Fine-grained database access-control policy enforcement using reverse queries

Abstract

A method of providing access control to a database accessible from a user interface is implemented at a policy enforcement point, which is located between the database and the user interface and includes the steps of: (i) intercepting a database query; (ii) assigning attribute values on the basis of a target table or target column in the query, a construct type in the query, or the user or environment; (iii) partially evaluating an access-control policy defined in terms of said attributes, by constructing a partial policy decision request containing the attribute values assigned in step ii) and evaluating the access-control policy for this, whereby a simplified policy is obtained; (iv) deriving an access condition, for which the simplified policy permits access; and (v) amending the database query by imposing said access condition and transmitting the amended query to the database.

1 . A method of providing access control (AC) in respect of a database storing information where the database is configured to accept a database query and return information extracted from the database,
 the method being implemented at least in part at a policy enforcement point (PEP), which is located between the database and a database client, and comprising:   i) intercepting, at the PEP, a database query;   ii) assigning attribute values by performing at least one of the following:
 ii-a) assigning a resource attribute value based on at least one target table or target column appearing in the query; 
 ii-b) assigning an action attribute value based on a construct type appearing in the query; and 
 ii-c) assigning a subject and/or environment attribute value based on an identity of the user or on environment data; 
   iii) providing an attributed-based AC policy defined in terms of said attributes;   iv) deriving an access condition, for which the AC policy, when evaluated for the attribute value(s) assigned in step ii), evaluates to permit access; and   v) amending the database query by imposing said access condition and   vi) transmitting the amended query to the database.   
     
     
         2 . The method of  claim 1 , wherein step iv) includes:
 rewriting the AC policy by substituting one or more auxiliary, preferably Boolean, attributes for a Boolean-valued condition;   converting at least part of the rewritten policy into a binary decision diagram (BDD);   analyzing said binary decision diagram with respect to satisfiability in order to determine a satisfiability condition in terms of the one or more auxiliary attributes, wherein all paths in the BDD evaluating to either true or false are derived; and   converting said satisfiability condition in terms of the one or more auxiliary attributes into an access condition in terms of one or more attributes in the AC policy.   
     
     
         3 . The method of  claim 1 , wherein, if the access condition derived in step iv) is not satisfiable, steps v) and vi) are replaced by:
 v′) sending a non-access notification to the user interface.   
     
     
         4 . The method of  claim 1 , wherein:
 step ii-a) includes assigning resource attribute values based on at least two target columns; and   a sequence of steps iii) and iv) is performed once for each resource attribute value thus assigned.   
     
     
         5 . The method of  claim 1 , wherein:
 steps iii)-v) are performed at a policy decision point (PDP), communicatively connected to the PEP; and   step iii) includes providing the PDP with data representing the attribute values.   
     
     
         6 . The method of  claim 1 , wherein:
 step iii) is performed at a policy decision point (PDP), which is communicatively connected to the PEP and which the PEP provides with data representing the attribute values; and   step v) is performed at the PEP.   
     
     
         7 . The method of  claim 1 , wherein step ii) comprises at least substeps ii-a) and ii-c). 
     
     
         8 . The method of  claim 1 , wherein one or more AC conditions in terms of database tables or columns or in terms of information stored in the database are initially provided, the method comprising the initial steps of:
 defining an attribute-based AC policy;   defining a resource attribute in the AC policy and associating this with one in the group comprising:
 a target table or column appearing in a database query, and 
 information to be retrieved in a table and/or column; 
   defining an action attribute in the AC policy and associating this with a database query construct type; and   converting said one or more AC conditions into expressions in terms of at least the resource and action attributes thus defined and including these into the AC policy.   
     
     
         9 . The method of  claim 1 , wherein the AC policy is encoded in Extended Access Control Markup Language (XACML). 
     
