KR100808143B1 - XML data stream processing system and method for managing the access control using XPath - Google Patents

Abstract

1. TECHNICAL FIELD OF THE INVENTION

The present invention relates to an XML data stream processing system and method having an access control function using Xpass.

2. The technical problem to be solved by the invention

The present invention defines an access control rule when processing XML data using XPath, which is an XML query word, and uses the XPath access control rule to define an entire element of the XML data stream and elements of the stream. An object of the present invention is to provide an XM data stream processing system and method having an access control function using X-pass to easily perform user-specific access control on a value of a specific element of a structure and a stream.

3. Summary of Solution to Invention

According to an aspect of the present invention, there is provided an XML data stream processing system comprising: user management means for registering and deleting a user and providing user information; Schema management means for registering, deleting a schema defining a standard for an XML data stream and providing schema information; Authority management means for granting and withdrawing authority for each schema for each user and providing user authority information in the form of X-pass; And parsing a user query for an XML data stream received from the outside, and verifying whether the query is valid in the structure and type of the schema using the schema information from the schema management means, and Stream query processing means for verifying the accessibility using the user authority information and processing the query as it is a legitimate query and accessible.

4. Important uses of the invention

The present invention is used for XML data stream processing system.

XL Data Stream, Access Control Rules, XPASS, XL Data Stream Processing System

Description

XML data stream processing system and method for managing the access control using XPath}

1 is a block diagram of an embodiment of an XML data stream processing system having an access control function using Xpass according to the present invention;

2 is a detailed configuration diagram of an embodiment of a module-specific operation in an XML data stream processing system according to the present invention;

3 is a diagram illustrating an embodiment of dynamic reflection of an access control rule defined as X-pass in an XML data stream processing system according to the present invention;

4 is a flowchart illustrating an embodiment of a user authorization process using Xpass in an XML data stream processing system according to the present invention;

FIG. 5 is a flowchart illustrating an access control method using X-pass when processing a stream query in an XML data stream processing system according to the present invention.

Explanation of symbols on the main parts of the drawings

101: wireless reader 102: sensor

103: XLM Stream 100: XLM Data Stream Processing System

110: user manager 120: schema manager

130: authority manager 131: access control rule validity verification module

132: access control rule management module

140: Stream Query Processor 141: XQuery Parser

142: validity verification module 143: syntax execution module

The present invention relates to an XML data stream processing system having an access control function using XPath, and more particularly, to an XML data stream processing of access control rules defined using XPath. The present invention relates to an XML data stream processing system and method having an access control function using Xpass for easily managing user-specific access control to an XML data stream.

Recently, with the development of the Internet, sensor networks, and ubiquitous, the use of XML information is expanding. Accordingly, there is an increasing demand for query processing on the XML data stream as well as user query processing on the XML document. In addition, there is a demand for a technology capable of controlling a stream object accessible to each user and application when processing a query for the XML data stream.

The conventional XML data stream processing system uses DTD (Document Type Definition) or XML Schema (XML Schema) for the specification of the input data stream, and the user uses the XM query language for the stream, for example, For example, XQL, XPath, XQuery, etc. are used to receive the desired result from the XML data stream.

However, the XML data stream processing system according to the prior art provides only a query processing technique for the XML data stream, and there is a problem in that it does not provide an access control method for the XML data stream. Here, for example, look at the specific prior art as follows.

As a first prior art, the US Patent Publication "Streaming XML data retrieval using XPath (published number 20050203957, published date 2005.9.15)", the event-based parser As a result of parsing the input XML data stream, the user can search the stream query X-passes registered by the user and generate a matched node to perform the stream processing, thereby improving performance when the XML data stream is processed. Make sure

In other words, the Dom parser used for XML parsing causes problems in memory usage to maintain a tree when processing a large amount of XML streams, and an event-based SAX (Simple API for XML) parser or stacks. (StAX: Streaming API for XML) While the parser causes a problem that the structure information is lost, the first prior art to solve this problem is to process the XML data stream using the XML Extractor (XML Extractor) To improve performance.

However, the first prior art is a technology related to a query processing method for the XML data stream, and there is a problem that access control to the structure of the XML stream and the stream is impossible when the XML data stream is processed.

Also, as a second prior art, the article titled "Specifying Access Control Policies for XML Documents with XPath (Proceedings of the ninth ACM symposium control models and technologies, June 2-4, 2004)", In order to provide access control and validity for XML documents, the management of access control rules of XML documents using XPass for specific schemas and XML documents, and the structure of all XML documents and documents complying with a specific schema By performing the access control on the, there is an effect to enable the access control to the XML document and the document internal structure.

