joint work with emilien antoine, gerome  miklau , julia  stoyanovich and vera  zaychik...

Joint work with Emilien Antoine, Gerome Miklau, Julia Stoyanovich and Vera Zaychik Moffitt

ICDE 2012Mai 30, 2012

Introducing Access Control in Webdamlog

Serge AbiteboulINRIA Saclay & ENS Cachan

Abiteboul – DBPL - 2013 2

•The Web as a distributed knowledge base•Webdamlog: a rule-based language for

the Web•Access control in Webdamlog•The Webdamlog system•Conclusion

Abiteboul – DBPL - 2013 3

A typical Web user’s data•What kinds of data?- data: photos, music, movies, reports, email

- metadata: photo taken by Alice in Paris on ...

- ontologies: Alice’s ontology and mapping with other ontologies

- localization: Alice’s pictures are on Picasa, back-ups are at INRIA

- security: Facebook credentials (Alice, 123456)

- annotations: Alice likes Elvis’ website

- beliefs: Alice believes Elvis is alive

- external knowledge: Bob keeps copies of Alice’s pictures

- time, provenance, ...

all kinds

Social data

Abiteboul – DBPL - 2013 4

A typical Web user’s data•What kinds of data?•Where is the data?

- laptop, desktop, smartphone, tablet, car computer

- mail, address book, agenda

- Facebook, LinkedIn, Picasa, YouTube, Tweeter

- svn, Google docs

- also access to data / information of family, friends, companies associations

all kindseverywhere

Abiteboul – DBPL - 2013 5

A typical Web user’s data•What kinds of data?•Where is the data?

all kinds everywhere•What kind of organization?

- terminology: different ontologies

- systems: personal machines, social networks

- distribution: different localization

- security: different protocols

- quality: incomplete / inconsistent information

heterogeneous

Abiteboul – DBPL - 2013 6

Example of processingAlice and Bob are getting engaged. Their friends want to offer them an album of photos where they are together

To make such a photo album• Find friends of Alice & Bob (say with Facebook)• for each friend, find where she keeps her photos

(say, Picassa)• find the means to access her photos possibly

via friends• find the photos that feature Bob and Alice

together, e.g., using tags or face recognition software

• possibly ask someone to verify the resultsSome reasoning is needed to execute these tasks

automatically!

Abiteboul – DBPL - 2013 7

A typical Web user

• Overwhelmed by the mass of information

• Cannot find the information needed

• Is not aware of important events

• Cannot manage/control how others access and use his/her own data

Abiteboul – DBPL - 2013 8

YOU need help!

How can systems help?• We need to move from a Web of text

to a Web of knowledge

- In the spirit of semantic Web

• To better support user needs,

- Systems need to analyze what is happening and construct knowledge

- Systems should exchange knowledge

- Systems should reason and infer knowledge

Abiteboul – DBPL - 2013 9

Thesis

All this forms a distributed knowledge basewith processing based on automated

reasoning

Abiteboul – DBPL - 2013 1

0

Our topic

•Distributed reasoning Exchanging facts and rules Webdamlog

• Access control with access control

Abiteboul – DBPL - 2013 1

1

•The Web as a distributed knowledge base•Webdamlog: a rule-based language for

the Web•Access control in Webdamlog•The Webdamlog system•Conclusion

Abiteboul – DBPL - 2013 1

2

Webdamlog: a datalog-style language

Datalog A prehistoric language by Web time...

+ nice and compact syntax+ well-studied with many extensions+ recursion essential: network cycles

WebdamlogNot as simple/beautiful & proceduralNeeded for real Web applications!

