Access control of XML documents considering update operations

Abstract

As a large quantity of information is presented in XML format on the Web, there are increasing demands for XML security. Until now, research on XML security has been focused on the security of data communication using digital signatures or encryption technologies. As XML is also used for a data representation of data storage, XML security comes to involve not only communication security but also managerial security. Managerial security is guaranteed through access control, but existing XML access control models consider only read queries. These models may make some problems when unauthorized users try to change XML documents or their structure. Therefore the access control of update queries must be executed correctly and efficiently as well as read queries. In this paper, we discuss an XML access control model and propose a technique that supports not only read operations but also update operations. We define new action types to systematically manage complex information of access right and to process various update queries in an efficient manner. Using these action types, the system can save memory and other system resources that are used in DOM-based DTD verification process, and shortens the overall steps of access control by filtering unnecessary queries out at the early stage. Although for read queries the proposed access control model introduces a minor overhead in determining action types, for update queries it shows better performance compared to existing access control models.

Incremental adaptation of XPath access control views

“…The model proposed by Damiani et al [6] is very popular and Fundulaki et al [8], Fan et al [7], Kuper et al [13] and Luo et al [15] propose models that are similar to [6]. Lim et al [14] propose a more sophisticated priority-based access control model. Recently, some new standards for XML access control, such as XACML have also emerged.…”

“…Recently, work has been reported on updating XML views [14]. However, to the best of our knowledge, no work has been done on the problem of adapting XPath views.…”

Access Policy Sheet for Access Control in Fine-Grained XML

“…Developing an access control model, and related mechanism, in terms of XML is an important step. With the rapid development of web environments XML data access control has been intensively studied (e.g., [2,8,4,5,3,1,7]). However, these existing research works on XML do not offer more advanced access control features such as authorization delegation.…”

An authorization model for XML databases

“…The model in [Lim03] is based on the model defined in [Dam00]. the access control strategy that they use for handling the write privilege is not clearly described.…”