Policy-based data-centric access control in a sorted, distributed key-value data store
View Patent ↗A method, apparatus and computer program product for policy-based access control in association with a sorted, distributed key-value data store in which keys comprise n-tuple structure that includes a cell-level access control. In this approach, an information security policy is used to create a set of pluggable policies. A pluggable policy may be used during data ingest time, when data is being ingested into the data store, and a pluggable policy may be used during query time, when a query to the data store is received for processing against data stored therein. Generally, a pluggable policy associates one or more user-centric attributes (or some function thereof), to a particular data-centric label. By using pluggable policies, preferably at both ingest time and query time, the data store is enhanced to provide a seamless and secure policy-based access control mechanism in association with the cell-level access control enabled by the data store.
1. A method executable on one or more computing machines and operative in association with a sorted, distributed key-value data store, comprising:
processing an enterprise information security policy to generate an ingest-time policy, and a query-time policy, at least one of the ingest-time policy and the query-time policy being pluggable, wherein according to the query-time policy at least one policy rule is applied to one or more user-centric attributes associated with a user-centric realm to generate at least one data-centric attribute associated with a data-centric realm;
as data is ingested into the data store at an ingest time, tagging one or more key-value pairs in the data with a data-centric label as determined by the ingest-time policy to generate tagged data, the data-centric label representing a function evaluated over a set of variables;
storing the tagged data in the data store;
at query time, the query time being distinct from and occurring after the ingest time, and in response to receipt of a query from a querier, modifying the query according to at least the query-time policy to include the at least one data-centric attribute, the data-centric attribute being distinct from the data-centric label; and
processing the query that has been modified to include the at least one data-centric attribute by forwarding to the data store the query that has been modified, receiving a response, and returning a response to the querier;
wherein the processing is executable by a hardware processor.
2. The method as described in claim 1 wherein the response is generated in the data store upon evaluating the at least one data-centric attribute in the query that has been modified with at least one data-centric label in the data store, the data-centric label in the data store having been associated with the data during the tagging at ingest time.
3. The method as described in claim 1 wherein the at least one data-centric attribute is determined by evaluating values of one or more user-centric attributes associated with the querier against at least one policy rule in the query-time policy.
4. The method as described in claim 3 wherein the values of the one or more user-centric attributes are retrieved from one or more user-attribute data sources as defined in a policy rule of the enterprise information security policy.
5. The method as described in claim 1 wherein the data-centric label in the tagged data comprises at least one immutable data element.
6. The method as described in claim 1 wherein the data-centric label is a visibility label.
7. The method as described in claim 6 wherein the visibility label encodes a Boolean expression of one or more data-centric labels.
8. The method as described in claim 1 wherein the data store is a NoSQL database.
9. The method as described in claim 1 wherein the data comprises one of: structured data, semi-structured data, unstructured data, and combinations thereof.