Abstract
Recently more and more data is stored in XML format. While XML increases flexibility, it also raises new security challenges such as access control for multilevel security. This paper considers the problem of generating secure and free of semantic conflicts partial views from XML documents. In the context of DTD-based multilevel security classification, we develop techniques to generate single-level DTDs for partial views. For this purpose, we define and manipulate two graphs, a Minimum Semantic Conflict Graph (MSCG) and a Multi-Plane DTD Graph (MPG). MSCG contains all semantic relationships among the XML tags that must be preserved within any partial view. Intuitively, MSCG ensures the generated views will be free of semantic conflict. MPG captures the structural relationships among tags and their security classifications. We show that secure views can be generated from the first reduced form MPG0 (i.e., an MPG that does not have edges outside the targeted security space), by ignoring unauthorized security planes. We define a set of procedures to restructure a general MPG into an MPG0 according to the corresponding MSCG.
The original version of this chapter was revised: The copyright line was incorrect. This has been corrected. The Erratum to this chapter is available at DOI: 10.1007/978-0-387-35697-6_26
Chapter PDF
References
S. Abiteboul. Querying semistructured data. Proceedings of the International Conference on Database Theory, 1997.
C. Beeri and T. Milo. Schemas for integration and translation of structured and semi-structured data. Proceedings of the International Conference on Database Theory, 1999.
E. Bertino, M. Braun, S. Castano, E. Ferrari and M. Mesiti. Author-X: A Java-based system for XML data protection. Proceedings of the IFIP WG 11.3 Conference on Database and Applications Security, 2000.
E. Bertino, S. Castano, E. Ferrari, and M.Mesiti. Specifying and enforcing access control policies for XML document sources. WWW Journal, vol. 3, 2000.
J. Bosak and T. Bray. XML and the second-generation web. Scientific American, May 1991.
P. Buneman, S. Davidson, G. Hillebrand and D. Suciu. A query language and optimization techniques for unstructured data. Proceedings of the ACM SIGMOD Conference, 1996.
E. Damiani, S. De Capitani di Vimercati, S. Paraboschi and P. Samarati. XML access control systems: A component-based approach. Proceedings of the IFIP WG 11.3 Conference on Database and Applications Security, 2000.
A. Gabillon and E. Bruno. Regulating access to XML documents. Proceedings of the IFIP WG 11.3 Conference on Database and Applications Security, 2001.
M. Kudo and S. Hada. XML document security based on provisional authorizations. Proceedings of the Seventh ACM Conference on Computer and Communications Security, 2000.
IEEE Computer Society. Bulletin of the Technical Committee on Data Engineering, Special Issue on XML,September 1999.
World Wide Web Consortium. Extensible Markup Language Language 1.0 Specification ( www.w3.org/TR/2000/REC-xml-20001006)October 2000.
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2003 IFIP International Federation for Information Processing
About this chapter
Cite this chapter
Stoica, A., Farkas, C. (2003). Secure XML Views. In: Gudes, E., Shenoi, S. (eds) Research Directions in Data and Applications Security. IFIP — The International Federation for Information Processing, vol 128. Springer, Boston, MA. https://doi.org/10.1007/978-0-387-35697-6_11
Download citation
DOI: https://doi.org/10.1007/978-0-387-35697-6_11
Publisher Name: Springer, Boston, MA
Print ISBN: 978-1-4757-6413-0
Online ISBN: 978-0-387-35697-6
eBook Packages: Springer Book Archive