XML Access Control Using Static Analysis
Makoto Murata Akihiko Tozawa Michiharu Kudo IBM Tokyo Research Lab/IUJ IBM Tokyo Research Lab IBM Tokyo Research Lab Research Institute 1623-14, Shimotsuruma, 1623-14, Shimotsuruma, 1623-14, Shimotsuruma, Yamato-shi, Yamato-shi, Yamato-shi, Kanagawa-ken 242-8502, Kanagawa-ken 242-8502, Kanagawa-ken 242-8502, Japan Japan Japan [email protected] [email protected] [email protected]
ABSTRACT 1. INTRODUCTION Access control policies for XML typically use regular path XML [5] has become an active area in database research. expressions such as XPath for specifying the objects for ac- XPath [6] and XQuery [4] from the W3C have come to be cess control policies. However such access control policies widely recognized as query languages for XML, and their are burdens to the engines for XML query languages. To implementations are actively in progress. In this paper, relieve this burden, we introduce static analysis for XML we are concerned with fine-grained (element- and attribute- access control. Given an access control policy, query expres- level) access control for XML database systems rather than sion, and an optional schema, static analysis determines if document-level or collection-level access control. We be- this query expression is guaranteed not to access elements lieve that access control plays an important role in XML or attributes that are permitted by the schema but hidden database systems, as it does in relational database systems. by the access control policy. Static analysis can be per- Some early experiences [21, 10, 3] with access control for formed without evaluating any query expression against an XML documents have been reported already. actual database. Run-time checking is required only when Access control for XML documents should ideally provide static analysis is unable to determine whether to grant or expressiveness as well as efficiency. That is, (1) it should be deny access requests. A nice side-effect of static analysis easy to write fine-grained access control policies, and (2) it is query optimization: access-denied expressions in queries should be possible to efficiently determine whether an ac- can be evaluated to empty lists at compile time. We have cess to an element or an attribute is granted or denied by built a prototype of static analysis for XQuery, and shown such fine-grained access control policies. It is difficult to ful- the effectiveness and scalability through experiments. fill both of these requirements, since XML documents have richer structures than relational databases. In particular, Categories and Subject Descriptors access control policies, query expressions, and schemas for XML documents are required to handle an infinite number H.2.7 [Database Management]: Database Administra- of paths, since there is no upper bound on the height of tion—Security, integrity, and protection; D.4.6 [Operating XML document trees. Systems]: Security and Protection—Access controls Existing languages (e.g. [21, 10]) for XML access con- trol achieve expressiveness by using XPath [6] as a simple General Terms and powerful mechanism for handling an infinite number of paths. For example, to deny accesses to name elements that Algorithms,Performance,Experimentation,Security,Theory are immediately or non-immediately subordinate to article elements, it suffices to specify a simple XPath expression Keywords //article//name as part of an access control policy. XML, XQuery, XPath, schema, automaton, access control, However, XPath-based access control policies are addi- query optimization, static analysis tional burdens for XML query engines. Whenever an el- ement or attribute in an XML database is accessed at run time, a query engine is required to determine whether or not this access is granted by the access control policies. Since such accesses are frequently repeated during query evalua- tion, naive implementations for checking access control poli- cies can lead to unacceptable performance. In this paper, we introduce static analysis as a new ap- Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are proach for XML access control. Static analysis examines ac- not made or distributed for profit or commercial advantage and that copies cesscontrolpoliciesandqueryexpressionsaswellasschemas, bear this notice and the full citation on the first page. To copy otherwise, to if present. Unlike the run-time checking described above, republish, to post on servers or to redistribute to lists, requires prior specific static analysis does not examine actual databases. Thus, permission and/or a fee. static analysis can be performed at compile time (when a CCS’03, October 27–31, 2003, Washington, DC, USA. query expression is created rather than each time it is eval- Copyright 2003 ACM 1-58113-738-9/03/0010 ...$5.00.
73
uated). Run-time checking is required only when static anal- searchers have used automata (string automata or tree au- ysis is unable to grant or deny access requests without ex- tomata) for handling queries, schemas, patterns, or integrity amining the actual databases. In addition, static analysis constraints. Furthermore, recent works apply boolean op- facilitates query optimization, since access-denied XPath ex- erations (typically the intersection operation) to such au- pressions in queries can be rewritten as empty lists at com- tomata. These works include type checking (e.g., [20, 12]), pile time. In Section 5, we will demonstrate effectiveness of query optimization using schemas (e.g., [14]), query opti- static analysis using examples. mization using views (e.g., [27, 11, 23, 25, 30]), consistency The key idea for our static analysis is to use automata for between integrity constraints and schemas (e.g., [13]). Our representing and comparing queries, access control policies, static analysis uses similar techniques. However, to the best and schemas. Our static analysis has two phases. In the of our knowledge, our static analysis is the first application first phase, we create automata from queries, access con- of automata for XML access control. trol policies, and (optionally) schemas: (1) automata cre- XPath containment [11, 23, 25, 30] is similar to our static ated from queries, called query automata,representpaths analysis, since we compare XPath expressions for queries to elements or attributes as accessed by these queries; (2) and those for access control policies. However, denial rules those