Keeping Secrets in Modalized DL Knowledge Bases

Gopalakrishnan Krishnasamy Sivaprakasam

and Giora Slutzki

Department of Mathematics & Computer Science, Central State University, Wilberforce, Ohio, U.S.A

Department of Computer Science, Iowa State University, Ames, Iowa, U.S.A

Keywords:

Secrecy Preserving Reasoning, Knowledge Bases, Modalized Description Logic, Query Answering.

Abstract:

In this paper we study Secrecy-Preserving Query Answering problem under the Open World Assumption

(OWA) for ELH

−>

Knowledge Bases. Here E LH

−>

is a top-free description logic E LH augmented with a

modal operator ^. We employ a tableau procedure designed to compute a rooted labeled tree T which contains

information about some assertional consequences of the given knowledge base. Given a secrecy set S, which

is a ﬁnite set of assertions, we compute a function E, called an envelope of S, which assigns a set of assertions

to each node of T. E provides logical protection to the secrecy set S against the reasoning of a querying

agent. Once the tree T and an envelope E are computed, we deﬁne the secrecy-preserving tree T

. Based on

the information available in T

, assertional queries with modal operator ^ can be answered efﬁciently while

preserving secrecy. To the best of our knowledge, this work is ﬁrst one studying secrecy-preserving reasoning

in description logic augmented with modal operator ^. When the querying agent asks a query q, the reasoner

answers “Yes” if information about q is available in T

; otherwise, the reasoner answers “Unknown”. Being

able to answer “Unknown” plays a key role in protecting secrecy under OWA. Since we are not computing

all the consequences of the knowledge base, answers to the queries based on just secrecy-preserving tree T

could be erroneous. To ﬁx this problem, we further augment our algorithms by providing recursive query

decomposition algorithm to make the query answering procedure foolproof.

1 INTRODUCTION

Recently, Tao et al., in (Tao et al., 2014) have de-

veloped a conceptual framework to study secrecy-

preserving reasoning and query answering in De-

scription Logic (DL) Knowledge Bases (KBs) under

Open World Assumptions (OWA). The approach uses

the notion of an envelope to hide secret information

against logical inference and it was ﬁrst deﬁned and

used in (Tao et al., 2010). The idea behind the en-

velope concept is that no expression in the envelope

can be logically deduced from information outside

the envelope. This approach is based on the assump-

tion that the information contained in a KB is incom-

plete (by OWA) and (so far) it has been restricted to

very simple DLs and simple query languages. Specif-

ically, in (Tao et al., 2010; Tao et al., 2014; Krish-

nasamy Sivaprakasam and Slutzki, 2016) the main

idea was to utilize the secret information within the

reasoning process, but then answering “Unknown”

whenever the answer is truly unknown or in case the

true answer could compromise conﬁdentiality. In this

paper, we extend this approach to a DL that incorpo-

rates a modal operator.

Generally, modalized DLs are DLs with modal

operators. Lutz et al., in (Lutz et al., 2001) pre-

sented an exponential time tableau decision algorithm

for modalized ALC. In (Tao et al., 2012), the au-

thors presented a PSPACE algorithm for satisﬁability

reasoning problem in acyclic modalized ALC KBs.

Modal logic was used to study privacy related rea-

soning tasks, see (Barth and Mitchell, 2005; Halpern

and O’Neill, 2005; Jafari et al., 2011). Speciﬁ-

cally in (Halpern and O’Neill, 2005), the authors

showed that the modal logic of knowledge for mul-

tiagent systems provides a framework for reasoning

about anonymity. This framework was extended in

(Tsukada et al., 2009) to reasoning about privacy.

In an attempt to reduce the complexity of reason-

ing in modal logic to polynomial time, Hemaspaan-

dra in (Hemaspaandra, 2000) had considered several

propositional modal logic languages with one modal

operator. Motivated by these works, in this paper

we study secrecy-preserving query answering prob-

lem for ELH

−>

KBs where ELH

−>

is the top-free

description logic ELH augmented with the modal op-

erator ^. The reason for excluding > from the syn-

Krishnasamy Sivaprakasam G. and Slutzki G.

Keeping Secrets in Modalized DL Knowledge Bases.

DOI: 10.5220/0006202505910598

In Proceedings of the 9th International Conference on Agents and Artiﬁcial Intelligence (ICAART 2017), pages 591-598

ISBN: 978-989-758-220-2

591

tax of ELH logic is to avoid computing tautological

statements that are not relevant to secrecy preserva-

tion. In the literature there are several top-free DL

languages. For instance, DL-Lite

is a top-free DL,

see (Calvanese et al., 2007). The syntax and seman-

tics of the ELH

−>

DL are presented in Section 2.

Given an ELH

−>

KB Σ =

A, T , R

, as a ﬁrst

step in constructing secrecy-preserving reasoning sys-

tem, we use a tableau algorithm to compute a ﬁnite

rooted labeled tree T. The labeling set of the root node

of the T is A

∗

which contains a set of consequences

of the KB Σ, restricted to concepts that actually occur

in Σ and an extra “auxiliary” set of concepts deﬁned

over the signature of Σ. Since the computed tree does

not contain all the consequences of the KB, in order

to answer user queries we have designed a recursive

algorithm which breaks the queries into smaller as-

sertions all the way until the information in T can be

used.

