Classifying data and enforcing data access control using a context-based hierarchical policy
One example method includes receiving a request from a user to access data stored in a filesystem, in response to the request, retrieving metadata of the data and metadata of the user, validating the metadata of the data and the metadata of the user against a data access rule, and granting the user access to the data upon successful validation of the metadata of the data and the metadata of the user.
1. A method, comprising:
receiving a request from a user to access data stored in a filesystem;
generating access request metadata based on the request from the user;
in response to the request, retrieving metadata of the data and metadata of the user;
validating the metadata of the data, the metadata of the user, and the access request metadata against a data access rule which is an element of a context-based hierarchical policy, and the data access rule follows the data and is enforced by an entity external to the data, wherever the data is located, and the data access rule is enforced regardless of how the data is requested to be accessed;
granting the user access to the data upon successful validation of the metadata of the data and the metadata of the user; and
when a kernel underlying the filesystem, and operable to perform data access checks in conjunction with a security provider and communicate data access decisions, erroneously generates an indication to the filesystem that access to the data should be granted to the user, overriding the indication and denying access to the data by the user.
2. The method as recited in claim 1 , wherein access to the data by the user is granted or denied based on a combination of user identity and content of the data.
3. The method as recited in claim 1 , wherein other data in a same folder as the data is not accessible to the user.
4. The method as recited in claim 1 , wherein the metadata of the data is updated and stored, automatically, in response to a change to the data.
5. The method as recited in claim 1 , wherein the data access rule is updated automatically in response to a change in the data, and the data access rule is enforceable immediately after it has been updated.
6. The method as recited in claim 1 , wherein the metadata includes annotations that are based on content of the data.
7. The method as recited in claim 1 , wherein the data metadata is generated according to one or more rules.
8. The method as recited in claim 1 , wherein the data access rule is applicable at an individual data object level.
9. The method as recited in claim 1 , wherein the access request comprises a request to read the data or a request to write to the data.
10. A non-transitory computer readable storage medium having stored therein instructions that are executable by one or more hardware processors to perform operations comprising:
receiving a request from a user to access data stored in a filesystem;
generating access request metadata based on the request from the user;
in response to the request, retrieving metadata of the data and metadata of the user;
validating the metadata of the data, the metadata of the user, and the access request metadata against a data access rule which is an element of a context-based hierarchical policy, and the data access rule follows the data and is enforced by an entity external to the data, wherever the data is located, and the data access rule is enforced regardless of how the data is requested to be accessed;
granting the user access to the data upon successful validation of the metadata of the data and the metadata of the user; and
when a kernel underlying the filesystem, and operable to perform data access checks in conjunction with a security provider and communicate data access decisions, erroneously generates an indication to the filesystem that access to the data should be granted to the user, overriding the indication and denying access to the data by the user.
11. The non-transitory computer readable storage medium as recited in claim 10 , wherein access to the data by the user is granted or denied based on a combination of user identity and content of the data.
12. The non-transitory computer readable storage medium as recited in claim 10 , wherein other data in a same folder as the data is not accessible to the user.
13. The non-transitory computer readable storage medium as recited in claim 10 , wherein the metadata of the data is updated and stored, automatically, in response to a change to the data.
14. The non-transitory computer readable storage medium as recited in claim 10 , wherein the data access rule is updated automatically in response to a change in the data, and the data access rule is enforceable immediately after it has been updated.
15. The non-transitory computer readable storage medium as recited in claim 10 , wherein the metadata includes annotations that are based on content of the data.
16. The non-transitory computer readable storage medium as recited in claim 10 , wherein the data metadata is generated according to one or more rules.
17. The non-transitory computer readable storage medium as recited in claim 10 , wherein the data access rule is applicable at an individual data object level.
18. The non-transitory computer readable storage medium as recited in claim 10 , wherein the access request comprises a request to read the data or a request to write to the data.
19. The method as recited in claim 1 , wherein prior to receipt of the request, the data was modified by a user other than the user who requested access to the data.
20. The non-transitory computer readable storage medium as recited in claim 10 , wherein prior to receipt of the request, the data was modified by a user other than the user who requested access to the data.