Tree Automata for Schema-Level Filtering of XML Associations

In this paper we present query-filtering techniques based on bottom-up tree automata for XML access control. In our authorization model (RXACL), RDF statements are used to represent security objects and to express the security policy. We present the concepts of a simple security object and an association security object. Our model allows us to express and enforce access control on XML trees and their associations. We propose a query-filtering technique that evaluates XML queries to detect disclosure of association-level security objects. We use tree automata to model-security objects. Intuitively a query Q discloses a security object o if and only if the (tree) automata corresponding to o accepts Q. We show that our schema-level method detects all possible disclosures, i.e., it is complete.