     
         10 . The method of  claim 1 , further comprising defining a column-to-attribute mapping, wherein:
 step iv) includes extracting an access condition containing a reference to an attribute without an assigned value; and   step v) includes converting, using the column-to-attribute mapping, the reference to an attribute without an assigned value into a reference to at least one column in the database and imposing the access condition after this conversion, for thereby causing the database to substitute information retrieved from said at least one column for the attribute without an assigned value during processing of the amended query.   
     
     
         11 . The method of  claim 1 , wherein the database is one in the group comprising:
 a relational database,   a post-relational database,   a document-based database,   an object-oriented database,   a key-value store,   a graph database.   
     
     
         12 . A computer program product comprising a non-transitory computer-readable medium storing instructions for performing the method of  claim 1 . 
     
     
         13 . An access-controlled database system comprising a policy enforcement point (PEP), for providing access control (AC) in respect of a database storing information,
 the PEP being adapted to be located between the database and a database client-where the database is configured to accept a database query and return information extracted from the database, and   the PEP comprising the following communicatively connected sections:   a communication interface for intercepting a database query; and   attribute evaluating means for assigning attribute values by performing one of the following:
 a) assigning a resource attribute value based on at least one target table or target column appearing in the query; 
 b) assigning an action attribute value based on a construct type appearing in the query; and 
 c) assigning a subject and/or environment attribute value based on at least an identity of the user or on environment data, 
   wherein the communication interface is further adapted to transmit an amended query, resulting from imposing an access condition derived from an attribute-based AC policy on the basis of attribute values provided by the attribute evaluating means, to the database.   
     
     
         14 . The system of  claim 13 , wherein the PEP further comprises:
 policy decision means for providing an attribute-based AC policy defined in terms of the attributes to which the attribute evaluating means is adapted to assign attribute values; and   analyzing means ( 26 ) for deriving an access condition, for which the AC policy, when evaluated for the attribute value(s) assigned by the attribute evaluating means, evaluates to permit access.   
     
     
         15 . The system of  claim 14 , wherein the analyzing means of the PEP is adapted to:
 rewrite an AC policy by substituting one or more auxiliary attributes for a Boolean-valued condition;   convert at least part of the rewritten policy into a binary decision diagram (BDD);   analyze said binary decision diagram with respect to satisfiability in order to determine a satisfiability condition in terms of one or more auxiliary attributes, wherein all paths in the BDD evaluating to either true or false are derived; and   convert said satisfiability condition in terms of the one or more auxiliary attributes into an access condition in terms of one or more attributes in the AC policy.   
     
     
         16 . The system of  claim 13 , wherein the PEP further comprises query modifying means for amending the database query intercepted by the communication interface by imposing said access condition. 
     
     
         17 . The system of  claim 16 , wherein the PEP is further adapted to detect a non-satisfiable access condition derived from the attribute-based AC policy, wherein the communication means is configured to transmit, in response to detection of a non-satisfiable access condition, a non-access notification to the user interface. 
     
     
         18 . The system of  claim 13 , comprising an access control system for providing access control in respect of a database storing information, the access control system comprising:
 the PEP; and   a policy decision point (PDP), which is separate from the PEP and communicatively connected thereto, and configured to store an attribute-based AC policy,   wherein the access control system further comprises:   policy decision means for providing an attribute-based AC policy defined in terms of the attributes to which the attribute evaluating means is adapted to assign attribute values;   analyzing means for deriving an access condition, for which the AC policy, when evaluated for the attribute value(s) assigned by the attribute evaluating means, evaluates to permit access; and   query modifying means for amending the database query intercepted by the communication interface by imposing said access condition.   
     
     
         19 . The system of  claim 18 , comprising:
 a database storing information;   a user interface, which is configured to accept a database query from a user and return information extracted from the database; and   the access control system,   wherein the communication interface of the PEP within the access control system is located between the database and the user interface.   
     
     
         20 . The system of  claim 13 , wherein the database is one in the group comprising:
 a relational database,   a post-relational database,   a document-based database,   an object-oriented database,   a key-value store,   a graph database.