created from access control policies, called access con- (shown in Section 3) in access control policies require that trol automata, represent paths to elements or attributes as our static analysis apply the negation operation to automata exposed by these access control policies; and (3) those cre- and use both over- and under-estimation of access control ated from schemas, called schema automata,representpaths automata. to elements or attributes as permitted by these schemas. In the second phase, we compare these automata while apply- 1.2 Outline ing the following rules: (1) accesses by queries are always- The rest of this paper is organized as follows. After re- granted if the intersection of query automata and schema viewing the fundamentals of XML, schemas, XPath, and automata is subsumed by the access control automata; (2) XQuery in Section 2, we introduce access control policies they are always-denied if the intersection of query automata, for XML documents in Section 3. We introduce static anal- schema automata, and access control automata is empty; ysis in Section 4 and further demonstrate the effectiveness and (3) they are statically indeterminate,otherwise. and scalability of static analysis in Section 5. We discuss fu- ture extensions for handling value-based access control and 1.1 Related Works the advanced features of XPath and XQuery, and conclude in Section 6. Fine-grained access control for XML documents has been studied by many researchers [2, 21, 3, 10, 15]. Their access control policies are similar to ours. They all provide run- 2. PRELIMINARIES time checking of access control policies, but do not consider In this section, we introduce the basics of XML, schema static analysis. Their algorithms for run-time checking as- languages, XPath, and XQuery. sume that XML documents are in the main memory and can be examined repeatedly. 2.1 XML Access control for an RDBMS is driven by views, which An XML document consists of elements, attributes, and hide some information (typically attributes in relations) in text nodes. These elements collectively form a tree. The the RDBMS. Queries written by users do not access actual content of each element is a sequence of elements or text databases, but rather access these views. View-driven ac- nodes. An element has a set of attributes, each of which has cess control is typically efficient, since view queries and user a name and a value. We hereafter use ΣE and ΣA as a set queries are optimized together and then executed. In other of tag names and that of attribute names, respectively. To words, access control is provided partly by optimization at distinguish between the symbols in these sets, we prepend compile-time and partly by checking at run-time. ’@’ to symbols in ΣA. Object-oriented database systems (OODBMS) provide richer An XML document representing a medical record is shown structures than RDBMSs or XML. In fact, an OODBMS in Figure 1. This XML document describes diagnosis and provides network structures and class hierarchies. Access chemotherapy information for a certain patient. Several control frameworks for the OODBMShaveappearedinthe comments are inserted in this document. For the rest of literature [1, 28]. Such frameworks typically rely on run- this paper, we use this document as a motivating example. time analysis and do not use static analysis. Our static analysis for XML access control is made possi- 2.2 Schema ble by the tree-structured nature of XML. First, the schemas A schema is a description of permissible XML documents. for XML are regular tree grammars, from which we can gen- A schema language is a computer language for writing schemas. erate automata that represent the permissible paths. Sec- DTD, W3C XML Schema [29], and RELAX NG [7] from ond, both access control policies and queries for XML use OASIS (and now ISO/IEC) are notable examples of schema regular path expressions (XPath) for locating elements or languages. attributes. We can thus use automata for uniformly han- We do not use particular schema languages in this paper, dling schemas, queries, and access control policies. but rather use tree regular grammars [9] as a formal model Implementation techniques for XQuery and XPath are be- of schemas. Murata et al. [24] have shown that tree reg- ing actively studied. However, when compared to SQL en- ular grammars can model DTD, W3C XML Schema, and gines, XQuery engines are far from mature. To the best of RELAX NG. the authors’ knowledge, none of the existing XQuery engines A schema is a 5-tuple G =(N,ΣE , ΣA,S,P), where: provide competitive optimization as well as access control. The use of automata for XML is not new. Many re- • N is a finite set of non-terminals,
74
of XHTML). In this example, “anchor” is a condition on elements and “occurring in para- E graphs” is a condition on ancestor elements. Such condi- • Σ is a finite set of element names, tions can be easily captured by regular path expressions, • ΣA is a finite set of attribute names, which are regular expressions describing permissible paths from the root element to elements or attributes. • S is a subset of ΣE × N, XPath provides a restricted variation of regular path ex- pressions. XPath is widely recognized in the industry and • P is a set of production rules X → r A,whereX ∈ N, used by XSLT [8] and XQuery. We focus on XPath in this r is a regular expression over ΣE ×N,andA is a subset paper, although our framework is applicable to any regular of ΣA. path expression. XPath uses axes for representing the structural relation- Production rules collectively specify permissible element ships between nodes. For example, the above example can structures. We separate non-terminals and element names, be captured by the XPath expression //p//a,where// is since we want to allow elements of the same name to have an axis called “descendant-or-self”. Although XPath pro- different subordinates depending on where these elements vides many axes, we consider only three of them, namely occur. Although examples in this paper can be captured “descendant-or-self” (//), “child” (/), and “attribute” (@) without separating non-terminals and element names, W3C in this paper. Extensions for handling other axes are dis- XML Schema and RELAX NG require this separation. Un- cussed in Section 6. Namespaces and wild-cards are outside like the definition in [24], we allow production rules to have 1 the scope of this paper, although our