![](bg2.png)
tax of ELH logic is to avoid computing tautological
statements that are not relevant to secrecy preserva-
tion. In the literature there are several top-free DL
languages. For instance, DL-Lite
R
is a top-free DL,
see (Calvanese et al., 2007). The syntax and seman-
tics of the ELH
^
−>
DL are presented in Section 2.
Given an ELH
^
−>
KB Σ =
h
A, T , R
i
, as a first
step in constructing secrecy-preserving reasoning sys-
tem, we use a tableau algorithm to compute a finite
rooted labeled tree T. The labeling set of the root node
of the T is A
∗
which contains a set of consequences
of the KB Σ, restricted to concepts that actually occur
in Σ and an extra “auxiliary” set of concepts defined
over the signature of Σ. Since the computed tree does
not contain all the consequences of the KB, in order
to answer user queries we have designed a recursive
algorithm which breaks the queries into smaller as-
sertions all the way until the information in T can be
used.
To protect the secret information in the secrecy set
S, we extend the idea of envelope (as a set of asser-
tions) to a function E that assigns a set of assertions
to each node in T. This envelope is computed by an-
other tableau algorithm based on the idea of inverting
the local and global expansion rules given in the first
tableau algorithm. Once such envelope is computed,
the answers to the queries are censored dependent
upon the labeling set assigned by E to the nodes of
T. Since, generally, an envelope is not unique, the de-
veloper has some freedom to output a envelope (from
the available choices) satisfying the needs of appli-
cation domain, company policy, social obligations or
user preferences.
Next, we discuss a query answering procedure
which allows us to answer queries without revealing
secrets. The queries are answered based on the in-
formation available in the secrecy-preserving tree ob-
tained from the tree T and the envelope E, see Section
4. This tree, once computed, remains fixed. Usu-
ally in secrecy-preserving query answering frame-
work queries are answered by checking their mem-
bership in a previously computed set, see (Tao et al.,
2010; Tao et al., 2014; Krishnasamy Sivaprakasam
and Slutzki, 2016). Since the secrecy-preserving tree
does not contain all the statements entailed by Σ, we
need to extend the query answering procedure from
just membership checking. Towards that end we have
designed a recursive algorithm to answer more com-
plicated queries. To answer a query q, the algorithm
first checks if q is a member of the labeling set of
the root node of the secrecy-preserving tree, in which
case the answer is “Yes”; otherwise, the given query
is broken into subqueries based on the logical con-
structors, and the algorithm is applied recursively on
the subqueries, see Section 5.
2 SYNTAX AND SEMANTICS
A vocabulary of ELH
^
−>
is a triple < N
O
, N
C
, N
R
>
of countably infinite, pairwise disjoint sets. The ele-
ments of N
O
are called object (or individual) names,
the elements of N
C
are called concept names and the
elements of N
R
are called role names. The set of
ELH
^
−>
concepts is denoted by C and is defined by
the following rules
C ::= A | C u D | ∃r.C | ^C
where A ∈ N
C
, r ∈ N
R
, C, D ∈ C and ^C denotes the
modal constructor, read as “diamond C”. Assertions
are expressions of the form C(a) or r(a, b), general
concept inclusions (GCIs) are expressions of the form
C v D and role inclusions are expressions of the form
r v s where C, D ∈ C, r, s ∈ N
R
and a, b ∈ N
O
.
The semantics of ELH
^
−>
concepts is defined by
using Kripke structures (Kripke, 1963). A Kripke
structure is a tuple M = hS, π, Ei where S is a set of
states, E ⊆ S × S is the accessibility relation, and π
interprets the syntax of ELH
^
−>
at each state s ∈ S.
Further, we denote by E(s) the set {t | (s, t) ∈ E} of
the successors of the state s. All the concepts and role
names will be interpreted in a common non-empty do-
main which we denote by ∆, see (Lutz et al., 2001;
Tao et al., 2012). The interpretation of concepts and
role names is defined inductively as follows: for all
a ∈ N
O
, A ∈ N
C
, r ∈ N
R
, C, D ∈ C and for all s ∈ S,
a
π(s)
∈ ∆; A
π(s)
⊆ ∆; r
π(s)
⊆ ∆ × ∆;
(C uD)
π(s)
= C
π(s)
∩ D
π(s)
; (^C)
π(s)
=
S
t∈E (s)
C
π(t)
;
(∃r.C)
π(s)
= {d ∈ ∆ | ∃e ∈ C
π(s)
: (d, e) ∈ r
π(s)
}.
An ABox A is a finite, non-empty set of assertions,
a TBox T is a finite set of GCIs and an RBox R is a
finite set of role inclusions. An ELH
^
−>
KB is a triple
Σ =
h
A, T , R
i
where A is an ABox, T is a TBox and
R is an RBox.
Let M = hS, π, Ei be a Kripke structure, s ∈ S,
C, D ∈ C, r, t ∈ N
R
and a, b ∈ N
O
. We say that
(M, s) satisfies C(a), r(a, b), C v D or r v t, nota-
tion (M, s) |= C(a), (M, s) |= r(a, b), (M, s) |= C v
D or (M, s) |= r v t if, respectively, a
π(s)
∈ C
π(s)
,
(a
π(s)
, b
π(s)
) ∈ r
π(s)
, C
π(s)
⊆ D
π(s)
or r
π(s)
⊆ t
π(s)
.
(M, s) satisfies Σ, notation (M, s) |= Σ, if (M, s) sat-
isfies all the assertions in A, all the GCIs in T and all
the role inclusions in R. M satisfies Σ, or M is a model
of Σ, if there exists a s ∈ S such that (M, s) |= Σ and
for all t ∈ S, (M, t) |= T ∪ R. Let α be an assertion, a
ICAART 2017 - 9th International Conference on Agents and Artificial Intelligence
592