Webdamlog is not datalog

Abiteboul – DBPL - 2013 1

3

Webdamlog: an extension of datalog

Datalog program fof(x,y) :- friend(x,y)fof(x,y) :- friend(x,z), fof(z,y)

Extensional facts (stored in the database)friend(“peter”,”paul”) friend(“paul”, “mary”) friend(“mary”,”sue”)

Intentional facts (derived)fof(“peter”,”paul”) fof(“peter”,”mary”) fof(“peter”, “sue”)fof(“paul”, “mary”) fof(“paul”, “sue”) fof(“mary”,”sue”)

Abiteboul – DBPL - 2013 1

4

Webdamlog: an extension of datalogExtends datalog

• negation, updates, distribution, delegation, time

For a world that is• distributed: autonomous and asynchronous

peers• dynamic: knowledge evolves; peers come and

goInfluenced by

• Active XML (INRIA) - for distribution & intentional data

• Dedalus (UC Berkeley) - for time & implementation

Abiteboul – DBPL - 2013 1

5

FactsFacts are of the form m@p(a1, ..., an), where

m is a relation name & p is a peer namea1, ..., an are data values (n is the arity of m@p)the set of data values includes the relations and peer names

Examplesfriend@my-iphone(“peter”, “paul”) extensionalfof@my-iphone(“adam”, “paul”) intentional

Abiteboul – DBPL - 2013 1

6

Examples of factsdata & metadata: pictures@alice-iphone(1771.jpg,

“Paris”, 11/11/2011)ontology: isA@yago.com("Elvis”, theKing)annotations: tags@delicious.com(“wikipedia.org”,

encyclopedia)localization: where@alice(pictures, picasa/alice)access rights: right@picasa(pictures, friends, read)security: secret@picasa/alice; public@picasa/alice

Abiteboul – DBPL - 2013 1

7

RulesRules are of the form

$R@$P($U) :- (not) $R1@$P1($U1), ..., (not) $Rn@$Pn($Un)where

$R, $Ri are relation terms$P, $Pi are peer terms $U, $Ui are tuples of terms

Safety condition$R and $P must appear positively bound in the bodyeach variable in a negative literal must appear positively bound in the body

A term is a variable

or a constant

Examples coming up, stay tuned

Abiteboul – DBPL - 2013 1

8

State transition

Choose some peer p randomly – asynchronouslyCompute the transition of p

the database updates at pthe messages sent to other peersthe delegations of rules to other peers

Keep going forever(I0, Γ0, ∅) ➝ (I1, Γ1, Γ1*) ➝... ➝ (In, Γn, Γn*) ➝...

Fair sequence: each peer is selected infinitely often

Abiteboul – DBPL - 2013 1

9

The semantics of rulesClassification based on locality and nature of head predicates (intentional or extensional)• Local rule at my-laptop: all predicates in the

body of the rules are from my-laptop

Local with local intentional head classic datalogLocal with local extensional head database updateLocal with non-local extensional head messaging between peersLocal with non-local intentional head view delegationNon-local general delegation

Abiteboul – DBPL - 2013 2

0

Local rules with local intentional head

Example: Rule at peer my-laptopfriend is extensional, fof is intentional

fof@my-iphone($x, $y) :- friend@my-iphone($x,$y)fof@my-iphone($x,$y) :- friend@my-iphone($x,$z), fof@my-iphone($z,$y)

fof is the transitive closure of friend

Datalog = Webdamlog with only local rules and local intentional head

Abiteboul – DBPL - 2013 2

1

Local rules with local extensional head

A new fact is inserted into the local database

believe@my-iphone(“Alice”, $loc) :- tell@my-iphone($p,”Alice”, $loc),friend@my-iphone($p)

Abiteboul – DBPL - 2013 2

2

Local rules with non-local extensional head

A new fact is sent to an external peer via a message$message@$peer($name, “Happy birthday!”) :-

today@my-iphone($date),birthday@my-iphone($name, $message, $peer, $date)

Extensional facts:today@my-iphone(March 6)birthday@my-iphone("Manon”, “sendmail”, “gmail.com”, March 6)

sendmail@gmail.com("Manon”, “Happy birthday”)

Abiteboul – DBPL - 2013 2

3

Local rules with non-local intentional head

View delegation!

boyMeetsGirl@gossip-site($girl, $boy) :- girls@my-iphone($girl, $loc),boys@my-iphone($boy, $loc)

Semantics of boyMeetGirl@gossip-site is a join of relations girls and boys from my-iphoneFormally, my-iphone delegates a rule boyMeetGirl@gossip-site(g,b) for each g, b, l, girls@my-iphone(g,l), boys@my-iphone(b,l)

Abiteboul – DBPL - 2013 2

4

Non-local rules: general delegation

(at my-iphone): boyMeetsGirl@gossip-site($girl, $boy) :- girls@my-iphone($girl,

$loc), boys@alice-

iphone($boy, $loc)

Suppose that girls@my-iphone(“Alice”, “Julia's birthday”) holds.

