tributions. First, we study secrecy in the context of as-
sertions as well as general concept inclusions (GCIs).
To the best of our knowledge, secrecy-preserving rea-
soning for GCIs has not been studied before. As a
ﬁrst step in constructing SPQA system, we design
two tableau algorithms to compute ﬁnite sets T
∗
and
then A
∗
, of consequences of the TBox T ∪ R
∗
and
the KB
h
A, T
∗
, R
∗
i
respectively, restricted to individ-
uals and concepts that actually occur in the given KB
Σ =
h
A, T , R
i
and an extra “auxiliary” set of con-
cepts deﬁned over the signature of Σ. The approach to
constructing SPQA system presented in this paper is
quite diﬀerent from (Tao et al., 2010). In (Tao et al.,
2010), the KB and envelope are expanded with new
queries. This makes the subsequent query answer-
ing step more and more complicated. In general, the
sets of all assertional consequences and GCI conse-
quences of a given Σ =
h
A, T , R
i
may be inﬁnite. By
forcing the tableau algorithms to compute the conse-
quences (both assertions and GCIs) of KB restricted
to individuals and subconcepts that occur in a given
prescribed set, we obtain ﬁnite A
∗
and T
∗
that in
fact can be computed eﬃciently in polynomial time.
These sets, once computed, remain ﬁxed and are not
modiﬁed. The two tableau algorithms are sound and
complete under the restrictions stated above, see sec-
tions 3.1 and 3.2. Since the sets A
∗
and T
∗
do not
contain all the consequences of the KB, in order to
answer user queries we have designed recursive algo-
rithms which break the queries into smaller assertions
or GCIs all the way until the information in the sets
A
∗
and T
∗
can be used. In eﬀect, we have split the
task of query answering into two parts: in the ﬁrst
part we compute all the consequences of Σ restricted
to concepts and individuals that occur in Σ, in the sec-
ond part we use a recursive algorithm to evaluate more
complex queries with the base case that has been com-
puted in the ﬁrst part.
In more detail, starting from the secrecy sets S
A
(of assertions) and S
T
(of GCIs), we compute ﬁ-
nite sets of assertions and GCIs, viz., the envelopes
E
A
⊆ A
∗
of S
A
and E
T
⊆ T
∗
of S
T
respectively.
These envelopes are computed by two tableau algo-
rithms based on the idea of inverting the expansion
rules of two tableau algorithms listed in Figures 1 and
2. The idea behind the envelope concept is that no
expression in the envelope can be logically deduced
from information outside the envelope. Once such
envelopes are computed, the answers to the queries
are censored whenever the queries belong to the en-
velopes. Since, generally, an envelope for a given
secrecy set is not unique, the developer can force
the algorithm to output a speciﬁc envelope from the
available choices satisfying the needs of application
domain, company policy, social obligations and user
preferences.
Next, we discuss query answering procedures
which allow us answer queries without revealing se-
crets. Usually in SPQA framework queries are an-
swered by checking their membership (a) in A
∗
\ E
A
if the query is an assertion; and (b) in T
∗
\ E
T
if
the query is a GCI. Since A
∗
and T
∗
do not contain
all the statements entailed by Σ, we need to extend
the query answering procedure from just membership
checking. Towards that end we designed two recur-
sive algorithms to answer more complicated assertion
and GCI queries. To answer an assertion query q, the
algorithm ﬁrst checks if q ∈ A
∗
\ E
A
in which case the
answer is “Yes”; otherwise, the given query is broken
into subqueries based on the constructors, and the al-
gorithm is applied recursively on the subqueries, see
section 5. This query answering procedure runs in
polynomial time in the size of the KB and the query
q. Similar approach is used to answer GCI queries.
2 SYNTAX AND SEMANTICS
A vocabulary of ELH is a triple < N
O
, N
C
, N
R
> of
countably inﬁnite, pairwise disjoint sets. The ele-
ments of N
O
are called object (or individual) names,
the elements of N
C
are called concept names and the
elements of N
R
are called role names. The set of E LH
concepts is denoted by C and is deﬁned by the follow-
ing rules
C ::= A | > | C u D | ∃r.C
where A ∈ N
C
, r ∈ N
R
, > denotes the “top concept”,
and C, D ∈ C. Assertions are expressions of the form
C(a) or r(a, b), general concept inclusions (GCIs) are
expressions of the form C v D and role inclusions are
expressions of the form r v s where C, D ∈ C, r, s ∈
N
R
and a, b ∈ N
O
. The semantics of ELH concepts
is speciﬁed, as usual, by an interpretation I =
D
∆, ·
I
E
where ∆ is the domain of the interpretation, and ·
I
is an interpretation function mapping each a ∈ N
O
to
an element a
I
∈ ∆, each A ∈ N
C
to a subset A
I
⊆ ∆,
and each r ∈ N
R
to a binary relation r
I
⊆ ∆ × ∆. The
interpretation function ·
I
is extended inductively to
all ELH concepts in the usual manner:
>
I
= ∆; (C u D)
I
= C
I
∩ D
I
;
(∃r.C)
I
= {d ∈ ∆ | ∃e ∈ C
I
: (d, e) ∈ r
I
}.
An Abox A is a ﬁnite, non-empty set of assertions. A
TBox T is a ﬁnite set of GCIs and an RBox R is a
ﬁnite set of role inclusions. An E LH KB is a triple
Σ =
h
A, T , R
i
where A is an ABox, T is a TBox and
ICAART 2016 - 8th International Conference on Agents and Artiﬁcial Intelligence
150