Abstract
In this paper, we propose an observation-based fine grained access control (OFGAC) mechanism where data are made accessible at various level of abstraction according to their sensitivity level. In this setting, unauthorized users are not able to infer the exact content of the data cell containing confidential information, while they are allowed to get partial information out of it, according to their access rights. The traditional fine grained access control (FGAC) can be seen as a special case of the OFGAC framework.
The paper is a revised and extended version of [6].
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Agrawal, R., Bird, P., Grandison, T., Kiernan, J., Logan, S., Rjaibi, W.: Extending relational database systems to automatically enforce privacy policies. In: Proc. of the 21st Int. Conf. on Data Engineering (ICDE 2005), pp. 1013–1022. IEEE CS (2005)
Bertino, E., Jajodia, S., Samarati, P.: A flexible authorization mechanism for relational data management systems. ACM Transactions on Information Systems 17(2), 101–140 (1999)
Cousot, P., Cousot, R.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Conf. Record of the 6th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (POPL 1977), pp. 238–252. ACM Press, Los Angeles (1977)
Griffiths, P.P., Wade, B.W.: An authorization mechanism for a relational database system. ACM Transactions on Database Systems 1(3), 242–255 (1976)
Halder, R., Cortesi, A.: Abstract interpretation for sound approximation of database query languages. In: Proc. of the IEEE 7th Int. Conf. on Informatics and Systems (INFOS 2010), pp. 53–59. IEEE CFP1006J-CDR, Cairo (2010)
Halder, R., Cortesi, A.: Observation-based fine grained access control for relational databases. In: Proc. of the 5th Int. Conf. on Software and Data Technologies (ICSOFT 2010), pp. 254–265. INSTICC Press, Athens (2010)
Jajodia, S., Samarati, P., Subrahmanian, V.S., Bertino, E.: A unified framework for enforcing multiple access control policies. SIGMOD Record 26(2), 474–485 (1997)
Kabra, G., Ramamurthy, R., Sudarshan, S.: Redundancy and information leakage in fine-grained access control. In: Proc. of the ACM SIGMOD Int. Conf. on Management of Data (SIGMOD 2006), pp. 133–144. ACM Press, Chicago (2006)
LeFevre, K., Agrawal, R., Ercegovac, V., Ramakrishnan, R., Xu, Y., DeWitt, D.: Limiting disclosure in hippocratic databases. In: Proc. of the 30th Int. Conf. on Very Large Data Bases (VLDB 2004), pp. 108–119 (2004)
Rizvi, S., Mendelzon, A., Sudarshan, S., Roy, P.: Extending query rewriting techniques for fine-grained access control. In: Proc. of the ACM SIGMOD Int. Conf. on Management of Data (SIGMOD 2004), pp. 551–562. ACM Press, Paris (2004)
Sabelfeld, A., Myers, A.C.: Language-based information-flow security. IEEE Journal on Selected Areas in Communications 21(1), 5–19 (2003)
Shi, J., Zhu, H.: A fine-grained access control model for relational databases. Journal of Zhejiang University - Science C 11, 575–586 (2010)
Shi, J., Zhu, H., Fu, G., Jiang, T.: On the soundness property for sql queries of fine-grained access control in dbmss. In: Proc. of the 8th IEEE/ACIS Int. Conf. on Computer and Information Science (ICIS 2009), pp. 469–474. IEEE CS, Shanghai (2009)
Wang, Q., Yu, T., Li, N., Lobo, J., Bertino, E., Irwin, K., Byun, J.W.: On the correctness criteria of fine-grained access control in relational databases. In: Proc. of the 33rd Int. Conf. on Very Large Data Bases (VLDB 2007), Vienna, Austria, pp. 555–566 (2007)
Zhu, H., Lü, K.: Fine-Grained Access Control for Database Management Systems. In: Cooper, R., Kennedy, J. (eds.) BNCOD 2007. LNCS, vol. 4587, pp. 215–223. Springer, Heidelberg (2007)
Zhu, H., Shi, J., Wang, Y., Feng, Y.: Controlling information leakage of fine-grained access model in dbmss. In: Proc. of the 9th Int. Conf. on Web-Age Information Management (WAIM 2008), pp. 583–590. IEEE CS, Zhangjiajie (2008)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Halder, R., Cortesi, A. (2013). Fine Grained Access Control for Relational Databases by Abstract Interpretation. In: Cordeiro, J., Virvou, M., Shishkov, B. (eds) Software and Data Technologies. ICSOFT 2010. Communications in Computer and Information Science, vol 170. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-29578-2_15
Download citation
DOI: https://doi.org/10.1007/978-3-642-29578-2_15
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-29577-5
Online ISBN: 978-3-642-29578-2
eBook Packages: Computer ScienceComputer Science (R0)