Context-Aware Mobile Database Management Workshop

Position paper – Elisa Bertino (bertino@dsi.unimi.it) – University of Milano (Italy)

Recent advances in technologies for communication devices, especially portable ones, and in networks have made available a large variety of means by which users can easily communicate among each others and get access to relevant information anywhere at any time. On the other hand, there is today an explosion in the production of digital contents and services that are directly available from the Web. The development of suitable data management infrastructures and tools supporting the users in gaining access to data and services, and enabling collaborative activities across today’s information spaces is thus crucial. The development of such infrastructures and tools is challenging and entails addressing several issues, many of which are listed in [1]. In our position paper, we would like to focus on two different topics, which we believe, are strictly related to mobile systems. The first topic is related to access control policies and mechanisms for information distribution according to several dissemination techniques (information push, pull, broadcast). Work on such topic has been carried out as part of the Author-X project. The second topic is related to message routing policies in “universal communication systems”. The work we have so far accomplished deals specifically with policies establishing user preferences with respect to routing actions for messages, possibly containing multimedia data. It is part of the UCS-Router Project. In the following we survey results from those projects, since we believe they could the basis for discussion on some of the workshop topics.

Author-X – Secure and selective access and flexible distribution mechanisms for XML documents

XML (eXtensible Markup Language) has recently emerged as the most relevant standardization effort in the area of document representation through markup languages. Because XML documents can contain information at different degrees of sensitivity, there is a strong need for models and mechanisms enabling the specification and enforcement of access control policies. The development of suitable access control policies, models, and mechanisms for XML poses several new requirements. In this research project, we propose access control policies and an associated model addressing XML security requirements.  A first requirement arises from the fact that varying protection granularity levels should be supported. The second requirement arises from the fact that XML documents do not always conform to a predefined document type.  Other relevant requirements include content-based authorizations, also in presence of multimedia data, and support for large and dynamic user population. Traditional authorization models are not adequate to fully meet access control requirements typical of XML document sources. Finally, selective access to documents should also supported when dealing with different document distribution strategies (pull, push, broadcast).

The goal of the Author-X project is to develop an access control system addressing the above requirements. Within the project we have developed a discretionary access control model for XML documents, characterized by the following features: varying levels of authorization granularity; propagation of authorization across document composite structures; document-based authorization policy; DTD-based authorization policy with various options for documents partially covered by in-place access control policies (options include: authorization propagation, affinity-based authorization, explicit authorizations). The model supports two basic access modes: browsing and authoring. Those modes have different semantics depending on the document components on which they are applied. Moreover, our model supports a notion of document view, enabling the release only of specific portions of documents, depending on the user privileges. We have also developed mechanisms for secure dissemination of XML documents. The Author-X server supports a traditional pull approach, according to which documents reside at one or more servers and clients, on behalf of their users, require them when needed. There are, however, many situations in which a server periodically broadcast data to the clients (consider for example, the case of a newsletter sent once a week to all users). We refer to such an approach as information push. In general, since different users may have privileges to see different, selected portions of the same document (or set of documents), supporting an information push approach may entail generating different physical views of the same document (or sets of documents) and sending them to the proper users. The number of such views may become rather large and thus such an approach cannot be practically applied. We have thus developed an approach which consists of using different encryption keys for encrypting different portions of the same document. Each user only receives the key(s) for the portion(s) he/she is enabled to access. Under such an approach, the same (encrypted) copy of the document is broadcasted to all the users. Within this approach, we support three strategies for distributing the keys to the users. They can be send together with the documents, by properly encrypting them, or can be retrieved by users from an LDAP directory, or can be separately sent to users by secure mail mechanisms.  We have also integrated our access control mechanism with user credential mechanisms. A credential is a set of attributes concerning a user that are relevant for security purpose (for example, age, position within the organization, projects the user is working on). Credentials are classified in credential types  (manager, programmer, employee, etc. are example of credential types). Credentials are essentially a way to describe users. Credentials bear many similarities with roles used in role-based access control mechanisms, even though there are some differences. The use of credentials allows one to directly express relevant security policies in terms that are closer to the organizational structure of the enterprise. By using credentials one can simply formulate policies such as “Only programmers that are permanent staff can access documents related to the internals of the system.” We have developed an XML-based language for defining credentials and credential types. Finally, we have extended our authorization model to support access control for distributed document modifications. Essentially, the goals are: (i) to allow the security administrator to specify policies concerning which user can make which type of modification on which documents; (ii) to develop a mechanism enforcing such policies in situations where documents flow from a user to another. The mechanism we have developed tries to minimize the interactions with the document server for the purpose of access control. 

Author-X leaves room for much more research work. We are in particular interested in supporting selective and secure accesses not only to documents and data but also to services. We would like to have secure accesses even when clients are disconnected from access control servers and for clients with limited processing and storage capabilities. A second research direction is the development of languages for access control policies taking into account contextual information concerning users, such as the user location or the time of the day. Finally, integration of our access control mechanism with platforms for privacy preferences is also relevant.

