An approach to model and query event-based temporal data
Temporal database systems support all functions related to the management of large amounts of constantly changing data. However, current temporal database systems support a flat view of the history of data changes, in that all the changes are considered equally relevant and are, therefore, all stored in the database. However, many applications, such as monitoring and planning applications, call for more flexibility. Monitoring applications, in particular, may require that the history of a data item is stored only whenever a certain event occurs. For other applications, the history of data changes may be less important than the event causing the changes. In this paper, we propose an event-based temporal object model which allows us to keep track of selected values within the history of a data object attribute. The portions within the history of a data object which are actually stored in the database are identified by relating them to events. In the paper, besides defining the data model, we investigate the problem of querying a database with incomplete temporal information.

title: An Approach to Authorization Modeling in Object-Oriented Database Systems
abstract: Authorization is an important functionality that every data management system should provide. An authorization mechanism allows different access rights on data items to be selectively assigned to users. Authorization models and mechanisms have been widely investigated in the framework of traditional database systems. The extension of those models and mechanisms to advanced data management systems is quite complex, because those systems are characterized by data models with a larger number of semantic constructs than traditional models, like the relational one. A first authorization model defined for object-oriented (and semantic) database systems has been presented in . In this paper we present an authorization model that substantially extends and revises that model. The most significant extension concerns the support for content-dependent authorization, which was not provided in . Content-dependent authorization is very important in providing an authorization mechanism able to directly support authorization policies of application environments. Moreover, it is a crucial functionality in environments where data objects frequently change their status. In addition, the model presented here differs from the model defined in [20] in that new authorization types are introduced and a finer control of versions is provided. Finally, authorization administration of objects is considered.

title: Index Configurations in Object-Oriented Databases

title: The specification and enforcement of authorization constraints in workflow management systems
abstract: In recent years, workflow management systems (WFMSs) have gained popularity in both research and commercial sectors. WFMSs are used to coordinate and streamline business processes. Very large WFMSs are often used in organizations with users in the range of several thousands and process instances in the range of tens and thousands. To simplify the complexity of security administration, it is common practice in many businesses to allocate a role for each activity in the process and then assign one or more users to each role—granting an authorization to roles rather than to users. Typically, security policies are expressed as constraints (or rules) on users and roles; separation of duties is a well-known constraint. Unfortunately, current role-based access control models are not adequate to model such constraints. To address this issue we (1) present a language to express both static and dynamic authorization constraints as clauses in a logic program; (2) provide formal notions of constraint consistency; and (3) propose algorithms to check the consistency of constraints and assign users and roles to tasks that constitute the workflow in such a way that no constraints are violated.

title: An Extended Algebra for Constraint Databases
abstract: Constraint relational databases use constraints to both model and query data. A constraint relation contains a finite set of generalized tuples. Each generalized tuple is represented by a conjunction of constraints on a given logical theory and, depending on the logical theory and the specific conjunction of constraints, it may possibly represent an infinite set of relational tuples. For their characteristics, constraint databases are well suited to model multidimensional and structured data, like spatial and temporal data. The definition of an algebra for constraint relational databases is important in order to make constraint databases a practical technology. We extend the previously defined constraint algebra (called generalized relational algebra). First, we show that the relational model is not the only possible semantic reference model for constraint relational databases and we show how constraint relations can be interpreted under the nested relational model. Then, we introduce two distinct classes of constraint algebras, one based on the relational algebra, and one based on the nested relational algebra, and we present an algebra of the latter type. The algebra is proved equivalent to the generalized relational algebra when input relations are modified by introducing generalized tuple identifiers. However, from a user point of view, it is more suitable. Thus, the difference existing between such algebras is similar to the difference existing between the relational algebra and the nested relational algebra, dealing with only one level of nesting. We also show how external functions can be added to the proposed algebra.

title: Extending the ODMG Object Model with Time
abstract: Although many temporal extensions of the relational data model have been proposed, there is no comparable amount of work in the context of object-oriented data models. Moreover, extensions to the relational model have been proposed in the framework of SQL standards, whereas no attempts have been made to extend the standard for objectoriented databases, defined by ODMG. This paper presents T_ODMG, a temporal extension of the ODMG-93 standard data model. The main contributions of this work are, thus, the formalization of the ODMG standard data model and its extension with time. Another contribution of this work is the investigation, on a formal basis, of the main issues arising from the introduction of time in an object-oriented model.

title: An integrated approach to federated identity and privilege management in open systems
abstract: Online partnerships depend on federations of not only user identities but also of user entitlements across organizational boundaries.

title: Systematic control and management of data integrity
abstract: Integrity has long been considered a fundamental requirement for secure computerized systems, and especially today's demand for data integrity is stronger than ever as many organizations are in-creasing their reliance on data and information systems. A number of recently enacted data privacy regulations also require high in-tegrity for personal data. In this paper, we discuss various issues concerning systematic control and management of data integrity with a primary focus on access control. We first examine some previously proposed integrity models and define a set of integrity requirements. We then present an architecture for comprehensive integrity control systems, which has its basis on data validation and metadata management. We also provide an integrity control policy language that we believe is flexible and intuitive.

title: GEO-RBAC: a spatially aware RBAC
abstract: Securing access to data in location-based services and mobile applications requires the definition of spatially aware access control systems. Even if some approaches have already been proposed either in the context of geographic database systems or context-aware applications, a comprehensive framework, general and flexible enough to cope with spatial aspects in real mobile applications, is still missing. In this paper, we make one step towards this direction and we present GEO-RBAC, an extension of the RBAC model to deal with spatial and location-based information. In GEO-RBAC, spatial entities are used to model objects, user positions, and geographically bounded roles. Roles are activated based on the position of the user. Besides a physical position, obtained from a given mobile terminal or a cellular phone, users are also assigned a logical and device independent position, representing the feature (the road, the town, the region) in which they are located. To make the model more flexible and re-usable, we also introduce the concept of role schema, specifying the name of the role as well as the type of the role spatial boundary and the granularity of the logical position. We then extend GEO-RBAC to cope with hierarchies, modeling permission, user, and activation inheritance.

title: Privacy preserving schema and data matching
abstract: In many business scenarios, record matching is performed across different data sources with the aim of identifying common information shared among these sources. However such need is often in contrast with privacy requirements concerning the data stored by the sources. In this paper, we propose a protocol for record matching that preserves privacy both at the data level and at the schema level. Specifically, if two sources need to identify their common data, by running the protocol they can compute the matching of their datasets without sharing their data in clear and only sharing the result of the matching. The protocol uses a third party, and maps records into a vector space in order to preserve their privacy. Experimental results show the efficiency of the matching protocol in terms of precision and recall as well as the good computational performance.