Abstract:
Disclosed are a method and system for scalable distribution of semantic web updates. A first embodiment of the invention leverages publish/subscribe technology to distribute those updates such that clients receive only the information they require. A second embodiment of the invention uses an access control feature to limit the statements clients are allowed to read. Optionally in this second embodiment, the same publish/subscribe messaging infrastructure may be used both to distribute updated semantic web data and also to distribute relevant changes to the access control information. The invention is particularly well suited for use with the Resource Description Framework (RDF) language.

Description:
BACKGROUND OF THE INVENTION 
       [0001]    1. Field of the Invention 
         [0002]    This invention generally relates to semantic web technology, and more specifically, to methods and systems for scalable distribution of semantic web updates. Even more specifically, the invention relates to such methods and systems that arc particularly well suited for use with the Resource Description Framework (RDF) language. 
         [0003]    2. Background Art 
         [0004]    RDF is a language used to represent information, particularly meta data about resources available in the World Wide Web. For example, RDF may be used to represent copyright or licensing information about a document on the Web, or the author and title of a particular Web page. RDF can also be employed for representing data or meta data about items or matters that can be identified on the World Wide Web even though these items cannot be directly retrieved from the Web. Examples of these latter items may include data about a user&#39;s Web preferences, and information, such as the price and availability, of items for sale at on-line shopping facilities. Specifications for RDF are established by the World Wide Web Consortium. The RDF specification also describes how to serialize RDF data for use in web services, etc. (e.g. RDF/XML). 
         [0005]    RDF uses identifiers, referred to as Uniform Resource Identifiers, or URIs, and is based on a specific terminology. An RDF statement includes a subject, a predicate and an object. The subject identifies the thing, such as person or Web page, that the statement is about. The predicate identifies the property or characteristic, such as title or owner, of the subject of the RDF statement, and the object identifies a value of that property or characteristic. For example, if the RDF statement is about pet owners, the subject might be “owner,” the predicate could be “name,” and the object could be “Joe.” This format, among other advantages, allows RDF to represent statements as a graph of nodes and arcs. In the graph, the subjects and objects may be represented by, for example, ovals, circles or squares, or some combination thereof while the predicates of the RDF statements may be represented by arcs or arrows connecting the subject of each statement with the object of the statement. 
         [0006]    An important feature of RDF is that it provides a common framework for expressing information. This allows this information to be exchanged among applications without losing any meaning of the information. Because of this common framework application developers can utilize the availability of common tools and parsers to process RDF information. 
         [0007]    While the RDF specification describes a data model, and there exists several query languages, there is no standard method for publishing updated semantic web data to distributed clients. More specifically, conventional semantic web solutions (1) provide query languages and APIs for retrieving specified data patterns from an RDF graph, and (2) provide rudimentary eventing systems allowing clients to receive notification whenever any RDF statements are added or removed to a repository/store. These conventional solutions however, do not efficiently transmit updates to distributed clients, and in particular, do not distribute updates such that clients receive only the information they require or request. 
       SUMMARY OF THE INVENTION 
       [0008]    An object of this invention is to provide a standard method for publishing updated semantic web data to distributed clients. 
         [0009]    Another object of the present invention is to leverage existing publish/subscribe technology to distribute updated semantic web data such as RDF, so that clients receive only the information they require. 
         [0010]    A farther object of the invention is to provide an architecture for distributing and enforcing semantic web access control information. 
         [0011]    Still another object of this invention is to use the same publish/subscribe messaging infrastructure both to distribute updated semantic web data, and also to distribute relevant changes to control information that is used to restrict access to the updated semantic web data. 
         [0012]    These and other objectives are attained with a method and system for scalable distribution of semantic web updates. A first embodiment of the invention leverages publish/subscribe technology to distribute those updates such that clients receive only the information they require. A second embodiment of the invention uses an access control feature to limit the statements clients arc allowed to read. Optionally, in this second embodiment, the same publish/subscribe messaging infrastructure may he used both to distribute updated semantic web data, and also to distribute relevant changes to the access control information. 
         [0013]    The invention is particularly well suited for use with the Resource Description Framework (RDF) language. In the preferred embodiment of the invention, clients communicate with an RDF store server through a combination of synchronous web service operations, and asynchronous JMS updates, and clients may register for only the updates they are interested in. 
         [0014]    Further benefits and advantages of the invention will become apparent from a consideration of the following detailed description, given with reference to the accompanying drawings, which specify and show preferred embodiments of the invention. 
     
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0015]      FIG. 1  shows a computer system embodying the present invention. 