By the way, the second prior art can only control access to the XML document and the document internal structure, and there is a problem in that access control is impossible at the time of query processing of the XML data stream whose data volume is rapidly increasing.

The present invention has been proposed to solve the above problems, and defines an access control rule when processing the XL data using XPath, an XML query word, and uses the defined XPath access control rule. XML data stream processing system having an access control function using Xpass to easily perform user-specific access control on the entire XML data stream, the element structure of the stream, and the value of a specific element of the stream. The purpose is to provide a method.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

According to an aspect of the present invention, there is provided an XML data stream processing system comprising: user management means for registering and deleting a user and providing user information; Schema management means for registering, deleting a schema defining a standard for an XML data stream and providing schema information; Authority management means for granting and withdrawing authority for each schema for each user and providing user authority information in the form of X-pass; And parsing a user query for an XML data stream received from the outside, and verifying whether the query is valid in the structure and type of the schema using the schema information from the schema management means, and Stream query processing means for verifying the accessibility using the user authority information and processing the query as it is a legitimate query and accessible.

On the other hand, the method of the present invention for achieving the above object, In the access control method using X-pass, access control rule definition step of defining an access control rule for user-specific authorization check; A user confirmation step of obtaining user information from the current session; A query input step of receiving a user query from an external source; A parsing step of parsing the received user query to generate an XQuery parse tree; A validity verification step of verifying whether the query is valid for the structure and type of the schema by using the schema information while traversing the generated query pars tree, and verifying the accessibility using the user authority information; And a query processing step of processing the received user query and providing the result to the outside as the validity verification succeeds.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a block diagram illustrating an entire embodiment of an XML data stream processing system having an access control function using Xpass according to the present invention.

As shown in FIG. 1, an XML data stream processing system having an access control function using Xpass according to the present invention is a user manager for providing user information of a current session when controlling access to an XML data stream. 110, a scheme for providing various types of information such as a target stream, a structure of a stream, and a type of a specific element of a stream when defining an access control rule by providing a standard of an externally input stream (that is, an XML data stream). An authority manager 130 for granting each user access to a condition of a specific stream, a structure of a stream, and an element value using the manager 120, the user manager 110, and the schema manager 120. Parse a user query and access the current user query using the access authority information of the authority manager 130. A stream query processor 140 is provided for performing control processing and query processing on the stream and, as a result, providing the stream to the user.

At this time, the XML data stream processing system 100 according to the present invention is X from the various input sources of the XML data stream, such as the RFID reader 101, the sensor 102, the XML stream 103, etc. It operates to build various application services such as merchandise management service, disaster / disaster prevention service, U-office, etc., which use the LS data stream as input data. In this case, each application service may control the permitted stream using different X-pass access rights.

In addition, the user manager 110 registers and deletes a user and provides user information of the current session when processing a stream query.

In addition, the schema manager 120 registers and deletes a schema (XML Schema) that defines a standard for the XML data stream input from the outside, and provides schema information.

In addition, the authority manager 130 grants, revokes, and provides related information to registered users and schemas.

In addition, the stream query processor 140 parses a user query word (Ex Query) for the XML data stream, and performs validity verification and query processing.

Detailed operation of each internal module of the XML data stream processing system 100 will be described later with reference to FIG. 2.

FIG. 2 is a detailed block diagram of an operation of each module in an XML data stream processing system according to the present invention.

As shown in FIG. 2, the stream query processor 140 performs an XQuery parser 141 for processing an XQuery type query, schema validity verification for a target schema structure and type, and user authority validation. A validity verification module 142 for access control processing (eg, adding conditional clause in query syntax) and a syntax execution module 143 for performing query processing (user query processing) on the stream according to the result.

In order to perform the stream query processing using the query, the query query parser 141 of the stream query processor 140 parses a user query received from the outside and obtains the query query tree as a result.

Then, the validity verification module 142 receives the access control rule (that is, the X-pass access control rule) and the schema information from the authority manager 130 and the schema manager 120, respectively, using the presence or absence of the target element, Perform type verification and validity check on access rights. In the validity verification, the access control for the structure query is performed, and the access control rule for the value is added as a conditional clause to the stream query. In addition, access control on the value of a specific element for each user is performed by selectively providing only an accessible result for the value when performing the stream query syntax.

In addition, the authority manager 130 may include an access control rule validity verification module 131 for performing validity verification of the X-pass access control rule, and an access control rule management module 132 for managing the X-pass access control rule. Include. In this case, the authority manager 130 may use the XQuery parser 141 that is an internal component of the stream query processor 140 by using XPath as an access control rule.