framework can easily a set of permissible attribute names . handle them. For the sake of simplicity, we do not handle text as values XPath allows conditions on elements to have additional of elements or attributes in this paper. In the case of DTDs, conditions. For example, we might want to locate foo el- this restriction amounts to the confusion of #PCDATA and ements such that their @bar attributes have "abc" as the EMPTY. values. Such additional conditions are called predicates. G Example 1 A schema for our motivating example is 1 = This example can be captured by the XPath expression N , E , A,S ,P ( 1 Σ1 Σ1 1 1), where //foo[@bar = "abc"],where[@bar = "abc"] is a predi- cate. N1 = {Record,Diag,Chem,Com,Patho,Presc}, E Σ1 = {record, diagnosis, chemotherapy, comment, pathology, prescription}, 2.4 XQuery A Σ1 = {@type}, Several query languages for XML have emerged recently. S1 = {record[Record]}, Although they have different query algebras, most of them ∗ P1 = {Record → (diagnosis[Diag] , use XPath for locating elements or attributes. Our frame- ∗ , chemotherapy[Chem] work can be applied to any query language as long as it uses comment[Com]∗, record[Record]∗) ∅, ∗ Diag → (pathology[Patho], comment[Com] ) ∅, regular path expressions for locating elements or attributes. Chem → (prescription[Presc]∗ , However, we focus on XQuery in the rest of this paper. comment[Com]∗) ∅, FLWR (FOR-LET-WHERE-RETURN) expressions are of Com → ∅, Patho → {@type}, Presc → ∅}. central importance to XQuery. A FLWR expression consists of a FOR, LET, WHERE, and RETURN clause. An equivalent DTD is shown below. The FOR or LET clause associates one or more variables with XPath expressions. By evaluating these XPath ex- create tuples. The WHERE clause imposes additional con- ditions on tuples. Those tuples not satisfying the WHERE clause are discarded. Then, for each of the remaining tuples, the RETURN clause is evaluated and a value or sequence of values is returned. The following query lists the pathology-comment pairs for the Gastric Cancer. 1RELAX NG provides a more sophisticated mechanism for handling attributes [19]. 75 76 Access words, whenever access to a node is allowed, access to all Query Schema Control the ancestor elements must be allowed as well. We impose Policy this requirement since we believe that elements or attributes isolated from their ancestor elements are meaningless. For example, if an element or attribute specifies a relative Step 1 Step 2 Step 3 URI, its interpretation depends on the attribute xml:base [22] specified at the ancestor elements. Another advantage of the denial downward consistency is that it makes imple- Schema Access Query mentation of runtime policy evaluation easier. Automata Control Automata To satisfy the above requirements, the semantics of our Automata access control policy is defined as follows: 1. An access control rule with +R or -R (capital letter) Step 4 propagates downward through the XML document struc- ture. An access control rule with +r or -r (small letter) does not propagate and just describes the rule on the Analysis Result specified node. Figure 3: Framework of the analysis 2. A rule with denial permission for a node overrules any rules with grant permission for the same node. 3.3 Run-time Access Control For the integration of access control and query processing, 3. If no rule is associated with a certain node, the default we assume that if there exist access-denied nodes in a target denial permission “-” is applied to that node. XML document, the query processor behaves as if they do not exist in the document. We believe that the node-level Now we informally describe an algorithm to generate an access control will greatly benefit by returning only autho- access decision according to the above definitions. First, the rized nodes without raising an error 4. algorithm gathers every grant rule with +r and marks “+” We explain how the semantics described above are en- on the target nodes referred to by the XPath expression. If forced by the access control system at run-time. A sample the node type is an element, the algorithm marks “+”on scenario is the following: Whenever an access to a node immediate children nodes (e.g. a text and comment nodes) (and its descendant nodes) is requested, the node-level ac- except for the attributes and the elements. It also marks cess controller makes an access decision on each node. The a“+” on all the descendant nodes if the action is R.Next, controller first retrieves access control rules applicable to the algorithm gathers the remaining rules (denial rules) and the requested node(s). Then, the controller computes the marks “-” on the target nodes in the same way. The “-” access decision(s) according to the rules and returns grant mark overwrites the “+” mark if any. Finally, the algorithm or denial for each node. Obviously, a naive implementation marks “-” on every node that is not yet marked. This opera- of this scenario can lead to poor performance by repeating tion is performed for each subject and action independently. evaluations of the rules per node. For example, the access control policy in Section 3.1 is interpreted as follows: The first rule marks the entire tree with “+” and therefore Doctor is allowed to read every node 4. STATIC ANALYSIS (including attributes and text nodes) equal to or below any In this section, we introduce our framework for static record element. The second and third rules are policies for analysis. The key idea is to use automata for comparing Intern. The second rule marks the entire tree with “+”as schemas, access control policies, and query expressions. the first rule does and the third rule marks comment elements Figure 3 depicts an overview of our static analysis. Static and subordinate text nodes with “-”, which overwrites + analysis has four steps as below: marks. Thus, three comment elements and text nodes are Step 1: creating schema automata from schemas determined as “access denied”. The XML document that Step 2: creating access control automata from access con- Intern canseeisshowninFigure2. trol policies Note that the above algorithm does not always force a Step 3: creating query automata from XQuery queries policy to satisfy the denial downward consistency. For ex- Step 4: comparison of schema automata, query automata, ample, if a rule with +R is specified on a certain node and a and access control automata rule with -R is specified on an ancestor element of the explic- itly access-granted node, the denial rule revokes the grant When schemas are not available, we skip Step 1 and do permission intended by the policy writer. Policy authoring not use schema automata in Step 4. tools (or analysis tools) can assist policy writers to detect such cases. 