Information access using ontologies

Abstract

A method for data access includes defining an ontology for application to a set of diverse data sources ( 58 ) comprising data having predefined semantics, and associating with the ontology one or more logical rules applicable to the semantics of the data in the data sources. Upon receiving a query from a user regarding the data, a query plan is determined for responding to the query by selecting one or more of the data sources responsively to the ontology and by identifying an operation to be applied to the data responsively to the applicable logical rules. A response to the query is then generated in accordance with the query plan.

1 - 34 . (canceled) 
     
     
         35 . A method for exchange of information, comprising:
 establishing a virtual private network among a plurality of nodes, comprising at least first and second nodes, which are configured to communicate with one another over an underlying public physical network;   defining a semantic communication model for conveying data packets among the nodes in the virtual private network, responsively to an ontology of the information;   sending a data packet over the virtual private network from the first node to the second node; and   filtering the data packet against the semantic communication model at the second node, so as to verify that the data packet is legitimate.   
     
     
         36 . The method according to  claim 35 , wherein defining the semantic communication model comprises defining a closed set of semantic messages that may be carried by data packets in the virtual private network. 
     
     
         37 . The method according to  claim 35 , wherein the nodes are distributed among a set of autonomous organizations. 
     
     
         38 . The method according to  claim 35 , wherein the nodes comprise gateway nodes, which are configured to communicate with clients and data sources using native data formats, and to translate the native data formats to the semantic communication model for communication over the virtual private network. 
     
     
         39 . The method according to  claim 38 , wherein the nodes further comprises hub nodes, and wherein establishing the virtual private network comprises configuring the gateway nodes to communicate with the hub nodes using the semantic communication model. 
     
     
         40 - 66 . (canceled) 
     
     
         67 . Apparatus for data access, comprising a hub processor, which is adapted to receive a definition of an ontology for application to a set of diverse data sources comprising data and a definition of data access rights with respect to the ontology, and which is adapted to control user access to the data responsively to the ontology of the data and the access rights applicable thereto. 
     
     
         68 . The apparatus according to  claim 67 , wherein the ontology comprises a user ontology, and wherein the hub processor is adapted to define the data access rights by assigning a classification to a user according to the user ontology, and to compare the classification to the access rights applicable to the data in order to control the user access. 
     
     
         69 . The apparatus according to  claim 67 , wherein the diverse data sources are distributed among a set of autonomous organizations comprising at least first and second organizations, and wherein the hub processor is adapted to classify a user according to an organizational affiliation of the user so as to control access by users in the first organization to the data sources held by the second organization. 
     
     
         70 . The apparatus according to  claim 67 , wherein the hub processor is adapted to receive a query from a user to access the data in the data sources, to determine a query plan for responding to the query by selecting one or more of the data sources responsively to the ontology such that the access rights permit the user to access the data in the one or more of the data sources, and to generate a response to the query in accordance with the query plan. 
     
     
         71 - 73 . (canceled) 
     
     
         74 . Apparatus for exchange of information, comprising a plurality of computing nodes, which comprise at least first and second nodes, and which are linked to communicate over a virtual private network running over an underlying public physical network, and which are configured to exchange data packets over the virtual private network in accordance with a semantic communication model, which is defined responsively to an ontology of the information, wherein at least the second node is adapted, upon receiving a data packet over the virtual private network from the first node, to filter the data packet against the semantic communication model so as to verify that the data packet is legitimate. 
     
     
         75 - 117 . (canceled) 
     
     
         118 . The apparatus according to  claim 67 , wherein the hub processor is adapted to associate with the ontology one or more logical rules applicable to the semantics of the data in the data sources, and is further adapted, upon receiving a query from a user regarding the data, to determine a query plan for responding to the query by selecting one or more of the data sources responsively to the ontology and by identifying an operation to be applied to the data responsively to the applicable logical rules, and to generate a response to the query in accordance with the query plan. 
     
     
         119 . The apparatus according to  claim 67 , wherein the hub processor is adapted to collect information regarding a topology and performance characteristics of the data sources, and is further adapted, upon receiving a query from a user regarding the data, to determine a query plan responsively to the query and to the information regarding the topology and performance characteristics, and to generate a response to the query in accordance with the query plan. 
     
     
         120 . The apparatus according to  claim 74  and wherein the plurality of computing nodes comprises a grid of at least one agent and at least one gateway. 
     
     
         121 . The apparatus according to  claim 120  and wherein the at least one gateway comprises at least one of at least one wrapper and at least one portal. 
     
     
         122 . The apparatus according to  claim 121  and also comprising a security utility operative to provide public key infrastructure (PKI) and authentication facilities for at least one of the at least one agent, the at least one wrapper and at least one portal. 
     
     
         123 . The apparatus according to  claim 120  and also comprising an agent manager operative to enable reconfiguration of the grid without disrupting services of the grid. 
     
     
         124 . The apparatus according to  claim 120  and also comprising a network utility operative to gather and update information regarding topology and status of resources associated with the plurality of nodes. 
     
     
         125 . The apparatus according to  claim 120  and wherein the grid is operative to provide distributed virtual private network services to the plurality of nodes. 
     
     
         126 . The apparatus according to  claim 120  and wherein said grid is operative to balance loads across said grid when sensing at least one grid condition. 
     
     
         127 . The apparatus according to  claim 126  and wherein said at least one grid condition is at least one of a fallen node, an inaccessible source and a revoked certificate.