To protect the secret information in the secrecy set

S, we extend the idea of envelope (as a set of asser-

tions) to a function E that assigns a set of assertions

to each node in T. This envelope is computed by an-

other tableau algorithm based on the idea of inverting

the local and global expansion rules given in the ﬁrst

tableau algorithm. Once such envelope is computed,

the answers to the queries are censored dependent

upon the labeling set assigned by E to the nodes of

T. Since, generally, an envelope is not unique, the de-

veloper has some freedom to output a envelope (from

the available choices) satisfying the needs of appli-

cation domain, company policy, social obligations or

user preferences.

Next, we discuss a query answering procedure

which allows us to answer queries without revealing

secrets. The queries are answered based on the in-

formation available in the secrecy-preserving tree ob-

tained from the tree T and the envelope E, see Section

4. This tree, once computed, remains ﬁxed. Usu-

ally in secrecy-preserving query answering frame-

work queries are answered by checking their mem-

bership in a previously computed set, see (Tao et al.,

2010; Tao et al., 2014; Krishnasamy Sivaprakasam

and Slutzki, 2016). Since the secrecy-preserving tree

does not contain all the statements entailed by Σ, we

need to extend the query answering procedure from

just membership checking. Towards that end we have

designed a recursive algorithm to answer more com-

plicated queries. To answer a query q, the algorithm

ﬁrst checks if q is a member of the labeling set of

the root node of the secrecy-preserving tree, in which

case the answer is “Yes”; otherwise, the given query

is broken into subqueries based on the logical con-

structors, and the algorithm is applied recursively on

the subqueries, see Section 5.

2 SYNTAX AND SEMANTICS

A vocabulary of ELH

−>

is a triple < N

, N

of countably inﬁnite, pairwise disjoint sets. The ele-

ments of N

are called object (or individual) names,

the elements of N

are called concept names and the

elements of N

are called role names. The set of

ELH

−>

concepts is denoted by C and is deﬁned by

the following rules

C ::= A | C u D | ∃r.C | ^C

where A ∈ N

, r ∈ N

, C, D ∈ C and ^C denotes the

modal constructor, read as “diamond C”. Assertions

are expressions of the form C(a) or r(a, b), general

concept inclusions (GCIs) are expressions of the form

C v D and role inclusions are expressions of the form

r v s where C, D ∈ C, r, s ∈ N

and a, b ∈ N

The semantics of ELH

−>

concepts is deﬁned by

using Kripke structures (Kripke, 1963). A Kripke

structure is a tuple M = hS, π, Ei where S is a set of

states, E ⊆ S × S is the accessibility relation, and π

interprets the syntax of ELH

−>

at each state s ∈ S.

Further, we denote by E(s) the set {t | (s, t) ∈ E} of

the successors of the state s. All the concepts and role

names will be interpreted in a common non-empty do-

main which we denote by ∆, see (Lutz et al., 2001;

Tao et al., 2012). The interpretation of concepts and

role names is deﬁned inductively as follows: for all

a ∈ N

, A ∈ N

, r ∈ N

, C, D ∈ C and for all s ∈ S,

π(s)

∈ ∆; A

π(s)

⊆ ∆; r

π(s)

⊆ ∆ × ∆;

(C uD)

π(s)

= C

π(s)

∩ D

π(s)

; (^C)

π(s)

t∈E (s)

π(t)

;

(∃r.C)

π(s)

= {d ∈ ∆ | ∃e ∈ C

π(s)

: (d, e) ∈ r

π(s)

An ABox A is a ﬁnite, non-empty set of assertions,

a TBox T is a ﬁnite set of GCIs and an RBox R is a

ﬁnite set of role inclusions. An ELH

−>

KB is a triple

Σ =

A, T , R

where A is an ABox, T is a TBox and

R is an RBox.

Let M = hS, π, Ei be a Kripke structure, s ∈ S,

C, D ∈ C, r, t ∈ N

and a, b ∈ N

. We say that

(M, s) satisﬁes C(a), r(a, b), C v D or r v t, nota-

tion (M, s) |= C(a), (M, s) |= r(a, b), (M, s) |= C v

D or (M, s) |= r v t if, respectively, a

π(s)

∈ C

π(s)

, b

π(s)

) ∈ r

π(s)

, C

π(s)

⊆ D

π(s)

or r

π(s)

⊆ t

π(s)

(M, s) satisﬁes Σ, notation (M, s) |= Σ, if (M, s) sat-

isﬁes all the assertions in A, all the GCIs in T and all

the role inclusions in R. M satisﬁes Σ, or M is a model

of Σ, if there exists a s ∈ S such that (M, s) |= Σ and

for all t ∈ S, (M, t) |= T ∪ R. Let α be an assertion, a

ICAART 2017 - 9th International Conference on Agents and Artiﬁcial Intelligence

592

GCI or a role inclusion. We say that Σ entails α, no-

tation Σ |= α, if for all Kripke structures M satisfying

Σ and for all states s of M, (M, s) |= Σ ⇒ (M, s) |= α.