4.1 Automata and XPath expressions A rule that uses +R or -R can be converted to the rule with In preparation, we introduce automata and show how we +r or -r. For example, (Sbj,+R,/a) is semantically equiv- capture XPath expressions by automata. alent to a set of three rules: (Sbj,+r,/a), (Sbj,+r,/a//*) and (Sbj ,+r,/a//@*).Thus,+R and -R are technically 4Another semantic model is to raise an access violation syntactic sugar, but enable a more succinct representation whenever the query processor encounters the “access de- of the policy specification. nied” node. 77 A non-deterministic finite state automaton (NFA) M is where init fin a tuple (Ω,Q,Q ,Q ,δ), where Ω is an alphabet, Q is ΣE = {record, diagnosis, chemotherapy, comment, init a finite set of states, Q ⊆ Q is a set of initial states, pathology, prescription}, Qfin ⊆ Q is a set of final states,andδ is a transition function ΣA = {@type}, Q × Q N = {Record, Diag, Chem, Com, Patho, Presc}, from Ωtothepowersetof [18]. The set of strings ini M L M δ(q , record)={Record}, accepted by is denoted ( ). δ , { }, Recall that we have allowed only three axes of XPath (see (Record diagnosis)= Diag δ(Record, chemotherapy)={Chem}, Section 2.3). This restriction allows us to capture XPath δ(Record, comment)={Com}, expressions with automata. As long as an XPath expression δ(Record, record)={Record}, contains no predicates, we can easily construct an automa- δ(Diag, pathology)={Patho}, ton from it. We first create a regular expression by replac- δ(Diag, comment)={Com}, ing “/” and “//” with “·”and“· Ω∗·”, respectively, where δ(Chem, prescription)={Presc}, δ , { }, “·” denotes the concatenation of two regular sets, and then (Chem comment)= Com δ(Patho, @type)={qfin}. create an automaton from this regular expression. The con- structed automaton accepts a path if and only if it matches Observe that this automaton accepts the following paths. the XPath expression. /record, When an XPath expression r contains predicates, we can- /record/comment, not capture its semantics exactly by using an automaton. /record/diagnosis, r /record/diagnosis/pathology, However, we can still approximate by constructing an /record/diagnosis/pathology/@type, over-estimation automaton M[r]andanunder-estimation /record/diagnosis/comment, automaton M[r]. To construct M[r], we assume that predi- /record/chemotherapy, cates are always satisfied. That is, we first remove all predi- /record/chemotherapy/prescription, cates from r and then create an automaton M[r]. Obviously, /record/chemotherapy/comment, M[r] accepts all paths matching r and may accept other /record/record, r /record/record/comment,... paths (over-estimation). For example, if is /record[...], /record/record/record, then L(M[r]) = {/record}. /record/record/record/comment,... Meanwhile, to construct M[r], we assume that predicates r Since the example schema in Section 2 allows record ele- are never satisfied. That is, if a step in contains one or ments to nest freely, this automaton allows an infinite num- more predicates, we first replace this step with an empty ber of paths. set, and then create an automaton M[r]. Obviously, M[r] does not accept any paths if r contains predicates (under- 4.3 Step 2: Creating access control automata r L M r estimation). For example, if is /record[...],then ( [ ]) An access control policy consists of rules, each of which is an empty set. applies to some roles. For each role, we create a pair of au- r As a special case, when does not contain any predicates, tomata: an under-estimation access control automaton and M r M r M r [ ]isidenticalto [ ] and we simply write [ ]forde- an over-estimation access control automata. This pair cap- noting both. tures the set of those paths to elements or attributes which are exposed by the access control policy. 4.2 Step 1: Creating schema automata In preparation, we replace +R and -R rules with +r and Since we are interested in permissible paths rather than -r rules, respectively (see Section 3.2). Let r1, ..., rm be the permissible trees, we construct a schema automaton from XPath expressions occurring in the grant rules (+r), and let a schema. A schema automaton accepts permissible paths r1, ..., rn be the XPath expressions occurring in the denial rather than permissible documents. rules (-r). E A Let G =(N,Σ , Σ ,S,P) be a schema. To construct a We first assume that none of r1, ..., rm,r1, ..., rn contain schema automaton from G, we use all non-terminals (i.e., predicates. Recall that we interpret the policy according to N)ofG as final states. We further introduce an additional the “denial-takes-precedence” principle. M Γ accepts those fin ini final state q and a start state q . Formally, the schema paths which are allowed by one of r1, ..., rm but are denied automaton for G is by any of r1, ...., rn. Formally, G E A ini fin ini fin M =(Σ ∪ Σ ,N ∪{q ,q }, {q },N ∪{q },δ), Γ L(M )=(L(M[r1]) ∪···∪L(M[rm])) ini fin E where δ is a transition function from (N ∪{q ,q })×(Σ ∪ \ (L(M[r1]) ∪···∪L(M[rn])) A ini fin Σ )tothepowersetofN ∪{q ,q } such that E A where Σ = Σ ∪ Σ and “\” denotes the set difference. Γ δ x, {x | x → rA P, x We can construct M by applying boolean operations to ( e)= for some in e[ ] occurs M[r1], ..., M[rm],M[r1], ..., M[rn]. r}∪{x | x qini, x ∈ S}, in = e[ ] We demonstrate this construction for the access control fin δ(x, a)={q | a ∈Afor some x → r A in P }, policy in Section 3.1. For the role Intern, this policy con- tains a grant rule and a denial rule, both of which propa- where e is an element name in ΣE and a is an attribute gate downward. The grant rule contains an XPath /record, name in ΣA. while the denial rule contains an XPath //comment.Thus, For example, consider the example schema in Section 2. The schema automaton for this schema is Γ E ∗ A L(M )={record}· (Σ ) · (Σ ∪{}) G E A ini fin ini fin E ∗ E ∗ A M =(Σ ∪ Σ ,N ∪{q ,q }, {q },N ∪{q },δ) \ (Σ ) ·{comment}· (Σ ) · (Σ ∪{}) 78 Now, let us consider the case that predicates occur in Next, we create a query automaton M r for each r of the r1, ..., rm,r1, ..., rn. Since predicates cannot be captured by extracted XPath expressions. If r occurs