Extending query rewriting techniques for fine-grained access control

Current day database applications, with large numbers of users, require fine-grained access control mechanisms, at the level of individual tuples, not just entire relations/views, to control which parts of the data can be accessed by each user. Fine-grained access control is often enforced in the application code, which has numerous drawbacks; these can be avoided by specifying/enforcing access control at the database level. We present a novel fine-grained access control model based on authorization views that allows "authorization-transparent" querying; that is, user queries can be phrased in terms of the database relations, and are valid if they can be answered using only the information contained in these authorization views. We extend earlier work on authorization-transparent querying by introducing a new notion of validity, conditional validity. We give a powerful set of inference rules to check for query validity. We demonstrate the practicality of our techniques by describing how an existing query optimizer can be extended to perform access control checks by incorporating these inference rules.

[1]  Dorothy E. Denning,et al.  Commutative Filters for Reducing Inference Threats in Multilevel Database Systems , 1985, 1985 IEEE Symposium on Security and Privacy.

[2]  Sushil Jajodia,et al.  Secure Databases: Constraints, Inference Channels, and Monitoring Disclosures , 2000, IEEE Trans. Knowl. Data Eng..

[3]  Divesh Srivastava,et al.  Answering Queries with Aggregation Using Views , 1996, VLDB.

[4]  Kyuseok Shim,et al.  Optimizing queries with materialized views , 1995, Proceedings of the Eleventh International Conference on Data Engineering.

[5]  Surajit Chaudhuri,et al.  Optimization of real conjunctive queries , 1993, PODS '93.

[6]  Amihai Motro Panorama: A database system that annotates its answers to queries with their properties , 2004, Journal of Intelligent Information Systems.

[7]  Prasan Roy,et al.  Efficient and extensible algorithms for multi query optimization , 1999, SIGMOD '00.

[8]  Arnon Rosenthal,et al.  Security Administration for Federations, Warehouses, and other Derived Data , 1999, DBSec.

[9]  Jeffrey D. Ullman,et al.  Protection in operating systems , 1976, CACM.

[10]  Goetz Graefe,et al.  The Volcano optimizer generator: extensibility and efficient search , 1993, Proceedings of IEEE 9th International Conference on Data Engineering.

[11]  Ashish Gupta,et al.  Aggregate-Query Processing in Data Warehousing Environments , 1995, VLDB.

[12]  Jonathan Goldstein,et al.  Optimizing queries using materialized views: a practical, scalable solution , 2001, SIGMOD '01.

[13]  Virgil D. Gligor,et al.  Characteristics of role-based access control , 1996, RBAC '95.

[14]  Sushil Jajodia,et al.  Recent Advances in Access Control Models , 2001, WAIM.

[15]  Sushil Jajodia,et al.  The inference problem: a survey , 2002, SKDD.

[16]  Jeffrey D. Ullman,et al.  Computing capabilities of mediators , 1999, SIGMOD '99.

[17]  Amihai Motro,et al.  An access authorization model for relational databases based on algebraic manipulation of view definitions , 1989, [1989] Proceedings. Fifth International Conference on Data Engineering.

[18]  Arnon Rosenthal,et al.  Administering Permissions for Distributed Data: Factoring and Automated Inference , 2001, DBSec.

[19]  Sushil Jajodia,et al.  Flexible support for multiple access control policies , 2001, TODS.

[20]  Sushil Jajodia,et al.  Towards a Multilevel Secure Relational Data Model , 1991, SIGMOD Conference.

[21]  Hamid Pirahesh,et al.  Answering complex SQL queries using automatic summary tables , 2000, SIGMOD '00.

[22]  Werner Nutt,et al.  Rewriting aggregate queries using views , 1999, PODS.

[23]  Alon Y. Halevy,et al.  Answering queries using views: A survey , 2001, The VLDB Journal.

[24]  Arnon Rosenthal,et al.  View security as the basis for data warehouse security , 2000, DMDW.

[25]  Mohamed Ziauddin,et al.  Materialized Views in Oracle , 1998, VLDB.

[26]  Gail-Joon Ahn,et al.  Role-based authorization constraints specification , 2000, TSEC.

[27]  Sushil Jajodia,et al.  Toward a multilevel secure relational data model , 1991, SIGMOD '91.