3 COMPUTATION OF A MODEL

FOR ELH

−>

KB Σ AND A

∗

Denote by N

the set of all concept names and role

names occurring in Σ and let S be a ﬁnite set of con-

cepts over N

. Let C

Σ,S

be the set of all subconcepts

of concepts that occur in S or Σ and deﬁne

∗

={C(a) | C ∈ C

Σ,S

and Σ |= C(a)}∪

{r(a, b) | Σ |= r(a, b)}.

We use O

to denote the set of individual names that

occur in Σ, and deﬁne the witness set W = {w

r ∈ N

∩ N

and C ∈ C

Σ,S

}. Deﬁne O

∗

= O

∪ W.

Given Σ and C

Σ,S

, we outline a procedure that com-

putes a tree called a constraint tree over Σ: a rooted

tree T = hV, k

, E, Li where V is a set of nodes, k

∈ V

is the root of T, E is a set of directed edges and L is

a function that labels each node with a set of asser-

tions obtained by applying the expansion rules speci-

ﬁed below. The procedure builds T starting from the

root node k

whose labeling set L(k

) is initialized as

the ABox A. Further, T is grown by recursively ap-

plying the expansion rules in Figures 1 and 2. T is said

to be completed if no expansion rule in Figures 1 or 2

is applicable to it. The procedure is designed to out-

put a completed constraint tree T = hV, k

, E, Li with

L(k

) = A

∗

. For the purpose of query answering, T is

used as a “good approximation” of a (Kripke) model

of the given KB, for details see Section 5.

In more detail, there are two kinds of expansion

rules: (a) local expansion rules and (b) global expan-

sion rules. Local expansion rules are given in Figure

1 and generate new assertions within a single label-

ing set. The u

−

-rule decomposes conjunctions, and

∃

−

-rule decomposes existential restriction assertions

of the form ∃r.C(a) by introducing a corresponding

witness w

from the set W. The v-rule derives new

assertions based on the GCIs present in T . To con-

struct concept assertions whose associated concept

expressions already belong to C

Σ,S

, we use the u

and

∃

-rules. Finally, the H-rule derives role assertions

based on role inclusions in R. The global expansion

rules are given in Figure 2. The ^

−

-rule generates

new nodes that are directly accessible from the cur-

rent node. The ^

-rule adds a new ^ assertion to the

parent node of the current node.

A technicality; S will be used in Section 4 in the con-

text of secrecy-preserving reasoning.

− rule : if C(a), D(a) ∈ L(i), C u D ∈ C

Σ,S

and C u D(a) < L(i),

then L(i) := L(i) ∪ {C uD(a)};

−

− rule : if C u D(a) ∈ L(i),

and C(a) < L(i) or D(a) < L(i),

then L(i) := L(i) ∪ {C(a), D(a)};

∃

− rule : if r(a, b), C(b) ∈ L(i), ∃r.C ∈ C

Σ,S

and ∃r.C(a) < L(i),

then L(i) := L(i) ∪ {∃r.C(a)};

∃

−

− rule : if ∃r.C(a) ∈ L(i), and

∀b ∈ O

∗

, {r(a, b),C(b)} * L(i),

then L(i) := L(i) ∪ {r(a, w

),C(w

)},

where w

∈ W;

v −rule : if C(a) ∈ L(i), C v D ∈ T ,

and D(a) < L(i),

then L(i) := L(i) ∪ {D(a)};

H − rule : if r(a, b) ∈ L(i), r v s ∈ R,

and s(a, b) < L(i),

then L(i) := L(i) ∪ {s(a, b)};

Figure 1: Local expansion rules.

−

− rule : if there is a node i with ^C(a) ∈ L(i)

and i has no successor j

with C(a) ∈ L( j),

then add a new successor k of i

with L(k) := {C(a)};

− rule : if there is a node i with C(a) ∈ L(i),

^C ∈ C

Σ,S

and i has a parent j

with ^C(a) < L( j),

then L( j) := L( j) ∪ {^C(a)}.

Figure 2: Global expansion rules.

Example 1. Let Σ =

A, T , R

be a ELH

−>

KB,

where A = {^A(a),C(d), u(a, d)}, T = {^A v

B,C v ^^(D u E), E v ∃u.F, ^D v ^G}, R = {u v

v} and S = {∃u.C, ^^D}. Then, applying the rules in

Figures 1 and 2 we compute the completed constraint

tree T = hV, k

, E, Li whose labeling sets are given in

Figure 3. In this example, O

∗

= {a, d, w

, w

} and

- L(k

) = {^A(a), B(a),C(d), u(a, d), ∃u.C(a),

v(a, d), ^^(D u E)(d), ^^D(d)},

- L(k

) = {A(a)},

- L(k

) = {^(D u E)(d), ^D(d), ^G(d)},

- L(k

) = {D u E(d), D(d), E(d), ∃u.F(d),

u(d, w

), F(w

), v(d, w

)} and

- L(k

) = {G(d)}. 

