Flexible authentication of XML documents

ABSTRACT

XML is increasingly becoming the format of choice for information exchange, in critical areas such as government, finance, healthcare and law, where integrity is of the essence. As this trend grows, one can expect that documents (or collections thereof) may get quite large, and clients may wish to query for specific segments of these documents. In critical applications, clients must be assured that they are getting complete and correct answers to their queries. Existing methods for signing XML documents cannot be used to establish that an answer to a query is complete. A simple approach has a server processing queries and certifying answers by digitally signing them with an on-line private key; however, the server, and its on-line private key, would be vulnerable to external hacking and insider attacks. We propose a new approach to signing XML documents which allows untrusted servers to answer certain types of path queries and selection queries over XML documents without the need for trusted on-line signing keys. This approach enhances both the security and scalability of publishing information in XML format over the internet. In addition, it provides greater flexibility in authenticating parts of XML documents, in response to commercial or security policy considerations.

REFERENCES

• 1: Serge Abiteboul , Peter Buneman , Dan Suciu, Data on the Web: from relations to semistructured data and XML, Morgan Kaufmann Publishers Inc., San Francisco, CA, 1999
• 2: Serge Abiteboul , Victor Vianu, Regular path queries with constraints, Proceedings of the sixteenth ACM SIGACT-SIGMOD-SIGART symposium on Principles of database systems, p.122-133, May 11-15, 1997, Tucson, Arizona, United States [doi>10.1145/263661.263676]
• 3: Angela Bonifati , Stefano Ceri, Comparative analysis of five XML query languages, ACM SIGMOD Record, v.29 n.1, p.68-79, March 2000 [doi>10.1145/344788.344822]
• 4: Ahto Buldas , Peeter Laud , Helger Lipmaa, Accountable certificate management using undeniable attestations, Proceedings of the 7th ACM conference on Computer and communications security, p.9-17, November 01-04, 2000, Athens, Greece [doi>10.1145/352600.352604]
• 5: J.Clark:XSL Transformation (XSLT),Version 1.0. W3C Recommendation,Nov 1999.
• 6: J.Cowan:XML Information Set.W3C Working Draft,March 2001.
• 7: J.Clark,S.DeRose:XML Path Language (XPath). W3C Recommendation,Nov 1999.
• 8: Ernesto Damiani , Sabrina De Capitani di Vimercati , Stefano Paraboschi , Pierangela Samarati, XML Access Control Systems: A Component-Based Approach, Proceedings of the IFIP TC11/ WG11.3 Fourteenth Annual Working Conference on Database Security: Data and Application Security, Development and Directions, p.39-50, August 21-23, 2000
• 9: Ernesto Damiani , Sabrina De Capitani di Vimercati , Stefano Paraboschi , Pierangela Samarati, Securing XML Documents, Proceedings of the 7th International Conference on Extending Database Technology: Advances in Database Technology, p.121-135, March 27-31, 2000
• 10: Premkumar T. Devanbu , Michael Gertz , Charles U. Martel , Stuart G. Stubblebine, Authentic Third-party Data Publication, Proceedings of the IFIP TC11/ WG11.3 Fourteenth Annual Working Conference on Database Security: Data and Application Security, Development and Directions, p.101-112, August 21-23, 2000
• 11: Digest Values for DOM (DOMHASH).RFC2803, http://www.land .eld.com/rfcs/rfc2803.html,April 2000.
• 12: Dongwon Lee , Wesley W. Chu, Comparative analysis of six XML schema languages, ACM SIGMOD Record, v.29 n.3, p.76-87, Sept. 2000 [doi>10.1145/362084.362140]
• 13: D.Eastlake,J.Reagle,D.Solo:XML -Signature Syntax and Processing,Internet Draft,www.ietf.org/- internet-drafts/draft-ietf-xmldsig-core-2-00.txt
• 14: D.C.Fallside:XML Schema Part 0:Primer.W3C Recommendation,Ma 2001.
• 15: M.T.Goodrich,R.Tamassia,and A.Schwerin: Implementation of an Authenticated Dictionary with Skip Lists and Commutative Hashing,In DISCEX II , 2001 (also U.S.Patent Filing ).
• 16: Dan Gusfield, Algorithms on strings, trees, and sequences: computer science and computational biology, Cambridge University Press, New York, NY, 1997
• 17: C.Martel,G.Nuckolls,P.Devanbu,M.Gertz,A. Kwong,S.Stubblebine,General Model for Authentic Data Publication, www.cs.ucdavis.edu/ ~devanbu/.les/model-paper.pdf
• 18: Ralph C. Merkle, A certified digital signature, Proceedings on Advances in cryptology, p.218-238, July 1989, Santa Barbara, California, United States
• 19: M.Naor and K.Nissim.Certi .cate Revocation and Certi .cate Update.In Proceedings,7th USENIX Security Symposium ,1999.

INDEX TERMS

Primary Classification:
  I. Computing Methodologies
  I.7 DOCUMENT AND TEXT PROCESSING
      I.7.2 Document Preparation

          Nouns: XML

Additional Classification:
  H. Information Systems
  H.5 INFORMATION INTERFACES AND PRESENTATION (I.7)
      H.5.m Miscellaneous

  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.4 Electronic Commerce
          Subjects: Security

General Terms:
Algorithms, Performance, Security