US 8,914,323 B1Granted

Policy-based data-centric access control in a sorted, distributed key-value data store

AssigneeSqrrl Data, Inc.

InventorsMichael R. Allen, John W. Vines, Adam P. Fuchs

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method, apparatus and computer program product for policy-based access control in association with a sorted, distributed key-value data store in which keys comprise a cell-level access control. In this approach, an information security policy is used to create a set of pluggable policies. A pluggable policy may be used during data ingest time, when data is being ingested into the data store, and a pluggable policy may be used during query time, when a query to the data store is received for processing against data stored therein. Generally, a pluggable policy associates one or more user-centric attributes (or some function thereof), to a particular set of data-centric attributes. By using pluggable policies, preferably at both ingest time and query time, the data store is enhanced to provide a seamless and secure policy-based access control mechanism in association with the cell-level access control enabled by the data store.

Claims20

Dependent claims

A method operative in association with a sorted, distributed key-value data store, comprising:

as data is ingested into the data store at an ingest time, tagging one or more key-value pairs in the data with a data-centric label as determined by an ingest-time policy to generate tagged data, the data-centric label representing a function adapted to be evaluated over a set of variables;
storing the tagged data in the data store;
at query time, the query time being distinct from the ingest time, and in response to receipt of a query from a querier, performing the following sub-steps:
processing the query according to a query-time policy to identify a set of one or more data-centric attributes the query is allowed to use, wherein the processing evaluates values of one or more user-centric attributes associated with the querier against at least one policy rule in the query-time policy to identify the set of one or more data-centric attributes;
modifying the query to include the set of one or more data-centric attributes so identified, the one or more data-centric attributes being distinct from the data-centric label;
forwarding to the data store the query that has been modified to include the set of one more identified data-centric attributes;
receiving a response to the query that has been modified to include the set of one more identified data-centric attributes, wherein the response is generated in the data store upon evaluating the set of one or more data-centric attributes in the query with at least one data-centric label in the data store, the data-centric label in the data store having been associated with the data during the tagging at ingest time;
and
returning the response to the querier;
wherein at least one of the steps is carried out in software executing in a hardware processor.

7 more elements

An apparatus operating in association with a sorted, distributed key-value data, comprising:

at least one processor;
computer memory holding computer program instructions executed by the at least one processor to provide policy-based access control, the computer program instructions comprising:
program code operative as data is ingested into the data store at an ingest time to tag one or more key-value pairs in the data with a data-centric label as determined by an ingest-time policy to generate tagged data, the data-centric label representing a function adapted to be evaluated over a set of variables;
program code operative to store the tagged data in the data store;
and
program code operative at a query time, the query time being distinct from the ingest time, and in response to receipt of a query from a querier:
to process the query according to a query-time policy to identify a set of one or more data-centric labels the query is allowed to use, wherein the processing evaluates values of one or more user-centric attributes associated with the querier against at least one policy rule in the query-time policy to identify the set of one or more data-centric attributes;
to modify the query to include the set of one or more data-centric attributes so identified, the one or more data-centric attributes being distinct from the data-centric label;
to forward to the data store the query that has been modified to include the set of one more identified data-centric attributes;
to receive a response to the query that has been modified to include the set of one more identified data-centric attributes, wherein the response is generated in the data store upon evaluating the set of one or more data-centric attributes in the query with at least one data-centric label in the data store, the data-centric label in the data store having been associated with the data during the tagging at ingest time;
and
to return the response to the querier.

9 more elements

A computer program product in a non-transitory computer-readable medium to provide policy-based access control in association with a sorted, distributed key-value data store providing policy-based access control, the computer program product including computer program instruction comprising:

program code operative as data is ingested into the data store at an ingest time to tag one or more key-value pairs in the data with a data-centric label as determined by an ingest-time policy to generate tagged data, the data-centric label representing a function adapted to be evaluated over a set of variables;
program code operative to store the tagged data in the data store;
and
program code operative at a query time, the query time being distinct from the ingest time, and in response to receipt of a query from a querier:
to process the query according to a query-time policy to identify a set of one or more data-centric attributes the query is allowed to use, wherein the processing evaluates values of one or more user-centric attributes associated with the querier against at least one policy rule in the query-time policy to identify the set of one or more data-centric attributes;
to modify the query to include the set of one or more data-centric attributes so identified, the one or more data-centric attributes being distinct from the data-centric label;
to forward to the data store the query that has been modified to include the set of one more identified data-centric attributes;
to receive a response to the query that has been modified to include the set of one more identified data-centric attributes, wherein the response is generated in the data store upon evaluating the set of one or more data-centric attributes in the query with at least one data-centric label in the data store, the data-centric label in the data store having been associated with the data during the tagging at ingest time;
and
to return the response to the querier.

7 more elements

Dependencies are inferred from the claim text.