Method and system for controlling access to data via a data-centric security model

A computer program product, comprising a computer readable storage medium having a computer readable program code stored therein, said computer readable program code containing instructions that when executed by a processor of a computing system implement a method for controlling an access to data via a data-centric security model, said method comprising:

• defining a business data classification scheme as a hierarchy that includes a plurality of data classifications, said plurality of data classifications being aligned with a plurality of business operations in a many-to-one correspondence, wherein said business data classification scheme associates a data classification included in said plurality of data classifications with a set of security requirements that describes first security procedures for protecting an access to first data elements classified by said data classification;
• automatically labeling a data element with a data label, wherein said data label includes said data classification and said set of security requirements, wherein said data classification classifies said data element, and wherein said set of security requirements included in said data label specifies said first security procedures to protect an access to said data element;
• receiving a first policy statement that specifies an action that provides said access to said data element, a data type of said data element, a role permitted to perform said action to access said data element of said data type, and a first sensitivity of said data element, wherein said first policy statement is based on first regulatory requirements;
• subsequent to said receiving said first policy statement, generating a data control rule (DCR) as an enforceable statement in an access control policy language by automatically encoding said data classification and said first policy statement as said enforceable statement in said access control policy language;
• subsequent to said generating said DCR, automatically determining a first set of security services is required to protect said access to said data element based on said data element being classified by said data classification that is encoded in said first DCR;
• subsequent to determining said first set of security services, determining said first regulatory requirements are replaced by second regulatory requirements, said second regulatory requirements being a result of legislation;
• subsequent to said determining said first regulatory requirements are replaced, receiving a second policy statement as a replacement of said first policy statement, wherein said second policy statement specifies said action that provides said access to said data element, said data type of said data element, said role permitted to perform said action to access said data element of said data type, and a second sensitivity of said data element, said second sensitivity being different from said first sensitivity, wherein said second policy statement is based on said second regulatory requirements;
• automatically transforming said second policy statement into a second DCR by automatically encoding said data classification and said second policy statement as a second enforceable statement in said access control policy language, wherein said second enforceable statement is said second DCR;
• subsequent to said automatically transforming said second policy statement into said second DCR, automatically determining a second set of security services is required to protect said access to said data element based on said second policy statement being said replacement of said first policy statement and said second policy statement and said data classification of said data element being encoded in said second DCR, said second set of security services being different from said first set of security services;
• subsequent to said determining said second set of security services, receiving a data request that requests said access to said data element;
• subsequent to said receiving said data request, determining said action is a permissible action based on said second DCR;
• subsequent to said receiving said data request, determining said role is a permissible role based on said second DCR;
• granting said access to said data element based on said action and said role being permissible based on said second DCR;
• and
• subsequent to said granting said access, accessing said data element by running said second set of security services to protect said access of said data element based on said second sensitivity included in said second policy statement that replaced said first policy statement, instead of by running said first set of security services to protect said access of said data element based on said first sensitivity included in said first policy statement.

A process for supporting computing infrastructure, said process comprising providing at least one support service for at least one of creating, integrating, hosting, maintaining, and deploying computer-readable code in a computing system, wherein the code in combination with the computing system is capable of performing a method of controlling an access to data via a data-centric security model, said method comprising:

• defining, via a computing system, a business data classification scheme as a hierarchy that includes a plurality of data classifications, said plurality of data classifications being aligned with a plurality of business operations in a many-to-one correspondence, wherein said business data classification scheme associates a data classification included in said plurality of data classifications with a set of security requirements that describes first security procedures for protecting an access to first data elements classified by said data classification;
• automatically labeling, via said computing system, a data element with a data label, wherein said data label includes said data classification and said set of security requirements, wherein said data classification classifies said data element, and wherein said set of security requirements included in said data label specifies said first security procedures to protect an access to said data element;
• said computing system receiving a first policy statement that specifies an action that provides said access to said data element, a data type of said data element, a role permitted to perform said action to access said data element of said data type, and a first sensitivity of said data element, wherein said first policy statement is based on first regulatory requirements;
• subsequent to said receiving said first policy statement, said computing system generating a data control rule (DCR) as an enforceable statement in an access control policy language by automatically encoding said data classification and said first policy statement as said enforceable statement in said access control policy language;
• subsequent to said generating said DCR, said computing system automatically determining a first set of security services is required to protect said access to said data element based on said data element being classified by said data classification that is encoded in said first DCR;
• subsequent to determining said first set of security services, said computing system determining said first regulatory requirements are replaced by second regulatory requirements, said second regulatory requirements being a result of legislation;
• subsequent to said determining said first regulatory requirements are replaced, said computing system receiving a second policy statement as a replacement of said first policy statement, wherein said second policy statement specifies said action that provides said access to said data element, said data type of said data element, said role permitted to perform said action to access said data element of said data type, and a second sensitivity of said data element, said second sensitivity being different from said first sensitivity, wherein said second policy statement is based on said second regulatory requirements;
• said computing system automatically transforming said second policy statement into a second DCR by automatically encoding said data classification and said second policy statement as a second enforceable statement in said access control policy language, wherein said second enforceable statement is said second DCR;
• subsequent to said automatically transforming said second policy statement into said second DCR, said computing system automatically determining a second set of security services is required to protect said access to said data element based on said second policy statement being said replacement of said first policy statement and said second policy statement and said data classification of said data element being encoded in said second DCR, said second set of security services being different from said first set of security services;
• subsequent to said determining said second set of security services, receiving a data request that requests said access to said data element;
• subsequent to said receiving said data request, said computing system determining said action is a permissible action based on said second DCR;
• subsequent to said receiving said data request, said computing system determining said role is a permissible role based on said second DCR;
• said computing system granting said access to said data element based on said action and said role being permissible based on said second DCR;
• and
• subsequent to said granting said access, accessing said data element by running said second set of security services to protect said access of said data element based on said second sensitivity included in said second policy statement that replaced said first policy statement, instead of by running said first set of security services to protect said access of said data element based on said first sensitivity included in said first policy statement.