The Community for Technology Leaders
RSS Icon
Issue No.02 - March-April (2013 vol.10)
pp: 99-113
J. Biskup , Fak. fur Inf., Tech. Univ. Dortmund, Dortmund, Germany
Lan Li , Sch. of Inf. Security Eng., Shanghai Jiao Tong Univ., Shanghai, China
This work aims at treating the inference problem in XML documents that are assumed to represent potentially incomplete information. The inference problem consists in providing a control mechanism for enforcing inference-usability confinement of XML documents. More formally, an inference-proof view of an XML document is required to be both indistinguishable from the actual XML document to the clients under their inference capabilities, and to neither contain nor imply any confidential information. We present an algorithm for generating an inference-proof view by weakening the actual XML document, i.e., eliminating confidential information and other information that could be used to infer confidential information. In order to avoid inferences based on the schema of the XML documents, the DTD of the actual XML document is modified according to the weakening operations as well, such that the modified DTD conforms with the generated inference-proof view.
XML, Hospitals, Information systems, Inference algorithms, Access control, Diseases, DTD, Inference control, inference-proof, view, XML documents
J. Biskup, Lan Li, "On Inference-Proof View Processing of XML Documents", IEEE Transactions on Dependable and Secure Computing, vol.10, no. 2, pp. 99-113, March-April 2013, doi:10.1109/TDSC.2012.86
[1] E. Bertino, S. Castano, E. Ferrari, and M. Mesiti, "Specifying and Enforcing Access Control Policies for XML Document Sources," World Wide Web, vol. 3, no. 3, pp. 139-151, 2000.
[2] E. Damiani, S.D.C. di Vimercati, S. Paraboschi, and P. Samarati, "A Fine-Grained Access Control System for XML Documents," ACM Trans. Information Systems Security, vol. 5, no. 2, pp. 169-202, 2002.
[3] L. Li, X. Jiang, and J. Li, "Enforce Mandatory Access Control Policy on XML Documents," Proc. Seventh Int'l Conf. Information and Comm. Security (ICICS), S. Qing, W. Mao, J. Lopez, and G. Wang, eds., pp. 336-349, 2005.
[4] I. Fundulaki and M. Marx, "Specifying Access Control Policies for XML Documents with XPath," Proc. Ninth ACM Symp. Access Control Models and Technologies (SACMAT). T. Jaeger and E. Ferrari, eds., pp. 61-69, 2004.
[5] B. Finance, S. Medjdoub, and P. Pucheral, "The Case for Access Control on XML Relationships," Proc. 14th ACM Int'l Conf. Information and Knowledge Management (CIKM), O. Herzog, H.-J. Schek, N. Fuhr, A. Chowdhury, and W. Teiken, eds., pp. 107-114, 2005.
[6] W. Fan, C.Y. Chan, and M.N. Garofalakis, "Secure XML Querying with Security Views," Proc. ACM SIGMOD Int'l Conf. Management of Data, G. Weikum, A.C. König, and S. Deßloch, eds., pp. 587-598, 2004.
[7] B. Groz, S. Staworko, A.-C. Caron, Y. Roos, and S. Tison, "XML Security Views Revisited," Proc. 12th Int'l Symp. Database Programming Languages (DBPL), P. Gardner and F. Geerts, eds., pp. 52-67, 2009.
[8] G.M. Kuper, F. Massacci, and N. Rassadko, "Generalized XML Security Views," Proc. 10th ACM Symp. Access Control Models and Technologies (SACMAT). E. Ferrari and G.-J. Ahn, eds., pp. 77-84, 2005.
[9] W. Fan, F. Geerts, X. Jia, and A. Kementsietsidis, "Rewriting Regular XPath Queries on XML Views," Proc. IEEE 23rd Int'l Conf. Data Eng. (ICDE), pp. 666-675, 2007.
[10] C. Farkas, A. Brodsky, and S. Jajodia, "Unauthorized Inferences in Semistructured Databases," Information Sciences, vol. 176, no. 22, pp. 3269-3299, 2006.
[11] X. Yang and C. Li, "Secure XML Publishing without Information Leakage in the Presence of Data Inference," Proc. 30th Int'l Conf. Very Large Data Bases (VLDB), M.A. Nascimento, M.T. Özsu, D. Kossmann, R.J. Miller, J.A. Blakeley, and K.B. Schiefer, eds., pp. 96-107, 2004.
[12] J. Biskup and P.A. Bonatti, "Controlled Query Evaluation with Open Queries for a Decidable Relational Submodel," Ann. Math. Artificial Intelligence, vol. 50, nos. 1/2, pp. 39-77, 2007.
[13] S. Jajodia and C. Meadows, "Inference Problems in Multilevel Secure Database Management Systems," Information Security: An Integrated Collection of Essays, M. Abrams, S. Jajodia, and H. Podell, eds., pp. 570-584, IEEE CS Press, 1995.
[14] F.Y.L. Chin and G. Özsoyoglu, "Auditing and Inference Control in Statistical Databases," IEEE Trans. Software Eng., vol. SE-8, no. 6, pp. 574-582, Nov. 1982.
[15] K. Hashimoto, K. Sakano, F. Takasuka, Y. Ishihara, and T. Fujiwara, "Verification of the Security against Inference Attacks on XML Databases," IEICE Trans., vol. 92-D, no. 5, pp. 1022-1032, 2009.
[16] Z. Li and Y. Wang, "An Approach for XML Inference Control Based on RDF," Proc. 17th Int'l Conf. Database and Expert Systems Applications (DEXA), S. Bressan, J. Küng, and R. Wagner, eds., pp. 338-347, 2006.