in a FOR-LET- automata, we have to construct an over-estimation access WHERE clause, then M r is defined as M[r]. Observe that control automaton M Γ as well as an under-estimation access we over-estimate r, since we would like to err on the safe control automaton M Γ. Rather than exactly accepting the side in our static analysis. When r occurs in a RETURN set of exposed paths, the former and latter automata over- clause, M r is defined as an automaton that accepts a path estimates and under-estimates this set, respectively. Ob- if and only if some of its sub-paths matches r. Formally, serve that L(M[r1]), ..., L(M[rm]) are positive atoms and r E ∗ A L(M )=L(M[r])· (Σ ) · (Σ ∪{}). L(M[r1]), ..., L(M[rn]) are negative atoms in the above equa- tion. To construct an under-estimation access control au- This automaton can easily be constructed from M[r]. tomaton M Γ, we under-estimate positive atoms and over- As an example, let r be /record//comment,whichisthe estimate negative atoms. On the other hand, to construct last XPath expression occurring in the RETURN clause. an over-estimation access control automaton M Γ,weover- Then, M r accepts /record/comment, /record/comment/@type, estimate positive atoms and under-estimate negative atoms. /record/comment/record, /record/comment/diagnosis,and Formally, so forth. 4.5 Step 4: Comparison of automata L M Γ L M r ∪···∪L M r ( )=(( [ 1]) ( [ m])) We are now ready to compare schema automata, access \ (L(M[r1]) ∪···∪L(M[rn])), control automata, and query automata. For simplicity, we Γ first assume that predicates do not appear in the access con- L(M )=(L(M[r1]) ∪···∪L(M[rm])) trol policy. \ L M r ∪···∪L M r . ( ( [ 1]) ( [ n])) The path expression r is always-granted if every path ac- G Γ M Again, we can construct M and M Γ by applying boolean cepted by both the schema automaton and query au- M r operations to automata occurring in the right-hand side of tomaton is accepted by the access control automaton M Γ the above equations. ;thatis, r G Γ Suppose that the grant rule and denial rules in the exam- L(M ) ∩ L(M ) ⊆ L(M ). ple policy, use /record[...] and //comment[...],respec- M G tively. Then, When schemas are unavailable, we assume that allows all paths and examine if r Γ Γ E ∗ A L(M ) ⊆ L(M ). L(M )=∅· (Σ ) · (Σ ∪{}) E ∗ E ∗ A r \ (Σ ) ·{comment}· (Σ ) · (Σ ∪{}) The path expression is always-denied if no path is ac- cepted by all of the schema automaton, query automaton, ∅, = and access control automaton; that is, L M Γ { }· E ∗· A ∪{} ( )= record (Σ ) (Σ ) L M r ∩ L M G ∩ L M Γ ∅. E ∗ E ∗ A ( ) ( ) ( )= \ (Σ ) ·∅·(Σ ) · (Σ ∪{}) When schemas are unavailable, we examine if { }· E ∗· A ∪{} = record (Σ ) (Σ ) r Γ L(M ) ∩ L(M )=∅. The path expression r is statically indeterminate if it is 4.4 Step 3: Creating query automata neither always-granted or always-denied. Given a FLWR expression of XQuery, we first extract the As an example, we use the XQuery expression in Section 2.4, XPath expressions occurring in it. If an XPath expression the DTD in Section 2.2, and the access control policy in contains variables, we replace each of them with the XPath Section 3.1. We have already constructed a schema automa- expression associated with that variable. ton in Section 4.2, an access control automaton in Section 4.3, It is important to distinguish XPath expressions in RE- and a query automaton for /record//comment in Section 4.4. TURN clauses and those in other (FOR, LET, and WHERE) It can be easily seen that L(M r) ∩ L(M G)isasingletonset clauses. XPath expressions in FOR-LET-WHERE clauses containing /record/comment and that L(M Γ)doesnotcon- examine elements or attributes, but do not access their sub- tain this path. Thus, the last XPath expression ($r//comment) ordinate elements. On the other hand, XPath expressions in the example query is always-denied. in RETURN clauses return subtrees including subordinate When predicates appear in the access control policy, we elements and attributes. have to use M Γ and M Γ rather than M Γ. We use an under- As an example, consider the XQuery expression given in estimation M Γ when we want to determine whether or not Section 2.4. From this XQuery expression, we extract the a query is always-granted. That is, we examine if following XPath expressions. Observe that the variable $r r G Γ L(M ) ∩ L(M ) ⊆ L(M ). is expanded. When schemas are unavailable, we examine if FOR-LET-WHERE r Γ L(M ) ⊆ L(M ) /record /record/diagnosis/pathology/@type Likewise, we use an over-estimation M Γ when we determine whether or not a path expression is always-denied. That is, RETURN we examine if /record/diagnosis/pathology r G /record//comment L(M ) ∩ L(M ) ∩ L(M Γ)=∅. 79 role name rule semantics Role: Maintainer 1 M (Maintainer) Access to all information is +R,/ granted. 2 MM (Member Mgmt.) Access to all member info. is Role: Seller granted, but access to item +R,/ info. is not. -R,//person[@id != $userid]/creditcard 3 IM (Item Mgmt.) Access to all item info. is -R,//person[@id != $userid]/profile granted. -R,//bidder/personref 4 S (Seller) A seller cannot see privacy -R,//closed auction[seller/@person != $userid]/buyer info., and personal info. (credit -R,//privacy card info. and profiles). A seller can see who bought his Role: Visitor item. Otherwise, access to +R,/ anonymous bidder info. and -R,//person buyer info. is denied. -R,//bidder/personref -R,//seller 5 B (Buyer) A buyer cannot see privacy -R,//buyer info., and personal info. A -R,//privacy buyer can see his own bids and purchases. Otherwise, access to anonymous bidder info. and Figure 4: The definition of sample policy buyer info is denied. 6 V (Visitor) A visitor cannot see privacy info., and personal info. A vis- periments based on this implementation. In the first exper- itor cannot see who sells, bids iment, we evaluate how much the cost of query evaluation and buy an item. will be reduced by our static analysis and query optimiza- 7 UB (Buyer: US only) The same access permission as tion. In the second experiment, we measure the scalability Buyer except that access to for- eign items is denied. of our static analysis for very large policies and schemas. 