An access control model supporting periodicity constraints and temporal reasoning

ABSTRACT

Access control models, such as the ones supported by commercial DBMSs, are not yet able to fully meet many application needs. An important requirement derives from the temporal dimension that permissions have in many real-world situations. Permissions are often limited in time or may hold only for specific periods of time. In this article, we present an access control model in which periodic temporal intervals are associated with authorizations. An authorization is automatically granted in the specified intervals and revoked when such intervals expire. Deductive temporal rules with periodicity and order constraints are provided to derive new authorizations based on the presence or absence of other authorizations in specific periods of time. We provide a solution to the problem of ensuring the uniqueness of the global set of valid authorizations derivable at each instant, and we propose an algorithm to compute this set. Moreover, we address issues related to the efficiency of access control by adopting a materialization approach. The resulting model provides a high degree of flexibility and supports the specification of several protection requirements that cannot be expressed in traditional access control models.

REFERENCES

• 1: Martín Abadi , Michael Burrows , Butler Lampson , Gordon Plotkin, A calculus for access control in distributed systems, ACM Transactions on Programming Languages and Systems (TOPLAS), v.15 n.4, p.706-734, Sept. 1993 [doi>10.1145/155183.155225]
• 2: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, A Temporal Access Control Mechanism for Database Systems, IEEE Transactions on Knowledge and Data Engineering, v.8 n.1, p.67-80, February 1996 [doi>10.1109/69.485637]
• 3: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, Supporting Periodic Authorizations and Temporal Reasoning in Database Access Control, Proceedings of the 22th International Conference on Very Large Data Bases, p.472-483, September 03-06, 1996
• 4: BERTINO, E., BETTINI, C., FERRARI, E., AND SAMARATI, P. 1996c. On using materialization strategies for a temporal authorization model. In Post-SIGMOD Workshop on Materialized Views: Techniques and Applications Proceedings (Montreal, Que., June 6), 34-81.
• 5: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, Decentralized administration for a temporal access control model, Information Systems, v.22 n.4, p.223-248, June 1997 [doi>10.1016/S0306-4379(97)00013-6]
• 6: Elisa Bertino , Pierangela Samarati , Sushil Jajodia, Authorizations in relational database management systems, Proceedings of the 1st ACM conference on Computer and communications security, p.130-139, November 03-05, 1993, Fairfax, Virginia, United States [doi>10.1145/168588.168605]
• 7: C. J. Date, An introduction to database systems (7th ed.), Addison-Wesley Longman Publishing Co., Inc., Boston, MA, 1999
• 8: FALASCHI, M., LEVI, G., MARTELLI, M., AND PALAMIDESSI, C. 1988. A new declarative semantics for logic languages. In Fifth International Conference and Symposium on Logic Programming Proceedings (Seattle, WA, Aug. 15-19), 993-1005.
• 9: FERRARI, E. 1998. Access control mechanisms for database systems: Formal models and architectural aspects. Ph.D. Thesis, Dipartimento di Scienze dell'Informazione, Universita` di Milano.
• 10: FOUNDATION, O. S. 1993. OSF/Motif Programmer's Guide. Prentice-Hall, Englewood Cliffs, NJ.
• 11: Allen Van Gelder , Kenneth A. Ross , John S. Schlipf, The well-founded semantics for general logic programs, Journal of the ACM (JACM), v.38 n.3, p.619-649, July 1991 [doi>10.1145/116825.116838]
• 12: GELFOND,M.AND LIFSCHITZ, V. 1988. The stable model semantics for logic programming. In Fifth International Conference and Symposium on Logic Programming Proceedings (Seattle, WA, Aug. 15-19), 1070-1080.
• 13: Georg Gottlob , Sherry Marcus , Anil Nerode , Gernot Salzer , V. S. Subrahmanian, A non-ground realization of the stable and well-founded semantics, Theoretical Computer Science, v.166 n.1-2, p.221-262, Oct. 20, 1996 [doi>10.1016/0304-3975(95)00207-3]
• 14: Ashish Gupta , Inderpal Singh Mumick , V. S. Subrahmanian, Maintaining views incrementally, Proceedings of the 1993 ACM SIGMOD international conference on Management of data, p.157-166, May 25-28, 1993, Washington, D.C., United States
• 15: CORPORATE Informix Software, Informix guide to SQL, Prentice Hall PTR, Upper Saddle River, NJ, 2000
• 16: Sushil Jajodia , Pierangela Samarati , V. S. Subrahmanian , Eliza Bertino, A unified framework for enforcing multiple access control policies, Proceedings of the 1997 ACM SIGMOD international conference on Management of data, p.474-485, May 11-15, 1997, Tucson, Arizona, United States
• 17: LU, J., LUDASCHER, B., SCHU, J., AND SUBRAHMANIAN, V. 1996. Well-founded views in constraint databases: Incremental materialization and maintenance. Tech. Rep., University of Maryland.
• 18: James J. Lu , Guido Moerkotte , Joachim Schue , V. S. Subrahmanian, Efficient maintenance of materialized mediated views, Proceedings of the 1995 ACM SIGMOD international conference on Management of data, p.340-351, May 22-25, 1995, San Jose, California, United States
• 19: NIEZETTE,M.AND STEVENNE, J. 1992. An efficient symbolic representation of periodic time. In First International Conference on Information and Knowledge Management Proceedings. (Baltimore, MD, Nov. 2-5).
• 20: Peter Z. Revesz, A closed-form evaluation for Datalog queries with integer (gap)-order constraints, Theoretical Computer Science, v.116 n.1, p.117-149, Aug. 2, 1993
• 21: Peter Z. Revesz, Safe Stratified Datalog with Integer Order Programs, Proceedings of the First International Conference on Principles and Practice of Constraint Programming, p.154-169, September 19-22, 1995
• 22: STEINER,J.G.,NEUMAN, C., AND SCHILLER, J. I. 1988. Kerberos: An authentication service for open network systems. In USENIX Conference Proceedings (Dallas, TX, Winter 1988), 191-202.
• 23: David Toman , Jan Chomicki , David S. Rogers, Datalog with integer periodicity constraints, Proceedings of the 1994 International Symposium on Logic programming, p.189-203, November 1994, Symposia, Melbourne
• 24: WOO,T.AND LAM, S. 1993. Authorizations in distributed systems: A new approach. J. Comput. Sec. 2, 2&3, 107-136.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Security

Keywords:
access control, periodic authorization, temporal constraints, time management