On Securely Manipulating XML Data Houari Mahfoud and Abdessamad - - PowerPoint PPT Presentation

Houari Mahfoud and Abdessamad Imine Houari Mahfoud and Abdessamad Imine

CASSIS Team CASSIS Team INRIA-LORIA Grand-Est, Nancy, France INRIA-LORIA Grand-Est, Nancy, France

5TH INTERNATIONAL SYMPOSIUM ON FOUNDATIONS & PRACTICE OF SECURITY 5TH INTERNATIONAL SYMPOSIUM ON FOUNDATIONS & PRACTICE OF SECURITY ( (FPS 2012 FPS 2012) ) OCTOBER 25-26, 2012, MONTREAL, QC, CANADA OCTOBER 25-26, 2012, MONTREAL, QC, CANADA

On Securely Manipulating XML Data

Introduction Update Access Control Securely Updating XML

1

Basic Notions

2 3 4

Conclusion

5

Outline

Introduction Update Access Control Securely Updating XML

1

Basic Notions

2 3 4

Conclusion

5

Outline

State of the art State of the art

 XML is rapidly emerging as the new standard for data representation and

exchange on the Internet.

 The security requirement is the main problem when manipulating XML documents.  The need for XML security: Business information, Health-care data,...  Most of XML access control approaches deal only with read access rights.  Access control considering update rights has not received more attention.  The XQuery Update Facility: a recommendation of W3C providing facility to

modify XML documents.

Drawbacks Drawbacks

 Existing update access control languages are unable to specify some update

policies in case of recursive DTDs.

 No practical tool exists to securely querying and updating XML data over recursive

DTDs.

 Interaction between read and update privileges has not been thoroughly studied.

Introduction

Example: Some recursive DTDs: Example: Some recursive DTDs:

Introduction

(a) Patient Treatment Life-cycle Management (b) Corresponding DTD

Introduction

Example: Hospital DTD Example: Hospital DTD

Introduction Update Access Control Securely Updating XML

1

Basic Notions

2 3 4

Conclusion

5

Outline

 Ele is a set of element types;  root is a distinguished element type, called the root type;  Rg is a function such that for any A in Ele, Rg(A) is a regular expression of

the form: A DTD D is a triple (Ele, Rg, root) where:

 A Rg(A) is the production of A;  B is a child type of A, and A is a parent type of B;  D is recursive if there is an element type A defined in terms of itself

directly or indirectly.

Basic Notions

DTD (Document Type Definition): DTD (Document Type Definition): DTDs

 Insert source into target: insert nodes in source as children of target's node.  Insert source as first/as last into target: insert nodes in source as first (resp.

as last) children of target's node.

 Insert source before/after target: insert nodes in source as preceding (resp.

following) sibling nodes of target's node.

 Replace target with source: replace target's node with the nodes in source.  Replace value of target with string-value: replace the text-content of

target's node with the new value string-value.

 Delete target: delete nodes returned by target along with their descendant

nodes.

 Rename target with string-value: rename the label of target's node with the

new label string-value. In the following, source is a set of XML nodes, and target is an XPath expression which returns a single node in case of Insert and Replace operations.

Basic Notions

XQuery Update Operations: XQuery Update Operations: XQuery Update Operations

Introduction Update Access Control Securely Updating XML

1

Basic Notions

2 3 4

Conclusion

5

Outline

For each user group of an XML document T:

 Specify an update-access policy S;  Enforce S at update time: any update op must be performed only at nodes that

are updatable w.r.t. S.

 How to specify update policies at various levels of granularity ? And over

arbitrary DTDs ?

 How to efficiently enforce those update policies ?

Update Access Control

Goals: Goals: Challenges: Challenges: Goals & Challenges

Each doctor can update

• nly data of treatments

that she has done.

Update Policy: Update Policy:

Update Access Control

Example: Doctor Update Policy Example: Doctor Update Policy Goals & Challenges

Delete //treatment[type='surgery']/Tresult ERROR: insufficient privilege

User update: User update:

Update Access Control

Example: Update rights of doctor " Imine " Example: Update rights of doctor " Imine " Goals & Challenges

Update Access Control

Previous proposals for controlling XML update: Previous proposals for controlling XML update: Damiani2008 Damiani2008

 Update policies are defined by annotating element types of the DTD by

security attributes.

 E.g., attribute @insert=Y on element type treatment specifies that some

nodes can be inserted as children of treatment nodes.

 Update policy is translated into security automaton.  Each update operation is rewritten into a safe one by parsing this

automaton.

Drawbacks Drawbacks

 Query rewriting over automaton is guaranteed only in case of non-recursive

DTDs.

 Update annotations are local which is insufficient to specify some update

constraints.

Related Work

Update Access Control

Previous proposals for controlling XML update: Previous proposals for controlling XML update: Fundulaki2007 Fundulaki2007 Drawbacks Drawbacks

 An XPath-based rules language, named XACU, is proposed to specify update

policies.

 An XACU rule has the form: (object, action, effect).  An XACU rule can be positive/negative, local/recursive.  Grant/Deny overrides as conflict resolution policy.  The XACU language can be used only for non-recursive DTDs.

Related Work

Each doctor can update

• nly data of treatments

that she has done.

