Dynamic access-control policies on XML encrypted data - Archive ouverte HAL Accéder directement au contenu
Article Dans Une Revue ACM Transactions on Information and System Security Année : 2008

Dynamic access-control policies on XML encrypted data

Résumé

The erosion of trust put in traditional database servers and in Database Service Providers and the growing interest for different forms of selective data dissemination are different factors that lead to move the access-control from servers to clients. Different data encryption and key dissemination schemes have been proposed to serve this purpose. By compiling the access-control rules into the encryption process, all these methods suffer from a static way of sharing data. With the emergence of hardware security elements on client devices, more dynamic client-based access-control schemes can be devised. This paper proposes a tamper-resistant client-based XML access-right controller supporting flexible and dynamic access-control policies. The access-control engine is embedded in a hardware-secure device and, therefore, must cope with specific hardware resources. This engine benefits from a dedicated index to quickly converge toward the authorized parts of a potentially streaming XML document. Pending situations (i.e., where data delivery is conditioned by predicates, which apply to values encountered afterward in the document stream) are handled gracefully, skipping, whenever possible the pending elements and reassembling relevant parts when the pending situation is solved. Additional security mechanisms guarantee that (1) the input document is protected from any form of tampering and (2) no forbidden information can be gained by replay attacks on different versions of the XML document and of the access-control rules. Performance measurements on synthetic and real datasets demonstrate the effectiveness of the approach. Finally, the paper reports on two experiments conducted with a prototype running on a secured hardware platform.
Fichier principal
Vignette du fichier
BOUGA_IJ13_TISSEC_2008.pdf (569.5 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-00623914 , version 1 (15-09-2011)

Identifiants

  • HAL Id : hal-00623914 , version 1

Citer

Luc Bouganim, François Dang Ngoc, Philippe Pucheral. Dynamic access-control policies on XML encrypted data. ACM Transactions on Information and System Security, 2008, 10 (4), pp.1-37. ⟨hal-00623914⟩
133 Consultations
211 Téléchargements

Partager

Gmail Facebook X LinkedIn More