An Extended Authorization Model for Object Databases^*

Article type: Research Article

Authors: Bertino, Elisa | Origgi, Fabio | Samarati, Pierangela

Affiliations: Dipartimento di Scienze dell'Informazione, Università di Milano, Milano, Italy

Note: [*] A preliminary version of this paper appeared in Proceedings of the 8th Working Conference on Database Security, Bad Salzdetfurth, Germany, August 1994 [5].

Abstract: Object-oriented database systems represent today one of the most promising technology to a number of applications in business and industry. A serious problem with these systems is that they do not provide adequate access control mechanisms for controlling access to information. One of the most significant proposal for the protection of OODBMSs is represented by the Orion authorization model. In the Orion authorization model several concepts have been introduced such as those of implicit/explicit and strong/weak authorizations. However, the Orion authorization model suffers from some drawbacks and addresses only partially some protection problems. In this paper we present an authorization model for the protection of object-oriented database systems based on the types of authorizations introduced in the Orion authorization model. Although based on the same concepts, our model differs from Orion in many respects. The main differences concern the semantics of negative authorizations and of user groups. These differences result in different implication rules for the derivation of authorizations. In the paper we also discuss the problems of authorization administration, creation of new objects, and access control.

DOI: 10.3233/JCS-1994/1995-32-305

Journal: Journal of Computer Security, vol. 3, no. 2-3, pp. 169-206, 1995