BOUNCER is a privacy-aware query engine for federations of RDF datasets that respects individual privacy and access control policies. It describes data sources using Privacy-aware RDF Molecule Templates (PRDF-MTs) that specify classes, predicates, access control operations, and links between templates. BOUNCER decomposes queries into star-shaped subqueries aligned with PRDF-MTs, selects sources allowing required operations, and generates bushy query plans respecting source policies. An evaluation found BOUNCER incurs overhead enforcing policies but can identify more efficient valid plans than existing engines. It was concluded BOUNCER provides a means to describe source policies and guarantees generating valid privacy-respecting query plans.

1. wdaqua.eu
BOUNCER: A Privacy-aware Query Processing Over
Federations of RDF Datasets
Kemele M. Endris, Zuhair Almhithawi, Ioanna Lytra, Maria-Esther Vidal, Sören Auer
DEXA 2018 - September 3 - 6, 2018
Regensburg, Germany
Innovation Training
Network (ITN)

2. 2
Data privacy
Individual’s rights of
preserving access control to
personal data, e.g., health
information, genomics, and
political and religious
preferences.

3. 3
Data privacy
Individual’s rights of
preserving access control to
personal data, e.g., health
information, genomics, and
political and religious
preferences.
http://www.oneadvisory.london/gdpr-eu-general-data-protection-regulation/

4. Motivating Example
4
Patient Mutation GeneLiquid Biopsy
1
https://commons.wikimedia.org/wiki/File:Green_hospital_icon.svg
Clinical Records Genomic data

5. RDF Graphs
5
Mutation Gene
15604253 22980975
‘c.2369C>T’ ‘7:55181378’
‘p.T790M’
‘ENST00000
275493’
‘EGFR’
:located_in
:mentioned_in
:acc_num
:mentioned_in
:mutation_aa
:geneName:mutation_loci:mutation_cds
Public
Data!

6. RDF Graphs
6
Patient
Liquid Biopsy
:name :gender
:smoking :egfr_mutated
:address
:birthdate
:biopsy
:targetTotal
:mutation_aa
Controlled
Data!
Local Join
Permitted!
No
Operation
Permitted!
‘Einstein str. 1,
10100, Germany’
‘Alice Bob’ ‘Female’
‘03/03/1923’
0.63%
‘p.T790M’‘True’‘False’
Sensitive
Data

7. SPARQL Query
7
Patient Mutation GeneLiquid
Biopsy
1
https://commons.wikimedia.org/wiki/File:Green_hospital_icon.svg
Clinical Records Genomic data
SPARQL Query
PREFIX ex: <http://example.com/vocab/>
SELECT DISTINCT ?mutation ?loci ?pubmedid ?accNum
WHERE {
?lbiop ex::mutation_aa ?mutation .
?lbiop ex:targetTotal ?targetTotal .
?patient ex:biopsy ?lbiop .
?patient ex:smoking “False” .
?patient ex:egfr_mutated “True” .
?cmut ex:mutation_aa ?mutation .
?cmut ex:mentioned_in ?pubmedid .
?cmut ex:mutation_loci ?loci .
?cmut ex:located_in ?gene .
?gene ex:gene_name “EGFR” .
?gene ex:acc_num ?accNum . }
1
2
3
4
5
6
7
8
9
10
11
Genes associated with non-smoking lung cancer
patients whose liquid biopsy
has been studied for somatic mutations that
involve EGFR gene amplification:
● Mutation name
● Genomic coordinates of the mutations
● Pubmed ID
● Accession numbers

8. Different Execution Plans
8
PREFIX ex: <http://example.com/vocab/>
SELECT DISTINCT ?mutation ?loci ?pubmedid ?accNum
WHERE {
?lbiop ex::mutation_aa ?mutation .
?lbiop ex:targetTotal ?targetTotal .
?patient ex:biopsy ?lbiop .
?patient ex:smoking “False” .
?patient ex:egfr_mutated “True” .
?cmut ex:mutation_aa ?mutation .
?cmut ex:mentioned_in ?pubmedid .
?cmut ex:mutation_loci ?loci .
?cmut ex:located_in ?gene .
?gene ex:gene_name “EGFR” .
?gene ex:acc_num ?accNum . }
1
2
3
4
5
6
7
8
9
10
11
1
2 3
4
5 6
7
8 9
10
11
1
2 3
4
5 6
7
8 9
10
10
11
10
11
6
7
8 9
1
23 4
5
Running the Query over different Federated Query Engines
FedX ANAPSID MULDER
Dependent
JOIN
Independen
t JOIN

9. Invalid Executions of Query Plans
9
1
2 3
4
5 6
7
8 9
10
11
1
2 3
4
5 6
7
8 9
10
10
11
10
11
6
7
8 9
1
23 4
5
FedX ANAPSID MULDER
Violates AC policy of
hospital by extracting
data about patient and
biopsy!
Violates AC policy of
hospital by extracting
data about patient and
biopsy!
Violates AC policy of
hospital by extracting
data about patient!

