Access control in the aqualogic data services platform

ABSTRACT

The AquaLogic Data Services Platform (ALDSP) is a middleware platform for building data services that integrate and provide operations over data drawn from spanning multiple heterogeneous information sources. A data service consists of an XML Schema instance, describing its information content, and a collection of XQuery functions and procedures that comprise its set of operations. This paper describes access control in ALDSP. We describe ALDSP's securable resource hierarchy, its fine-grained access control capabilities for securing portions of data service schemas, how XQuery can be used to specify data-driven security policies, and how user identity mapping is supported. We then provide an in-depth overview of how ALDSP works, including implementation techniques to keep access control checking from interacting badly with view rewriting, query optimization, and caching.

REFERENCES

• 1: BEA Systems, Inc. Securing AquaLogic Data Services Platform. http://download.oracle.com/docs/cd/E1316901/ales/docs30/integrateappenviron/dataservices.html.
• 2: BEA Systems, Inc. Security for Oracle WebLogic Server. http://download.oracle.com/docs/cd/E1284001/wls/docs103/security.html.
• 3: Michael Carey, Data delivery in a service-oriented world: the BEA aquaLogic data services platform, Proceedings of the 2006 ACM SIGMOD international conference on Management of data, June 27-29, 2006, Chicago, IL, USA [doi>10.1145/1142473.1142551]
• 4: OASIS. eXtensible access control markup language. http://docs.oasis-open.org/xacml/2.0/access control-xacml-2.0-core-spec-os.pdf.
• 5: Oracle Corporation. Oracle Entitlements Server (formerly ALES). http://www.oracle.com/products/middleware/identity-management/entitlements-server.html.
• 6: Vinayak Borkar , Michael Carey , Daniel Engovatov , Dmitry Lychagin , Till Westmann , Warren Wong, XQSE: An XQuery Scripting Extension for the AquaLogic Data Services Platform, Proceedings of the 2008 IEEE 24th International Conference on Data Engineering, p.1229-1238, April 07-12, 2008 [doi>10.1109/ICDE.2008.4497532]
• 7: Vinayak Borkar , Michael Carey , Dmitry Lychagin , Till Westmann , Daniel Engovatov , Nicola Onose, Query processing in the aqualogic data services platform, Proceedings of the 32nd international conference on Very large data bases, September 12-15, 2006, Seoul, Korea
• 8: V. Borkar, M. Carey, N. Mangtani, D. McKinney, R. Patel, and S. Thatte. XML data services. In Intl. Journal of Web Services Research, 2006.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.0 General
          Subjects: Security, integrity, and protection**

Additional Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.5 Heterogeneous Databases
          Subjects: Data translation**; Program translation**
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Design, Languages, Security

Keywords:
access control, data services, information integration, service-oriented architecture, xml, xquery