The security API of IRO-DB

This paper describes the application programming interface (API) providing authorization and access control in IRO-DB. IRO-DB is an ODMB compliant federated database system supporting interoperable access between relational and object-oriented databases. The developed security API implements a federated, administrative, discretionary access control policy which is role-based but additionally supports ownership of data. Authorization rules can be positive as well as negative and use implied authorization for deriving implicit access from a set of explicit rules. The security API depicts a C++ class library maintaining security information (like authorization subjects, objects, and rules) and providing security mechanisms (like identification, authentication, authorization and access control). As a consequence of providing interoperable access by keeping the autonomy of participating component databases a mapping mechanism between the heterogeneous local security policies and the global IRO-DB policy had to be provided. Corresponding functionality is also included in the IRO-DB security API.