SEQUOIA: Scalable Policy-Based Access Control for Search Operations in Data-Driven Applications

Abstract

Abstract. Policy-based access control is a technology that achieves separation of concerns through evaluating an externalized policy at each access attempt. While this approach has been well-established for requestresponse applications, it is not supported for database queries of datadriven applications, especially for attribute-based policies. In particular, search operations for such applications involve poor scalability with regard to the data set size for this approach, because they are influenced by dynamic runtime conditions. This paper proposes a scalable application-level middleware solution that performs runtime injection of the appropriate rules into the original search query, so that the result set of the search includes only items to which the subject is entitled. Our evaluation shows that our method scales far better than current state of practice approach that supports policy-based access control.

A systematic literature review of authorization and access control requirements and current state of the art for different database models

“…The established policy language and access control model eXtensible Access Control Markup Language (XACML) [2], for example, supports separation of concerns. In addition, in research prototypes like the ones presented by Bertino et al (2001), Colombo and Ferrari (2017), Kacimi and Benhlima (2017), Bogaerts et al (2017) and Mohamed et al (2022), authorization policy management and enforcement are also independent of the application and the underlying datastore. However, there are still many integrated and platform-dependent approaches.…”

Evaluating the effects of access control policies within NoSQL systems

“…Let us now focus on the key requirements that we have considered in defining an approach to evaluate the impact of access control policies on data handled by NoSQL systems. These requirements have been derived from the literature on access control (e.g., [13,4]), existing enforcement monitors (e.g., Apache Ranger 5 ), and features of NoSQL datastores.…”

“…delField (du, oid); end (4) for oid ∈ π tbp (du) do (5) delField (du, oid); end (6) delField (du, "tbs"); (7) delField (du, "tbp"); (8) return du; end Algorithm 5), field tbs of du collects all the placeholders for which a substitution is required. In the considered scenario, tbs only includes the string 53da, which represents the identifier of a field of du specifying as value an object characterized by the fields Date, From, Cc, To, and Subject.…”

“…(3) else (4) if st=open then dec =permit; else dec =deny; end (5) if dec =deny then push (unauthCGR, cgl1 ); (6) if cgl2 =⊥ then (7) dec =handleSP (dec, dcgl2, ppc, crs, st); (8) if dec =deny then push (unauthCGR, cgl2 ); end (9) return dec end sages, included in the database emailDB, 2) no policy has been specified for messages, and 3) the policies specified for emailDB, evaluated during the mapping phase of projector grant the access. Let us suppose that the system is closed, and the analysis is performed considering denials take precedence as conflict resolution strategy, and most specific overrides as propagation criterion.…”