Seminar Details
| Date |
26-10-2004 |
| Time |
15:00 |
| Room/Location |
217, 2 piano |
| Title |
Security Views: Providing both Security and Schema for XML |
| Speaker |
Dr. Gabriel Kuper |
| Affiliation |
Department of Information and Communication Technology - Università di Trento |
| Link |
http://www.unitn.it/people/info/gabrielmark.kuper.html
|
| Abstract |
We describe a security model for XML that provides support for both access/inference control and schema information.
The model consists of an expressive language for specifying access-control policies,
a notion of security views for characterizing information accessible to authorized users,
and a derivation algorithm for computing a security view definition from a access-control
specification.
The main advantages of this approach are (a) schema availability: a view schema is exposed to the users to facilitate query formulation and optimization without security breach; (b) access and inference control: security views protect sensitive data from direct access and indirect inference through queries by unauthorized users; and (c) efficient enforcement strategy: access control policies are both specified and enforced at the schema level (conceptual level) rather than at the document level (physical level),
and these yield a cost-effective approach to maintaining the consistency and integrity of security views.
Our main contributions are (a) the ability to handle arbitrary DTDs, rather than DTDs restricted to a specific normal form, (b) extension of the framework to accomodate different security policies and (c) specifications of algorithms to derive security views from a security annotation.
This is joint work with Fabio Massacci |
|
|
 |
