FINE-GRAINED, LABEL-BASED, XML ACCESS CONTROL MODEL

• US 20090063951A1
• Filed: 09/01/2007
• Published: 03/05/2009
• Est. Priority Date: 09/01/2007
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Rjaibi, Walid, Zhang, Zheng (Alex)
• Granted Patent: US 7,913,172 B2
• Time in Patent Office: Days
• US Class Current: 715/234
• CPC Class Codes: G06F 16/83 Querying

Abstract

A method for controlling access to an XML document includes referencing a schema definition comprising a path security label definition associated with a sibling-to-sibling path of an XML document. An XML document may then be validated by comparing it with the schema definition. This validation may include verifying that the XML document has a path security label associated with a sibling-to-sibling path that is at least as restrictive as that specified by the path security label definition. An access security label may be assigned to a user seeking to access the sibling-to-sibling path. The path security label and the access security label may then be compared, using pre-determined access rules, to determine whether the user is authorized to access the sibling-to-sibling path. Access to the sibling-to-sibling path may then be granted or denied according to the access rules.

Claims

1. A computer program product comprising a computer readable medium having:

computer usable program code executable to perform operations to control access to an XML document comprising a plurality of nodes and a plurality of paths between each of the nodes, the operations of the computer program product comprising;

referencing a schema definition comprising a path security label definition associated with a sibling-to-sibling path of an XML document;

receiving an XML document to be validated by comparison with the schema definition;

comparing the XML document to the schema definition;

verifying that the XML document has a path security label associated with a sibling-to-sibling path that is at least as restrictive as that specified by the path security label definition of the schema definition for the nodes associated with the sibling-to-sibling path;

determining an access security label assigned to a user seeking to access the sibling-to-sibling path protected by the path security label;

comparing, using pre-determined access rules, the path security label to the access security label to determine whether the user is authorized to access the sibling-to-sibling path; and

controlling access to the sibling-to-sibling path in accordance with the access rules.

2. The computer program product of claim 1, wherein the sibling-to-sibling path is specified in the schema definition using at least one XPath expression.

3. The computer program product of claim 1, wherein the schema definition is selected from the group consisting of a document type definition (DTD) and an XML schema definition (XSD).

4. The computer program product of claim 1, wherein the access security label assigned to a user is assigned by a user issuing an SQL command utilizing an SQL extension to assign the access security label.

5. A computer program product to control access to an XML document comprising a plurality of nodes and a plurality of paths between each of the nodes, the computer program product comprising a computer-readable medium storing a program of computer-readable instruction that when executed on a computer causes the computer to:

generate a schema definition comprising a path security label definition associated with a sibling-to-sibling path of an XML document;

receive an XML document to be validated by comparison with the schema definition;

compare the XML document to the schema definition;

verify that the XML document has a path security label associated with a sibling-to-sibling path that is at least as restrictive as that specified by the path security label definition;

assign an access security label to a user seeking to access the sibling-to-sibling path protected by the path security label;

compare, using pre-determined access rules, the path security label to the access security label to determine whether the user is authorized to access the sibling-to-sibling path; and

control access to the sibling-to-sibling path in accordance with the access rules.

6. The computer program product of claim 5, wherein the sibling-to-sibling path is specified in the schema definition using at least one XPath expression.

7. The computer program product of claim 5, wherein the schema definition is selected from the group consisting of a document type definition (DTD) and an XML schema definition (XSD).

8. The computer program product of claim 5, wherein assigning an access security label comprises utilizing an SQL extension to assign the access security label.