UCS-Router – Declarative policy languages for message routing in universal communication systems
Users have today several options among which to choose whenever they need to communicate and/or to exchange data, including multimedia ones, with other users or applications. Devices, such as new generation cellular phones, palm PC, PDA, laptops, have enormously improved the communication process, by increasing both the quantity and quality of data that are exchanged and by providing easy-to-use interfaces. Such a wealth of communication devices has, however, the problem that now users end up having several phone numbers and other electronic addresses at which they can be reached. A user has then to let others know all the various numbers and addresses where he/she can be reached. Things become more complicated when a user can be reached at a certain number, or address, depending on some conditions, such as the time of day, or when a user needs to be selective when letting others know his numbers or addresses. Things are also complicated from the side of the caller. A user wishing to get in touch with another user has to know which number or address to use, possibly depending on some conditions, such as the time of day or the type and contents of communication to be made.  Approaches, which have been recently proposed to address such a problem, are based on the concept of Universal Communication Identifier (UCI) [4]. The UCI is a unique identifier associated with a person independently from the devices he/she has. A user wishing to send a message to a given user, or to call such a user, uses such identifier. The message or call is then automatically routed by the UCI system to the appropriate device number or electronic address. In this way the message sender/caller is free from keeping track of the devices currently belonging to the message/call receiver. Such an approach lets users free to concentrate on the communication contents rather than on details concerning the communication devices. In order to be effective, such an approach must provide a mechanism by which UCI owners can specify policies for routing messages and calls arriving at their UCI. Such policies can depend on a variety of conditions, such as the sensitivity of the message contents, the sender/caller characteristics, the time at which the message/call arrives, the availability/capability of the devices. Moreover, the UCI owners must also be able to specify policies concerning messages/call arriving at a particular device, in order to define a particular behavior for such device. An example of such a policy is “reject messages containing huge images arriving at my mobile phone”. Finally, the UCI owner should be able to require notification messages whenever a message/call arrives to his/her UCI, or a particular device handles a message/call, or a message/call is rejected. 
In the UCS-Router project, we have addressed  the above requirement by developing a declarative Policy Language that supports the specification of message/call routing policies for the UCI owner. The language is based on the active rule paradigm, typical of Active Databases,  and makes it possible for a user to specify his/her own routing policies through a set of policy rules. A policy rule specifies the routing action to be taken whenever a message/call, arriving at the UCI or at one the devices associated with it, verifies a given condition. Possible actions that can be taken include rejecting the message/call, routing the message/call to a device or a set of devices, sending notification messages. Conditions specify filters on the applicability of the rule and can be expressed against the sender properties, the device capabilities and states, the message itself. Because the language is declarative, specifying new routing policies it is very easy. To further enhance extensibility, the language supports the notions of device type, message type, and user credential type, representing respectively the properties associated with device, messages, and users. Such properties are important since they are the basis on which filtering and routing conditions can be specified in our rule language. All those types are organized according to an inheritance hierarchy that can be refined by the introduction of new types, following an object-oriented approach. 
The Policy Language has been implemented into a Policy Engine able to enforce the policies specified by the users subscribing to the UCI services. We refer to such users as Policy Engine Users. Moreover, by the means of translation services that external providers can integrate into the Policy Engine, it is possible to translate a message format whenever a device is not able to handle the message directly. For example, an email can be translated into a speech if the device that should handle it is a phone. Other services can be coupled with the Policy Engine, such as services for checking the current state of a device (e.g. a mobile phone can be available, busy or unreachable), or for establishing the connection with the receiver’s device. Finally to improve usability, the Policy Engine is complemented by two different end-user environments, supporting respectively the system administrator and the policy engine users. The latter environment enables Policy Engine users to enter their preferences concerning message/call routing and filtering by using a form-based interface.
Several open issues are left to investigation. First we would like to extend our approach, based on declarative policy languages, to support information dissemination in mobile data systems. Also, here there is the need of languages supporting on one side user preferences and on the other side allowing one to specify “information routing policies” based on contents, devices used, user location, and other contextual information. Second, we would like to investigate efficient storage strategies for such rule languages. Finally, security is to be addressed.

References.
[1]	NSF Workshop Series on Context-Aware Mobile Database Management. Workshop Introduction Web Page. http://www.sice.umkc.edu/nsfmobile/wshop.html/workshop-intro.html
[2]	E.Bertino, S.Castano, E.Ferrari, “Author-X: a Comprehensive System for Securing XML Documents", IEEE Internet Computing, Vol.5, No.3, pp. 21-31, May/June 2001.
[3]	E.Bertino, M.Cochinwala, M.Mesiti, “UCS-Router : a Policy Engine for Enforcing Message Routine Rules in a Universal Communication System”, Proc. 3rd International Conference on Mobile Data Management (MDM), Singapore, Jan.8-11, 2002 (in print)
[4] 	M.Cochinwala, H.Hauser, and N.Suri. Network Convergence using Universal Numbers: The UPT Project. In Proc. of  VLDB workshop on database on telecommunications. Rome, September , 2001.