Keeping Secrets in Modalized DL Knowledge Bases

593

L(k

) = A

∗

L(k

)

L(k

)

L(k

)

L(k

)

Figure 3: Completed constraint tree T = hV, k

, E, Li.

We will use the following notion of TBox acyclic-

ity, called here ^-acyclicity.

Deﬁnition 1. A sequence S

, S

...., S

, ... of concept

assertions over Σ, is called a ^-sequence, if it satisﬁes

the following conditions:

• S

= C

), C

∈ C

Σ,S

, a

∈ O

∗

• Given, S

= C

), with C

∈ C

Σ,S

, a

∈ O

∗

, the

next element in the sequence can be obtained as

follows: Let B

be the set of all assertions ob-

tained by applying the local rules starting from

. Put D

= B

∪ {S

- If D

does not contain any ^-assertions, then

is the last assertion of the sequence.

- If D

contains some ^-assertions, then

pick one, say ^P(b), and deﬁne S

n+1

) = P(b).

The resulting ^-sequence is said to be non-repetitive,

if for distinct i, j, C

, C

Deﬁnition 2. A TBox T is said to be ^-acyclic (with

respect to the rules given in Figures 1 and 2), if every

^-sequence is non-repetitive.

In this paper, we assume that all TBoxes are ^-

acyclic as per Deﬁnition 2 (we shall omit the phrase

“with respect to the rules”). We denote by Λ the algo-

rithm which, given Σ and C

Σ,S

, nondeterministically

applies the expansion rules in Figures 1 and 2 until no

further applications are possible. It is easy to see that

for each node k in the constraint tree T = hV, k

, E, Li,

the size of L(k) is polynomial in | Σ | + | C

Σ,S

|. An up-

per bound for the depth of T is given in the following

claim which follows immediately from Deﬁnitions 1

and 2.

Claim 1. The depth of T is O(| C

Σ,S

|).

All executions of Λ terminate and by Claim 1,

Λ builds a tree T whose depth is linear in | C

Σ,S

Since the ^-rule can in some cases be applied expo-

nentially many times in | Σ | + | C

Σ,S

|, T may have

exponentially many nodes. For instance, consider

a ELH

−>

KB Σ =

A, T , R

, where A = {A

(a)},

T = {A

v ^∃r.A

i+1

, A

v ^∃s.A

i+1

, 1 ≤ i ≤ n − 1}

and R =

0. Clearly, TBox T is ^-acyclic. To com-

pute the constraint tree T for Σ, the global rules must

be applied exponentially many times, implying that,

the worst case the running time of Λ is exponential in

| Σ | + | C

Σ,S

Before proving the correctness of Λ, we deﬁne the

notion of interpretation of a constraint tree, see (Lutz

et al., 2001; Tao et al., 2012).

Deﬁnition 3. Let T = hV, k

, E, Li be a constraint tree

over Σ, M = hS, π, Ei a Kripke structure, and σ a map-

ping from V to S. We say that M satisﬁes T via σ if

for all k, k

∈ V,

- (k, k

) ∈ E ⇒ (σ(k), σ(k

)) ∈ E, and

- (M, σ(k)) |= L(k), i.e., (M, σ(k)) |= α for every

α ∈ L(k)

We say that M satisﬁes T, denoted as M ||= T, if there

is a mapping σ such that M satisﬁes T via σ.

In the next lemma, we formulate the local sound-

ness property of Λ. We say that f

is an extension of

a function f if f

agrees with f on the domain of f .

The proof of the following lemma is omitted.

Lemma 1. Let Σ =

A, T , R

be ELH

−>

KB with an

^-acyclic TBox T and let M = hS, π, Ei be a Kripke

structure satisfying Σ. Also let T be a constraint tree

over Σ, α a local or global expansion rule and T

a constraint tree obtained by applying α to T. If M

satisﬁes T via σ, then there exists a Kripke structure

= hS, π

, Ei such that

- M

satisﬁes Σ and π

is an extension of π,

- M

satisﬁes T

via σ

, an extension of σ.

Lemma 1 makes sure that each application of local

and global rules preserves the model existence prop-

erty. Next we deﬁne the canonical Kripke structure

of a constraint tree.

Deﬁnition 4. Let T = hV, k

, E, Li be a completed

constraint tree over Σ. The canonical Kripke struc-

ture M

= hS, π, Ei for T is deﬁned as follows:

- S = V, E = E , ∆ = O

∗

= O

∪ W,

- a

π(k)

= a for all a ∈ O

∗

and each k ∈ V,

- A

π(k)

= {a ∈ O

∗

| A(a) ∈ L(k)}, A ∈ N

∩ N

- r

π(k)

= {(a, b) ∈ O

∗

×O

∗

| r(a, b) ∈ L(k)}, for all

r ∈ N

∩ N

π(k) is extended to compound concepts in the usual

way (see Section 2).