8 US (Seller: US only) Thesameaccesspermissionas Seller except that access to for- 5.1 Effectiveness of Static Analysis eign items is denied. We wish to show the percentage of queries that are made 9 UV (Visitor: US only) The same access permission as more efficient, for average, real-world cases. For each query, Visitor except that access to we also benchmark the performance increase. First, using a foreign items is denied. well-known collection of queries, we show which queries are made more efficient. Second, using an example document Table 1: The sample access control policy and the same collection of queries, we measure the number of nodes exempted from access or runtime access checks. When schemas are unavailable, we examine if r Settings. We use the sample queries and the DTD devel- L M ∩ L M Γ ∅. 5 ( ) ( )= oped by the XMark project , which is a well-known bench- 4.6 Query Optimization mark framework for XQuery based on an auction scenario. An auction document consists of a list of auction items, par- r When an XPath expression in a XQuery expression is ticipants information., etc. The benchmark has 20 sample r always-denied, we can replace by an empty list. This queries. For example, the following is Query #4. rewriting makes it unnecessary to evaluate r as well as to perform run-time checking of the access control policy for r, for $b in document("auction.xml")//open_auction and may trigger further optimization if we have an optimizer where $b/bidder/personref[@person="person18829"] for XQuery. before $b/bidder/personref[@person="person10487"] Recall our example XQuery expression in Section 2.4. return 80 Query # 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 Query # 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 M G G G G G G G G G G G G G G G G G G G G M G G G G G G G G G G G G G G G G G G G G MM G G G G G D - G D G G G D D G G G G D G MM G G G G G - - G D G G G - - G G G G - G IM D D D D D G - D D D D D G G D D D D G D IM - - - - - G ------G - - - - - G - S G G G D G G G - - - - - G G G G G G G - S G G G D G ------G - - G - - B G G G - G G G - - - - - G G G G G G G - B G G G - G ------G - - G - - V D G G D G G D D D D D D G G G D D G G D V D G G D G - - D D D D D - - G - D G - D US G ------D - - - G - - - US G ------ UB G ------D - - - G - - - UB G ------ UV D ------D - - D - - - D - - D UV D ------D ------D - - D (a) With the DTD (b) Without the DTD Table 2: Results of Static Analysis of XMark Queries tion 4, we over- and under-estimate the access control au- 3500 tomata in order to perform the static analysis. s de3000 o n t 2500 no access Queries Made Efficient. For each query/role pair, we check n va whether or not our static analysis removes the runtime ac- le2000 access without re cess check. We perform the experiment for two cases: one f 1500 runtime access check case with the DTD and the other case without the DTD. We o access with runtime r 1000 statically analyze all the XPath expressions for each query. be access check m u 500 Recall that if an XPath expression in the query is always- n denied, we rewrite the query. 0 M M M S B V S B V Tables 2(a) and 2(b) show the results of our static analysis M I U U U with and without the DTD, respectively. Each entry in the role table indicates the result by either “G”, “D”, or “−”. • “G” indicates that all XPath expressions in the query Figure 5: Nodes Exempted from Access or Runtime are always-granted. Access Check • “D” indicates that at least one of the XPath expres- sions in the query is always-denied, while all other ex- analysis frequently makes runtime access checks unneces- pressions are always-granted. sary. • “−” indicates that at least one XPath expression in the query is statically indeterminable. Nodes Exempted from Access or Runtime Access Check. Here we consider how much cost of query evaluation is re- A query marked by “G” contains no XPath expressions re- duced by our static analysis and query optimization. As quiring the runtime access check. If a query is marked by the metric of reduced cost, we count the number of nodes “D”, it contains XPath expressions that always fail their exempted from access or runtime access check by our static runtime access checks. However, in this case, we rewrite analysis and query optimization. such expressions as null lists in advance. As a result of this As an example document, we use an auction document rewrite, the runtime access check becomes unnecessary. Fi- of the XMark project. This document has 250,000 nodes, nally, if queries are marked by “−”, the result of the runtime and is generated by specifying factor =0.05 (see the XMark check is not predictable, and must be performed. project page). For example, we can read from Table 2(a) that the mark When a query is evaluated against this document, some of Query #4 for role IM is “D”. This means that when a nodes in this document are accessed by the XPath expres- user filling a role IM makes Query #4, we first rewrite the sions in this query. We classify these nodes into three groups, query so that it can be evaluated without the runtime access which are defined as follows: check. Tables 2(a) and 2(b) show that 65% and 40% of the que- no access These nodes are exempt from access. In other ry/role pairs, respectively (i.e., “G” + “D”), do not require words, the original query accesses these nodes but the the runtime access check. Furthermore, for 25% and 10% of rewritten query does not. the query/role pairs (i.e., “D”), we can optimize queries by rewriting. access without runtime access check These nodes are From Table 2(b), we conclude that even when no DTDs exempt from the runtime access control check, but are available, our static analysis can result in significant op- they must still be read. timization of the query. From from Table 2(a), we conclude that the analysis can be further refined by exploiting DTD access with runtime access check These nodes are not information. Note that the sample policy contains XPaths exempt from runtime access check or access. In other with predicates, which cause over- and under-estimation of words, the rewritten query accesses these nodes and the access control automata. Even in such a case, our static this access requires runtime access check. 