Securing Data Access with Templated Queries

[AdamSobieski]

Introduction

How can interoperating systems, e.g., intelligent agents in multi-agent systems, each having their own databases or knowledge graphs, provide access control with respect to their resources? Could verifying and validating each structured query, in these regards, be simplified?

The idea presented here is to use templates to transform structured queries into objects more resembling remote procedure calls or actions so that verifying and validating these, for well-known query types, could be performed more efficiently.

Interestingly, in this approach, the transmitted objects describe those processes with which to obtain their corresponding structured query-language representations, e.g., SPARQL or SQL.

Text-based templates could be processed, alongside bindings for their parameters, into structured queries. Such templates could, for example, utilize a notation like {{name}} or {{name type}} to indicate those positions in them to be replaced by those arguments bound to their template parameters.

Examples

XML

Let us consider a templated SPARQL query, a resource at https://resource.org/1.hbs, which might resemble:

PREFIX dc: <http://purl.org/dc/elements/1.1/>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

SELECT ?title
WHERE
{
  ?book dc:title ?title .
  ?book dc:creator ?author .
  ?author foaf:name "{{author}}" .
}

Next, the following markup:

<template input="text/handlebars" output="text/sparql" src="https://resource.org/1.hbs">
  <param name="author">Bob Smith</param>
</template>

indicates to process the templated query, replacing {{author}} with Bob Smith so that the resultant SPARQL query would be:

PREFIX dc: <http://purl.org/dc/elements/1.1/>
PREFIX foaf: <http://xmlns.com/foaf/0.1/>

SELECT ?title
WHERE
{
  ?book dc:title ?title .
  ?book dc:creator ?author .
  ?author foaf:name "Bob Smith" .
}

Here is an example with a template that could be processed into SQL:

<template input="text/handlebars" output="text/sql" src="https://resource.org/2.hbs">
  <param name="param1">value1</param>
  <param name="param2">value2</param>
</template>

Here is an example which provides alternatives between two templating formats available. That is, there could be more than one text-based templating format.

<template>
  <source input="text/handlebars" output="text/sparql" src="https://resource.org/3.hbs">
    <param name="param1">value1</param>
    <param name="param2">value2</param>
  </source>
  <source input="text/t4" output="text/sparql" src="https://resource.org/3.t4">
    <param name="param1">value1</param>
    <param name="param2">value2</param>
   </source>
</template>

Here is an example showing how a cryptographic hash could be used to further describe a template resource.

<template input="text/handlebars" output="text/sparql" integrity="..." src="https://resource.org/4.hbs">
  <param name="param1">value1</param>
  <param name="param2">value2</param>
</template>

Here is the first example revisited to show that additional attributes could be provided upon parameters, e.g., categorizing or describing them. The expressiveness for additional attributes on parameters could enhance scenarios involving the description of constraints, e.g., with ODRL.

<template input="text/handlebars" output="text/sparql" src="https://resource.org/1.hbs">
  <param name="author" class="human agent subject">Bob Smith</param>
</template>

Alternatively, for some templating languages, descriptions of templates' parameters could be placed in the template resources.

JSON

Here is what the templating-based compression model could resemble, expressed in JSON:

{
  "template": "https://resource.org/5.hbs",
  "input": "text/handlebars",
  "output": "text/sparql",
  "arguments": {
    "param1": "value1",
    "param2": "value2"
  }
}

Discussion

The indicated techniques map the processing, the verification and validation, of structured queries into the processing of objects more resembling remote procedure calls.

With caching, recipients of templated queries could efficiently retrieve any recognized templates from their caches.

In some cases, software functions could be developed for well-known URLs to handle instances of templated queries.

In other cases, runtime code generation could be of use.

Developed, generated or emitted functions – these functions perhaps involving compiled query representations or optimized query plans – could be indexed by the well-known URLs and subsequently invoked with the provided arguments, after these were validated.

The indicated techniques could contribute to making both transmission and computation more efficient when securing or providing access control systems for databases and knowledge graphs, in particular when the expected structured queries are to be from a well-known, extensible set of possibilities.

The indicated techniques could simplify providing access control for incoming queries based upon their compression patterns, well-known URIs, or "verbs", for instance using ODRL.

Conclusion

Thank you for any feedback on these ideas.

Bibliography

Kirrane, Sabrina, Alessandra Mileo, and Stefan Decker. "Access control and the resource description framework: A survey." Semantic Web 8, no. 2 (2016): 311-352.