[PPT] - Secure XML Database Access with Views SecReT09 Benoit Groz (joint PowerPoint Presentation

SLIDE 1

Secure XML Database Access with Views

SecReT’09 Benoit Groz (joint work with Anne-Cécile Caron,Yves Roos, Sławek Staworko, Sophie Tison)

Mostrare

10 juillet 2009

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 1 / 19

SLIDE 2

Securing databases with views

Many ways to enforce access control for XML. Among others: Checking the queries:

◮ statically⇒ may reject proper queries and access

[Oasis project: XACML]

◮ dynamically⇒ incurs costly runtime security check

[Murata et al. CCS’03]

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 3 / 19

SLIDE 3

Securing databases with views

Many ways to enforce access control for XML. Among others: Checking the queries:

◮ statically⇒ may reject proper queries and access

[Oasis project: XACML]

◮ dynamically⇒ incurs costly runtime security check

[Murata et al. CCS’03]

Annotating the data:

◮ annotating the data, or materializing the view ⇒ expensive

maintenance [Damiani et al. EDBT’00, Cho et al. VLDB’02]

◮ annotating the DTD with Non-materialized view

Rewriting queries from the view to the document [Fan et al. SIGMOD’04, Vercammen et al, Rassadko et al ... ]

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 3 / 19

SLIDE 4

Outline

1

Non-materialized views and query rewriting

2

Comparing Access Control Policies

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 4 / 19

SLIDE 5

Visibilium omnium... et invisibilium

“Whoever wishes to keep a secret must hide the fact that he possesses one”.

attributed to Johann Wolfgang von Goethe

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 5 / 19

SLIDE 6

Overview

Hidden part User part DTD D Annotation A

(specifies hidden elements)

View Schema Dv Query Q document t Q’ Answer Answer to query Q = evaluation of Q′

n the original document t

View derivation Query rewriting

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 6 / 19

SLIDE 7

Framework: XML

XML document=tree. No data-values.

<projects> <project> <name> </name> . . . </project> <project> . . . </project> </projects>

projects project name stable license src bin doc free project name dev license src doc free

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 7 / 19

SLIDE 8

RegularXPath

We use Regular XPath queries

Query q1 = ⇓∗/⇓ :: doc Ans(q1,t) = {n11,n14}

projects project name stable license src bin doc free project name dev license src doc free

n0 n1 n2 n3 n4 n5 n9 n10 n11 n12 n6 n7 n8 n13 n14 n15 document t

“get all documentations”

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 8 / 19

SLIDE 9

RegularXPath

We use Regular XPath queries

Query q2 =

⇓ :: project[⇓ :: stable]/⇓ :: name

Ans(q2,t) = {n3}

projects project name stable license src bin doc free project name dev license src doc free

n0 n1 n2 n3 n4 n5 n9 n10 n11 n12 n6 n7 n8 n13 n14 n15 document t

“get names of stable projects”

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 8 / 19

SLIDE 10

Access control for XML

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

We wish to hide: whether a project is stable or in-development the binaries the sources for non-free projects

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 9 / 19

SLIDE 11

DTD and Annotation

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

Example

projects → project∗ project → name,(stable | dev),license

A0(project,stable) = false A0(project,dev) = false

license → free | propr stable → src,bin,doc

A0(stable,src) = [⇑∗::project/⇓∗::free] A0(stable,doc) = true

dev → src,doc

A0(dev,src) = [⇑∗::project/⇓∗::free] A0(dev,doc) = true

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 9 / 19

SLIDE 12

The security view

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

projects project name license src doc free project name license doc propr project name license src doc free

View A(t)

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 9 / 19

SLIDE 13

Annotating the DTDs

⊲ annotation as a function A : Σ×Σ → {true,false,[f]}.

Example

projects → project∗ project → name,(stable | dev),license

A0(project,stable) = false A0(project,dev) = false

license → free | propr stable → src,bin,doc

A0(stable,src) = [⇑∗::project/⇓∗::free] A0(stable,doc) = true

dev → src,doc

A0(dev,src) = [⇑∗::project/⇓∗::free] A0(dev,doc) = true

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 10 / 19

SLIDE 14

Annotating the DTDs

⊲ annotation as a function A : Σ×Σ → {true,false,[f]}.

Example

projects → project∗ project → name,(stable | dev),license

A0(project,stable) = false A0(project,dev) = false

license → free | propr stable → src,bin,doc

A0(stable,src) = [⇑∗::project/⇓∗::free] A0(stable,doc) = true

dev → src,doc

A0(dev,src) = [⇑∗::project/⇓∗::free] A0(dev,doc) = true

Proposition

This model of annotation is equivalent to defining accessible elements with a X Reg filter f A

acc such that :

∀n ∈ Nt. n accessible wrt. A ⇐ ⇒ (t,n) | = f A

acc

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 10 / 19

SLIDE 15

Rewriting Queries

Theorem: Regular XPath is closed under query rewriting

There exists a function Rewrite such that :

∀t. Ans(Q,A(t)) = Ans(Rewrite(Q,A),t)

Moreover, Rewrite(Q,A) is computable in time O(|A|∗|Q|).

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 11 / 19

SLIDE 16

Rewriting Queries

Theorem: Regular XPath is closed under query rewriting

There exists a function Rewrite such that :

∀t. Ans(Q,A(t)) = Ans(Rewrite(Q,A),t)

Moreover, Rewrite(Q,A) is computable in time O(|A|∗|Q|).

Proof.