[17] J. Clark and S. DeRose, "XML Path Language (XPath) Version 1.0.," W3C Recommendation, Nov. 1999.
[18] M. Arenas and L. Libkin, "A Normal Form for XML Documents," ACM Trans. Database Systems, vol. 29, pp. 195-232, 2004.
[19] M.W. Vincent, J. Liu, and C. Liu, "Strong Functional Dependencies and Their Application to Normal Forms in XML," ACM Trans. Database Systems, vol. 29, no. 3, pp. 445-462, 2004.
[20] S. Hartmann and S. Link, "Efficient Reasoning About a Robust XML Key Fragment," ACM Trans. Database Systems, vol. 34, no. 2, pp. 1-33, 2009.
[21] M. Karlinger, "Keys and Foreign Keys for XML - Design and Reasoning," PhD thesis, Johannes Kepler Universität, Linz, AT, 2010.
[22] G. Gottlob, C. Koch, R. Pichler, and L. Segoufin, "The Complexity of XPath Query Evaluation and XML Typing," J. ACM, vol. 52, no. 2, pp. 284-335, 2005.
[23] G. Gottlob, C. Koch, and R. Pichler, "Efficient Algorithms for Processing XPath Queries," ACM Trans. Database Systems, vol. 30, no. 2, pp. 444-491, 2005.
[24] P. Barceló, L. Libkin, A. Poggi, and C. Sirangelo, "XML with Incomplete Information," J. ACM, vol. 58, no. 1, pp. 4.1-4.10, 2010.
[25] S. Abiteboul, L. Segoufin, and V. Vianu, "Representing and Querying XML with Incomplete Information," ACM Trans. Database Systems, vol. 31, no. 1, pp. 208-254, 2006.
[26] D.E. Denning and J. Schlörer, "Inference Controls for Statistical Databases," IEEE Computer, vol. 16, no. 7, pp. 69-82, July 1983.
[27] X.Y. Chen and R. Wei, "A Dynamic Method for Handling the Inference Problem in Multilevel Secure Databases," Proc. Int'l Conf. Information Technology: Coding and Computing (ITCC'05), pp. 751-756, 2005.
[28] J. Biskup, C. Tadros, and L. Wiese, "Towards Controlled Query Evaluation for Incomplete First-Order Databases," Proc. Sixth Int'l Conf. Foundations of Information and Knowledge Systems (FoIKS), S. Link and H. Prade, eds., pp. 230-247, 2010.
[29] J. Biskup and L. Wiese, "A Sound and Complete Model-Generation Procedure for Consistent and Confidentiality-Preserving Databases," Theoretical Computer Science, vol. 412, no. 31, pp. 4044-4072, 2011.
[30] J. Biskup and C. Tadros, "Policy-Based Secrecy in the Runs & Systems Framework and Controlled Query Evaluation," Proc. Int'l Worksop Security (IWSEC) (Short Papers) I. Echizen, N. Kunihiro, and R. Sasaki, eds., pp. 60-77, 2010.
[31] J. Biskup and L. Wiese, "Preprocessing for Controlled Query Evaluation with Availability Policy," J. Computer Security, vol. 16, no. 4, pp. 477-494, 2008.
[32] J. Biskup, "Usability Confinement of Server Reactions: Maintaining Inference-Proof Client Views by Controlled Interaction Execution," Proc. Sixth Int'l Conf. Databases in Networked Information Systems (DNIS), S. Kikuchi, S. Sachdeva, and S. Bhalla, eds., pp. 80-106, 2010.
[33] D. Zinn, S. Bowers, S. Köhler, and B. Ludäscher, "Parallelizing XML Data-Streaming Workflows via MapReduce," J. Computer Systems Sciences, vol. 76, no. 6, pp. 447-463, 2010.
[34] L. Fegaras, C. Li, and U. Gupta, "An Optimization Framework for Map-Reduce Queries," Proc. 15th Int'l Conf' Extending Database Technology (EDBT), E. A. Rundensteiner, V. Markl, I. Manolescu, S. Amer-Yahia, F. Naumann, and I. Ari, eds., pp. 26-37, 2012.
[35] N. Alipanah, L. Khan, and B. Thuraisingham, "Optimized Ontology-Driven Query Expansion Using Map-Reduce Framework to Facilitate Federated Queries," Computer Systems Science Eng., vol. 27, no. 2, 2012.
[36] C. Yao, X.S. Wang, and S. Jajodia, "Checking for K-Anonymity Violation by Views," Proc. 31st Int'l Conf. Very Large Data Bases (VLDB), K. Böhm, C.S. Jensen, L.M. Haas, M.L. Kersten, P.-Å. Larson, and B.C. Ooi, eds., pp. 910-921, 2005.
[37] K. Wang and B.C.M. Fung, "Anonymizing Sequential Releases," Proc. 12th ACM SIGKDD Int'l Conf. Knowledge Discovery and Data Mining (KDD), T. Eliassi-Rad, L.H. Ungar, M. Craven, and D. Gunopulos, eds., pp. 414-423, 2006.
[38] X. Xiao and Y. Tao, "M-invariance: Towards Privacy Preserving Re-Publication of Dynamic Datasets," Proc. ACM SIGMOD Int'l Conf. Management of Data, C.Y. Chan, B.C. Ooi, and A. Zhou, eds., pp. 689-700, 2007.
41 ms
(Ver 2.0)

Marketing Automation Platform Marketing Automation Tool