EXtensible Markup Language (XML) security has become a relevant research topic due to the widespread use of XML as the language for information interchange and document definition over the Web. In this context, developing an access control mechanism in terms of XML is an important step for Web information security. In this paper, we present the protection and administration facilities of Author-X, a Java-based system for discretionary access control to XML documents. Relevant features of Author-X are both a set-oriented and a document-oriented credential-based document protection, a differentiated protection of document/document type contents through the support of multi-granularity protection objects and positive/negative authorizations, and the support for different access control strategies. In this paper, we focus on the strategies we have developed for enforcing access control. Additionally, we provide a description of the environment we have developed to help the Security Officer in performing administrative activities related to both security policy and subject credential management.
Protection and administration of XML data sources / E. Bertino, S. Castano, E. Ferrari, M. Mesiti. - In: DATA & KNOWLEDGE ENGINEERING. - ISSN 0169-023X. - 43:3(2002 Dec), pp. 237-260. ((Intervento presentato al 14. convegno IFIP Working Conference on Database and Applicaions Security tenutosi a Schoorl nel 2000.
|Titolo:||Protection and administration of XML data sources|
BERTINO, ELISA (Corresponding)
CASTANO, SILVANA (Secondo)
MESITI, MARCO (Ultimo)
|Parole Chiave:||XML security; access control; administration facilities; eXcelon DBMS; Java|
|Settore Scientifico Disciplinare:||Settore INF/01 - Informatica|
|Data di pubblicazione:||dic-2002|
|Digital Object Identifier (DOI):||http://dx.doi.org/10.1016/S0169-023X(02)00127-1|
|Appare nelle tipologie:||01 - Articolo su periodico|