Secure querying of recursive XML views: a standard xpath-based technique

Houari Mahfoud 1 Abdessamad Imine 1
1 CASSIS - Combination of approaches to the security of infinite states systems
FEMTO-ST - Franche-Comté Électronique Mécanique, Thermique et Optique - Sciences et Technologies, Inria Nancy - Grand Est, LORIA - FM - Department of Formal Methods
Abstract : Most state-of-the art approaches for securing XML documents allow users to access data only through authorized views defined by annotating an XML grammar (e.g. DTD) with a collection of XPath expressions. To prevent improperdisclosure of confidential information, user queries posed on these views need to be rewritten into equivalent queries on the underlying documents, which enables us to avoid the overhead of view materialization and maintenance. A major concern here is that XPath query rewriting for recursive XML views is still an open problem. To overcome this problem, some authors have proposed rewriting approaches based on the non-standard language, "Regular XPath", which is more expressive than XPath and makes rewriting possible under recursion. However, query rewriting under Regular XPath can be of exponential size as it relies on automaton model. Most importantly, Regular XPath remains a theoretical achievement. Indeed, it is not commonly used in practice as translation and evaluation tools are not available. In this work, we show that query rewriting is always possible for recursive XML views using only the expressive power of the standard XPath. We propose a general approach for securely querying of XML data under arbitrary security views (recursive or not) and for a significant fragment of XPath. We provide a linear rewriting algorithm that is efficient and scales well.
Type de document :
Communication dans un congrès
The World Wide Web Conference (WWW 2012), Apr 2012, Lyon, France. ACM, pp.575-576, 2012, WWW '12 Companion - Proceedings of the 21st international conference companion on World Wide Web. 〈10.1145/2187980.2188134〉
Liste complète des métadonnées

https://hal.inria.fr/hal-00759903
Contributeur : Abdessamad Imine <>
Soumis le : lundi 3 décembre 2012 - 10:38:39
Dernière modification le : jeudi 11 janvier 2018 - 06:24:26

Identifiants

Citation

Houari Mahfoud, Abdessamad Imine. Secure querying of recursive XML views: a standard xpath-based technique. The World Wide Web Conference (WWW 2012), Apr 2012, Lyon, France. ACM, pp.575-576, 2012, WWW '12 Companion - Proceedings of the 21st international conference companion on World Wide Web. 〈10.1145/2187980.2188134〉. 〈hal-00759903〉

Partager

Métriques

Consultations de la notice

161