A Rewrite Based Approach for Enforcing Access Constraints for XML

摘要

Access control for semi-structured data is nontrivial, as witnessed by the number of access control approaches in literature. Recently, a case has been made for expressing access constraints at finer levels of granularity on data nodes and extending constraints to structural relationships. In this paper, we introduce a rewrite-based approach for access constraint enforcement, based on the ACXESS framework we developed at Indiana University. The ACXESS framework utilizes virtual security views and introduces a set of rewrite rules that takes advantage of the Security Annotated Schema (SAS) - an internal representation for virtual views. It is capable of rewriting user queries against security views into queries against the source data, while honoring the access constraints.