           [0016]      FIG. 2  shows example messages that may be used in the implementation of this invention. 
           [0017]      FIG. 3  is a flow chart illustrating the startup and event processing by the clients of the system of  FIG. 1 . 
           [0018]      FIG. 4  is a flow chart showing the startup and request processing by the server of  FIG. 1 . 
           [0019]      FIG. 5  shows a modification of the system of  FIG. 1 . 
           [0020]      FIG. 6  illustrates the update message flow and internal state of the update managers of the system of  FIG. 5 . 
           [0021]      FIG. 7  is a flow chart depicting the operation of the update manager of the system of  FIG. 5 . 
           [0022]      FIG. 8  shows a sample message used in the system of  FIG. 5 . 
           [0023]      FIG. 9  illustrates an optional modification to the architecture of  FIG. 7 . 
           [0024]      FIG. 10  shows the update message flow and internal state of the update managers of  FIG. 9 . 
           [0025]      FIG. 11  is a flow chart illustrating the operation of the update managers of the system of  FIG. 9 . 
           [0026]      FIG. 12  shows sample messages that may be used in the system of  FIG. 9 . 
       
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
       [0027]      FIG. 1  illustrates a distributed computer system  100  that may be used in the practice of this invention. In particular,  FIG. 1  shows a server computer  102 , a plurality of client computers  104 , and a publish/subscribe infrastructure  106 . The devices of system  100  are connected together by any suitable network. Preferably, this network may be, for example, the Internet, but could also be an intranet a local area network, a wide area network, or other networks. 
         [0028]    Any suitable server  102  may be used in system  100 , and for example, the server may be an IBM RS/6000 server. Also, the clients  104  of the system may be, for instance, personal computers, laptop computers, servers, workstations, main frame computers, or other devices capable of communicating over the network. Likewise, the devices of system  100  may be connected to the network using a wide range of suitable connectors or links, such as wire, fiber optics or wireless communication links. Distributed system  100  may include additional servers, clients and other devices not shown in  FIG. 1 . 
         [0029]    As mentioned above, in the depicted example, the devices of system  100  may be connected together via the Internet, which is a worldwide collection of networks and gateways that use the TCP/IP suite of protocols to communicate with one another. In the operation of system  100 , server  102  provides data and applications to the clients. Among other functions, the server and the clients store semantic web statements such as RDF statements. For this reason, as depicted in  FIG. 1 , server  102  is referred to as an RDF store server, and clients  104  are referred to as RDF store clients. 
         [0030]    Any suitable mechanism may be used to store the RDF statements. For example, relational databases that may be used to store RDF statements are disclosed, in copending application no. (Attorney Docket POU920050098US1) for “Method And System For Controlling Access To Semantic Web Statements,” filed ______, and copending application no. (Attorney Docket POU920050099US1), for “Method And System For Efficiently Storing Semantic Web Statements In A Relational Database,” filed ______, the disclosures of which are hereby incorporated herein in their entireties by reference . 
         [0031]    The present invention is directed generally to the distribution of such semantic statements. More specifically, the invention leverages existing JMS publish/subscribe technology (e.g. IBM Websphere Event Broker), represented at  106 , to distribute RDF updates such that clients receive only the information they require. Updates include adding, changing or removing RDF statements. 
         [0032]    In system  100 , clients  104  listen for events using content-based message selection, a feature provided by the JMS standard. The server  102  publishes all events into the publish/subscribe cloud  106 , allowing the brokers to discard events that do not match any client subscriptions. The example messages illustrated in  FIG. 2  show the properties available for selection by a client. In particular, a message used to add a statement is shown at  202 , a message used to change a statement is shown at  204 , and a message used to remove a statement is shown at  206 . Using the JMS message selector language (similar to SQL), a client may listen for changes affecting particular statements, or statements matching a particular subject/predicate/object pattern. Thus, a client may not be able to receive all events generated by the server  102 , but they could efficiently listen for all statements concerning a particular subject resource. 
         [0033]      FIG. 3  illustrates the client startup and event processing for keeping a subgraph up-to-date. In this routine, at step  302 , the client  104  connects to the JMS broker cloud  106 , and subscribes to events using content-based message selection. At step  304 , the client starts to receive updates. At step  306 , the client executes a server-side RDF query (e.g. RDQL (RDF Data Query Language) or SPARQL (Simple Protocol And RDF Query Language)), via web services, to populate initial data. 
         [0034]    At step  310 , the routine checks to determine if any JMS messages are pending. If no messages are pending, this step is repeated until a message is pending; and, when a message is pending, the routine moves on to step  312 . At this step, the client checks to determine if the pending message indicates that an RDF statement has been removed. If this is the case, the statement is removed from the local RDF stores at step  314 , and the routine returns to step  310 . 