The following lemma shows that M

satisﬁes the

completed constraint tree T. The proof is omitted.

Lemma 2. Let Σ =

A, T , R

be ELH

−>

KB with a

^-acyclic TBox T . Also let T be a completed con-

straint tree over Σ. Then M

||= T.

ICAART 2017 - 9th International Conference on Agents and Artiﬁcial Intelligence

594

Next we prove that (M

, k) |= T ∪ R, for each

k ∈ S. We need the following auxiliary lemma whose

proof is an easy induction on the structure of C.

Lemma 3. For each C ∈ C

Σ,S

, each a ∈ O

∗

and each

k ∈ V, if (M

, k) |= C(a) then C(a) ∈ L(k).

The proof of the following lemma follows imme-

diately from Lemmas 2 and 3 and it is omitted.

Lemma 4. For each k ∈ S, (M

, k) |= T ∪ R.

The following corollary is an immediate conse-

quence of Lemmas 2 and 4.

Corollary 1. M

satisﬁes Σ.

Proof. By Deﬁnitions 3 and 4 and Lemmas 2 and 4,

we have that (1) (M

, k

) |= Σ and (2) for each k ∈ V,

, k) |= T ∪ R. Hence M

satisﬁes Σ. 

The proof of the next theorem follows from Deﬁ-

nition 4 and Lemma 3. In a sense, this theorem cap-

tures the completeness property of the algorithm Λ.

Theorem 1. Let T = hV, k

, E, Li be a completed con-

straint tree over Σ and M

= hS, π, Ei a canonical

Kripke structure for T. Then, for all k ∈ V, C ∈ C

Σ,S

r ∈ N

∩ N

, and all a, b ∈ O

∗

- (M

, k) |= r(a, b) ⇒ r(a, b) ∈ L(k) and

- (M

, k) |= C(a) ⇒ C(a) ∈ L(k).

Finally, the following is a consequence of Theo-

rem 1 and Corollary 1.

Corollary 2. L(k

) = A

∗

4 SECRECY-PRESERVING

REASONING IN ELH

−>

KB’S

Let Σ =

A, T , R

be a ELH

−>

KB and T = hV, k

, E,

Li a completed constraint tree over Σ. Let S ⊆ A

∗

the “secrecy set”. Given Σ, S and T, the objective is

to answer assertion queries while preserving secrecy,

i.e., answering queries so that assertions in S remain

protected. Our approach is to compute a function E

that assigns a ﬁnite set of assertions to each node in T.

E is called the secrecy Envelope for S, so that protect-

ing E(i) for all i ∈ V, the querying agent cannot log-

ically infer any assertion in S. The sets E(i) for each

i ∈ V are obtained by applying the inverted expan-

sion rules given in Figures 4 and 5. The role of OWA

in answering the queries is the following: When an-

swering a query with “Unknown”, the querying agent

should not be able to distinguish between the case that

the answer to the query is truly unknown to the KB

reasoner and the case that the answer is being pro-

tected for reasons of secrecy. We envision a situation

in which once the T is computed, a reasoner R is as-

sociated with it, i.e., R has unfettered access to T. R

is designed to answer queries as follows: If a query

cannot be inferred from Σ, the answer is “Unknown”.

If it can be inferred and it is not in E(k

), the answer

is “Yes”; otherwise, the answer is “Unknown”. We

make the following assumptions about the capabili-

ties of the querying agent:

(a) does not have direct access to ABox A, but is

aware of the underlying vocabulary of Σ,

(b) has full access to TBox T and RBox R,

(d) is not aware of the witness set W, by hidden

name assumptions (HNA), for more details see

(Tao et al., 2010).

We formally deﬁne the notion of an envelope

Deﬁnition 5. Let Σ =

A, T , R

be a ELH

−>

KB, S

a ﬁnite secrecy set and T = hV, k

, E, Li a completed

constraint tree. The secrecy envelope of S is a func-

tion E with domain V satisfying the following proper-

ties:

- S ⊆ E(k

); for each i ∈ V, E(i) ⊆ L(i), and

- for each i ∈ V, each α ∈ E(i), L(i) \ E(i) 6|= α.

The intuition for the above deﬁnition is that for

each i ∈ V, no information in E(i) can be inferred

from the set L(i) \ E(i). To compute an envelope, we

use the idea of inverting the rules of Figures 1 and 2

(see (Tao et al., 2010), where this approach was ﬁrst

utilized for membership assertions). Induced by the

Local and Global expansion rules in Figures 1 and

2, we deﬁne the corresponding “inverted” Local and

Global expansion rules in Figures 4 and 5, respec-

tively. Note that the ∃

−

-rule does not have its cor-

responding inverted rule. The reason for the omission

is that an application of this rule results in adding as-

sertions with individual names from the witness set.

By HNA, the querying agent is barred from asking

any queries that involve individual names from the

witness set. Inverted expansion rules are denoted by

preﬁxing Inv- to the name of the corresponding ex-

pansion rules.

