![](bg2.png)
dataset; the access permissions accorded to each
scientist may vary according to their specialization and
their affiliation. In the worst case, it is possible that a
role-based policy must assign a unique role to each
scientist. The concept of role parameterization has
been shown to be an effective solution to role
proliferation (Ge et al, 2004); instead of defining a
separate role for each scientist, one can use a much
smaller number of roles and parameterize each role
with variables representing area of specialization and
affiliation. With a smaller number of roles, it becomes
easier to formulate and enforce the desired access
control restrictions.
In this paper, we introduce techniques that can be used
to implement controlled and secure access to published
XML documents. Specifically, we define
parameterized role-based ACPs (PRBAC policies);
each such policy consists of a set of rules associating a
role with one or more views (or fragments) defined
over an XML document. Policy rules may contain role
parameters and/or system variables. Once a user is
authenticated to play role R, any role parameters and
system variables are instantiated and the user can
access only those views which are associated with role
R. We have designed a key assignment algorithm
which, given a PRBAC policy and an XML document
(or dataset), generates the minimal number of keys
required to enforce the stated policy. Generated keys
are used to multi-encrypt a document so that each
element of the document is encrypted with at most one
key. Since each view may be encrypted with multiple
keys, users playing a specific role R are provided with
an R-accessible keyring, consisting of the set of keys
needed to decrypt and access exactly the document
portions they are allowed to see.
This paper is organized as follows. Section 2 describes
related work. Section 3 introduces preliminary
notation and concepts and Section 4 defines the
language of parameterized roles and the PRBAC
model. Section 5 describes key generation and multi-
encryption of documents. Section 6 describes areas for
future work. Because of space restrictions, proofs are
omitted.
Contributions. Our contributions include the
complete description of a PRBAC model tailored for
static, published XML datasets. To our knowledge,
this is the first formulation of such a model. We also
detail an approach that, for a given uninstantiated
PRBAC policy (i.e. even before values of parameters
and system variables are known) and XML document
D (1) generates the minimum number of keys needed
to multi-encrypt D; (2) applies the minimal number of
encryption operations on D needed to enforce the
PRBAC policy; and (3) for each role R in the PRBAC,
generates the R-accessible keyring. All of these steps
can be carried out using two SAX-based traversals of
D.
2 RELATED WORK
Motivated by the increasing use of XML as a data
representation format, several access control models
specifically tailored for XML have been proposed in
recent years. Such approaches permit the formulation
of fine-grained access control policies at the schema,
document, and/or element level. At a high level, it is
possible to distinguish between materialized view-
oriented approaches, in which client queries are
answered over a sub-document (view) generated by
the database management system, containing only the
accessible regions of an XML database.[(Bertino et al,
2002), (Damiani et al, 2002)], and secure publishing
approaches (Miklau et al 2003) and (Müldner et al,
2006), in which a single, partially-encrypted version of
a document is distributed and access control policies
are enforced using public-key cryptography. While
materialized view-oriented approaches hide the
original document from the client, a very large number
of materialized views may be required in applications
dealing with large, complex documents and/or several
users. Secure publishing approaches are designed for
cases in which it is unnecessary, and even undesirable,
to allow users direct access to a database, and instead
provide to users a published, static “snapshot” of the
database contents. Our approach follows the secure
publishing paradigm.
Role based ACPs have been extensively
researched [(Ferraiolo et al, 2001), (Osborn et al,
2000), (RBAC, 2008), (Wang et al, 2004)]. (Ge, 2004)
describes an extension to the role-based access control
model in which parameterized roles are used to deal
with scenarios in which data access is dependent on
certain characteristics held by an individual user. In
applications with a small number of users, it is feasible
to define a separate role for each individual user, yet
this approach clearly becomes unmanageable if the
user base is moderately large. Rather than defining
several thousand roles with a membership of one, an
administrator can define a single, parameterized role,
and specify an access control rule which dictates
SUCCINCT ACCESS CONTROL POLICIES FOR PUBLISHED XML DATASETS
381