Access control in a relational data base management system by query modification

ABSTRACT

This work describes the access control system being implemented in INGRES (INteractive Graphics and REtrieval System). The scheme can be applied to any relational data base management system and has several advantages over other suggested schemes. These include: a) implementation easeb) small execution time overheadc) powerful and flexible controlsd) conceptual simplicityThe basic idea utilized is that a user interaction with the data base is modified to an alternate form which is guaranteed to have no access violations. This modification takes place in a high level interaction language. Hence, the processing of a resulting interaction can be accomplished with no further regard for protection. In particular, any procedure calls in the access paths for control purposes, such as in [1,2], are avoided.

REFERENCES

• 1: Hoffman, L., "The Formulary Model for Access Control and Privacy," Stanford Linear Accelerator Center Report 117, May, 1970.
• 2: "CODASYL Data Description Language," NBS Handbook 112, U. S. Dept. of Commerce, January, 1974.
• 3: Browne, P. and Steinauer, D., "A Model for Access Control," Proc. 1971 ACM-SIGFIDET Workshop on Data Description, Access and Control, San Diego, Calif., November, 1971.
• 4: Weissman, C., "Security Controls in the ADEPT-50 Time Sharing System," Proc. 1969 Fall Joint Computer Conference, November, 1969.
• 5: Friedman, T., "The Authorization Problem in Shared Files," IBM Systems Journal, No. 4, 1970.
• 6: McDonald, N., Stonebraker, M., and Wong, E., "Preliminary Specification of INGRES," Electronics Research Laboratory Report #435-436, University of California, Berkeley, California, May, 1974.
• 7: Owens, R., "Evaluation of Access Authorization Characteristics of Derived Data Sets," Proc. 1971 SIGFIDET Workshop on Data Description, Access and Control, San Diego, California, November, 1971.
• 8: Systems," Project MAC Report TR-89, M.I.T., Cambridge, Mass., July, 1971.
• 9: Codd, E., "A Data Base Sublanguage Founded on the Relational Calculus," Proc. 1971 SIGFIDET Workshop on Data Description, Access and Control, San Diego, California, November, 1971.
• 10: Boyce, R., et al., "Specifying Queries as Relational Expressions: SQUARE," IBM Technical Report RJ1291, IBM Research Laboratory, San Jose, California, October, 1973.
• 11: Donald D. Chamberlin , Raymond F. Boyce, SEQUEL: A structured English query language, Proceedings of the 1974 ACM SIGFIDET (now SIGMOD) workshop on Data description, access and control, p.249-264, May 01-03, 1974, Ann Arbor, Michigan [doi>10.1145/800296.811515]
• 12: Codd, E., "Relational Completeness of Data Base Sublanguages," Courant Computer Science Symposium, Vol. 6, Data Base Systems, Prentice Hall, New York, May, 1971.
• 13: Michael Stonebraker, A functional view of data independence, Proceedings of the 1974 ACM SIGFIDET (now SIGMOD) workshop on Data description, access and control, p.63-81, May 01-03, 1974, Ann Arbor, Michigan [doi>10.1145/800296.811505]
• 14: E. F. Codd, A relational model of data for large shared data banks, Communications of the ACM, v.13 n.6, p.377-387, June 1970 [doi>10.1145/362384.362685]
• 15: James B. Rothnie, Jr., An approach to implementing a relational data management system, Proceedings of the 1974 ACM SIGFIDET (now SIGMOD) workshop on Data description, access and control, p.277-294, May 01-03, 1974, Ann Arbor, Michigan [doi>10.1145/800296.811517]
• 16: Boyce, R. and Chamberlin, D., "Using a Structured English Query Language as a Data Definition Facility,$" IBM Research Report No. RJ 1318, IBM Research Laboratory, San Jose, California, December, 1973.
• 17: Robert M. Graham, Protection in an information processing utility, Communications of the ACM, v.11 n.5, p.365-369, May 1968 [doi>10.1145/363095.363146]
• 18: Lampson, B., "Dynamic Protection Structures," Proc. 1969 Fall Joint Computer Conference, November 1969.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.4 Systems
          Subjects: Relational databases

Additional Classification:
  D. Software
  D.4 OPERATING SYSTEMS
      D.4.6 Security and Protection
          Subjects: Access controls

  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.0 General

          Nouns: INGRES
      H.2.3 Languages
          Subjects: Query languages

General Terms:
Languages, Management

Keywords:
Protection, Query languages, Query modification, Relational data bases