System and method for policy control in databases
Embodiments of the present disclosure relate to generating a high level security policy for a data repository without knowledge of the access control, entitlement, and other models of the data repository. A set of abstractions that define a security policy language may be generated based on data in a data repository collection. The set of abstractions may define a security policy language, which may be provided to a security administrator who can define a security policy with the security policy language. The security policy may be translated into a common physical language to generate a common physical policy. The processing device may then translate the common physical policy into a set of commands for each of one or more data repositories that the data repository collection is comprised of.
1. A method comprising:
generating a set of abstractions that define a security policy language based on data in a set of data repositories;
receiving a security policy defined using the security policy language;
translating the security policy into a common physical language to generate a common physical policy; and
translating, by a computing device, the common physical policy into a set of commands for each of one or more data repositories that the set of data repositories is comprised of, the set of commands to restrict access to the one or more data repositories by one or more users associated with respective computing devices, and wherein the translation into the set of commands is a one to many translation from the common physical language to the language of each of the one or more data repositories.
2. The method of claim 1 , further comprising:
reverse translating a second set of commands of the set of data repositories into a set of high level statements;
analyzing the set of high level statements; and
generating a description of contents of the data repository based on the analysis of the set of high level statements.
3. The method of claim 1 , wherein generating the set of abstractions comprises:
iteratively, until a grouping threshold has been reached:
assigning a set of tags and labels among the data in the set of data repositories;
grouping the data in the set of data repositories into one or more groups based on the set of tags and labels; and
determining if the grouping threshold has been reached; and
in response to determining that the grouping threshold has been reached, assigning an abstraction to each group to generate the set of abstractions.
4. The method of claim 1 , wherein the security policy comprises one or more sentences, each sentence comprising one or more abstractions of the security policy language, and wherein translating the security policy into the common physical language comprises:
converting each abstraction of the security policy into a common physical abstraction.
5. The method of claim 1 , wherein translating the common physical policy into a set of commands for a data repository comprises translating the common physical policy into a set of commands based on a language of the data repository.
6. The method of claim 5 , wherein each of the one or more data repositories implements a respective set of commands using a corresponding access control layer.
7. The method of claim 6 , further comprising:
determining that an access control layer of a particular data repository cannot execute its respective set of commands;
generating a view in the particular data repository; and
executing the respective set of commands of the particular data repository using the view.
8. A system comprising:
a memory; and
a processing device operatively coupled to the memory, the processing device to:
generate a set of abstractions that define a security policy language based on data in a set of data repositories;
receive a security policy defined using the security policy language;
translate the security policy into a common physical language to generate a common physical policy; and
translate the common physical policy into a set of commands for each of one or more data repositories that the set of data repositories is comprised of, the set of commands to restrict access to the one or more data repositories by one or more users associated with respective computing devices, and wherein the translation into the set of commands is a one to many translation from the common physical language to the language of each of the one or more data repositories.
9. The system of claim 8 , wherein the processing device is further to:
reverse translate a second set of commands of a data repository of the set of data repositories into a set of high level statements;
analyze the set of high level statements; and
generate a description of contents of the data repository based on the analysis of the set of high level statements.
10. The system of claim 8 , wherein to generate the set of abstractions, the processing device is to:
iteratively, until a grouping threshold has been reached:
assign a set of tags and labels among the data in the set of data repositories;
group the data in the set of data repositories into one or more groups based on the set of tags and labels; and
determine if the grouping threshold has been reached; and
in response to determining that the grouping threshold has been reached, assign an abstraction to each group to generate the set of abstractions.
11. The system of claim 8 , wherein the security policy comprises one or more sentences, each sentence comprising one or more abstractions of the security policy language, and wherein to translate the security policy into the common physical language, the processing device is further to:
convert each abstraction of the security policy into a common physical abstraction.
12. The system of claim 8 , wherein to translate the common physical policy into a set of commands for a data repository, the processing device is to translate the common physical policy into a set of commands based on a language of the data repository.
13. The system of claim 12 , wherein each of the one or more data repositories implements a respective set of commands using a corresponding access control layer.
14. The system of claim 13 , wherein the processing device is further to:
determine that an access control layer of a particular data repository cannot execute its respective set of commands;
generate a view in the particular data repository; and
execute the respective set of commands of the particular data repository using the view.
15. A non-transitory computer-readable medium having instructions stored thereon which, when executed by the processing device, cause the processing device to:
generate a set of abstractions that define a security policy language based on data in a set of data repositories;
receive a security policy defined using the security policy language;
translate the security policy into a common physical language to generate a common physical policy; and
translate, by the processing device, the common physical policy into a set of commands for each of one or more data repositories that the set of data repositories is comprised of, the set of commands to restrict access to the one or more data repositories by one or more users associated with respective computing devices, and wherein the translation into the set of commands is a one to many translation from the common physical language to the language of each of the one or more data repositories.
16. The non-transitory computer-readable medium of claim 15 , wherein the processing device is further to:
reverse translate a second set of commands of a data repository of the set of data repositories into a set of high level statements;
analyze the set of high level statements; and
generate a description of contents of the data repository based on the analysis of the set of high level statements.
17. The non-transitory computer-readable medium of claim 15 , wherein to generate the set of abstractions, the processing device is to:
iteratively, until a grouping threshold has been reached:
assign a set of tags and labels among the data in the set of data repositories;
group the data in the set of data repositories into one or more groups based on the set of tags and labels; and
determine if the grouping threshold has been reached; and
in response to determining that the grouping threshold has been reached, assign an abstraction to each group to generate the set of abstractions.
18. The non-transitory computer-readable medium of claim 15 , wherein the security policy comprises one or more sentences, each sentence comprising one or more abstractions of the security policy language, and wherein to translate the security policy into the common physical language, the processing device is further to:
convert each abstraction of the security policy into a common physical abstraction.
19. The non-transitory computer-readable medium of claim 15 , wherein to translate the common physical policy into a set of commands for a data repository, the processing device is to translate the common physical policy into a set of commands based on a language of the data repository.
20. The non-transitory computer-readable medium of claim 19 , wherein each of the one or more data repositories implements a respective set of commands using a corresponding access control layer.