Translate the base axes using f A

acc:

Rewrite(⇑,A) = self[f A

acc]/(⇑[¬f A acc])∗/self[f A acc].

Rewrite the query inductively.

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 11 / 19

SLIDE 17

Rewriting Queries

Hidden part User part Query Q document t Q’=Rewrite(Q,A) Answer

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 12 / 19

SLIDE 18

Rewriting Queries

Hidden part User part Query Q document t Q’=Rewrite(Q,A) Answer Q = ⇓ :: project/⇓ :: src Q′ = ⇓ :: project[license/free]/⇓ :: ∗/⇓ :: src

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 12 / 19

SLIDE 19

Outline

1

Non-materialized views and query rewriting

2

Comparing Access Control Policies

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 13 / 19

SLIDE 20

Comparing access control policies

Definition

Two annotations A1 and A2 over DTD D are equivalent iff they hide the same nodes: A1 ≡D A2 iff ∀t ∈ L(D). A1(t) = A2(t)

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 14 / 19

SLIDE 21

Comparing access control policies

Definition

Two annotations A1 and A2 over DTD D are equivalent iff they hide the same nodes: A1 ≡D A2 iff ∀t ∈ L(D). A1(t) = A2(t)

Proposition

Testing equivalence of annotations is EXPTIME-complete.

Proof.

This problem is polynomially equivalent to the problem of equivalence of

X Reg filters over a DTD.

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 14 / 19

SLIDE 22

Comparing Access control policies

Definition

A1 and A2 annotations over DTD D. A1 is 1-restriction of A2 in the presence of D, denoted A1 D

1 A2 iff ∀t ∈ L(D). NA1(t) ⊆ NA2(t)

Intuition: The simplest way for comparing two annotations: A1 is more “restrictive” than A2 if it shows no element hidden by A2.

Proposition

Testing 1-restriction is EXPTIME-complete.

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 15 / 19

SLIDE 23

Does 1 ensure the properties we expect?

Example

projects → project∗ project → name,(stable | dev),license

A0(project,stable) = false A0(project,dev) = false

license → free | propr stable → src,bin,doc

A0(stable,src) = [⇑∗::project/⇓∗::free] A0(stable,doc) = true

dev → src,doc

A0(dev,src) = [⇑∗::project/⇓∗::free] A0(dev,doc) = true

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 16 / 19

SLIDE 24

Does 1 ensure the properties we expect?

Example

projects → project∗ project → name,(stable | dev),license

A0(project,stable) = false A0(project,dev) = false

license → free | propr stable → src,bin,doc

A0(stable,src) = [⇑∗::project/⇓∗::free] A0(stable,doc) = true

dev → src,doc

A0(dev,src) = [⇑∗::project/⇓∗::free] false A0(dev,doc) = true

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 16 / 19

SLIDE 25

Does 1 ensure the properties we expect?

Example

projects → project∗ project → name,(stable | dev),license

A0(project,stable) = false A0(project,dev) = false

license → free | propr stable → src,bin,doc

A0(stable,src) = [⇑∗::project/⇓∗::free] A0(stable,doc) = true

dev → src,doc

A0(dev,src) = [⇑∗::project/⇓∗::free] false A0(dev,doc) = true

projects project name stable license src bin doc free project name stable license src bin doc propr project name dev license src doc free

document t

⇒User can select all projects under free license that are not stable !

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 16 / 19

SLIDE 26

An information-oriented comparison

Argument A1 should be more “restrictive” than A2 if every information inferred from A1 can be inferred from A2.

Definition

A1 and A2 annotations over DTD D. A1 is 2-restriction of A2 in the presence of D, denoted A1 D

2 A2 iff ∀Q1∃Q2. ∀t ∈ L(D). Ans(Q1,A1(t)) = Ans(Q2,A2(t))

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 17 / 19

SLIDE 27

An information-oriented comparison

Definition

A1 and A2 annotations over DTD D. A1 is 2-restriction of A2 in the presence of D, denoted A1 D

2 A2 iff ∀Q1∃Q2. ∀t ∈ L(D). Ans(Q1,A1(t)) = Ans(Q2,A2(t))

Theorem

This property is undecidable.

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 18 / 19

SLIDE 28

An information-oriented comparison

Definition

A1 and A2 annotations over DTD D. A1 is 2-restriction of A2 in the presence of D, denoted A1 D

2 A2 iff ∀Q1∃Q2. ∀t ∈ L(D). Ans(Q1,A1(t)) = Ans(Q2,A2(t))

Theorem

This property is undecidable.

Alternative characterization

A1 D

2 A2 if and only if

∃f.∀t | = D∀n ∈ NA2(t).(n,A2(t)) | = f ⇐ ⇒ n ∈ NA1(t) = ⇒ : if filter f is provided, then one can verify the property in EXPTIME

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 18 / 19

SLIDE 29

An information-oriented comparison

Definition

A1 and A2 annotations over DTD D. A1 is 2-restriction of A2 in the presence of D, denoted A1 D

2 A2 iff ∀Q1∃Q2. ∀t ∈ L(D). Ans(Q1,A1(t)) = Ans(Q2,A2(t))

Theorem

This property is undecidable.

Theorem

However, for non-recursive DTDs, 2-restriction can be tested in EXPTIME

B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 18 / 19

SLIDE 30

Further work

implementation update propagation richer schema and query language

ther view formalisms
B. Groz, S. Staworko et al (Mostrare)

Secure XML Database Access with Views 10 juillet 2009 19 / 19