An Approach to Authorization Modeling in Object-Oriented Database Systems
Authorization is an important functionality that every data management system should provide. An authorization mechanism allows different access rights on data items to be selectively assigned to users. Authorization models and mechanisms have been widely investigated in the framework of traditional database systems. The extension of those models and mechanisms to advanced data management systems is quite complex, because those systems are characterized by data models with a larger number of semantic constructs than traditional models, like the relational one. A first authorization model defined for object-oriented (and semantic) database systems has been presented in . In this paper we present an authorization model that substantially extends and revises that model. The most significant extension concerns the support for content-dependent authorization, which was not provided in . Content-dependent authorization is very important in providing an authorization mechanism able to directly support authorization policies of application environments. Moreover, it is a crucial functionality in environments where data objects frequently change their status. In addition, the model presented here differs from the model defined in [20] in that new authorization types are introduced and a finer control of versions is provided. Finally, authorization administration of objects is considered.

title: Index Configurations in Object-Oriented Databases

title: Mark-and-Sweep Garbage Collection in Multilevel Secure Object-Oriented Database Systems
abstract: In this paper, the introduction of garbage collection techniques in a multilevel secure object-oriented database system is discussed; in particular, the attention is focused on mark-and-sweep collectors. A secure garbage collection scheme guarantees referential integrity and avoids potential covert channels arising from object deletion.

title: Object-oriented database management systems: concepts and issues
abstract: Requirements imposed on both the object data model and object management by the support of complex objects are outlined. The basic concepts of an object-oriented data model are discussed. They are objects and object identifiers, aggregation, classes and instantiation mechanisms, metaclasses, and inheritance. Object-oriented models are compared with semantic, relational, and Codasyl models. Object-oriented query languages and query processing are considered. Some operational aspects of data management in object-oriented systems are examined. Schema evolution is discussed.<<ETX>>

title: Transaction optimization in rule databases
abstract: The authors propose an approach to transection optimization in rule databases. It is based on a new technique to express updates in rule languages based on a non-immediate update execution. This technique is used to statically characterize some properties of the rules and transactions. Those properties are used at run-time to detect and remove redundant/complementary updates which are useless, hence increasing the efficiency of transaction execution.<<ETX>>

title: A conceptual annotation approach to indexing in a Web-based information system
abstract: All the specialists have agreed that the possibility of adding to multimedia WWW objects some sort of 'conceptual' annotations describing their information content would greatly contribute to solve the problem of their 'intelligent' indexing and retrieval. We propose to associate with the Web objects not the final conceptual annotation, but a simple natural language (NL) caption, in the form of short texts representing a general, neutral description of their informational content. The NL caption will then be converted into a conceptual annotation in NKRL (Narrative Knowledge Representation Language), making use of an automatic translation system like those we have implemented in the context of recent European projects.

title: GEO-RBAC: a spatially aware RBAC
abstract: Securing access to data in location-based services and mobile applications requires the definition of spatially aware access control systems. Even if some approaches have already been proposed either in the context of geographic database systems or context-aware applications, a comprehensive framework, general and flexible enough to cope with spatial aspects in real mobile applications, is still missing. In this paper, we make one step towards this direction and we present GEO-RBAC, an extension of the RBAC model to deal with spatial and location-based information. In GEO-RBAC, spatial entities are used to model objects, user positions, and geographically bounded roles. Roles are activated based on the position of the user. Besides a physical position, obtained from a given mobile terminal or a cellular phone, users are also assigned a logical and device independent position, representing the feature (the road, the town, the region) in which they are located. To make the model more flexible and re-usable, we also introduce the concept of role schema, specifying the name of the role as well as the type of the role spatial boundary and the granularity of the logical position. We then extend GEO-RBAC to cope with hierarchies, modeling permission, user, and activation inheritance.

title: Systematic control and management of data integrity
abstract: Integrity has long been considered a fundamental requirement for secure computerized systems, and especially today's demand for data integrity is stronger than ever as many organizations are in-creasing their reliance on data and information systems. A number of recently enacted data privacy regulations also require high in-tegrity for personal data. In this paper, we discuss various issues concerning systematic control and management of data integrity with a primary focus on access control. We first examine some previously proposed integrity models and define a set of integrity requirements. We then present an architecture for comprehensive integrity control systems, which has its basis on data validation and metadata management. We also provide an integrity control policy language that we believe is flexible and intuitive.

title: An integrated approach to federated identity and privilege management in open systems
abstract: Online partnerships depend on federations of not only user identities but also of user entitlements across organizational boundaries.