A model of authorization for next-generation database systems

Reviewer: Jane B. Grimson

The authors present an authorization model designed for post-relational database management systems (DBMSs) that are based on object-oriented or semantic data models. They argue that conventional approaches to authorization , based on the tuple and relation, are not suitable for the richer data models of the next generation of DBMSs. The model proposed represents a refinement and extension of the one presented previously by Rabitti et al. [1]. It has three dimensions—subjects (user or user groups), types (read, update, and create), and data objects themselves. Authorization rules have three attributes—they are implicit or explicit, positive or negative, and strong or weak—which provide the basis on which to build a powerful and flexible authorization mechanism. Explicit rules are those that are explicitly stated and physically stored, for example, to give a user read permission on a particular data object. Implicit rules, by contrast, are not stored in the system, but are deduced from explicit rules. The use of implicit rules incurs a processing overhead in that they have to be deduced, but their use can represent a substantial saving of storage over explicit storage of all rules. Implicit rules are probably even more important and natural in the inheritance-based object-oriented model than in conventional relational, network, and hierarchical models. Positive rules are used to grant permissions, while negative rules deny permissions. The third attribute of an authorization rule, which specifies whether it is weak or strong, is also particularly useful in inheritance-based models, since it provides a mechanism for overriding rules inherited from elsewhere. Weak rules can be overridden, whereas strong rules cannot. The authors have formalized their authorization model, which is essential in light of the complexities involved with strong versus weak and implicit versus explicit rules in the context of inheritance. For example, it helps to highlight possible conflicts arising from multiple inheritance. The paper is clearly written and well illustrated with examples. It tackles an area of DBMS research, namely security, that is of great interest to DBMS users but may be somewhat neglected in the database research community. The present model does not support content- or context-dependent authorization, although the implication at the end of the paper is that the authors intend to look at these issues.