10. Agenda
1. BOUNCER: A privacy-aware federated query
engine over SPARQL endpoints
2. Empirical Evaluation
3. Conclusions and Lessons Learned
10

11. 11
BOUNCER
Privacy-Aware
Query Engine

12. BOUNCER: Architecture
BOUNCER describes data sources using
Privacy-aware RDF Molecule Templates
(PRDF-MTs)
12

13. BOUNCER: Architecture
BOUNCER describes data sources using
Privacy-aware RDF Molecule Templates
(PRDF-MTs)
13

14. Privacy-aware RDF Molecule Templates (PRDF-MTs)
• PRDF-MTs characterize RDF molecules that share same
characteristics, e.g., ex:geneName, ex:mentioned_in
• PRDF-MTs are defined in terms of:
• RDF Class
• Set of predicates
• Set of access control operations associated with the
predicates
• Intra and inter links between PRDF-MTs
• API interfaces to access the data, e.g., SPARQL endpoint
14

15. Privacy-aware RDF Molecule Templates (PRDF-MTs)
15
Mutation Gene
ex:mentioned_in
ex:mutation_cds ex:mutation_loci
ex:mutation_aa
ex:acc_num
ex:geneName
ex:located_in Projecting Values
is allowed!
(Values are Public)

16. Privacy-aware RDF Molecule Templates (PRDF-MTs)
16
Patient
Liquid Biopsy
ex:biopsy
ex:address
ex:name
ex:gender
ex:birthdate
ex:targetTotal
ex:mutation_aaex:egfr_mutatedex:smoking
JoinLocal
No Operation
Permitted!
Join operation
permitted
Locally!

17. Privacy-aware Operations
1. Join Local
○ Join operation allowed only at server (on premises of the publisher(owner))
2. Join at Federation Mediator
○ Join operation allowed both at the server and at the mediator, i.e., the
federation engine
○ Values can not be projected out of the mediator
3. Project(public)
○ The values of the property p can be projected from the dataset to the user.
○ Join operation is allowed both at the server and mediator
17
Access control policy of a dataset is composed of privacy-aware
operations that can be performed on properties in the dataset.

18. Privacy-aware Source Selection & Decomposition
1. BOUNCER creates a query decomposition with service graph patterns
(SGPs) of star-shaped subqueries built according to PRDF-MTs
○ Star-shaped subqueries (SSQs) set of triple patterns with the same subject
2. Respect the privacy and access control policy of selected sources
○ Minimize execution time and maximize answer completeness by selecting
only relevant sources that allow for at least one access operation
18

19. Star-shaped Subqueries (SSQs)
19
PREFIX ex: <http://example.com/vocab/>
SELECT DISTINCT ?mutation ?loci ?pubmedid ?accNum
WHERE {
?lbiop ex::mutation_aa ?mutation .
?lbiop ex:targetTotal ?targetTotal .
?patient ex:biopsy ?lbiop .
?patient ex:smoking “False” .
?patient ex:egfr_mutated “True” .
?cmut ex:mutation_aa ?mutation .
?cmut ex:mentioned_in ?pubmedid .
?cmut ex:mutation_loci ?loci .
?cmut ex:located_in ?gene .
?gene ex:gene_name “EGFR” .
?gene ex:acc_num ?accNum . }
1
2
3
4
5
6
7
8
9
10
11
SSQ1
SSQ2
SSQ3
SSQ4
3 4
5
1
2
9
11
ex:biopsy
ex:mutarion_aa
ex:located_in
6 7
8 10

20. BOUNCER: Privacy-aware Source Selection
20
3 4
5
1
2
ex:biopsy ex:mutarion_aa ex:located_in
9
6 7
8
11
10
Patient Liquid Biopsy
SSQs
PRDF-MT
Mutation Gene
Source
AC Operations
3
4
5
JoinLocal
JoinLocal
JoinLocal
1
2
JoinLocal
JoinLocal
10
11
Public
Public
6
7
8
9
Public
Public
Public
Public