In order to grant each user right by using the Xpass, the rights manager 130 receives the Xpass for authorization from the outside and uses the XQuery parser 141 of the stream query processor 140 to receive the Xpass. Obtain the path parse tree. Then, the access control rule validity verification module 131 of the authority manager 130 receives the input and performs validity verification on the existence and type of the target element of the X-pass access control rule. As the validity verification succeeds, the access control rule management module 132 dynamically reflects the successful X-pass access control rule in the existing access control rule. This will be described later with reference to FIG. 3.

FIG. 3 is a diagram illustrating an embodiment of dynamically reflecting an access control rule defined as X-pass in an XML data stream processing system according to the present invention.

Here, the case where the X-pass access control rule is dynamically reflected in the existing access control rule and the privilege elevation and the privilege depreciation will be described together. In this case, the dynamic reflection of the X-pass access control rule is performed by the access control rule management module 132 of the rights manager 130.

As shown in FIG. 3, the authorization scope includes the element itself and all descendant elements. That is, when "G (/ a / b)" is granted to the b element of the target schema, access rights are also granted to the c, d, and e elements which are child elements. At this time, the access control rule becomes "/ a / b" which is an input Xpass.

In addition, granting authority to the last non-privileged element among the elements of a sibling relationship causes an elevation of privilege when the authority is granted. That is, if "G (/ a / f)" is granted to the f element, which is the last unauthorized element, the permission for all neighbors (/ a / b, / a / f) is granted to the parent element ( privilege is elevated to / a) and the access control rule becomes "/ a".

In addition, when the privilege of some of the child elements of the authorized parent element is revoked, access rights are granted to other child elements except the target child element. That is, if "R (/ a / b / e)" is executed, the access control rules of "/ a / b" are lowered, and the access control rules are "/ a / b / c" and "/ a / b /". d ".

On the other hand, the authority to the value is granted as a condition on the value of the target element. In other words, if "G (/ a [f <= 2])" is executed, the access rights for the stream in which the value of element f is less than or equal to 2 are generated, and the access control rule is "/ a [f <= 2] ".

In addition, granting the value of an element having an access right rule on an existing value does not add a new access right rule, but merges the right condition and the OR condition on the existing value. That is, when "G (/ a [f> 5])" is performed, the existing access right rule is merged with the access right rule "/ a [f <= 2 or f> 5]".

In addition, the revocation of authority to a value is performed only for the target condition among the existing conditions. That is, if "R (/ a [f <= 2])" is executed, the target condition "f <= 2" is removed from the condition permission of the target element, and the access right rule is "/ a [f> 5]". Becomes

4 is a flowchart illustrating an embodiment of a user authorization process using Xpass in an XML data stream processing system according to the present invention.

First, the authority manager 130 parses the received Xpass using the XQuery parser 141 of the stream query processor 140 in response to receiving an Xpass for authorization from the outside (401).

Thereafter, the access control rule validity verification module 131 of the authority manager 130 displays the XPASS parse tree generated as a result of the parsing, and the schema information necessary for validity checking, the XQuery parser 141 and the schema manager 120. Received from 402 respectively.

Thereafter, the access control rule validity verification module 131 traverses the received Xpass parse tree and performs validity verification (403).

Looking at the validity verification process in detail, it is determined whether the target node is an element (413).

As a result of the determination of the target node type 413, if the target node is an element, it is determined whether the target element exists (423). If the target node is present, the access control rule management module 132 creates a new X-pass access control rule. The control is dynamically reflected in the access control rule (404), and if there is no error processing (405).

On the other hand, if the target node type determination result 413, if the target node is not an element, it is again determined whether the target node is a value (433). As a result, when it is determined that the value is for a specific element, it is determined whether the type information of the target node is valid (443), and if it is valid (correct) type information, the access control rule management module 132 makes a new Xpass. In step 404, the access control rule is dynamically reflected to the existing access control rule. If the access control rule is not valid type information, the process proceeds to error processing 405. On the other hand, as a result of determining whether the target node is a value 433, if it is not a value for a specific element, the process proceeds to an error process (405).

The access control rule obtained as a result of the above is used for checking authorization by user (that is, controlling access authority by user) in the subsequent stream query processing.

FIG. 5 is a flowchart illustrating an access control method using X-pass when processing a stream query in an XML data stream processing system according to the present invention.

