Abstract
We show by reduction from the halting problem for Turing machines that typical rule-based models of fine-grained access control of trees make impossible certain forms of analysis, limiting the ability to audit existing policies and evaluate new ones. Fine-grained access control is the problem of specifying the set of operations that may be performed on a complex structure. For tree-structured databases and documents, particularly XML, a rule-based approach is most common. In this model, access control policies consist of rules that select the allowed or disallowed targets of queries based on their hierarchical relationships to other nodes.
We consider the problem of determining whether a given document (that is, a rooted vertex-labelled tree) could have been produced in accordance with a particular access control policy for updates. We show that, for rule-based policies based on a simple fragment of XPath, this problem is undecidable. This result shows that rule-based access control policies based on XPath languages are, in some sense, too powerful, demonstrating the need for a model of access control of tree updates that bridges the gap between expressive and analyzable policies.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Bray, T., Paoli, J., Sperberg-McQueen, C.M., Maler, E., Yergeau, F., Cowan, J.: Extensible markup language (XML) 1.1. World Wide Web Consortium Recommendation (2004), http://www.w3.org/TR/2004/REC-xml11-20040204/
Bertino, E., Braun, M., Castano, S., Ferrari, E., Mesiti, M.: Author-X: A Java-based system for XML data protection. In: Proceedings IFIP TC11/WG11.3 Fourteenth Annual Working Conference on Database Security: Data and Application Security, Development and Directions, pp. 15–26 (2000)
Damiani, E., De Capitani di Vimercati, S., Paraboschi, S., Samarati, P.: Securing XML documents. In: Zaniolo, C., Grust, T., Scholl, M.H., Lockemann, P.C. (eds.) EDBT 2000. LNCS, vol. 1777, p. 121. Springer, Heidelberg (2000)
Hada, S., Kudo, M.: XML Access Control Language: Provisional authorization for XML documents. Technical Report, Tokyo Research Laboratory, IBM Research (2000), http://www.trl.ibm.com/projects/xml/xacl/xacl-spec.html
Clark, J., DeRose, S.: XML path language (XPath), version 1.0. World Wide Web Consortium Recommendation (1999), http://www.w3.org/TR/1999/REC-xpath-19991116
Deutsch, A., Tannen, V.: Containment of regular path expressions under integrity constraints. In: Knowledge Representation Meets Databases (2001)
Miklau, G., Suciu, D.: Containment and equivalence for a fragment of XPath. J. ACM 51(1), 2–45 (2004)
Cho, S., Amer-Yahia, S., Lakshmanan, L.V., Srivastava, D.: Optimizing the secure evaluation of twig queries. In: Proceedings 28th VLDB Conference (2002)
Lim, C.H., Park, S., Son, S.H.: Access control of XML documents considering update operations. In: Proceedings 2003 ACM Workshop on XML Security (2003)
Cautis, B., Abiteboul, S., Milo, T.: Reasoning about XML update constraints. In: PODS 2007: Proceedings of the twenty-sixth ACM SIGMOD-SIGACT-SIGART symposium on Principles of database systems, pp. 195–204. ACM, New York (2007)
Damiani, E., Fansi, M., Gabillon, A., Marrara, S.: Securely updating XML. In: Apolloni, B., Howlett, R.J., Jain, L. (eds.) KES 2007, Part III. LNCS, vol. 4694, pp. 1098–1106. Springer, Heidelberg (2007)
Fundulaki, I., Maneth, S.: Formalizing XML access control for update operations. In: Lotz, V., Thuraisingham, B.M. (eds.) SACMAT, pp. 169–174. ACM, New York (2007)
Bertino, E., Catania, B., Ferrari, E., Perlasca, P.: A logical framework for reasoning about access control models. ACM Trans. Inf. Syst. Secur. 6(1), 71–127 (2003)
Fundulaki, I., Marx, M.: Specifying access control policies for XML documents with XPath. In: Proceedings 9th ACM Symposium on Access Control Models and Technologies, pp. 61–69 (2004)
Laux, A., Martin, L.: XUpdate—XML update language. Working Draft (2000), http://xmldb-org.sourceforge.net/xupdate/xupdate-wd.html
Gottlob, G., Koch, C., Pichler, R.: Efficient algorithms for processing XPath queries. In: Proc. of the 28th International Conference on Very Large Data Bases (VLDB 2002) (2002)
Bravo, L., Cheney, J., Fundulaki, I.: ACCOn: checking consistency of XML write-access control policies. In: Kemper, A., Valduriez, P., Mouaddib, N., Teubner, J., Bouzeghoub, M., Markl, V., Amsaleg, L., Manolescu, I. (eds.) EDBT. ACM International Conference Proceeding Series, vol. 261, pp. 715–719. ACM, New York (2008)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2009 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Moore, N. (2009). The Halting Problem and Undecidability of Document Generation under Access Control for Tree Updates. In: Dediu, A.H., Ionescu, A.M., MartÃn-Vide, C. (eds) Language and Automata Theory and Applications. LATA 2009. Lecture Notes in Computer Science, vol 5457. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-00982-2_51
Download citation
DOI: https://doi.org/10.1007/978-3-642-00982-2_51
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-00981-5
Online ISBN: 978-3-642-00982-2
eBook Packages: Computer ScienceComputer Science (R0)