Enforcing access control over data streams

ABSTRACT

Access control is an important component of any computational system. However, it is only recently that mechanisms to guard against unauthorized access for streaming data have been proposed. In this paper, we study how to enforce the role-based access control model proposed by us in [5]. We design a set of novel secure operators, that basically filter out tuples/attributes from results of the corresponding (non-secure) operators that are not accessible according to the specified access control policies. We further develop an access control mechanism to enforce the access control policies based on these operators. We show that our method is secure according to the specified policies.

REFERENCES

• 1: D. J. Abadi, Y. Ahmad, M. Balazinska, U. Çetintemel, M. Cherniack, J. H. Hwang, W. Lindner, A. Maskey, A. Rasin, E. Ryvkina, N. Tatbul, Y. Xing, and S. B. Zdonik. The design of the borealis stream processing engine. In Proceedings of Conference of Innovative Data System Research (CIDR'05), pages 277--289, Asilomar, USA, 2005.
• 2: Daniel J. Abadi , Don Carney , Ugur Çetintemel , Mitch Cherniack , Christian Convey , Sangdon Lee , Michael Stonebraker , Nesime Tatbul , Stan Zdonik, Aurora: a new model and architecture for data stream management, The VLDB Journal — The International Journal on Very Large Data Bases, v.12 n.2, p.120-139, August 2003 [doi>10.1007/s00778-003-0095-z]
• 3: Arvind Arasu , Brian Babcock , Shivnath Babu , Mayur Datar , Keith Ito , Itaru Nishizawa , Justin Rosenstein , Jennifer Widom, STREAM: the stanford stream data manager (demonstration description), Proceedings of the 2003 ACM SIGMOD international conference on Management of data, June 09-12, 2003, San Diego, California [doi>10.1145/872757.872854]
• 4: B. Carminati, E. Ferrari, and K. L. Tan. Enforcing access control policies on data streams. Extended version of this paper. Available at: "http://www.dicom.uninsubria.it/~elena.ferrari/stream/TR0107.pd", 2006.
• 5: B. Carminati, E. Ferrari, and K. L. Tan. Specifying access control policies on data streams. In Proceedings of the Database System for Advanced Applications Conference (DASFAA 2007), Bangkok, Thailand, 2007.
• 6: Sirish Chandrasekaran , Owen Cooper , Amol Deshpande , Michael J. Franklin , Joseph M. Hellerstein , Wei Hong , Sailesh Krishnamurthy , Samuel R. Madden , Fred Reiss , Mehul A. Shah, TelegraphCQ: continuous dataflow processing, Proceedings of the 2003 ACM SIGMOD international conference on Management of data, June 09-12, 2003, San Diego, California [doi>10.1145/872757.872857]
• 7: E. Ferrari and B. Thuraisingham. Secure Database Systems. In O. Diaz and M. Piattini editors, Advanced Databases: Technology and Design, Artech House, London, 2000.
• 8: Wolfgang Lindner , Jorg Meier, Securing the Borealis Data Stream Engine, Proceedings of the 10th International Database Engineering and Applications Symposium, p.137-147, December 11-14, 2006 [doi>10.1109/IDEAS.2006.40]
• 9: StreamBase Home Page. http://www.streambase.com//.

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Security

Keywords:
access control, data stream, security