Correctness-preserving security for graph databases

1. A system, comprising:

a memory configured to store security context data associated with a user with respect to a graph database; and

a processor coupled to the memory and configured to:

receive a query associated with the user with respect to the graph database; and

allow a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path, wherein the path has an arbitrary depth comprising one or more relationships and one or more nodes and the processor is configured to allow the path to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the one or more relationships and one or more nodes comprising the path.

2. The system of claim 1 , wherein the processor is configured to allow the path to be traversed at least in part by discovering a node associated with the query, discovering a relationship associated with the node, and determining based at least in part on the security context data that the user has the right to traverse the relationship.

3. The system of claim 2 , wherein the node comprises a first node, the path includes the first node, the relationship, and a second node, and the processor is configured to allow the path to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the relationship and the second node.

4. The system of claim 1 , wherein the path comprises a first path connecting a first node comprising a beginning node of the first path and a second node comprising an end node of the first path; and wherein the processor is configured to allow the first path to be traversed, based at least in part on the traversal right, even in the event that the user does not have the right to traverse a second path between the first node and the second node.

5. The system of claim 1 , wherein the processor is configured to allow the path to be traversed, based at least in part on the traversal right, even in the event that the user does not have read access to an intermediate node included in said one or more nodes.

6. The system of claim 1 , wherein the processor is configured to allow the path to be traversed, based at least in part on the traversal right, even in the event that the user does not have read access to a relationship included in said one or more relationships.

7. The system of claim 1 , wherein the processor is configured to allow read access to data associated with one or more of a node and a relationship comprising the path only to an extent of a read access right included in the security context data.

8. The system of claim 1 , wherein the path comprises a first path and the processor is further configured to prevent a second path to be traversed in connection with the query based at least in part on a denial of the traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the second path.

9. The system of claim 1 , wherein the grant of the traversal right is associated with a node label.

10. The system of claim 1 , wherein the grant of the traversal right is associated with a relationship type.

11. A system comprising:

a memory configured to store security context data associated with a user with respect to a graph database; and

a processor coupled to the memory and configured to:

receive a query associated with the user with respect to the graph database;

allow a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path; and

deny access to data associated with both a first attribute associated with an access grant included in the security context data and a second attribute associated with a denial of access included in the security context data.

12. A system comprising:

a memory configured to store security context data associated with a user with respect to a graph database; and

a processor coupled to the memory and configured to:

receive a query associated with the user with respect to the graph database; and

allow a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path, wherein the traversal right does not include read access to data associated with the path.

13. A method, comprising:

storing security context data associated with a user with respect to a graph database;

receiving a query associated with the user with respect to the graph database; and

allowing a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path, wherein the path has an arbitrary depth comprising one or more relationships and one or more nodes and allowing the path to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the one or more relationships and one or more nodes comprising the path.

14. The method of claim 13 , wherein allowing the path to be traversed includes discovering a node associated with the query, discovering a relationship associated with the node, and determining based at least in part on the security context data that the user has the right to traverse the relationship.

15. The method of claim 14 , wherein the node comprises a first node, the path includes the first node, the relationship, and a second node, and the path is allowed to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the relationship and the second node.

16. The method of claim 13 , wherein the path comprises a first path connecting a first node comprising a beginning node of the first path and a second node comprising an end node of the first path; and wherein the first path is allowed to be traversed, based at least in part on the traversal right, even in the event that the user does not have the right to traverse a second path between the first node and the second node.

17. The method of claim 13 , further comprising at least one of:

allowing read access to data associated with one or more of a node and a relationship comprising the path only to an extent of a read access right included in the security context data; and

denying access to data associated with both a first attribute associated with an access grant included in the security context data and a second attribute associated with a denial of access included in the security context data.

18. The method of claim 13 , wherein the traversal right does not include read access to data associated with the path.

19. A computer program product embodied in a non-transitory computer readable medium, comprising computer instructions for:

storing security context data associated with a user with respect to a graph database;

receiving a query associated with the user with respect to the graph database; and

allowing a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path, wherein the path has an arbitrary depth comprising one or more relationships and one or more nodes and allowing the path to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the one or more relationships and one or more nodes comprising the path.

20. The computer program product of claim 19 , wherein allowing the path to be traversed includes discovering a node associated with the query, discovering a relationship associated with the node, and determining based at least in part on the security context data that the user has the right to traverse the relationship.

21. The computer program product of claim 19 , wherein at least one of:

the traversal right does not include read access to data associated with the path; and

the computer program product includes computer instructions for at least one of:

allow read access to data associated with one or more of a node and a relationship comprising the path only to an extent of a read access right included in the security context data; and denying access to data associated with both a first attribute associated with an access grant included in the security context data and a second attribute associated with a denial of access included in the security context data.