         [0035]    If, at step  312 , the pending message does not indicate that an RDF statement is being removed, then the pending message indicates that a statement is being added or modified, and from step  312 , the routine proceeds to step  316 . At this step, a time stamp on the message is examined. If, as represented at step  320 , the timestamp shows that the update is obsolete, then the routine returns to step  310 . If the message is not obsolete, then, at step  322 , the local store is updated with the new statement information, and then the routine returns to step  310 . 
         [0036]      FIG. 4  shows the server  102  startup and request processing. At step  402 , the server starts-up and connects to publish/subscribe broker cloud  106  as a publisher; and at step  404 , the server starts to listen for web server requests. At step  406 , the server checks to determine if any requests are pending. If none are, the server continues to listen for requests until a request is pending. When this happens, the routine moves on to step  410 , where the routine determines whether the request results in any change. If it does not, then, at step  412 , the request is processed and data are returned, and then the routine returns to step  406 . 
         [0037]    However, if at step  410 , the request does result in a change, the routine moves on to step  414 , and the request is processed and the data are returned. Then, at step  416 , an update message is published for each statement modified, and the routine then returns to step  406 . 
         [0038]    In the operation of system  100 , clients communicate with an RDF store server through a combination of synchronous web service operations and asynchronous JMS updates. This operation may be significantly complicated by statement-level access control lists, which restrict which clients are allowed to read which statements. This level of access control means that simple publish/subscribe cannot be relied on alone, because some application-level authentication and message filtering is needed. In addition, RDF statements are added, modified, and removed within the scope of transactions. This also complicates the scenario, since any particular client may only be allowed to see some of the statements involved in a transaction. 
         [0039]      FIG. 5  shows an architecture of a system  500  that accommodates this access control. Similar to system  100 , system  500  includes a store server  502 , one or more store clients  504 , and a publish/subscribe infrastructure  506 . System  500  further includes one or more update managers  510  and an ACL database  512 . As indicated in the FIG., server  502 , publish/subscribe infrastructure  506 , update managers  510  and database  512  form a trusted server network  514 . 
         [0040]    In system  500 , clients  504  may connect to one of many update managers (most likely using web services over point-to-point JMS, e.g. IBM WebSphere MQ). After authenticating, the client specifies a pattern for statement updates of interest. These patterns may match the subject, predicate or object of a statement, or other metadata the server chooses to include in the updates such as the date and time the statement is created. 
         [0041]    All statement updates are published, one at a time, by the store server, over an internal publish/subscribe broker cloud. The update managers subscribe to statement updates based on the patterns provided by their clients, and listen for all transaction completion messages. Each statement update is tagged with an ACL (Access Control List) identifier. Every time an update manger receives an update, it must ensure that the client is allowed to see the information before passing it on. 
         [0042]    With reference to  FIG. 5 and 6 , in this architecture, the RDF store server shares an ACL database directly with all of the update manager servers. Commonly, it may be noted., ACL data changes much less frequently than statements are updated. Without any additional optimization, each update manager would need to contact the ACL database every time it received a relevant statement update on behalf of a client. 
         [0043]    If security policies allow some delay in enforcement after changes to the access control database, HTTP-style caching could be applied here. Update managers would be allowed to cache ACL information, depending on expiration times or get-if-modified operations supported by the ACL database and configured by the store server. It may be noted that with caching, clients connecting to different update managers may see different view of the data (corresponding to different versions of the access control data). 
         [0044]      FIG. 7  shows in more detail the operation of the update manager. At step  702 , the update manager accepts a connection from a client; and at step  704 , client authentication is performed. Then, at step  706 , the routine determines whether there is a statement update pending from the store server. If there is not, the routine proceeds to step  710 , where the routine determines whether there is a complete transaction pending from the store server. If the transaction is not complete, the routine returns to step  706  and continues on from there. If the transaction Is complete, then the routine moves on to step  712 , where the completed transaction is sent to the user via a point-to-point JMS connection. After this, the routine returns to step  706  and then proceeds from there. 
         [0045]    If, at step  706 , there is a statement update pending, then the routine, at step  714 , looks up the update ACL URI in access control database, and then, at step  716 , determines whether the user has permission to read this update. If the user does have permission, then the routine proceeds to steps  720  and  722 . At step  720 , the update is sent to the user, via a point-to-point connection; and at step  722 , the update transaction ID is added to a list of pending transactions. From step  722 , the routine proceeds to step  710 . If, at step  714 , it is determined that the user does not have permission to read this update, the routine skips to step  710  and proceeds from there. 
