TY - GEN
T1 - A formal framework for reflective database access control policies
AU - Olson, Lars E.
AU - Gunter, Carl A.
AU - Madhusudan, P.
N1 - Funding Information:
The study is supported by 1. Chinese Academy of Medical Sciences Research Unit (No. 2019RU056 ), Shanghai Jiao Tong University，CAMS Innovation Fund for Medical Sciences (CIFMS) (No. 2019-I2M-5-064 ) and Shanghai Municipal Key Clinical Specialty , Shanghai, China; 2. Translational Medicine Cross Research Fund , School of Medicine, Shanghai Jiao Tong University (CN ), Award No. ZH2018ZDA32.
PY - 2008
Y1 - 2008
N2 - Refiectruc Database Access Control (RDBAC) is a model in which a database privilege is expressed as a database query itself. rather than as a static privilege contained in an access control list. RDBAC aids the management of database access controls by improving the expressiveness of policies. However, such policies introduce new interactions between data managed by different users, and can lead to unexpected results if not carefully written and analyzed. We propose the use of Transaction Datalog as a formal framework for expressing reflective access control policies. We demonstrate how it provides a basis for analyzing certain types of policies and enables secure implementations that can guarantee that configurations built on these policies cannot be subverted.
AB - Refiectruc Database Access Control (RDBAC) is a model in which a database privilege is expressed as a database query itself. rather than as a static privilege contained in an access control list. RDBAC aids the management of database access controls by improving the expressiveness of policies. However, such policies introduce new interactions between data managed by different users, and can lead to unexpected results if not carefully written and analyzed. We propose the use of Transaction Datalog as a formal framework for expressing reflective access control policies. We demonstrate how it provides a basis for analyzing certain types of policies and enables secure implementations that can guarantee that configurations built on these policies cannot be subverted.
KW - Fine-grained access control
KW - Formal safety verification
KW - Reflective database access control
KW - Transaction datalog
UR - http://www.scopus.com/inward/record.url?scp=69949149767&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=69949149767&partnerID=8YFLogxK
U2 - 10.1145/1455770.1455808
DO - 10.1145/1455770.1455808
M3 - Conference contribution
AN - SCOPUS:69949149767
SN - 9781595938107
T3 - Proceedings of the ACM Conference on Computer and Communications Security
SP - 289
EP - 298
BT - Proceedings of the 15th ACM Conference on Computer and Communications Security, CCS'08
T2 - 15th ACM conference on Computer and Communications Security, CCS'08
Y2 - 27 October 2008 through 31 October 2008
ER -