81 Role: ROLE10 Results. Our test environment was a 2.4 GHz Pentium 4 +R,/ machine with 512 Mbytes memory and the J2RE 1.4.0 IBM -R,/spec/body/div1/constraintnote/definitions build for Linux. The JIT-compiler is fully warmed up before -R,/spec/header/latestloc/xtermref -R,/spec/body/div1/definitions/exception each run. -R,//copyright Figure 7(a) shows the running-time of the initialization -R,/spec/header/prevlocs phase. Each point indicates the time required to compute -R,/spec/header/revisiondesc an access control automaton for each role in the randomly -R,/spec/body/div1/vcnote/definitions/reference generated policies. The running-time does not include the -R,/spec/header/authlist/author time required to compute schema automata M G,whichis -R,/spec/back/div1/ulist/item/vcnote/glist 63.7ms, 57.5ms, and 249.3ms for xmlspec-v21.dtd, HL7.dtd, /gitem/def/table/tbody/tr/td/wfcnote M G -R,//inform-div1/wfcnote and docbookx.dtd, respectively. The sizes of states of are 214, 623, and 501 for xmlspec-v21.dtd, HL7.dtd, and Figure 6: Random policy example docbookx.dtd, respectively. The size of the access control automaton M Γ is about 1,200 in the worst case. Figure 7(b) shows the running-time for the analysis phase, The bar chart (Figure 5) shows, for each role, the number where each point indicates the average time required for of nodes in the three categories. It shows the average for analyzing each XPath expression in the query. Queries #1 through #20. In both phases, the performance is much better in the We observe that the cost of query evaluation for roles M, case of HL7.dtd than in the case of xmlspec-v21.dtd or MM, IM and V is reduced significantly, because the third docbookx.dtd. This is because xmlspec-v21.dtd and doc- portion is very small. In particular, in the case of Maintainer bookx.dtd contain many recursive definitions and thus are (M) we do not require runtime access checks at all, because a more complicated than HL7.dtd. M Γ maintainer has an access to all nodes. On the other hand, for The initialization phase (computing ) takes more than IM and V, we have a large number of skipped nodes that do 10 seconds for large policies and the running-time increases not even need to be examined during the query evaluation. non-linearly. On the other hand, in the analysis phase, the running-time increases almost linearly with the number of 5.2 Scalability of Static Analysis rules. In the real world, we perform the initialization phase just once per policy, while we perform the analysis phase In the scalability test, we measure the running-time of our once per XPath expression in queries. Therefore, we con- analysis itself. We use real-world DTDs and random policies clude that our static analysis scales with respect to the size with large sets of rules. of schemas and access control policies. In this test, we distinguish two phases of the analysis, and examine each phase independently. The first phase is an ini- tialization phase, where we first compute a schema automa- 6. CONCLUSIONS AND FUTURE WORK ton M G, then compute an access control automaton M Γ In this paper, we have attempted to ease the burden of for each role in the policy. The second phase is the anal- checking access control policies for XML documents by dis- ysis phase, where we statically analyze XPath expressions tributing the burden to static analysis and run-time checks. in each query, i.e., we determine whether they are always- The key idea for our static analysis is to use automata denied or always-granted. When there are many queries, for representing and comparing queries, access control poli- we cache M G and M Γ which are computed in the initial- cies, and schemas. We have built a prototype of our static ization phase, and later in the analysis phase we repeatedly analysis, demonstrated its effectiveness, and experimented use them. with its performance. Our experiment (shown in Section 5) reveals that (1) static analysis frequently makes run-time Settings. Three large DTDs are used, that is, the xmlspec- checks unnecessary and further provides significant opti- v21.dtd from W3C XML Working Group [5], which has mizations, and (2) our prototype scales nicely when schemas, 157 element types, the HL7.dtd from Health Level Seven6, access control policies, and queries are large. which has 621 element types (as far as we know, this is the However, our static analysis has some limitations. We biggest DTD publicly available), and the docbookx.dtd by summarize these limitations and sketch future extensions OASIS DocBook technical committee7, which has 393 ele- for overcoming them. ment types. Value-based access control: Value-based access con- We use access control policies with different sizes, i.e., 1 trol requires that the XPath expressions in the access con- through 500 rules per role. For each of the given DTDs, trol policies contain predicates. Query expressions may also 10 access control policies are randomly generated by using use XPath predicates. We have approximated such access element names or attribute names defined in the DTD. As an control policies and query expressions by creating under- example, Figure 6 shows an access control policy generated estimation automata and over-estimation automata. These from the xmlspec-v21.dtd. approximations make some queries statically indeterminate. For each of the DTDs, we statically analyze a query with However, when an access control policy and query expres- 12 XPath expressions. Each query is derived from the Query sion specify the same value, we can capture predicates by #10 of XMark, in which each XPath expression has one // incorporating them into the underlying alphabet (e.g., by and several /. We chose element names appearing in these handling record[@patientId = $userid] as a “symbol”). XPath expressions according to the corresponding DTDs. Such automata help to statically perform value-based access control. For example, if a query expression and an access 6http://www.hl7.org control policy use record[@patientId = $userid],wecan 7http://www.oasis-open.org/committees/docbook statically grant this access. 82 10000 10000 10000 8000 8000 8000 6000 6000 6000 time [ms] 4000 time [ms] 4000 time [ms] 4000 2000 2000 2000 0 0 0 0 50 100 150 200 250 300 350 400 450 500 0 50 100 150 200 250 300 350 400 450 500 0 50 100 150 200 250 300 # of rules per role # of rules per role # of rules per role xmlspec-v21.dtd HL7.dtd docbookx.dtd (a) Initializing M Γ 1000 1000 1000 800 800 800 600 600 600 time [ms] 400 time [ms] 400 time [ms] 400 200 200 200 0 0 0 0 50 100 150 200 250 300 350 400 450 500 0 50 100 150 200 250 300 350 400 450 500 0 50 100 150 200 250 300 # of rules per role # of rules per role # of rules per role xmlspec-v21.dtd HL7.dtd docbookx.dtd (b) Analysis of each XPath expression Figure 7: Results of Scalability Tests Backward axes of XPath: Our static analysis does not XML query language. W3C working draft 16 august cover all axes (e.g., backward axes) of XPath. Although 2002. http://www.w3.org/TR/xquery/, August 2002. we can use tree automata (rather than string automata) [5] T. Bray, J. Paoli, and C. M. Sperberg-McQueen. to capture all the axes of XPath, tree automata are more Extensible Markup Language (XML) 1.0. W3C complicated and make implementations significantly harder. Recommendation. http://www.w3.org/TR/REC-xml, However, as a special case, we can easily handle some of the February 1998. backward axes by rewriting backward axes as forward ones [6] J. Clark and S. DeRose. XML Path Language [26]. (XPath) version 1.0. W3C Recommendation. Advanced features of XQuery: We have significantly http://www.w3.org/TR/xpath, Nov 1999. simplified XQuery here, but XPath allows arbitrary nesting [7]J.ClarkandM.Murata(Eds).