CSchema: A Downgrading Policy Language for XML Access Control

The problem of regulating access to XML documents has attracted muchattention from both academic and industry communities. In existingapproaches, the XML elements specified by access policies are eitheraccessible or inaccessible according to their sensitivity. However, in some cases, the original XMLelements are sensitive and inaccessible, but after being processedin some appropriate ways, the results become insensitive and thus accessible. This paper proposes a policy language to accommodate suchcases, which can express the downgrading operations on sensitivedata in XML documents through explicit calculations on them.The proposed policy language is called \it calculation-embedded schema(CSchema), which extends the ordinary schema languages with \itprotection type for protecting sensitive data and specifyingdowngrading operations. CSchema language has a type system toguarantee the type correctness of the embedded calculation expressionsand moreover this type system also generates a security view aftertype checking a CSchema policy. Access policies specified by CSchema areenforced by a validation procedure, which produces the releaseddocuments containing only the accessible data by validating theprotected documents against CSchema policies. These released documentsare then ready to be accessed by, for instance, XML query engines. Byincorporating this validation procedure, other XML processingtechnologies can use CSchema as the access control module.