On specifying security policies for web documents with an XML-based language

ABSTRACT

The rapid growth of the Web and the ease with which data can be accessed facilitate the distribution and sharing of information. Information dissemination often takes the form of documents that are made available at Web servers, or that are actively broadcasted by Web servers to interested clients. In this paper, we present an XML-compliant formalism for specifying security-related information for Web document protection. In particular, we introduceX-Sec, an XML-based language for specifying subject credentials and security policies and for organizing them into subject profiles and policy bases, respectively. The language is complemented by a set of subscription-based schemes for accessing distributed Web documents, which rely on defined XML subject profiles and XML policy bases.

REFERENCES

• 1: Elisa Bertino , Silvana Castano , Elena Ferrari , Marco Mesiti, Specifying and enforcing access control policies for XML document sources, World Wide Web, v.3 n.3, p.139-151, 2000 [doi>10.1023/A:1019289831564]
• 2: Elisa Bertino , Silvana Castano , Elena Ferrari, Securing XML documents: the author-X project demonstration, Proceedings of the 2001 ACM SIGMOD international conference on Management of data, p.605, May 21-24, 2001, Santa Barbara, California, United States
• 3: E. Bertino, S. Castano, and E. Ferrari. Author-X: a Comprehensive System for Securing XML Documents. Techical Report, DSI - University of Milano, submitted for publication.
• 4: Matt Blaze , Joan Feigenbaum , Jack Lacy, Decentralized Trust Management, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.164, May 06-08, 1996
• 5: Silvana Castano , Maria Grazia Fugini , Giancarlo Martella , Pierangela Samarati, Database security, ACM Press/Addison-Wesley Publishing Co., New York, NY, 1995
• 6: Silvana Castano , Valeria De Antonellis, A Discovery-Based Approach to Database Ontology Design, Distributed and Parallel Databases, v.7 n.1, p.67-98, January 1999 [doi>10.1023/A:1008686328306]
• 7: H. Gladney and J. Lotspiech. Safeguarding Digital Library Contents and Users: Assuring Convenient Security and Data Quality. D-lib Magazine, May 1997.
• 8: Amir Herzberg , Yosi Mass, Relying Party Credentials Framework, Proceedings of the 2001 Conference on Topics in Cryptology: The Cryptographer's Track at RSA, p.328-343, April 08-12, 2001
• 9: Amir Herzberg , Yosi Mass , Joris Michaeli , Yiftach Ravid , Dalit Naor, Access Control Meets Public Key Infrastructure, Or: Assigning Roles to Strangers, Proceedings of the 2000 IEEE Symposium on Security and Privacy, p.2, May 14-17, 2000
• 10: C. Geuer Pollmann. The XML Security Page. http://www.nue.et-inf.uni-siegen.de/~ geuerpollmann/xml security.html
• 11: J. Park, R. Sandhu and G.J. Ahn. Secure Attribute Services on the Web. ACM TISSEC (to appear), 2000.
• 12: William Stallings, Network Security Essentials: Applications and Standards, Prentice Hall PTR, Upper Saddle River, NJ, 1999
• 13: W. Winsborough, K. Seamons, V. Jones. Automated Trust Negotiation. DARPA Information Survivability Conference and Exposition (DISCEX'2000), January, 2000.
• 14: M. Winslett , N. Ching , V. Jones , I. Slepchin, Using digital credentials on the World Wide Web, Journal of Computer Security, v.5 n.3, p.255-267, June 1997
• 15: Word Wide Web Consortium. XML Path Language (Xpath), 1.0, 1999. W3C Recommendation. Available at http://www.w3.org/TR/xpath.
• 16: Word Wide Web Consortium. Extensible Markup Language (XML) 1.0, 1998. Available at http://www.w3.org/TR/REC-xml

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS

Additional Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.5 On-line Information Services
          Subjects: Web-based services
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.3 Group and Organization Interfaces
          Subjects: Web-based interaction

  I. Computing Methodologies
  I.7 DOCUMENT AND TEXT PROCESSING
      I.7.2 Document Preparation

          Nouns: XML

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS

General Terms:
Design, Languages, Management, Performance, Security, Theory

Keywords:
XML, access control, security policies, subject credentials