QFilter: fine-grained run-time XML access control via NFA-based query rewriting