Then my-iphone installs the following rule at alice-iphone(at alice-iphone): boyMeetsGirl@gossip-site(“Alice”,

$boy) :- boys@alice-iphone($boy, “Julia's

birthday”)

When girls@my-iphone(“Alice”, “Julia's birthday”) no longer holds, my-iphone uninstalls the rule

Abiteboul – DBPL - 2013 2

6

Complexity of delegation: illustration

fof(x,y) :- friend(x,y)(at p) fof@p(x,y) :- peers@p($q), friend@$q(x,y)

If peers@p contains 100 000 tuples peers@p(q1), ...., peers@p(q100 000)

This rule will install 100 000 rules!for i=1 to 100 000 (at qi) fof@p(x,y) :- friend@qi(x,y)

Data complexity transformed into program complexity

Abiteboul – DBPL - 2013 2

7

Summary of results [PODS 2011]

• Formal definition of the semantics of Webdamlog

• Results on expressivity- the model with delegation is more general,

unless all peers and programs are known in advance

• Convergence is very hard to achieve- positive Webdamlog- strongly stratified programs with negation

Abiteboul – DBPL - 2013 2

8

•The Web as a distributed knowledge base•Webdamlog: a rule-based language for

the Web•Access control in Webdamlog•The Webdamlog system•Conclusion

Abiteboul – DBPL - 2013

RequirementsData access Users would like to control who can read and modify their information

Data dissemination Users would like to control how their data are transferred from one participant to another, and how they are combined, with the owner of each piece of data keeping some control over it

Application control Users would like to control which applications can run on their behalf, and what information these applications can access.

29

Abiteboul – DBPL - 2013 3

0

The general picture

• The privileges we consider: read, write, grant

• For read:• Coarse grained access control: at the

relation level• Fine grain access control: at the tuple level 

Abiteboul – DBPL - 2013 3

1

Insertion in extentional relations

Definition of intensional relations• Requires write privilege on the target relation

• [at Alice] alicePhotos@Bob($f) :- person@Alice($p,

“Friend”),personInPhoto@Alice($pid, $p),

photo@Alice($pid,−, $f)

• [at Alice] allPhotos@Alice($f) : alicePhotos@Alice($f)

• [at Bob] allPhotos@Alice($f) :- bobPhotos@Bob($f)

Abiteboul – DBPL - 2013 3

2

Who can read a fact ? – default

• Extensional relations: if you have read privilege to the relation

• Intensional relations: if you have read privilege to the relation &if you can read all the tuples that have been used to create this fact – provenance of the fact

Abiteboul – DBPL - 2013 3

3

Digression: provenance

• Provenance of a tuple•How it was constructed: conjunction• Alternatives: disjunction

Abiteboul – DBPL - 2013 3

4

Digression: provenance graph

gossip@p(Jane, John)rule3

×

girls@p(Jane, Julia’s birthday) boys@p(John, Julia's birthday)rule1

× ×

boyMeetsGirl@p(Jane, John)

×+

(Also used for maintenance in case of update)

Abiteboul – DBPL - 2013 3

5

Coarse grain access control• [at Alice] alicePhotos@Bob($f) :-

person@Alice($p, “Friend”),personInPhoto@Alice($pid, $p),

photo@Alice($pid,−, $f)

• alicePhotos@Bob is extensional•Whoever has read access to alicePhotos@Bob

sees all the relation

Abiteboul – DBPL - 2013 3

6

Fine grain access control• [at Alice] allPhotos@Alice($f) :

alicePhotos@Alice($f)• [at Bob] allPhotos@Alice($f) :-

bobPhotos@Bob($f)

