Parameterized Role-Based Access Control Policies for XML Documents

Abstract

ABSTRACT Role-based access control policies (RBAC) are often used to provide access to fragments of static XML documents. Existing implementations of such RBACs often disseminate a single document encrypted with multiple cryptographic keys. However, most existing approaches are subject to role proliferation, especially in the case of large organizations where the number of defined roles may be several hundred. In such circumstances, correctly administering access control becomes much more difficult and error-prone. In this article, we present a novel approach to RBACs, which supports role parameterization to mitigate the potential of role proliferation. Our approach supports the association of specific user and/or session-specific credentials (i.e., parameters) with roles. We first define parameterized RBAC (PRABC), and then provide an algorithm for generating the minimal set of keys required to enforce a particular parameterized policy. We present another algorithm for efficiently encrypting an XML document in a single pass, using a technique that disguises the original structure of hidden subtrees. Finally, we include a key distribution algorithm that ensures each user receives only those keys that are needed for decrypting accessible fragments of the document. We analyze the complexity of our implementation and provide experiments to demonstrate its scalability.