Policy-based data-centric access control in a sorted, distributed key-value data store

1. A method operative in association with a sorted, distributed key-value data store, comprising:

as data is ingested into the data store at an ingest time, tagging one or more key-value pairs in the data with a data-centric label as determined by an ingest-time policy to generate tagged data, the data-centric label representing a function adapted to be evaluated over a set of variables;

storing the tagged data in the data store;

at query time, the query time being distinct from the ingest time, and in response to receipt of a query from a querier, performing the following sub-steps:

processing the query according to a query-time policy to identify a set of one or more data-centric attributes the query is allowed to use, wherein the processing evaluates values of one or more user-centric attributes associated with the querier against at least one policy rule in the query-time policy to identify the set of one or more data-centric attributes;

modifying the query to include the set of one or more data-centric attributes so identified, the one or more data-centric attributes being distinct from the data-centric label;

forwarding to the data store the query that has been modified to include the set of one more identified data-centric attributes;

receiving a response to the query that has been modified to include the set of one more identified data-centric attributes, wherein the response is generated in the data store upon evaluating the set of one or more data-centric attributes in the query with at least one data-centric label in the data store, the data-centric label in the data store having been associated with the data during the tagging at ingest time; and

returning the response to the querier;

wherein at least one of the steps is carried out in software executing in a hardware processor.

2. The method as described in claim 1 wherein the values of the one or more user-centric attributes are retrieved from one or more user-attribute data sources as defined in the policy rule.

3. The method as described in claim 1 wherein the ingest-time policy and the query-time policy are derived from an information security policy.

4. The method as described in claim 1 wherein the data-centric label in the tagged data comprises at least one immutable data element.

5. The method as described in claim 1 wherein the data-centric control is a visibility label.

6. The method as described in claim 5 wherein the visibility label encodes a Boolean expression of one or more data-centric attributes.

7. The method as described in claim 1 wherein the data store is a NoSQL database.

8. The method as described in claim 7 wherein the NoSQL database is Accumulo.

9. The method as described in claim 1 further including propagating the data-centric label throughout a data hierarchy.

10. The method as described in claim 1 wherein the data comprises one of: structured data, semi-structured data, unstructured data, and combinations thereof.

11. The method as described in claim 1 wherein the query includes a set of data-centric attributes asserted by the querier, or an indication requesting all entitled data-centric attributes.

12. An apparatus operating in association with a sorted, distributed key-value data, comprising:

at least one processor;

computer memory holding computer program instructions executed by the at least one processor to provide policy-based access control, the computer program instructions comprising:

program code operative as data is ingested into the data store at an ingest time to tag one or more key-value pairs in the data with a data-centric label as determined by an ingest-time policy to generate tagged data, the data-centric label representing a function adapted to be evaluated over a set of variables;

program code operative to store the tagged data in the data store; and

program code operative at a query time, the query time being distinct from the ingest time, and in response to receipt of a query from a querier:

to process the query according to a query-time policy to identify a set of one or more data-centric labels the query is allowed to use, wherein the processing evaluates values of one or more user-centric attributes associated with the querier against at least one policy rule in the query-time policy to identify the set of one or more data-centric attributes;

to modify the query to include the set of one or more data-centric attributes so identified, the one or more data-centric attributes being distinct from the data-centric label;

to forward to the data store the query that has been modified to include the set of one more identified data-centric attributes;

to receive a response to the query that has been modified to include the set of one more identified data-centric attributes, wherein the response is generated in the data store upon evaluating the set of one or more data-centric attributes in the query with at least one data-centric label in the data store, the data-centric label in the data store having been associated with the data during the tagging at ingest time; and

to return the response to the querier.

13. The apparatus as described in claim 12 wherein the values of the one or more user-centric attributes are retrieved from one or more user-attribute data sources as defined in the policy rule.

14. The apparatus as described in claim 12 wherein the query includes a set of data-centric attributes asserted by the querier, or an indication requesting all entitled data-centric attributes.

15. The apparatus as described in claim 14 , wherein the computer program instructions further include program code operative to parse the set of data-centric attributes asserted by the querier to remove any data-centric attribute that does not satisfy the policy rule.

16. The apparatus as described in claim 14 , wherein the computer program instructions further include program code operative to reject the query if any data-centric attribute asserted by the querier does not satisfy the policy rule.

17. A computer program product in a non-transitory computer-readable medium to provide policy-based access control in association with a sorted, distributed key-value data store providing policy-based access control, the computer program product including computer program instruction comprising:

program code operative as data is ingested into the data store at an ingest time to tag one or more key-value pairs in the data with a data-centric label as determined by an ingest-time policy to generate tagged data, the data-centric label representing a function adapted to be evaluated over a set of variables;

program code operative to store the tagged data in the data store; and

program code operative at a query time, the query time being distinct from the ingest time, and in response to receipt of a query from a querier:

to process the query according to a query-time policy to identify a set of one or more data-centric attributes the query is allowed to use, wherein the processing evaluates values of one or more user-centric attributes associated with the querier against at least one policy rule in the query-time policy to identify the set of one or more data-centric attributes;

to modify the query to include the set of one or more data-centric attributes so identified, the one or more data-centric attributes being distinct from the data-centric label;

to forward to the data store the query that has been modified to include the set of one more identified data-centric attributes;

to receive a response to the query that has been modified to include the set of one more identified data-centric attributes, wherein the response is generated in the data store upon evaluating the set of one or more data-centric attributes in the query with at least one data-centric label in the data store, the data-centric label in the data store having been associated with the data during the tagging at ingest time; and

to return the response to the querier.

18. The computer program product as described in claim 17 wherein the data store is Accumulo.

19. The computer program product as described in claim 17 wherein the values of the one or more user-centric attributes are retrieved from one or more user-attribute data sources as defined in the policy rule.

20. The computer program product as described in claim 17 wherein the policy rule is derived from an information security policy.