Authorization views and conditional query containment

Abstract

A recent proposal for database access control consists of defining "authorization views" that specify the accessible data, and declaring a query valid if it can be completely rewritten using the views. Unlike traditional work in query rewriting using views, the rewritten query needs to be equivalent to the original query only over the set of database states that agree with a given set of materializations for the authorization views. With this motivation, we study conditional query containment, i.e., containment over states that agree on a set of materialized views. We give an algorithm to test conditional containment of conjunctive queries with respect to a set of materialized conjunctive views. We show the problem is -complete. Based on the algorithm, we give a test for a query to be conditionally authorized given a set of materialized authorization views. © 2005 Springer-Verlag.