Specifying and enforcing access control policies for XML document sources

The World Wide Web is becoming the main information dissemination means in private and public organizations. As a consequence, several applications, at both the Internet and the intranet level, need mechanisms to support selective access to data that is available over the Web. In this context, developing an access control model, and related mechanisms, in terms of XML (eXtensible Markup Language) is an important step, because XML is increasingly used as the language for representing information exchanged over the Web. In this paper, we propose access control policies and an associated model for XML documents, addressing peculiar protection requirements posed by XML. A first requirement is that varying protection granularity levels should be supported to guarantee a differentiated protection of document contents. A second requirement arises from the fact that XML documents do not always conform to a predefined document type. To cope with these requirements, the proposed model supports varying protection granularity levels, ranging from a set of documents to a single document or specific document portion(s). Moreover, it allows the security administrator to choose different policies for documents not covered (or only partially covered) by the existing access control policies for document types. An access control mechanism for the enforcement of the proposed model is finally described