This paper presents a discretionary access control model in which authorizations contain temporal intervals of validity. An authorization is automatically revoked when the associated temporal interval expires. The proposed model provides rules for the automatic derivation of new authorizations from those explicitly specified. Both positive and negative authorizations are supported. A formal definition of those concepts is presented in the paper, together with the semantic interpretation of authorizations and derivation rules as clauses of a general logic program. Issues deriving from the presence of negative authorizations are discussed. We also allow negation in rules: it is possible to derive new authorizations on the basis of the absence of other authorizations. The presence of this type of rules may lead to the generation of different sets of authorizations, depending on the evaluation order. An approach is presented, based on establishing an ordering among authorizations and derivation rules, which guarantees a unique set of valid authorizations. Moreover, we give an algorithm detecting whether such an ordering can be established for a given set of authorizations and rules. Administrative operations for adding, removing, or modifying authorizations and derivation rules are presented and efficiency issues related to these operations are also tackled in the paper. A materialization approach is proposed, allowing to efficiently perform access control.
A Temporal Access Control Mechanism for Database Systems / E. Bertino, C. Bettini, E. Ferrari, P. Samarati. - In: IEEE TRANSACTIONS ON KNOWLEDGE AND DATA ENGINEERING. - ISSN 1041-4347. - 8:1(1996 Feb), pp. 67-80.
|Titolo:||A Temporal Access Control Mechanism for Database Systems|
BETTINI, CLAUDIO (Secondo)
SAMARATI, PIERANGELA (Ultimo)
|Parole Chiave:||Access control; Database management; Database security; General logic programs; Temporal authorization; Temporal reasoning|
|Settore Scientifico Disciplinare:||Settore INF/01 - Informatica|
|Data di pubblicazione:||feb-1996|
|Digital Object Identifier (DOI):||http://dx.doi.org/10.1109/69.485637|
|Appare nelle tipologie:||01 - Articolo su periodico|