Semantic Web Technologies and Data Confidentiality

Lalana Kagal

Decentralized Information Group
MIT Computer Science and Artificial Intelligence Laboratory

What is Data confidentiality ?

Some definitions

• ensures that information is accessible only to those authorized to have access
• regarding data that is spoken, written, acted on, etc., in strict privacy or secrecy
• done or communicated in confidence

What does it mean ?

• Data communicated in confidence should only be shared with those whom the sender authorizes and used for what the sender intended unless there is a overriding policy that states otherwise

Modeling confidentiality

Confidentiality

• Is not just about preventing access to certain information
• Is also about regulating what you can do with the information - share, statistical analysis, research, civil case, criminal investigations, etc.

Our approach

• Confidentiality is modeled as legal and social norms (policies) about information access and usage using Semantic Web technologies

Policy Specification

Policy

• An explicit representation of constraints and rules that govern an agent or system's behavior
• Machine understandable norms of behavior
• Usually restrict actions and data access

Confidentiality Policies

• Include usage restrictions while reasoning about privacy and confidentiality

Example Policy Language

• Rei is a declarative policy language that uses Semantic Web technologies
• representation is rule extension of OWL
• domain knowledge in any RDF language
• Policies are defined as constraints over allowable and obligated actions on resources/data in the environment
• Rich semantics associated with the domain knowledge allow policies to be described at different levels of abstractions, and provide greater extensibility and expressivity
• FORMAT: Deontic(Actor, Action(Resource/Data, PreCond, Effect), Usage, Sanction)

Example Confidentiality Policy

• Given an ontology of actions/purposes
• Access control: Nurses cannot access my insurance information
  Deontic: Prohibition
  Actor: Nurses
  Action: AccessDataAction(PatientInsuranceInfo)
• Usage restrictions: ABC employees may not use individual customer data execept for planning and marketing purposes
  Deontic: Permission
  Actor: ABCEmployee
  Action: UseDataAction(CustomerData)
  Usage: PlanningAction(CustomerData), MarketingAction(CustomerData)

Example Confidentiality Policy

• Usage: Doctor-patient confidentiality
  Deontic: Prohibition
  Actor: Doctors
  Action: ShareData(Patient, Anyone)
  
  Overriding obligation for handling expection
  Deontic: Obligation
  Actor: Doctors
  Action: ShareData(Patient, Authorities)
  Condition: PossibleChildAbuse(Patient), PossiblyHarm(Patient, Patient), PossiblyHarm(Patient, Others)

Example Confidentiality Policy

• Given an ontology of actions/purposes
• Access control: ABC employees can access customer related info of current customers only
  Deontic: Permission
  Actor: ABCEmployee
  Action: AccessDataAction(Customer)
  Condition: CurrentCustomer(Customer)
• Confidentiality/Privacy: ABC employees may use individual customer data internally for planning and marketing purposes
  

  Deontic: Permission Actor: ABCEmployee Action: UseDataAction(CustomerData) Usage: PlanningAction(CustomerData), MarketingAction(CustomerData)

  ========>

  Deontic: Permission Actor: ABCEmployee Action: ABCAction(CustomerData) Condition: performed(ABCEmployee, UseDataAction(CustomerData)), ABCAction isa PlanningAction or MarketingAction

Policy development

How will policy languages and policies evolve ?

• Similar to evolution of ontologies
• Top down - Develop a standard policy language
• Bottom up
• Communities of users can define local norms/policies for security, trust, confidentiality
• SW technologies allow extensibility as individuals can create new terms or ontologies without waiting for consensus from a governing body
• If different communities want to interoperate with each other, they will have to negotiate an appropriate mapping between their norms
• If a large group of users or several communities use a certain set of norms, they could be standardized

Enforcement Mechanisms

Possible Enforcement Mechanisms

• Specific tools that enforce access control requirements and usage restrictions
  • Policy Aware Web, http://www.policyawareweb.org
  • Provenance Aware Documents: http://dig.csail.mit.edu/TAMI/harveyj/provenance-final/thesis-presentation.html
• Reason over annotated transaction logs and audit trails to check if any violations occured

Our Approach

• Open distributed systems
  • information about individuals is easily obtained - web, public records, etc.
  • difficult to prevent information leakage
  • tools can be bypassed
• Facilitate compliance of policies by reasoning over transaction logs/audit trails
• Aimed at environments where audit trails are usually stored such as government organizations and e-science

Requirements

• Provenance of data and annotated transaction logs
• Computational policies
• Reasoning mechanism - calculates usage and facilitates policy compliance

TAMI: Transparent Accountable Datamining Initiative

Case Study: Privacy Act(5 USC § 552a) Part of the Privacy Act "Data collected about US citizens can be used only for the purposes for which it was collected" Real world TAMI scenario : http://www.washingtonpost.com/wp-dyn/content/article /2007/06/13/AR2007061302453_pf.html

Privacy Act (5 USC § 552a)

• "Data collected about US citizens can be used only for the purposes for which it was collected"
• When an agency collects information (stored in Systems of Records (SOR)) about US citizens, the agency must provide a System of Records Notice (SORN)
• SORN describes what kind of information was collected, for what purpose, what it can be used for
  • Sources
  • Data categories
  • Purposes
  • Routine uses: Possible recipients, Category of data, Purposes

What have we done so far ?

Implementation RDF ontologies: transaction logs, agencies, responsibilities, purposes Usage calculation + Reasoning: Scheme and cwm Data: Turtle Current limitations No inference control No attribute level confidentiality Conflicting usage restrictions

Social and Legal Perspective

• Social conventions: Reputation systems such as ebay
• Legal: What will be the mechanism for correction of data found to be incorrect? Will there be legal recourse in the event agencies rely on incorrect information ?
  
  E.g. FBI Finds It Frequently Overstepped in Collecting Data: http://www.washingtonpost.com/wp-dyn/content/article/2007/06/13/AR2007061302453_pf.html

Research Challenges

• Modeling confidentiality: Problems with using SW technologies for describing security, privacy, and confidentiality
• Should there be a basic standard policy language ?
• How to attach policies or usage restrictions to data
• Enforcement mechanisms: restricting access, preventing improper usage, or accountability
• Benchmarks for policy languages and reasoners

Summary

Summary

• Confidentiality = preventing access to data + usage restrictions
• Can be modeled as policies about information access and usage
• Facilitating compliance/accountability is an appropriate enforcement approach

More information

• This presentation : http://dig.csail.mit.edu/2007/Talks/0621-semgrail/
• Privacy act: http://www.usdoj.gov/oip/04_7_1.html
• TAMI: http://dig.csail.mit.edu/TAMI/
• Rei: http://rei.umbc.edu/
• Cwm: http://www.w3.org/2000/10/swap/doc/cwm.html
• Turtle: http://www.dajobe.org/2004/01/turtle/