Update Policy: Update Policy:

Update Access Control

Example: Fundulaki2007 limitations Example: Fundulaki2007 limitations

 (//intervention[doctor/dname='Imine']//treatment, delete, +)  (//intervention[doctor/dname≠'Imine']//treatment, delete, -)

Some XACU rules: Some XACU rules:

Nodes treatment3 and treatment4 are in the scopes of both the two XACU rules. Grant overrides: node treatment3 becomes updatable for Imine. Deny overrides: node treatment4 becomes not updatable for Imine.

Limit: Limit: Related Work

Introduction Update Access Control Securely Updating XML

1

Basic Notions

2 3 4

Conclusion

5

Outline

Securely Updating XML

Our XML Update Framework: Our XML Update Framework:

Security Administrator: Specifies for each group of users an update policy by annotating the DTD with update constraints (i.e. XPath qualifiers). Updates Rewriter Module: Translates each update operation into a safe one in order to be performed only over nodes that can be updated w.r.t. the update policy.

Proposed Model

An update specification S=(D, Annot): Annot is a mapping from element types

• f D into: Y, N, [Q].

For an element type A in D, and an update of type op, define Annot(A, op) as:

 Y: operation of type op can be performed at nodes of type A.  N: operation of type op cannot be performed at nodes of type A.  [Q]: operation of type op can be performed at node of type A iff [Q] is valid.

Securely Updating XML

Update Specification: Update Specification:

Update policy = DTD + XPath Qualifiers Principle: Update types: We define restricted update operations that can be performed only for some specific element types. E.g. insertInto[B], delete[B], replaceNode[Bi,Bj]. Inheritance and overriding of update rights.

Update Policies Specification

Securely Updating XML

Example: Update Policy for Nurses Example: Update Policy for Nurses Update Policies Specification

 Annot(department, insertInto[patient]) =

[name='Critical care']

 Annot(sibling, insertInto[patient]) = N

Update specification: Update specification:

Each doctor can update

• nly data of treatments

that she has done.

Update Policy: Update Policy:

Securely Updating XML

Example: Update Policy for doctor " Imine " Example: Update Policy for doctor " Imine "

 Annot(intervention, replaceValue[Tresult]) =

[dname='Imine']

 Annot(intervention, insertAfter[type, Tresult]) =

[dname='Imine']

 Annot(intervention, delete[Tresult]) =

[dname='Imine']

Update specification: Update specification: Update Policies Specification

Securely Updating XML

Rewriting principle: Rewriting principle:

Given an update specification S=(D, Annot) and an update operation op over an instance T of D. We rewrite op into a safe one opt such that executing opt over T has to modify only nodes that are updatable w.r.t. S.

Rewriting problem: Rewriting problem:

Consider the XPath fragment defined as follows: For recursive DTDs, the fragment is not closed under update operations rewriting.

Theorem. Theorem. Enforce Update Policies

 Delete //Tresult can be safely rewritten in .

User update: User update:

Securely Updating XML

Example: Update rights of doctor " Imine " Example: Update rights of doctor " Imine "

Delete //intervention[doctor/dname='Imine']/treatment/ (implies/diagnosis/treatment)*/Tresult

• LIMIT. The kleene star (*) cannot be expressed

in the standard XPath.

 A possible rewriting:

Enforce Update Policies

Securely Updating XML

Our solution: Our solution:

We extend into by adding upward axes (parent, ancestor, and ancestor-or-self), and the position predicate (i.e., [n]).

Theorem. Theorem.

We extend fragment as follows: For arbitrary DTDs (rescursive or not), the XPath fragment is closed under update operation rewriting.

Enforce Update Policies

Securely Updating XML

Update Rewriting Algorithm: Update Rewriting Algorithm:

A safe update opt defined in such that executing opt over any instance T

• f D has to modify only nodes that are updatable w.r.t. S.

 Input:

An update specification S=(D, Annot) and an update operation op defined in .

 Output:  Efficiency:

For any update specification S=(D, Annot) and any update operation op, rewriting

• f op can be done in O(|Annot|) time.

Enforce Update Policies

Delete //Tresult can be rewritten into :

User update: User update:

Securely Updating XML

Example: Update rights of doctor " Imine " Example: Update rights of doctor " Imine "

Which has to delete nodes Tresult1, Tresult2 and Tresult4. Delete //Tresult[ancestor::intervention[1] [doctor/dname='Imine']]

Enforce Update Policies

Introduction Update Access Control Securely Updating XML

1

Basic Notions

2 3 4

Conclusion

5

Outline

Conclusion

Done: Done:

 A general and expressive model for specifying XML Update policies.  An efficient and linear algorithm to safely rewrite XQuery Update

Operations defined over arbitrary DTDs and for a significant fragment of XPath.

To do: To do:

 Extend our approach to handle larger fragments of XPath.  Use XML schema rather than DTD grammar.  Provide a working system in order to investigate the practicality of our

approach.

On Securely Manipulating XML Data

Houari Mahfoud and Abdessamad Imine Houari Mahfoud and Abdessamad Imine

Thank you for your attention

Irini Fundulaki, Sebastian Maneth. Formalizing XML Access Control for Update Operations. In: SACMAT 2007. Wenfei Fan, Floris Geerts, Xibei Jia, and Anastasios

• Kementsietsidis. Rewriting Regular XPath Queries on XML Views.

In: ICDE 2007. Ernesto Damiani, Majirus Fansi, Alban Gabillon, Stefania

• Marrara. A General Approach to Securely Querying XML. In:

Computer Standards and Interface 2008.

Some references