Ontology-Based Secure XML Content Distribution

Abstract

This paper presents an ontology-driven secure XML content distribution scheme. This scheme first relies on a semantic access control model for XML documents that achieves three objectives: (1) representing flexible and evolvable policies, (2) providing a high-level mapping and interoperable interface to documents, and (3) automating the granting of fine-grained access rights by inferring on content semantics. A novel XML document parsing mechanism is defined to delegate document access control enforcement to a third party without leaking the document XML schema to it. The Encrypted Breadth First Order Labels (EBOL) encoding is used to bind semantic concepts with XML document nodes and to check the integrity of a document.

Towards Secure Content Based Dissemination of XML Documents

“…PUBLISH/SUBSCRIBE MODEL Publish/subscribe XML content dissemination works as follows ( Figure 3): (1) Prior to the first document publication, a publisher provides authorization policies to determine user authorizations which will be enforced by the dissemina- tion network. These policies can be flexible and may evolve (see [1]). (2) An end user sends a subscription request with valid credentials (e.g.…”

“…(4) Disseminators follow a dissemination protocol (detailed in [17]) in order to route the encoded XML document portions selectively to all authorized subscribers. The recipient verifies the received XML content by decoding the EBOL-based encoding, both semantically and structurally, in a verification phase which is detailed in our previous work [1].…”

“…This is achieved by an encoding method [1] that allows subscribers to verify integrity of the received documents.…”

“…This is addressed by (a) the encryption of published XML information, supported by a distributed key management and (b) an ontology-based authorization scheme that supports access control and dissemination on semantic level. For (a), the EBOL-based encoding [1] of the original XML document portions ensures that the content is only readable to the authorized partners who do not need to know each other a priori. In this context, techniques developed in our prior work [16] allow a group of users to compute a group secret key independently of each other.…”

“…if the user credentials expire or if authorization policies are changed). (3) The publisher of a given XML document encodes each XML document portion with its conceptual information [1], encrypts the nodes in a stipulated granularity with the computed secret key for the concept, and sends those to the disseminators. (4) Disseminators follow a dissemination protocol (detailed in [17]) in order to route the encoded XML document portions selectively to all authorized subscribers.…”