         [0046]      FIG. 8  shows sample messages that may be used in the operation of system  500 . In particular, a sample statement update message is shown at  802 , and sample transaction complete messages are shown at  804  and  806 . 
         [0047]    Any suitable update managers may be used in the practice of this invention. For example, suitable update managers are described in copending application no. (Attorney Docket no. POU920050059US1) for “System And Method For Tracking And Storing Semantic Web Revision History,” filed ______, and copending application no. (Attorney Docket no. POU920050060US1) for “Method And System For Selective Tracking Of Semantic Web Data Using Distributed Update Events,” filed ______, the disclosure of which is hereby incorporated herein in its entirety by reference. 
         [0048]      FIG. 9  illustrates another optional feature of the present invention. Specifically, with the system  900  shown in  FIG. 9 , the same publish/subscribe infrastructure  906  is used both to distribute the updated semantic web data and also to distribute relevant changes to the access control information. In this architecture modifications to the access control data are applied to the update managers  910 , preferably, quickly without sacrificing scalability, and publish/subscribe messaging within the trusted server network is used to distribute relevant ACL information (along with statement updates and transaction completion events) to each update manager. 
         [0049]    With reference to  FIGS. 9 and 10 , when a user connects to an update manager  910 , that server fetches the current list of relevant ACLs and group memberships, then subscribes to changes in that data via publish/subscribe infrastructure  506 . By only subscribing to ACL update messages that contain references to the user in question or one of their groups, each update manager avoids receiving extraneous updates. It may be noted that group modifications (relatively infrequent) require an update manager to change its publish/subscribe subscriptions. Because of the asynchronous operation of the publish/subscribe, the update manager may need to request a full snapshot of ACL information from the store server (similar to start-up). 
         [0050]    This architecture allows update mangers to filter incoming statement update messages immediately, without contacting any other node. 
         [0051]      FIG. 11  shows the operation of the update manager  910  of system  900 . As can be seen by comparing  FIGS. 7 and 11 , the operation of managers  910  of system  900  is similar to the operation of managers  710  of system  700 , with some additional steps and some steps modified. 
         [0052]    With particular reference to  FIG. 11 , at step  1102 , the update manager accepts a connection from a client; and at step  1104 , client authentication is performed. Then at step  1106 , the user manager contacts the RDF store server, and requests a list of the ACL UIRs that the user is allowed to read and requests group membership. Then, at step  1110 , the routine determines whether there is an ACL or group update from the store server pending. If there is, then at step  1112 , the list of ACL UIRs that the user is allowed to read is updated, refresh from server, subscriptions are changed if the user group changes. After step  1112  is completed, the routine proceeds to step  1114 . The routine also goes to step  1114  from step  1110  if at this latter step there are no ACL or group updates pending from the store server. 
         [0053]    At step  1114 , the routine determines whether there is a statement update pending from the store server. If there is not, the routine proceeds to step  1116  where the routine determines whether there is an applicable transaction complete pending from the store server. If there is no such transaction complete pending, the routine returns to step  1110  and continues on from there. If there is such a pending transaction complete at step  1114 , the routine moves on to step  1120 , where the completed transaction is sent to the user via a point-to-point JMS connection, and this transaction is removed from the pending transaction list. After this, the routine returns to step  1110  and then proceeds from there. 
         [0054]    If at step  1114 , there is an update statement pending, the routine moves to step  1122 , where a determination is made as to whether the user is entitled to this update. If the user is not entitled, the routine proceeds to step  1116 ; however, if the user is entitled to this update, the routine goes to step  1124 . At this step, the update is sent to the user via a point-to-point connection. Then, at step  1126 , the update&#39;s transaction ID is added to the pending transaction list, and from step  1126 , the routine then goes to step  1116  and proceed from there. 
         [0055]      FIG. 12  shows sample messages that may be used in the operation of system  900 . More specifically, a sample statement update message is shown at  1202 , and sample transaction complete messages are shown at  1204  and  1206 . Sample ACL and group update messages are illustrated at  1210 ,  1212  and  1214 . Update managers will subscribe to messages that contain either the user name or a connection or one of that user&#39;s groups. 
         [0056]    While it is apparent that the invention herein disclosed is well calculated to fulfill the objects stated above, it will be appreciated that numerous modifications and embodiments may be devised by those skilled in the art, and it is intended that the appended claims cover all such modifications and embodiments as fall within the true spirit and scope of the present invention.