Secure XML querying with security views

Abstract

The prevalent use of XML highlights the need for a generic, flexible access-control mechanism for XML documents that supports efficient and secure query access, without revealing sensitive information to unauthorized users. This paper introduces a novel paradigm for specifying XML security constraints and investigates the enforcement of such constraints during XML query evaluation. Our approach is based on the novel concept of security views, which provide for each user group (a) an XML view consisting of all and only the information that the users are authorized to access, and (b) a view DTD that the XML view conforms to. Security views effectively protect sensitive data from access and potential inferences by unauthorized users, and provide authorized users with necessary schema information to facilitate effective query formulation and optimization. We propose an efficient algorithm for deriving security view definitions from security policies (defined on the original document DTD) for different user groups. We also develop novel algorithms for XPath query rewriting and optimization such that queries over security views can be efficiently answered without materializing the views. Our algorithms transform a query over a security view to an equivalent query over the original document, and effectively prune query nodes by exploiting the structural properties of the document DTD in conjunction with approximate XPath containment tests. Our work is the first to study a flexible, DTD-based access-control model for XML and its implications on the XML query-execution engine. Furthermore, it is among the first efforts for query rewriting and optimization in the presence of general DTDs for a rich class of XPath queries. An empirical study based on real-life DTDs verifies the effectiveness of our approach.

Static analysis of XML security views and query rewriting

“…This framework has been widely studied from both the theoretical and practical angle [12,19,13,27,34,28,14].…”

“…The rewriting technique for downward queries [12] relies on the knowledge of the DTD. Our rewriting method works independently of the DTD.…”

“…Previous research often imposed various restrictions on these two parameters in order to facilitate the tasks relevant to the framework. For instance, taking the class of downward XPath queries allows to use the knowledge of the document DTD to benefit the query rewriting [12]. The task can be further simplified if the node accessibility is downward closed i.e., all descendants of an inaccessible node are inaccessible as well [2].…”

“…The task can be further simplified if the node accessibility is downward closed i.e., all descendants of an inaccessible node are inaccessible as well [2]. For similar reasons, in some works only non-recursive DTDs are considered [12,27].…”

“…Recall that in the case of the standard XPath queries [12], there are queries that cannot be rewritten, because the language is not powerful enough to capture node accessibility, and consequently, various restrictions need to be employed. Our work shows that both X Reg and MSO enjoy the closure on rewriting under views.…”