From now on, we assume that T has been com-

puted and is readily available for computing the en-

velope. The computation begins with the initializa-

tion step: The set E(k

) is initialized as S, and E(i)

is initialized as

0 for all i ∈ V \ {k

}. Next, the sets

E(k

) and E(i) for all i ∈ V \{k

} are expanded using

the inverted expansion rules listed in Figures 4 and 5

until no further applications are possible. The result-

ing function E is said to be completed. We denote by

the algorithm which computes the sets E(i) for all

i ∈ V. Due to non-determinism in applying the rules

Inv-u

and Inv-∃

, different executions of Λ

may

result different outputs. Since for each i ∈ V, L(i)

Keeping Secrets in Modalized DL Knowledge Bases

595

Inv- u

−

−rule : if {C(a), D(a)} ∩ E(i) ,

and C u D(a) ∈ L(i) \ E(i),

then E(i) := E(i) ∪ {C u D(a)};

Inv- u

−rule : if C u D(a) ∈ E(i),

{C(a), D(a)} ⊆ L(i) \ E(i)

and C u D ∈ C

Σ,S

then E(i) := E(i) ∪ {C(a)}

or E(i) := E(i) ∪ {D(a)};

Inv-∃

− rule : if ∃r.C(a) ∈ E(i),

{r(a, b),C(b)} ⊆ L(i) \ E(i) with

b ∈ O

∗

and ∃r.C ∈ C

Σ,S

then E(i) := E(i) ∪ {r(a, b)}

or E(i) := E(i) ∪ {C(b)};

Inv- v −rule : if D(a) ∈ E(i), C v D ∈ T ,

and C(a) ∈ L(i) \ E(i),

then E(i) := E(i) ∪ {C(a)};

Inv-H − rule : if s(a, b) ∈ E(i), r v s ∈ R,

and r(a, b) ∈ L(i) \ E(i),

then E(i) := E(i) ∪ {r(a, b)}.

Figure 4: Inverted local expansion rules.

is ﬁnite, the computation of Λ

terminates. Let the

sets E(i) for i ∈ V be an output of Λ

. Since the size

of each L(i) is polynomial in |Σ| + |C

Σ,S

|, and each

application of inverted expansion rule moves an as-

sertion from L(i) into E(i), the size of E(i) is at most

the size of L(i). Since the size of V can be exponen-

tial, Λ

may take exponential time to compute the sets

E(i). Deﬁne the secrecy-preserving tree (constraint)

for the secrecy set S to be T

= hV, k

, E, L

i, where

(i) = L(i) \ E(i) for all i ∈ V.

Example 2. (Example 1 cont.) Recall that T =

hV, k

, E, Li is the completed constraint tree. Let

S = {B(a), ^^D(d)} be the secrecy set. Then, by

using rules in Figures 4 and 5 we compute the en-

velope for S, and one of the corresponding secrecy-

preserving trees is given below:

- E(k

) = S ∪ {^A(a),C(d), ^^(D u E)(d)},

- E(k

) = {A(a)},

- E(k

) = {^(D u E)(d), ^D(d)},

- E(k

) = {D u E(d), D(d)} and

- E(k

) =

Before proving the main result on envelopes, we

present several auxiliary lemmas. First shows that for

each i ∈ V, no assertion in E(i) is “logically reach-

able” from L

(i). The proof is omitted.

Inv-^

−

− rule : if there is a node j with

C(a) ∈ E( j) and

^C(a) ∈ L(i) \ E(i)

where i is the parent of j,

then E(i) := E(i) ∪ {^C(a)};

Inv-^

− rule : if there is a node i with

^C(a) ∈ E(i) and

C(a) ∈ L( j) \ E( j)

where j is a successor of i

and ^C ∈ C

Σ,S

then E( j) := E( j) ∪ {C(a)}.

Figure 5: Inverted global expansion rule.

)

- L

) = {u(a, d), ∃u.C(a), v(a, d)},

- L

) =

- L

) = {^G(d)},

- L

) = {E(d), ∃u.F(d), u(d, w

), F(w

v(d, w

)} and

- L

) = {G(d)}. 

Figure 6: Secrecy-preserving tree T

= hV, k

, E, L

Lemma 5. Let E be a completed function resulting

from the algorithm Λ

. Also, let T

= hV, k

, E, L

be a secrecy-preserving tree. Then, for each i ∈ V,

(i) is completed.

Next we claim that the secrecy-preserving tree has

properties similar to those of its completed constraint

tree. The proof is similar to the proofs of Lemmas 2,

3 and 4.

Lemma 6. Let T

= hV, k

, E, L

i be a secrecy-

preserving tree obtained from the completed con-

straint tree T = hV, k

, E, Li over Σ and the completed

function E. Deﬁne the canonical Kripke structure

= hS, π, Ei for T

- S = V, E = E , ∆ = O

∗

= O

∪ W,

- a

π(k)

= a for all a ∈ O

∗

and each k ∈ V,

- A

π(k)

= {a ∈ O

∗

| A(a) ∈ L

(k)}, for all A ∈ N

ICAART 2017 - 9th International Conference on Agents and Artiﬁcial Intelligence

596

- r

π(k)

= {(a, b) ∈ O

∗

× O

∗

| r(a, b) ∈ L

(k)}, for

all r ∈ N

π(k) is extended to compound concepts in the usual

way (see Section 2). Then,

- M

||= T

- For each C ∈ C

Σ,S

, each a ∈ O

∗

and each k ∈ V,

if (M

, k) |= C(a), then C(a) ∈ L

(k) and

- For each k ∈ S, (M

, k) |= T ∪ R.