“RELAXNG of FLWR expressions and even allows recursive queries. We Specification”. OASIS Committee Specification, Dec. cannot handle recursive queries and are forced to rely on 2001. run-time checking. However, we can handle nested FLWR [8] J. Clark (Eds). “XML Transformations (XSLT) expressions by extracting XPath expressions. Version 1.0”. W3C Recommendation, Nov. 1999. Our next step is to incorporate static analysis as part of http://www.w3.org/TR/xslt. an XML database system and seek a good balance between [9] H. Comon, M. Dauchet, R. Gilleron, F. Jacquemard, run-time checking and static analysis. D. Lugiez, S. Tison, and M. Tommasi. Tree automata techniques and applications. Available at 7. ADDITIONAL AUTHORS http://www.grappa.univ-lille3.fr/tata, 1997. Additional author: Satoshi Hada (IBM Tokyo Research [10] E. Damiani, S. D. C. di Vimercati, S. Paraboschi, and Lab, 1623-14, Shimotsuruma, Yamato-shi, Kanagawa-ken P. Samarati. Securing XML documents. In EDBT 242-8502, Japan, email: [email protected]) 2000, LNCS 1777, Mar. 2000. [11] A. Deutsch and V. Tannen. Containment of regular 8. REFERENCES path expressions under integrity constraints. In [1] E. Bertino. Data hiding and security in KRDB, 2001. object-oriented databases. In ICDE 92, 1992. [12] D. Draper, P. Fankhauser, M. Fernandez, A. Malhotra, [2]E.Bertino,S.Castano,E.Ferrari,andM.Mesiti. K.Rose,M.Rys,J.Simeon,andP.Wadler.XQuery Controlled access and dissemination of XML 1.0 and XPath 2.0 formal semantics. W3C working documents. In WIDM’99. ACM, Nov. 1999. draft 16 august 2002, August 2002. [3]E.Bertino,S.Castano,E.Ferrari,andM.Mesiti. [13] W. Fan and L. Libkin. On XML integrity constraints Author-X: a Java-based system for XML data in the presence of DTDs. J. ACM, 49(3), 2002. protection. In IFIP WG 11.3 Working Conference on [14] M. F. Fernandez and D. Suciu. Optimizing regular Database Security, 2000. path expressions using graph schemas. In ICDE, 1998. [4] S. Boag, D. Chamberlin, M. F. Fernandez, [15] A. Gabillon and E. Bruno. Regulating access to XML D. Florescu, J. Robie, and J. Simeon. XQuery 1.0: An documents. In IFIP WG 11.3 Working Conference on 83 Database Security, Jul. 2001. APPENDIX [16] S. Godik and T. Moses (Eds). “eXtensible Access Control Markup Language (XACML) Version 1.0”. A. IMPLEMENTATION OASIS Standard, Feb. 2003. Here we present a few techniques for improving the per- [17] J. E. Hopcroft. An n log n algorithm for minimizing formance of our implementation. states in a finite automaton. Theory of Machines and Our automata library provides boolean operations (∩, ∪, Computations, 1971. \) as well as the determinization and minimization opera- [18] J. E. Hopcroft and J. D. Ullman. Introduction to tions. Our static analysis is built on top of these operations. Automata Theory, Languages, and Computation. From our experience, the performance of our static anal- Addison-Wesley, 1979. ysis largely depends on the minimization operation. To im- [19] H. Hosoya and M. Murata. Validation and boolean prove the performance of this operation, we use a very ef- operations for attribute-element constraints. In ficient algorithm by Hopcroft [17]. Furthermore, we avoid minimization when we can make automata small enough Programming Languages Technologies for XML by removing redundant states (i.e., unreachable states and (PLAN-X), October 2002. deadend states). We use this technique when we compute [20] H. Hosoya and B. C. Pierce. “XDuce: A Typed XML intersection (∩) and difference (\) automata. Processing Language”. In WebDB, 2000. On the other hand, we heavily use the determinization [21] M. Kudo and S. Hada. XML document security based operation. While computing M Γ and M Γ in Step 2 (Sec- on provisional authorization. In CCS-7.ACM,Nov tion 4.3), we always determinize intermediate automata as 2000. Γ well as M Γ and M . By doing so, we can efficiently test ⊆ [22] J. Marsh (Eds). XML Base. W3C Recommendation, by applying \ in Step 4 (Section 4.5). If M Γ and M Γ were June 2001. large non-deterministic automata, \ (which requires the de- http://www.w3.org/TR/2001/REC-xmlbase-20010627/. terminization) would be prohibitively expensive. [23] G. Miklau and D. Suciu. Containment and equivalence In computing automata in Step 4 (Section 4.5), we first for an XPath fragment. In PODS, 2002. use M r, which is typically compact, and then use M G, [24] M. Murata, D. Lee, and M. Mani. “Taxonomy of XML which can be very large and complex. More precisely, in Schema Languages using Formal Language Theory”. checking L(M Γ) ∩ L(M G) ∩ L(M r)=∅, we first compute In Extreme Markup Languages, Aug. 2001. L(M Γ)∩L(M r) and then compute its intersection with M G; http://www.idealliance.org/papers/extreme02/ in checking L(M r) ∩ L(M G) ⊆ L(M Γ), we first compute titles.html. L(M r) \ L(M Γ) and then check whether or not (L(M r) \ [25] F. Neven and T. Schwentick. XPath containment in L(M Γ)) ∩ L(M G) is empty. In our experience, L(M Γ) ∩ the presence of disjunction, DTDs, and variables. In L(M r)andL(M r) \ L(M Γ) are reasonably compact, but ICDT, 2003. G G Γ L(M Γ) ∩ L(M )andL(M ) \ L(M )canbeverycomplex. [26] D. Olteanu, H. Meuss, T. Furche, and F. Bry. XPath: Looking forward. In Proceedings of Workshop on XML Data Management (XMLDM), LNCS. Springer, 2002. [27] Y. Papakonstantinou and V. Vassalos. Query rewriting for semistructured data. In SIGMOD 1999, 1999. [28]F.Rabitti,E.Bertino,W.Kim,andD.Woelk.A model of authorization for next-generation database systems. TODS, 16(1), 1991. [29] W3C. “XML Schema”. W3C Recommendation, May 2001. [30] P. T. Wood. Containment for XPath fragments under DTD constraints. In ICDT, 2003. 84