Research On Access Control For XML Documents

XML has emerged as a prevalent standard of data exchange and storage. Some mechanisms are needed to protect sensitive information stored in XML documents, and access control is one of the mechanisms. Time is a critical factor in some access control policies. On the one hand, authorization of user is restricted in a limited time frame. On the other hand, access history has an impact on current authorization as a duty. It is complicated to authorize a large number of XML documents and numerous elements and attributes in these documents. Based on XML technology, these problems about access control for XML documents are researched.On the basis of analysis of XML technology and Role Based Access Control (RBAC), an access control model for XML documents is presented in the paper, combining with some features of Usage Control (UCON). The model extends RBAC model with Attribute Certificate, Time Condition Constraint and Time Obligation Constraint to enforce a multi-grained access control for XML documents. A unified access control specification language according to XML criterion is adopted to specify the policy of access control. An access control system based on the model for XML documents is designed. In the finality, application of RCON-XML model is analyzed in one scenario of Electronic Business.