Finally, we show that a completed function E is in

fact an envelope for the secrecy set S.

Theorem 2. Let T = hV, k

, E, Li be a completed con-

straint tree over Σ. Also, let T

= hV, k

, E, L

i be a

secrecy-preserving tree for the secrecy set S. Then,

the completed function E is an envelope for S.

Proof. We have to show that the completed function

E satisﬁes all three properties of Deﬁnition 5. Proper-

ties 1 and 2 are obvious. To prove property 3, suppose

that for some i ∈ V, some α ∈ E(i), L

(i) |= α.

Let M

= hS, π, Ei be the canonical Kripke struc-

ture for T

. By Lemma 6, for each i ∈ V, (M

, i) |=

(i). Again, by Lemma 6, α ∈ L

(i). This is a con-

tradiction. 

5 QUERY ANSWERING

Let Σ =

A, T , R

be a ELH

−>

KB. We assume

that the secrecy-preserving tree T

= hV, k

, E, L

has been precomputed and use E(k) to denote the set

∈ V | (k, k

) ∈ E} of the successors of the node

k ∈ V. The reasoner R answers queries based on

the information in T

and replies to a query q with

“Yes” if Σ |= q and q < E(k

); otherwise, the answer

is “Unknown”. Recall that, because of the syntactic

restrictions of the language ELH

−>

, R does not an-

swer “No” to any query.

Since the completed constraint tree T over Σ does

not contain all the consequences of Σ, the completed

secrecy-preserving tree T

obtained from T does not

contain all the information needed to answer queries.

To address this problems we provide a procedure

Eval(k, q) which works by recursively decomposing

the compound queries all the way to the information

available in T

, see Figure 7. Initial call of this pro-

cedure is at the root node k

of T

. In lines 1 and 2,

the reasoner checks the membership of q in L

(k) and

answers “Yes” if q ∈ L

(k). From line 3 onwards we

consider cases in which query q is broken into sub-

queries based on the constructors deﬁned in ELH

−>

and apply the procedure recursively. The following

theorem states the correctness claim of the algorithm.

Eval(k, q)

1: case q ∈ L

(k) = L(k) \ E(k)

2: return “Yes”

3: case q = C u D(a)

4: if Eval(k,C(a)) =“Yes” and

Eval(k, D(a)) =“Yes” then

5: return “Yes”

6: else

7: return “Unknown”

8: case q = ∃r.C(a)

9: if for some d ∈ O

∗

[ r(a, d) ∈ L

(k)

and Eval(k,C(d)) =“Yes”] then

10: return “Yes”

11: else

12: return “Unknown”

13: case q = ^C(a)

14: if for some l ∈ E(k)

[Eval(l,C(a)) = “Yes” ] then

15: return “Yes”

16: else

17: return “Unknown”

Figure 7: Query answering algorithm.

Theorem 3. Let Σ =

A, T , R

be an ELH

−>

KB,

= hV, k

, E, L

i a completed secrecy-preserving

tree and q a query. Then, for every k ∈ V,

- Soundness: Eval(k, q) outputs “Yes” ⇒ L

(k) |=

- Completeness: Eval(k, q) outputs “Unknown”

⇒ L

(k) 6|= q.

Proof. We omit the proof of soundness. To prove

the completeness part assume that L

(k) |= q. We

have to show that Eval(k, q) = “Yes”. Let M

be the

canonical Kripke structure for T

as deﬁned in Sec-

tion 4. By Lamma 6, M

||= T

and for all k ∈ V,

, k) |= T ∪ R. Therefore (M

, k) |= L

(k) and

hence, by the assumption, for every k, (M

, k) |= q.

We prove the claim by induction on the structure of q.

The inductive hypothesis is, for each k ∈ V and each

assertion α if (M

, k) |= α, then Eval(k, α) = “Yes”.

The base case: Let q =C(a) where C ∈ C

Σ,S

. Then, by

Lemma 6, C(a) ∈ L

(k). By Lines 1 and 2 in Figure

7, the claim follows immediately. Next, let q = C(a)

where C < C

Σ,S

- q = C u D(a). To answer this query the algo-

rithm computes Eval(k,C(a)) and Eval(k, D(a)).

Now, the assumption (M

, k) |= C u D(a) implies

, k) |= C(a) and (M

, k) |= D(a) which, by

inductive hypothesis, implies that Eval(k,C(a)) =

Eval(k, D(a)) = “Yes”. Hence, by Lines 4 and 5

in Figure 7, Eval(k,C u D(a)) = “Yes”.

