A flexible authorization mechanism for relational data management systems

ABSTRACT

In this article, we present an authorization model that can be used to express a number of discretionary access control policies for relational data management systems. The model permits both positive and negative authorizations and supports exceptions at the same time. The model is flexible in that the users can specify, for each authorization they grant, whether the authorization can allow for exceptions or whether it must be strongly obeyed. It provides authorization management for groups with exceptions at any level of the group hierarchy, and temporary suspension of authorizations. The model supports ownership together with decentralized administration of authorizations. Administrative privileges can also be restricted so that owners retain control over their tables.

REFERENCES

• 1: Martín Abadi , Michael Burrows , Butler Lampson , Gordon Plotkin, A calculus for access control in distributed systems, ACM Transactions on Programming Languages and Systems (TOPLAS), v.15 n.4, p.706-734, Sept. 1993 [doi>10.1145/155183.155225]
• 2: Elisa Bertino , Claudio Bettini , Elena Ferrari , Pierangela Samarati, A Temporal Access Control Mechanism for Database Systems, IEEE Transactions on Knowledge and Data Engineering, v.8 n.1, p.67-80, February 1996 [doi>10.1109/69.485637]
• 3: BERTINO, E., JAJODIA, S., AND SAMARATI, P. 1996b. A flexible authorization mechanism for relational data management systems. Tech. Rep. Computer Science Department, Universit di Milano, Milan, Italy.
• 4: Elisa Bertino , Sushi1 Jajodia , Pierangela Samarati, Supporting Multiple Access Control Policies in Database Systems, Proceedings of the 1996 IEEE Symposium on Security and Privacy, p.94, May 06-08, 1996
• 5: Elisa Bertino , Pierangela Samarati , Sushil Jajodia, An Extended Authorization Model for Relational Databases, IEEE Transactions on Knowledge and Data Engineering, v.9 n.1, p.85-101, January 1997 [doi>10.1109/69.567051]
• 6: BR GGEMANN, H. H. 1992. Rights in an object-oriented environment. In Database Security V, Status and Prospects, C. Landwehr and S. Jajodia, Eds. Elsevier North-Holland, Inc., New York, NY.
• 7: Silvana Castano , Maria Grazia Fugini , Giancarlo Martella , Pierangela Samarati, Database security, ACM Press/Addison-Wesley Publishing Co., New York, NY, 1995
• 8: Ronald Fagin, On an authorization mechanism, ACM Transactions on Database Systems (TODS), v.3 n.3, p.310-319, Sept. 1978 [doi>10.1145/320263.320288]
• 9: GAGLIARDI, R., LAPIS, G., AND LINDSAY, B. 1989. A flexible and efficient database authorization facility. Tech. Rep. RJ 6826(65360). IBM Almaden Research Center.
• 10: Nurith Gal-Oz , Ehud Gudes , Eduardo B. Fernández, A Model of Methods Access Authorization in Object-oriented Databases, Proceedings of the 19th International Conference on Very Large Data Bases, p.52-61, August 24-27, 1993
• 11: Patricia P. Griffiths , Bradford W. Wade, An authorization mechanism for a relational database system, ACM Transactions on Database Systems (TODS), v.1 n.3, p.242-255, Sept. 1976 [doi>10.1145/320473.320482]
• 12: INFORMIX. 1993. Informix-Online #Secure. Security Features User's Guide. Informix Software, Inc.
• 13: Sushil Jajodia , Pierangela Samarati , V. S. Subrahmanian, A Logical Language for Expressing Authorizations, Proceedings of the 1997 IEEE Symposium on Security and Privacy, p.31, May 04-07, 1997
• 14: LORETTI, S. 1996. Flexauth system--User manual. Computer Science Department, Universit di Milano, Milan, Italy.
• 15: LUNT, T. F. 1989. Access control policies for database systems. In Database Security II: Status and Prospects, C. E. Landwehr, Ed. North-Holland Publishing Co., Amsterdam, The Netherlands, 41-52.
• 16: LUNT, T. F., DENNING, D. E., SCHELL, R. R., HECKMAN, M., AND SHOCKLY, W. R. 1989. Secure distributed data views. Tech. Rep. Computer Science Laboratory, SRI International, Menlo Park, CA. Volumes 1-4.
• 17: MELTON, J. 1990. ISO/ANSI working draft--Database language sql2. Tech. Rep. ANSI X3H2-90-309. ANSI, New York, NY.
• 18: Fausto Rabitti , Elisa Bertino , Won Kim , Darrell Woelk, A model of authorization for next-generation database systems, ACM Transactions on Database Systems (TODS), v.16 n.1, p.88-131, March 1991 [doi>10.1145/103140.103144]
• 19: M. Satyanarayanan, Integrating security in a large distributed system, ACM Transactions on Computer Systems (TOCS), v.7 n.3, p.247-280, Aug. 1989 [doi>10.1145/65000.65002]
• 20: SELINGER, P. G. 1990. Authorizations and views. In Distributed Data Bases, I. W. Draffan and F. Pooe, Eds. Cambridge University Press, New York, NY.
• 21: HongHai Shen , Prasun Dewan, Access control for collaborative environments, Proceedings of the 1992 ACM conference on Computer-supported cooperative work, p.51-58, November 01-04, 1992, Toronto, Ontario, Canada [doi>10.1145/143457.143461]

INDEX TERMS

Primary Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

Additional Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Security, Theory

Keywords:
access control mechanism, access control policy, authorization, data management system, group management support, relational database