TY - GEN
T1 - Implementing reflective access control in SQL
AU - Olson, Lars E.
AU - Gunter, Carl A.
AU - Cook, William R.
AU - Winslett, Marianne
PY - 2009
Y1 - 2009
N2 - Reflective Database Access Control (RDBAC) is a model in which a database privilege is expressed as a database query itself, rather than as a static privilege in an access control matrix. RDBAC aids the management of database access controls by improving the expressiveness of policies. The Transaction Datalog language provides a powerful syntax and semantics for expressing RDBAC policies, however there is no efficient implementation of this language for practical database systems. We demonstrate a strategy for compiling policies in Transaction Datalog into standard SQL views that enforce the policies, including overcoming significant differences in semantics between the languages in handling side-effects and evaluation order. We also report the results of evaluating the performance of these views compared to policies enforced by access control matrices. This implementation demonstrates the practical feasibility of RDBAC, and suggests a rich field of further research.
AB - Reflective Database Access Control (RDBAC) is a model in which a database privilege is expressed as a database query itself, rather than as a static privilege in an access control matrix. RDBAC aids the management of database access controls by improving the expressiveness of policies. The Transaction Datalog language provides a powerful syntax and semantics for expressing RDBAC policies, however there is no efficient implementation of this language for practical database systems. We demonstrate a strategy for compiling policies in Transaction Datalog into standard SQL views that enforce the policies, including overcoming significant differences in semantics between the languages in handling side-effects and evaluation order. We also report the results of evaluating the performance of these views compared to policies enforced by access control matrices. This implementation demonstrates the practical feasibility of RDBAC, and suggests a rich field of further research.
UR - http://www.scopus.com/inward/record.url?scp=70350778358&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=70350778358&partnerID=8YFLogxK
U2 - 10.1007/978-3-642-03007-9_2
DO - 10.1007/978-3-642-03007-9_2
M3 - Conference contribution
AN - SCOPUS:70350778358
SN - 3642030068
SN - 9783642030062
T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
SP - 17
EP - 32
BT - Data and Applications Security XXIII - 23rd Annual IFIP WG 11.3 Working Conference, Proceedings
T2 - 23rd Annual IFIP WG 11.3 Working Conference on Data and Applications Security
Y2 - 12 July 2009 through 15 July 2009
ER -