First, the user manager 110 obtains user information from the current session (501). That is, the user information is obtained and transmitted to the stream query processor 140 for access control in the stream query processing. At this time, according to a separate request of the stream query processor 140 (if necessary), the user manager 110 operates by obtaining and returning user information.

Thereafter, the stream query processor 140 parses the user query received from the outside using the query query parser 141 (502). That is, it creates an XQuery parse tree. Then, the schema information required for validity check on the schema structure and type is received from the schema manager 120 (503), and authority information for checking whether or not the stream is accessible to the current user (access control rule). Is received from the rights manager 130 (504).

Thereafter, the stream query processor 140 performs schema validity verification and user authority verification while iterating through the parse query tree generated as the parsing result (505). In other words, it first checks whether the query is valid for the schema structure and type, and then checks whether the stream is accessible to the current user (checks whether the user is authorized). In operation 506, a determination is made as to whether the user query is a valid user query using the result of the validity verification.

Looking at the process in detail, it is determined whether or not the input user query is a valid query for the (element) structure and type of the schema information while iterating through the query query tree.

As a result of the determination, if the query is legitimate, it is determined whether it is accessible using an access control rule (ex-pass) related to the user and the target schema received from the authority manager 130. As a result of the accessibility determination, if the target node is not authorized, error processing is performed. If the target node is authorized, the process proceeds to the next step. At this time, if a privilege condition exists for a value (value of a specific element) that is a target node, the privilege condition is added as a condition clause to the query query tree for the user query.

If the user query validity verification result 506, the user query is legitimate for the schema information and authorization information, the received user query, that is, the query query is executed and the execution result is provided to the user (externally output). (507).

On the other hand, if the user query validity verification result 506, if the user query is not legitimate for the schema information or authority information (if at least one does not succeed in validating) error processing (508).

In the following detailed description, the operation of the XML data stream processing system and its operation result will be described with reference to Tables 1 to 6.

Here, the access control policy in the XML data stream processing system according to the present invention may be as follows. Privilege subjects are users (or roles). Authorization targets include the entire schema, the element structure of the schema, and the range of values contained in specific elements. In addition, the privilege coverage is an XML data stream generated based on the target schema, and authorization for a specific element of the schema is performed on the target element and all descendants of the element. In the following description, the authority for "READ" among the types of authority will be described as an example.

Table 1 is a schema that defines the standard of the stream input to the XML data stream processing system according to the present invention, expressing the contents of the company employee information in the XLM Schema.

Table 2 shows an access control rule for granting user access authority to the employee information schema of Table 1 according to the present invention. Here, the team leader has access to his salary information and salary information of the position in charge, and the position in charge is able to access his salary information.

Table 3 shows the XML data stream input to the XML data stream processing system according to the present invention. The input stream conforms to the schema of Table 1 above, and is employee information of a team leader (Yi Sun-shin) and employee information of a responsible job (Kim Chul-soo).

Table 4 shows an example of a user query (statement) for which the stream for the employee information schema of Table 1 is a query target.

When the user queries Yi Soon Shin and Kim Chul Soo request the same query statement as Table 4 to the XML data stream processing system according to the present invention, the authority information provided by the authority manager 130 during the internal query processing of the system (access control for each user) Rule), but if the authority information includes an access control rule for the value of a specific element as shown in Table 2, the inputted user query is converted and processed according to the authority of the user who requested the query. do. Table 5 shows an example of the query conversion processing described above.

The results that can be provided to each user as a result of the query processing are shown in Table 6. That is, according to the authority granted to each user, the team leader Yi Soon Shin can receive both his salary information and salary information of team members, and Kim Cheol-soo, a team member, can receive only his salary information as a result.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

The present invention as described above, by applying the X-pass of the X query used as a stream query in the XML data stream processing system to use as an access control rule of the XML data stream, to facilitate the authorization of each user X It is effective to define various types of access rules by using the structured processing technique for the XML of the path.

Claims (25)

