Abstract
Web-based applications greatly increase information availability and ease of access, which is optimal for public information. The distribution and sharing by the Web of information that must be accessed in a selective way requires the definition and enforcement of security controls, ensuring that information will be accessible only to authorized entities. Approaches proposed to this end level, independently from the semantics of the data to be protected and for this reason result limited. The eXtensible Markup Language (XML), a markup language promoted by the World Wide Web Consortium (W3C), represents an important opportunity to solve this problem. We present an access control model to protect information distributed on the Web that, by exploiting XML’s own capabilities, allows the definition and enforcement of access restrictions directly on the structure and content of XML documents. We also present a language for the specification of access restrictions that uses standard notations and concepts and briefly describe a system architecture for access control enforcement based on existing technology.
This work was supported in part by the INTERDATA and DATA-X - MURST 40% projects and by the Fifth (EC) Framework Programme under the FASTER project.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
Similar content being viewed by others
References
AlphaWorks. XML Security Suite, April 1999. http://www.alphaWorks.com/-tech/xmlsecuritysuite.
T. Berners-Lee, R. Fielding, and L. Masinter. Uniform Resource Identifiers (URI): Generic Syntax, 1998. http://www.isi.edu/in-notes/rfc2396.txt.
T. Bray et.al. (ed.). Extensible Markup Language (XML) 1.0. World Wide Web Consortium (W3C), February 1998. http://www.w3.org/TR/REC-xml.
S. Ceri, S. Comai, E. Damiani, P. Fraternali, S. Paraboschi, and L. Tanca. XML-GL: A Graphical Language for Querying and Restructuring XML Documents. In Proc. of the Eighth Int. Conference on the World Wide Web, Toronto, May 1999.
S. Ceri, P. Fraternali, and S. Paraboschi. Data-Driven, One-To-One Web Site Generation for Data-Intensive Applications. In Proc. of the 25th Int. Conference on VLDB, Edinburgh, September 1999.
CheckFree Corp. Open Financial Exchange Specification 1.0.2, 1998. http://www.ofx.net/.
S. DeRose, D. Orchard, and B. Trafford. XML Linking Language (XLINK), July 1999. http://www.w3.org/TR/xlink.
C. Ellerman. Channel Definition Format (CDF), March 1997. http://www.w3.org/TR/NOTE-CDFsubmit.html.
E.B. Fernandez, E. Gudes, and H. Song. AModel of Evaluation and Administration of Security in Object-Oriented Databases. IEEE TKDE, 6(2):275–292, April 1994.
S. Jajodia, P. Samarati, and V.S. Subrahmanian. A Logical Language for Expressing Authorizations. In Proc. of the IEEE Symposium on Security and Privacy, pages 31–42, Oakland, CA, May 1997.
S. Jajodia, P. Samarati, V.S. Subramanian, and E. Bertino. A Unified Framework for Enforcing Multiple Access Control Policies. In Proc. of the 1997 ACM International SIGMOD Conference on Management of Data, Tucson, AZ, May 1997.
T.F. Lunt. Access Control Policies for Database Systems. In C.E. Landwehr, editor, Database Security, II: Status and Prospects, pages 41–52. North-Holland, Amsterdam, 1989.
F. Rabitti, E. Bertino, W. Kim, and D. Woelk. A Model of Authorization for Next-Generation Database Systems. ACM TODS, 16(1):89–131, March 1991.
J. Reagle and L.F. Cranor. The Platform for Privacy Preferences. Communications of the ACM, 42(2):48–55, February 1999.
Rutgers Security Team. WWW Security. A Survey, 1999. http://www-ns.rutgers.edu/www-security/.
P. Samarati, E. Bertino, and S. Jajodia. An Authorization Model for a Distributed Hypertext System. IEEE TKDE, 8(4):555–562, August 1996.
A. van Hoff, H. Partovi, and T. Thai. The Open Software Description Format (OSD), August 1997. http://www.w3.org/TR/NOTE-OSD.html.
L. Wood. Document Object Model Level 1 Specification, October 1998. http://www.w3.org/pub/WWW/REC-DOM-Level-1/.
World Wide Web Consortium (W3C). Extensible Stylesheet Language (XSL) Specification, April 1999. http://www.w3.org/TR/WD-xsl.
World Wide Web Consortium (W3C). XML Path Language (XPath) Version 1.0, October 1999. http://www.w3.org/TR/PR-xpath19991008.
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2000 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Damiani, E., di Vimercati, S.D.C., Paraboschi, S., Samarati, P. (2000). Securing XML Documents. In: Zaniolo, C., Lockemann, P.C., Scholl, M.H., Grust, T. (eds) Advances in Database Technology — EDBT 2000. EDBT 2000. Lecture Notes in Computer Science, vol 1777. Springer, Berlin, Heidelberg. https://doi.org/10.1007/3-540-46439-5_8
Download citation
DOI: https://doi.org/10.1007/3-540-46439-5_8
Published:
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-67227-2
Online ISBN: 978-3-540-46439-6
eBook Packages: Springer Book Archive