Correctness-preserving security for graph databases
Techniques are disclosed to provide correctness-preserving security for graph databases. In various embodiments, security context data associated with a user with respect to a graph database is stored. A query associated with the user with respect to the graph database is received. A path is allowed to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path.
1. A system, comprising:
a memory configured to store security context data associated with a user with respect to a graph database; and
a processor coupled to the memory and configured to:
receive a query associated with the user with respect to the graph database; and
allow a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path, wherein the traversal right allows the path to be traversed regardless of whether the user has access rights to read said one or more of a node and a relationship included in the path.
2. The system of claim 1 , wherein the processor is configured to allow the path to be traversed at least in part by discovering a node associated with the query, discovering a relationship associated with the node, and determining based at least in part on the security context data that the user has the right to traverse the relationship.
3. The system of claim 2 , wherein the node comprises a first node, the path includes the first node, the relationship, and a second node, and the processor is configured to allow the path to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the relationship and the second node.
4. The system of claim 1 , wherein the path has an arbitrary depth comprising one or more relationships and one or more nodes and the processor is configured to allow the path to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the one or more relationships and one or more nodes comprising the path.
5. The system of claim 4 , wherein the path comprises a first path connecting a first node comprising a beginning node of the first path and a second node comprising an end node of the first path; and wherein the processor is configured to allow the first path to be traversed, based at least in part on the traversal right, even in the event that the user does not have the right to traverse a second path between the first node and the second node.
6. The system of claim 4 , wherein the processor is configured to allow the path to be traversed, based at least in part on the traversal right, even in the event that the user does not have read access to an intermediate node included in said one or more nodes.
7. The system of claim 4 , wherein the processor is configured to allow the path to be traversed, based at least in part on the traversal right, even in the event that the user does not have read access to a relationship included in said one or more relationships.
8. The system of claim 1 , wherein the processor is configured to allow read access to data associated with one or more of a node and a relationship comprising the path only to an extent of a read access right included in the security context data.
9. The system of claim 1 , wherein the path comprises a first path and the processor is further configured to prevent a second path to be traversed in connection with the query based at least in part on a denial of the traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the second path.
10. The system of claim 1 , wherein the processor is further configured to deny access to data associated with both a first attribute associated with an access grant included in the security context data and a second attribute associated with a denial of access included in the security context data.
11. The system of claim 1 , wherein the grant of the traversal right is associated with a node label.
12. The system of claim 1 , wherein the grant of the traversal right is associated with a relationship type.
13. The system of claim 1 , wherein the traversal right does not include read access to data associated with the path.
14. A method, comprising:
storing security context data associated with a user with respect to a graph database;
receiving a query associated with the user with respect to the graph database; and
allowing a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path, wherein the traversal right allows the path to be traversed regardless of whether the user has access rights to read said one or more of a node and a relationship included in the path.
15. The method of claim 14 , wherein allowing the path to be traversed includes discovering a node associated with the query, discovering a relationship associated with the node, and determining based at least in part on the security context data that the user has the right to traverse the relationship.
16. The method of claim 15 , wherein the node comprises a first node, the path includes the first node, the relationship, and a second node, and the path is allowed to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the relationship and the second node.
17. The method of claim 14 , wherein the path has an arbitrary depth comprising one or more relationships and one or more nodes and the path is allowed to be traversed at least in part by determining based at least in part on the security context data that the user has the right to traverse the one or more relationships and one or more nodes comprising the path.
18. The method of claim 17 , wherein the path comprises a first path connecting a first node comprising a beginning node of the first path and a second node comprising an end node of the first path; and wherein the first path is allowed to be traversed, based at least in part on the traversal right, even in the event that the user does not have the right to traverse a second path between the first node and the second node.
19. A computer program product embodied in a non-transitory computer readable medium, comprising computer instructions for:
storing security context data associated with a user with respect to a graph database;
receiving a query associated with the user with respect to the graph database; and
allowing a path to be traversed in connection with responding to the query based at least in part on a grant of a traversal right, reflected in the security context data, to traverse one or more of a node and a relationship included in the path, wherein the traversal right allows the path to be traversed regardless of whether the user has access rights to read said one or more of a node and a relationship included in the path.
20. The computer program product of claim 19 , wherein allowing the path to be traversed includes discovering a node associated with the query, discovering a relationship associated with the node, and determining based at least in part on the security context data that the user has the right to traverse the relationship.