Efficient Authorization of Graph-database Queries in an Attribute-supporting ReBAC Model
Efficient Authorization of Graph-database Queries in an Attribute-supporting ReBAC Model
复制标题
支持属性的 ReBAC 模型中图数据库查询的高效授权
DOI：
10.1145/3401027
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Philip W. L. Fong
中科院分区：
文献类型：
--
作者：
Syed Zain R. Rizvi;Philip W. L. Fong
Neo4j是一个流行的图形数据库，提供两个版本：企业版和社区版。企业版通过自定义开发的过程提供可自定义的基于角色的访问控制功能，而社区版不提供任何访问控制支持。作为一个图形数据库，Neo4j似乎是基于授权的访问控制（ReBAC）的自然应用程序，ReBAC是一种访问控制范例，其中授权决策基于系统中主体和资源之间的关系（即，授权图）。在本文中，我们介绍了AReBAC，这是一个支持属性的ReBAC模型，用于Neo4j，通过对资源而不是过程进行操作来提供更细粒度的访问控制。AReBAC采用Nano-Cypher，这是一种基于Neo4j的Cypher查询语言的声明性策略语言，其结果允许我们使用访问控制策略编织数据库查询并同时评估两者。评估组合的查询和策略产生（i）与搜索标准匹配并且（ii）请求主体被授权访问的结果。AReBAC是伴随着算法和实现所需的实现所提出的想法，包括GP-Eval，查询评估算法。我们还介绍了活端回跳（LBJ），一个回溯计划，提供了一个显着的性能提升冲突导向的回跳评估查询。正如我们之前的工作所展示的那样，GP-Eval的原始版本已经比Neo4j的Cypher评估引擎执行得更快。采用LBJ的GP-Eval的优化版本进一步显着提高了性能，从而展示了该技术的能力。
Neo4j is a popular graph database that offers two versions: an enterprise edition and a community edition. The enterprise edition offers customizable Role-based Access Control features through custom developed procedures, while the community edition does not offer any access control support. Being a graph database, Neo4j appears to be a natural application for Relationship-Based Access Control (ReBAC), an access control paradigm where authorization decisions are based on relationships between subjects and resources in the system (i.e., an authorization graph). In this article, we present AReBAC, an attribute-supporting ReBAC model for Neo4j that provides finer-grained access control by operating over resources instead of procedures. AReBAC employs Nano-Cypher, a declarative policy language based on Neo4j’s Cypher query language, the result of which allows us to weave database queries with access control policies and evaluate both simultaneously. Evaluating the combined query and policy produces a result that (i) matches the search criteria, and (ii) the requesting subject is authorized to access. AReBAC is accompanied by the algorithms and their implementation required for the realization of the presented ideas, including GP-Eval, a query evaluation algorithm. We also introduce Live-End Backjumping (LBJ), a backtracking scheme that provides a significant performance boost over conflict-directed backjumping for evaluating queries. As demonstrated in our previous work, the original version of GP-Eval already performs significantly faster than the Neo4j’s Cypher evaluation engine. The optimized version of GP-Eval, which employs LBJ, further improves the performance significantly, thereby demonstrating the capabilities of the technique.
约束表达式和工作流可满足性
DOI：
10.1145/2462410.2462419
发表时间：
2013
期刊：
--
影响因子：
--
作者：
Crampton J
通讯作者：
Crampton J