• allPhotos@Alice is intensional• Sue who has read privilege to

allPhotos@Alice and alicePhotos only, can see only the photos of Alice in allPhotos

• Lili who has read privilege to the three relations, sees everything

Abiteboul – DBPL - 2013 3

7

Overwriting the default for intensional data

• Let us change the rule to:• [at Alice] allPhotos@$x($f) :-

alicePhotos@Alice($f), friends@Alice($x)

• Issue: you can read the photos only if you also have read privilege to friends@Alice

Abiteboul – DBPL - 2013 3

8

Overwriting the default for intensional data

• [at Alice] allPhotos@$x($f) :-alicePhotos@Alice($f),

[hide friends@Alice($x)]

•Hide: block the provenance from friends@Alice

• Similar mechanism for extensional data – expose

Abiteboul – DBPL - 2013 3

9

Issues with non local rules• [at Bob]

message@Sue(“I hate you”) :- date@Alice(d)aliceSecret@Bob(x) :- date@Alice(d), secret@Alice(x)

Ignoring access rights, by delegation, this results in running• [at Alice]

message@Sue(“I hate you”) :- date@Alice(d)

aliceSecret@Bob(x) :- date@Alice(d), secret@Alice(x)

Abiteboul – DBPL - 2013 4

0

Default solution: sand boxWe run the rule at Alice in a Sandbox

•We use the access rights of BobSo the second rule does not succeed in sending secrets

• The message specifies that this is done at Bob’s requestSo requires authentication/signatures

• Alternative: delegation without sandbox. Possible if the peer that asks for the delegation is given the privilege to install rules at the other peer – Here if Alice gives Bob the right to install a rule in her environment

Abiteboul – DBPL - 2013 4

1

Access control implementation • A program with access control is compiled

locally in a Webdamlog program without that is executed

• Access control data is managed like any other data

Relation acl (defines relation access)

Relation kind (ext or int)• Based on provenance implemented as a

distributed graph•On-going work on optimization

Abiteboul – DBPL - 2013 4

2

•The Web as a distributed knowledge base•Webdamlog: a rule-based language for

the Web•Access control in Webdamlog•The Webdamlog system

Abiteboul – DBPL - 2013 4

3

The Webdamlog engineBased on Bud

• developed at UC BerkeleyManages knowledge

- Stores facts and rules- exchanges knowledge

with other engines- performs reasoning

Abiteboul – DBPL - 2013 4

4

The engine: beyond Bud• Compilation of

(Bud’s language)• Main Webdamlog features

not supported by Bud1. Variable relation and peer

names2. Delegations with dynamic

changes of the program

Webdamlog+AC ⇒ Webdamlog ⇒ Bloom

Abiteboul – DBPL - 2013 4

5

The Webdamlog peer

Support communication with other peers and with usersSupport common security protocolsSupport wrappers to external systems such as FacebookProvides Web interfaces

Abiteboul – DBPL - 2013 4

6

Provenance graphs

• Records the history of derivation• Provenance semiring semantics [Green et al.

07]• Used for performance optimization • Used for fine grain access control• Other possible uses such as explanation of

results

Abiteboul – DBPL - 2013 4

7

•The Web as a distributed knowledge base•Webdamlog: a rule-based language for

the Web•Access control in Webdamlog•The Webdamlog system•Conclusion

Abiteboul – DBPL - 2013

ThesisLet us turn the Web into a distributed knowledge base

with billions of userssupported by billions of systems

analyzing informationextracting knowledge

exchanging knowledgeinferring knowledge

48

Abiteboul – DBPL - 2013 4

9

WebdamlogLanguage•A language for distributed data management

[PODS 2011]•Datalog with distribution, updates, messaging •Main novelty: delegation

Implementation •WebdamExchange peer in Java [demo ICDE

2011]•Webdamlog engine based on Bud [demo

Sigmod 2013]Access control: on-going work with Miklau-StoyanovichProbabilistic Webdamlog: on-going work with Deutch-Vianu

Cambridge University Press, 2012

http://webdam.inria.fr/Jorge

Grazie !