Affiliations: [a] Dipartimento di Scienze dell'Informazione, Università di Milano, via Comelico, 39, 20135 Milano, Italy, E-mail: castano@dsi.unimi.it, decapita@dsi.unimi.it | [b] Dipartimento di Elettronica e Informazione, Politecnico di Milano, P.za Leonardo Da Vinci, 32, 20133 Milano, Italy, E-mail: fugini@elet.polimi.it
Abstract: Global authorizations in database federations can be derived from local authorizations exported by the databases composing the federation. Particularly, when several component databases participate in the federation and a high number of users and protection objects are involved, techniques are needed for defining and managing global access privileges. This paper describes an automated approach for the derivation of global authorizations according to the policy of decentralized minimum privilege, based on the analysis of authorizations exported by component databases. The approach takes into account both security requirements of constituent databases, to preserve their local authorization autonomy, and cooperation requirements, to contemporary enable a flexible data sharing between constituent databases. A federation authorization model and abstraction criteria to derive global authorizations consistent with the exported local ones are presented. Different abstraction strategies can be applied for derivation, depending on the nature of the global objects to be protected and on the security requirements of the federated system.
