Affiliations: [a] Security Technology Business Unit, Cisco Corporation, San Jose, CA, USA. E-mail: meile@cisco.com | [b] Computer & Information Science Department, Temple University, Philadelphia, PA, USA. E-mails: kkant@temple.edu, mathamna@temple.edu | [c] Center for Secure Information Systems, George Mason University, Fairfax, VA, USA. E-mail: jajodia@gmu.edu
Abstract: In this paper, we consider restricted data sharing between a set of parties that wish to provide some set of online services requiring such data sharing. Each party is assumed to store its data in private relational databases, and is given a set of mutually agreed set of authorization rules that specify access to attributes over individual relations or joins over relations owned by one or more parties. The access restrictions introduce significant additional complexity in rule enforcement and query planning as compared with a traditional distributed database environment. We examine the problem of minimum cost rule enforcement which simultaneously checks for the enforceability of each rule and generation of minimum cost plan of its execution. However, the paper is not focused on specific cost functions, but instead of efficient methods for enforcing rules in the face of access restrictions and inter-party data transfer needs. We propose an efficient heuristic algorithm for this minimal enforcement since the exact problem is NP-hard. In some cases, it is not possible to enforce the rules with the regular parties only. In such cases, we need help of trusted third parties (TPs). If all parties trust a single TP, such a party can enforce all unenforced rules, but it is desirable to use the TP minimally. We also consider the extended case where multiple TPs are required since not every regular party can trust a single TP.
Keywords: Cooperative data access, rule enforcement, consistent query planning, third parties
