For Xml Document Access Control Research

Access control for XML documents ensure that sensitive information stored in the documents will not be accessed by unauthorized users. User queries to XML documents include not only read operation, but also update operations. Most of the exsiting researches on access control for XML documents consider read-access restrictions only and seldomly deal with access rights for update operation. This paper mainly focused on how to enforce correct and effective access control to update queries for XML documents. Based on existing researches, action-type based access control technique for XML documents is proposed.Our research is supported by Aviation Science Fund under grant No.2006ZC31001.Works achieved in this paper are as follow:1) Depict explicitly the different access control steps read and update operations went through. Then, point out the problems need to be improved in respects of performance in DTD verification process.2) Action type is defined to distinguish update operations semantically. With action types, the effenciency of DTD verification can be improved by removing unnecessary XML parsing and DOM tree search.3) Access authourization is extended to include action type. Based on the extended access authorization, a new Labeling algorithm is proposed which can avoid repetitive labeling process executed by the XML access control system.4) Divide the access decision process into two steps, queries violating the right are filtered out in the first step, thus, memory and other system resources spend on the following access control processes can be saved.5) Design and implement a prototype system based on the proposed access control technique. System structure is designed according to the access control technique, then, architecture and mechanism for each module in the system is depicted in detail. We also model each component in the system with UML.6) Apply XML into access control of XML documents, present system information used for storage or exchange in XML format, such as access authorization,access request,user-group etc. The access control technique proposed support not only read operation but also update operations. It can shorten the overall steps of access control when appling to sample problems. Performance analysis with typical user queries verifies that the proposed thechnique show better performance in an environment where update queries occur frequently after compared with existing ones.