Verifiable labels for mandatory access control

A computer program product for using decentralized verifiable credential as mandatory access control (MAC) labels, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:

• receive, from an entity, a first verifiable MAC label associated with an object to which access is controlled;
• receive, from the entity, a second verifiable MAC label associated with a subject requesting to access the object;
• determine whether to grant, to the subject, access to the object responsive to the request based on comparing the first verifiable MAC label associated with the object and the second verifiable MAC label associated with the subject to a verifiable MAC policy;
• and
• wherein each of the first verifiable MAC label, the second verifiable MAC label, and the verifiable MAC policy is formatted as a verifiable credential that is machine readable and digitally signed, and wherein the verifiable credential comprises one or more globally unique Decentralized Identifiers (DIDs) based on Uniform Resource Identifiers (URI).

A data processing system, comprising:

• a processor coupled to a memory;
• and an operating environment (OE) agent for the data processing system, wherein the OE agent is configured to use decentralized verifiable credential as mandatory access control (MAC) labels, including:
• receiving, from an entity, a first verifiable MAC label associated with an object to which access is controlled by the OE agent;
• receiving, from the entity, a second verifiable MAC label associated with a subject;
• receiving, from the subject, a request to access the object;
• determining whether to grant, to the subject, access to the object responsive to the request based on comparing the first verifiable MAC label associated with the object and the second verifiable MAC label associated with the subject to a verifiable MAC policy;
• and
• wherein each of the first verifiable MAC label, the second verifiable MAC label, and the verifiable MAC policy is formatted as a verifiable credential that is machine readable and digitally signed, and wherein the verifiable credential comprises one or more globally unique Decentralized Identifiers (DIDs) based on Uniform Resource Identifiers (URI).

A computer-implemented method for operating a verifiable mandatory access control (MAC) system, comprising:

• defining verifiable MAC labels for resources to which access is controlled by a data processing system;
• issuing verifiable credentials for the verifiable MAC labels,
• wherein the verifiable MAC labels are formatted as the verifiable credentials, and wherein the verifiable credentials comprise one or more globally unique Decentralized Identifiers (DIDs) based on Uniform Resource Identifiers (URI);
• storing the verifiable credentials in a wallet on the data processing system;
• periodically receiving new verifiable credentials from a credential repository;
• validating the new verifiable credentials;
• storing the new validated credentials in the wallet;
• and
• wherein the verified credentials and the new verified credentials are machine readable and digitally signed.

A mandatory access control system, comprising:

• a peer node associated with a blockchain network,
• the blockchain network comprising a plurality of nodes,
• the peer node adapted to record a plurality of globally unique Decentralized Identifiers (DIDs) for a mandatory access control system;
• a plurality of first verifiable MAC labels associated with a respective plurality of objects to which access is controlled;
• and
• a plurality of a second verifiable MAC labels associated with a respective plurality of subjects requesting to access the plurality of objects
• wherein each of the plurality of first verifiable MAC labels and the plurality of second verifiable MAC labels is formatted as a verifiable credential that is machine readable and digitally signed, and wherein the verifiable credential comprises one or more of the globally unique DIDs based on Uniform Resource Identifiers (URI).