21. BOUNCER: Privacy-aware Source Selection
21
SSQs
PRDF-MT
Source
AC Operations
3
4
5
ex:mutarion_aa
Patient & Liquid Biopsy Mutation & Gene
3
4
5
JoinLocal
JoinLocal
JoinLocal
1
2
JoinLocal
JoinLocal
10
11
Public
Public
6
7
8
9
Public
Public
Public
Public
9
6 7
8
1110
1
2
Joins can be
performed locally

22. BOUNCER: Privacy-aware Query Planning
● BOUNCER applies a greedy heuristic based approach to
generate a bushy plan
○ leaves correspond to Star Shaped Queries (SSQs)
● BOUNCER finds a valid plan that respects the
privacy-policy of the data sources.
○ Selects physical operators based on the access policy of
the data sources
22

23. 23
SSQs
PRDF-MT
Source
AC Operations
Operator respects the privacy
policy of binding values for
ex:muation_aa
Patient & Liquid Biopsy
3
4
5
1
2
Mutation & Gene
9
6 7
8
1110
Dependent JOINBOUNCER:
Privacy-aware
Query Planning

24. Empirical Evaluation
24

25. Experimental Setup
Research Questions (RQs):
RQ1) Does privacy-aware enforcement employed during source selection,
query decomposition, and planning impact query execution time?
RQ2) Can privacy-aware policies be used to identify query plans that
enhance execution time and answer completeness?
25

26. Experimental Setup
Benchmark:
The Berlin SPARQL Benchmark (BSBM) dataset
■ 200M triples
■ 14 queries
Metrics
■ Execution time: elapsed time between the submission of a query to an
engine and the delivery of the answers (timeout: 300 sec)
■ Throughput: number of answers produced per second
26

27. Experiment I: Decomposition and Planning Time
● Goal: Assess impact of access control enforcement during source
selection, decomposition and planning on the overall query execution
time. (RQ1)
● All properties in the federation are public,
● MULDER and BOUNCER are compared on:
a. Decomposition and Planning time.
b. Query execution time
27

28. Experiment I: Decomposition and Planning Time
28
BOUNCER consumes
more time in query
decomposition and
planning

29. Experiment I: Decomposition and Planning Time
29
BOUNCER consumes
more time in query
decomposition and
planning
Enforcing privacy and
access control is
costly

30. Experiment I: Overall Execution Time
30
BOUNCER query
plans speed up
execution time
Effective and valid
plans can be
identified
Simple query

31. Experiment II
● Goal: Access impact of privacy-aware query plans
● Privacy policy:
a. Local Join: all properties of Person, Producer, Product, and ProductFeature
b. Project (Public): all properties of Offer, Review, ProductType, and Vendor
● Federated Query Engines
a. FedX
b. ANAPSID
c. MULDER
d. BOUNCER
31

32. Experiment II: Efficiency of Query Plans
32
Existing engines can
generate executable
plans by chance.

33. Experiment II: Efficiency of Query Plans
33
Existing engines can
generate executable
plans by chance.
BOUNCER always
generates valid plans
BOUNCER valid plans
can be more efficient
than other plans

34. Conclusions and Lessons Learned
34
Sources and data privacy policies can
be described in terms of PRDF-MTS.
BOUNCER is a privacy-aware
federated query engine

35. Conclusions and Lessons Learned
35
Sources and data privacy policies can
be described in terms of PRDF-MTS.
BOUNCER is a privacy-aware
federated query engine
Enforcing data privacy and access
control is costly
Efficient and valid plans can be
identified

36. Conclusions and Lessons Learned
36
Sources and data privacy policies can
be described in terms of PRDF-MTS.
BOUNCER is a privacy-aware
federated query engine
Enforcing data privacy and access
control is costly
Efficient and valid plans can be
identified
BOUNCER always identifies valid plans
and can outperform existing
federated SPARQL engines

37. CONTACT
Kemele M. Endris
Forschungszentrum L3S
Leibniz Universität Hannover
Welfengarten 1B
30167, Hannover, Germany
email: endris@L3S.de
phone: +49-151-762-14695
Prof. (Uni.Simon Bolivar) Dr. Maria-Esther Vidal
Scientific Data Management
Technische Informationsbibliothek (TIB)
Welfengarten 1B
30167, Hannover, Germany
email: Maria.Vidal@tib.eu
phone: +49-115-762-14690
wdaqua.eu
37
Thank you for your
attention! Innovation Training
Network (ITN)