The societal and economical consequences surrounding Big Data-driven
platforms have increased the call for decentralized solutions. However,
retrieving and querying data in more decentralized environments requires
fundamentally different approaches, whose properties are not yet well
understood. Link Traversal-based Query Processing (LTQP) is a technique for
querying over decentralized data networks, in which a client-side query engine
discovers data by traversing links between documents. Since decentralized
environments are potentially unsafe due to their non-centrally controlled
nature, there is a need for client-side LTQP query engines to be resistant
against security threats aimed at the query engine's host machine or the query
initiator's personal data. As such, we have performed an analysis of potential
security vulnerabilities of LTQP. This article provides an overview of security
threats in related domains, which are used as inspiration for the
identification of 10 LTQP security threats. Each threat is explained, together
with an example, and one or more avenues for mitigations are proposed. We
conclude with several concrete recommendations for LTQP query engine developers
and data publishers as a first step to mitigate some of these issues. With this
work, we start filling the unknowns for enabling querying over decentralized
environments. Aside from future work on security, wider research is needed to
uncover missing building blocks for enabling true decentralization.Comment: This is an extended version of an article with the same title
published in the proceedings of the QuWeDa workshop at ISWC 2022. Next to
more details in the related work and conclusions sections, this extension
introduces concrete mitigations of each vulnerabilit