Access control method and a system for privacy protection

A computer program product comprising a non-transitory computer useable medium having computer readable program code recorded thereon for protecting information in a distributed stream processing system, the computer readable program code comprising:

• computer readable program code for assigning a principal label to a processing component, wherein the processing component receives data and includes a program that transforms the data to produce new data as output, and wherein the principal label identifies a name and risk level for each data attribute readable by the processing component,
• computer readable program code for assigning a channel label to a first communication channel that is connected to an input of the processing component, wherein the channel label includes a name and risk level of each data attribute present in the first communication channel;
• computer readable program code for determining if the risk levels of the data attributes of the first communication channel are higher than at least one, but not all, of the risk levels of the data attributes of the principal label;
• and
• computer readable program code for preventing the processing component from reading all the data attributes of the first communication channel based on a determination that the risk levels of the data attributes of the first communication channel are higher than at least one, but not all, of the risk levels of the data attributes of the processing component,
• wherein the principal label includes a read label that identifies the risk levels of the data attributes readable by the processing component, a write label that ensures communication channels written to by the processing component are permitted to receive the data output from the processing component, a selection label that identifies selection operations performed by the processing component on at least one of the data attributes read by the processing component, an addition label that includes new data attributes added to the data output by the processing component and a suppression label that identifies which of the data attributes read by the processing component has its risk level decreased by the processing component.