- q = ∃r.C(a). By the assumption, (M

, k) |=

∃r.C(a). This implies that, for some d ∈

Keeping Secrets in Modalized DL Knowledge Bases

597

∗

, (M

, k) |= r(a, d) and (M

, k) |= C(d). By

Theorem 1, r(a, d) ∈ L

(k) and by the induc-

tive hypothesis Eval(k,C(d))=“Yes”. Hence, by

the Lines 9 and 10 in Figure 7, Eval(k, ∃r.C(a))=

“Yes”.

- q = ^C(a). Then, (M

, k) |= ^C(a). This implies

that, for some l ∈ E(k), (M

, l) |= C(a). By Def-

inition 4, (k, l) ∈ E and therefore l ∈ E(k). By

the inductive hypothesis Eval(l,C(a)) = “Yes”.

Hence, by the Lines 14 and 15 in Figure 7,

Eval(k, ^C(a))= “Yes”.



Given an assertional query q, the algorithm given

in Figure 7 checks for some assertions related to query

q in the labeling sets of nodes along a particular path

in T

. Since the size of each labeling set is bounded

by | Σ | + | C

Σ,S

|, by the Claim 1, this algorithm runs

in time polynomial in | Σ | + | C

Σ,S

|. Hence the as-

sertional query answering can be done in polynomial

time in the size of | Σ | + | C

Σ,S

Example 3. (example 2 cont.) Recall that T

a secrecy-preserving tree. Suppose that the query-

ing agent asks the assertional queries ∃u.C(a),

^^∃v.F(d) and ^A(a) . Using the algorithm in Fig-

ure 7, we get the following answers:

q Eval(k, q) Remarks

∃u.C(a) Yes by Lines 1 and 2

^^∃v.F(d) Yes by 14, 15, 9 and 1

^A(a) Unknown by 14 and 17 

6 CONCLUSIONS

In this paper we have studied the problem of secrecy-

preserving query answering over ELH

−>

KBs. We

have used the conceptual logic-based framework for

secrecy-preserving reasoning which was introduced

in Tao et al. 2014, to a top-free description logic

ELH augmented with a modal operator ^. The

main contribution is in the way that we compute the

consequences and preserve secrecy while answering

queries. We break the process into two parts, the ﬁrst

one using the ^-assertions in the KB, precomputes

the rooted labeled tree T and the envelope E for the

given secrecy set S. For this we use two separate (but

related) tableau procedures. In query answering step,

given T and E, we deﬁne the secrecy-preserving tree

. Once T

has been computed, the query answer-

ing procedure is efﬁcient and can be implemented in

polynomial time.

REFERENCES

Barth, A. and Mitchell, J. C. (2005). Enterprise privacy

promises and enforcement. In Proceedings of the 2005

workshop on Issues in the theory of security, pages

58–66. ACM.

Calvanese, D., De Giacomo, G., Lembo, D., Lenzerini, M.,

and Rosati, R. (2007). Tractable reasoning and efﬁ-

cient query answering in description logics: The dl-

lite family. J. of Automated Reasoning, 39(3):385–

429.

Halpern, J. Y. and O’Neill, K. R. (2005). Anonymity and

information hiding in multiagent systems. Journal of

Computer Security, 13(3):483–514.

Hemaspaandra, E. (2000). The complexity of poor mans

logic. In STACS 2000, pages 230–241. Springer.

Jafari, M., Fong, P. W., Safavi-Naini, R., Barker, K., and

Sheppard, N. P. (2011). Towards deﬁning semantic

foundations for purpose-based privacy policies. In

Proceedings of the ﬁrst ACM conference on Data

and application security and privacy, pages 213–224.

ACM.

Kripke, S. A. (1963). Semantical analysis of modal logic

1 normal modal propositional calculi. Mathematical

Logic Quarterly, 9(5-6):67–96.

Krishnasamy Sivaprakasam, G. and Slutzki, G. (2016).

Secrecy-preserving query answering in E LH knowl-

edge bases. In ICAART.

Lutz, C., Sturm, H., Wolter, F., and Zakharyaschev, M.

(2001). Tableaux for temporal description logic with

constant domains. In Automated Reasoning, pages

121–136. Springer.

Tao, J., Slutzki, G., and Honavar, V. (2010). Secrecy-

preserving query answering for instance checking in

EL. In Proceedings of Web Reasoning and Rule Sys-

tems, 195–203.

Tao, J., Slutzki, G., and Honavar, V. (2012). Pspace tableau

algorithms for acyclic modalized ALC. Journal of

Automated Reasoning, 49(4):551–582.

Tao, J., Slutzki, G., and Honavar, V. (2014). A conceptual

framework for secrecy-preserving reasoning in knowl-

edge bases. TOCL, 16(1):3:1–3:32.

Tsukada, Y., Mano, K., Sakurada, H., and Kawabe, Y.

(2009). Anonymity, privacy, onymity, and identity: A

modal logic approach. In Computational Science and

Engineering, 2009. CSE’09. International Conference

on, volume 3, pages 42–51. IEEE.

ICAART 2017 - 9th International Conference on Agents and Artiﬁcial Intelligence

598