Policy enforcement in a virtual database system
A method for transacting data with a data repository via a virtual database system includes receiving a query comprising user metadata and a request for transacting data with one or more data repositories and parsing the query to create a command graph comprising one or more nodes and node-associated metadata, wherein each of the one or more nodes represents a command action for processing or transacting the data, and the node-associated metadata describes a behavior of the command action. Further, the method includes retrieving one or more policy rules based on the user metadata, applying security policies to the one or more nodes by updating the node-associated metadata, updating the command graph based on the updating of the node-associated metadata, and executing each of the command actions corresponding to the one or more nodes of the updated command graph.
1 . A method for transacting data with a data repository via a virtual database system, the method comprising:
receiving a query comprising user metadata and a request for transacting data with one or more data repositories;
parsing the query to create a command graph comprising one or more nodes and node-associated metadata, wherein each of the one or more nodes represents a command action for processing or transacting the data, and the node-associated metadata describes a behavior of the command action;
retrieving one or more policy rules based on the user metadata;
applying security policies to the one or more nodes by updating the node-associated metadata;
wherein the security policies are reduced to a canonical form representing a union of access allowances and prohibitions; wherein the one or more policy rules include one or more policy conflict resolution rules based on the user metadata; wherein applying the security policies comprises the prohibitions taking precedence when the one or more policy rules conflict;
updating the command graph based on the updating of the node-associated metadata; and
executing each command action corresponding to the one or more nodes of the updated command graph.
2 . The method of claim 1 , wherein the request for transacting data comprises one or more XSQL commands.
3 . The method of claim 1 , wherein the request for performing a data transaction includes at least one of a request for uploading the data to the one or more data repositories or a request for downloading the data from the data repository.
4 . The method of claim 1 , wherein the request for performing a data transaction includes at least one of a request to select the data for download from the data repository, insert the data into the data repository, update the data in the data repository, or delete the data in the data repository.
5 . The method of claim 1 , wherein the node-associated metadata describes one or more permissions for performing actions associated with the transacting of the data.
6 . The method of claim 1 , wherein the user metadata includes one or more of roles, groups, or hierarchies for one or more users, and wherein the one or more policy rules determine permissions for performing actions when transacting the data for the one or more users grouped by the one or more of roles, groups, or hierarchies.
7 . The method of claim 1 , wherein the one or more policy rules include at least one of a row-level access control, a column-level access control, a predicate-based access control, a role-based access control, a group-based access control, a hierarchy-based access control, or a dynamic access control.
8 . The method of claim 1 , further comprising performing an authentication of a user with the virtual database system, wherein the virtual database system comprises an application programming interface for accessing a plurality of different data repositories.
9 . The method of claim 1 , further comprising optimizing the updated command graph by reordering the one or more nodes, joining the one or more nodes, or modifying the one or more nodes, wherein the optimizing improves an efficiency of the command actions corresponding to the one or more nodes of the updated command graph without altering a result of the command actions.
10 . The method of claim 9 , wherein the optimizing further includes obtaining one or more predicate-based access control policies and modifying one or more of the command actions corresponding to the one or more nodes of the updated command graph to incorporate the one or more predicate-based access control policies.
11 . The method of claim 9 , wherein the optimizing includes processing the updated command graph multiple times until a specified optimization criteria are met.
12 . The method of claim 1 , wherein the command action for processing or transacting the data comprises one or more XSQL commands, and the method further comprising: updating the one or more XSQL commands based on a data repository associated with the request for transacting data with the one or more data repositories, by at least one of replacing a generic function with a corresponding function specific to the data repository or replacing an abstract table name with a corresponding table name of the data repository.
13 . The method of claim 1 , further comprising updating the one or more policy rules, wherein updating the one or more policy rules includes at least one of:
creating an allowance policy rule associated with access to a particular data resource for one or more users;
creating a denial policy rule associated with access to a particular data resource for one or more users; or
assigning one or more policy rules to one or more users.
14 . The method of claim 1 , wherein the security policies comprise at least one of allowing an access to data within the one or more data repositories or denying access to data within the one or more data repositories.
15 . The method of claim 1 , wherein the security policies comprise predicate-based access control, the predicate-based access control is configured to allow access to data within the one or more data repositories based on a positive evaluation of a specific condition.
16 . The method of claim 15 , wherein the specific condition is configured to allow access to a first set of data within the one or more data repositories, the first set of data having an associated first set of parameters, while denying access to a second set of data within the one or more data repositories, the second set of data having an associated second set of parameters, wherein the first set of parameters is different from the second set of parameters.
17 . The method of claim 1 , further comprising using a second union of statically and dynamically defined users to apply policies to the command graph for a specific user at the moment a command is submitted.
18 . The method of claim 1 , further comprising identifying policies for a group of users within a namespace of policy sets and enforcing the policies by dynamically placing policy nodes into the command graph.
19 . One or more computer-readable non-transitory storage media storing computer readable programming instructions configured to be executed by one or more processors to perform a method comprising:
receiving a query comprising user metadata and a request for transacting data with one or more data repositories;
parsing the query into a command graph comprising one or more nodes and node-associated metadata, wherein each of the one or more nodes represents a command action for processing or transacting the data, and the node-associated metadata describes a behavior of the command action;
retrieving one or more policy rules based on the user metadata;
applying security policies to the one or more nodes by updating the node-associated metadata;
wherein the security policies are reduced to a canonical form representing a union of access allowances and prohibitions; wherein the one or more policy rules include one or more policy conflict resolution rules based on the user metadata; wherein applying the security policies comprises the prohibitions taking precedence when the one or more policy rules conflict;
updating the command graph based on the updating of the node-associated metadata; and
executing each of the command actions corresponding to the one or more nodes of the updated command graph.