In the XML data stream processing system, User management means for registering and deleting a user and providing user information; Schema management means for registering, deleting a schema defining a standard for an XML data stream and providing schema information; Authority management means for granting and withdrawing authority for each schema for each user and providing user authority information in the form of X-pass; And After parsing a user query for an externally received XML data stream, verify whether the query is valid for the structure and type of the schema by using the schema information from the schema management means, and the user from the authority management means. Stream query processing means for verifying the accessibility using authority information and processing the query as it is a legitimate query and accessible XM L data stream processing system comprising a. The method of claim 1, The stream query processing means, A parser for parsing a user query received from an external source and generating an query query tree; By using the schema information from the schema management means while traversing the generated query pars tree, it is possible to verify whether or not the query is legitimate in the structure and type of the schema, and can be accessed using the user authority information from the authority management means. Justification means for verifying whether or not; And As the validity verification succeeds, syntax execution means for performing current user query processing XM L data stream processing system comprising a. delete The method of claim 2, The validity verification means, And an access control rule for a value as a conditional clause in the user query to selectively provide an accessible result for the value when performing the query processing. The method of claim 1, The authority management means, Access control rule validity verification means for performing validity verification of the X-pass access control rule; And Access control rule management means for managing the X-pass access control rule XM L data stream processing system comprising a. The method of claim 5, The access control rule validity verification means, According to an Xpass parse tree generated as a result of parsing an Xpass for authorization, a validity check on the existence and type of a target element of an Xpass access control rule is performed. ML data stream processing system. The method of claim 6, The access control rule management means, And as the validity verification by the access control rule validity verification means succeeds, dynamically applying the verified X-pass access control rule to the existing access control rule. The method of claim 7, wherein The access control rule management means, XML data stream processing system characterized in that to dynamically reflect the verified successful X-pass access control rules to the existing access control rules, the authorization scope includes the element itself and all descendant elements. The method of claim 7, wherein The access control rule management means, And granting the privilege to the last non-privileged element of the neighbor relationship, if the authority is granted to all the elements of the neighbor relationship. The method of claim 7, wherein The access control rule management means, XML data stream processing system, characterized in that to grant access rights to other child elements other than the target child element by revoking the rights of some of the child elements of the authorized parent element. The method of claim 7, wherein The access control rule management means, If the authority to the value, the XML data stream processing system, characterized in that the condition for the value of the target element. The method of claim 7, wherein The access control rule management means, In the case of granting a value of an element having an access permission rule for an existing value, the XML data stream processing system of claim 11, wherein merging is performed under an OR condition and an OR condition for the existing value. The method of claim 7, wherein The access control rule management means, When performing the revocation of the authority to the value XML data stream processing system, characterized in that selectively withdraw the target condition among the existing conditions. In the access control method using X-pass, An access control rule definition step of defining an access control rule for checking authority for each user; A user confirmation step of obtaining user information from the current session; A query input step of receiving a user query from an external source; A parsing step of parsing the received user query to generate an XQuery parse tree; A validity verification step of verifying whether the query is valid for the structure and type of the schema by using the schema information while traversing the generated query pars tree, and verifying the accessibility using the user authority information; And As the validity verification is successful, a query processing step of processing the input user query and providing the result to the outside Access control method using the X-pass including a. The method of claim 14, The access control rule definition step, An X-pass input step of receiving an X-pass for authorization from the outside; Parsing the received X-pass to generate an X-pass parse tree; An access control rule validity verification step of performing validity verification using schema information while traversing the generated Xpass parse tree; And As the validity verification succeeds, an access control rule dynamic reflection step of dynamically applying a new access control rule to an existing access control rule Access control method using the Xpass, characterized in that it comprises a. The method of claim 15, The access control rule dynamic reflection step, And the target node is an element, and as the element exists, a new access control rule is dynamically reflected in an existing access control rule. The method of claim 16, The access control rule dynamic reflection step, And dynamically reflecting the new X-pass access control rule into the existing access control rule, but including an authorization range of the element itself and all descendant elements. The method of claim 16, The access control rule dynamic reflection step, And granting authority to all the elements of the neighbor relationship if the authority is granted to all the elements of the neighbor relationship, the privilege escalation is performed. The method of claim 16, The access control rule dynamic reflection step, The access control method using the X-pass, characterized in that to grant the access rights to the other child elements, except the target child element in accordance with the revocation of the rights of some of the child elements of the authorized parent element. The method of claim 15, The access control rule dynamic reflection step, When the target node is a value and the type information of the target node is valid, a new access control rule is dynamically reflected to the existing access control rule. The method of claim 20, The access control rule dynamic reflection step, The access control method using the X-pass, characterized in that given as a condition for the value of the target element in accordance with the authority to the value. The method of claim 20, The access control rule dynamic reflection step, If the authorization of the value of the element having an access permission rule for the existing value, the access control method using the X-pass, characterized in that to merge the authority condition and the OR (OR) condition for the existing value. The method of claim 20, The access control rule dynamic reflection step, When the revocation of the authority for the value is performed, the access control method using Xpass, characterized in that selectively withdraw the target condition among the existing conditions. delete The method of claim 14, The validity verification step, And adding an access control rule for a value as a conditional clause to the user query to selectively provide an accessible result for the value when performing a query processing.

Images