Authorization and access control in IRO-DB

The paper describes authorization and access control in the IRO-DB database system, a system supporting interoperable access between relational and object oriented databases. The security policy developed is a federated administrative discretionary access control policy which supports positive, negative, as well as implied authorization, includes a procedure for conflict resolution within the set of specified authorization rules, and concentrates on role based security.