Implementing Reflective Access Control in SQL

10 years 19 days ago
Implementing Reflective Access Control in SQL
Reflective Database Access Control (RDBAC) is a model in which a database privilege is expressed as a database query itself, rather than as a static privilege in an access control matrix. RDBAC aids the management of database access controls by improving the expressiveness of policies. The Transaction Datalog language provides a powerful syntax and semantics for expressing RDBAC policies, however there is no efficient implementation of this language for practical database systems. We demonstrate a strategy for compiling policies in Transaction Datalog into standard SQL views that enforce the policies, including overcoming significant differences in semantics between the languages in handling side-effects and evaluation order. We also report the results of evaluating the performance of these views compared to policies enforced by access control matrices. This implementation demonstrates the practical feasibility of RDBAC, and suggests a rich field of further research.
Lars E. Olson, Carl A. Gunter, William R. Cook, Ma
Added 09 Nov 2010
Updated 09 Nov 2010
Type Conference
Year 2009
Authors Lars E. Olson, Carl A. Gunter, William R. Cook, Marianne Winslett
Comments (0)