____________________________ XML Access Control for Semantically Related XML Documents & A Role-Based Approach to Access Control For XML Databases BY Asheesh Kumar AXK0656 April 27, 2006

XML Access Control for Semantically Related XML Documents _____________________________________________ Vijay Parmar and Hongchi Shi Vijay Parmar and Hongchi Shi Department of Computer Science & Computer Engineering University of Missouri- Columbia, USA University of Missouri- Columbia, USA Su-Shing Chen Su-Shing Chen Dept of computer & Information Science & Engineering University of Florida, USA

A Role-Based Approach to Access Control for XML Databases _____________________________________________ Zingzhu Wang Zingzhu Wang Department of Computer Science Department of Computer Science University of Western Ontario, Canada University of Western Ontario, Canada Su-Shing Chen Su-Shing Chen Department of Computer Science University of Western Ontario, Canada University of Western Ontario, Canada

XML most preferred way to store & exchange information XML most preferred way to store & exchange information Need to provide controlled access to such information is imminent Need to provide controlled access to such information is imminent Authors propose an access control policy & mechanism for a collection of semantically related XML documents Authors propose an access control policy & mechanism for a collection of semantically related XML documents XML Access Control for Semantically Related XML Documents _____________________________________________

Features of proposed access control mechanism It is developed for XML documents- semantically related It is developed for XML documents- semantically related Access control conditions can be specified based on contents of the document Access control conditions can be specified based on contents of the document Access control is role based Access control is role based XML Access Control for Semantically Related XML Documents _____________________________________________

Assume that each XML document resembles an entity playing a certain role Assume that each XML document resembles an entity playing a certain role Each entity has certain relationships with other entities (XML document) Each entity has certain relationships with other entities (XML document) An access request may result in data coming from more than one document in the collection An access request may result in data coming from more than one document in the collection Semantic relationships, so document playing a certain role can have access to other entities playing a different role Semantic relationships, so document playing a certain role can have access to other entities playing a different role XML Access Control for Semantically Related XML Documents _____________________________________________

Sample relationships of entities playing particular role Sample relationships of entities playing particular role

XML Access Control for Semantically Related XML Documents _____________________________________________ Relationship between entities (XML documents) Relationship between entities (XML documents)

Observations for Access Control Policy XML documents are not accessed by the document names.. XML documents are not accessed by the document names.. Entity playing a role may requests data from collection of XML documents by giving a general request over the whole collection Entity playing a role may requests data from collection of XML documents by giving a general request over the whole collection Now, requesting entities identification & role would cause access control mechanism to restrict its access according to access control policy Now, requesting entities identification & role would cause access control mechanism to restrict its access according to access control policy All documents in collection must comply with same DTD, so all entities playing a similar role have same structure but different content All documents in collection must comply with same DTD, so all entities playing a similar role have same structure but different content XML Access Control for Semantically Related XML Documents _____________________________________________

Overview of Access Control Policy Specification The Access Control Policy DTD

Operation types and execution Read Read Write Write Create Create Delete Delete Operations are performed by first querying the XML document collection with the XPATH query expression provided in the access request Operations are performed by first querying the XML document collection with the XPATH query expression provided in the access request XML Access Control for Semantically Related XML Documents _____________________________________________

Steps involved in Read Operation XPath query is processed on collection of XML documents XPath query is processed on collection of XML documents Results checked for list of allowed elements for read operation under the appropriate role Results checked for list of allowed elements for read operation under the appropriate role Result of above step leaves a set of document fragment that is further checked for access control condition Result of above step leaves a set of document fragment that is further checked for access control condition Condition for each allowed element and sub element is checked Condition for each allowed element and sub element is checked If conditions are satisfied, the content of allowed element are not deleted If conditions are satisfied, the content of allowed element are not deleted XML Access Control for Semantically Related XML Documents _____________________________________________

A sample Read operation A sample Read operation

XML Access Control for Semantically Related XML Documents _____________________________________________

Condition Specification Conditions indicate constraint for the access to the particular allowed element for a specific operation Conditions indicate constraint for the access to the particular allowed element for a specific operation Presence of name of an element in the allowed element list indicates that it is allowed for access for a particular role only if the conditions are satisfied Presence of name of an element in the allowed element list indicates that it is allowed for access for a particular role only if the conditions are satisfied Conditions can be specified in the access control policy document with the ‘condition’ element Conditions can be specified in the access control policy document with the ‘condition’ element AND & OR conditions.. AND & OR conditions.. XML Access Control for Semantically Related XML Documents _____________________________________________

Condition types Prohibit Prohibit Equals Equals Exists Exists NotExists NotExists XML Access Control for Semantically Related XML Documents _____________________________________________

A sample Condition Specification

XML Access Control for Semantically Related XML Documents _____________________________________________ A student is not allowed to update his grades but allowed to view them

XML Access Control for Semantically Related XML Documents _____________________________________________ Overall Access control model

Propose to combine Role Graph Model, Authorization Type Graph and Authorization Object Schema, Authorization Object Graph Propose to combine Role Graph Model, Authorization Type Graph and Authorization Object Schema, Authorization Object Graph Group of permission -> Role -> assigned to users Group of permission -> Role -> assigned to users Permissions are privileges Permissions are privileges Privileges are made up of object and access mode ( read/ write etc) Privileges are made up of object and access mode ( read/ write etc) Object part of an XML database is any part of XML Object part of an XML database is any part of XML A Role-Based Approach to Access Control for XML Databases _____________________________________________

Example Role Graph Example Role Graph

A Role-Based Approach to Access Control for XML Databases _____________________________________________ Authorization Object Schema for example Authorization Object Schema for example

A Role-Based Approach to Access Control for XML Databases _____________________________________________ Authorization Object Graph for example Authorization Object Graph for example

A Role-Based Approach to Access Control for XML Databases _____________________________________________ Authorization Type Graph Authorization Type Graph

A Role-Based Approach to Access Control for XML Databases _____________________________________________ Authorization Association Matrix Authorization Association Matrix

Thank You Asheesh Kumar AXK0656