 'http://mycampus.cs.cmu.edu/QOWL#location') (subject '') (object 'http://cs.cmu.edu/~john') ) ...

Slide22: 

Directory Facilitator Agent (FIPA) Agent Management Agent (FIPA) Ontologist Agent Task-Specific Agents FIPA ACL messages and OWL Content JADE platform User Interaction Agent HTTP Request e-Wallet Manager Agent JESS XSLT OWL (ontologies, annotations) Rules (definitions, services, privacy) Queries edition results

Concluding remarks: 

Concluding remarks Rather than directly publishing Web services, individuals and organizations will often want to expose a unified front-end ('e-Wallet') that: Enforces automated resource identification logic Enforces privacy/confidentiality (access andamp; obfuscation) Implementation: Multi-layer reasoning engine that distinguishes between different types of knowledge (core k., service invocation k., k. sanitized following application of confidentiality rules) OWL andamp; rule extension (essentially Horn clauses andamp; variables) and rule editor Validation with students accessing context-aware agents on CMU’s campus

Q&A: 

Source:http://www.firstmonday.org/issues/issue4_9/odlyzko/index.html Qandamp;A Fabien L. Gandon Norman M. Sadeh