Efficient Authorization of Graph Database Queries in an Attribute-Supporting ReBAC Model
Efficient Authorization of Graph Database Queries in an Attribute-Supporting ReBAC Model
复制标题
支持属性的 ReBAC 模型中图数据库查询的高效授权
DOI：
10.1145/3176258.3176331
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Philip W. L. Fong
中科院分区：
文献类型：
--
作者：
Syed Zain R. Rizvi;Philip W. L. Fong
Neo4j是一个流行的图形数据库，提供两个版本；一个付费的企业版和一个免费的社区版。企业版通过自定义开发的过程提供可定制的基于角色的访问控制（RBAC）特性，而社区版不提供任何访问控制支持。作为一个图形数据库，Neo4j是基于关系的访问控制（ReBAC）的自然应用程序，ReBAC是一种访问控制范式，其中授权决策基于系统中主题和资源之间的关系。在本文中，我们介绍了AReBAC，一个支持Neo4j属性的ReBAC模型（适用于两个版本），它提供了更细粒度的访问控制。AReBAC使用Nano-Cypher，这是一种基于Neo4j的Cypher查询语言的声明性策略语言，其结果允许我们将数据库查询与访问控制策略编织在一起，并同时对两者进行评估。对组合查询和策略进行评估会产生i)匹配搜索条件的结果，ii)请求主体有权访问该结果。我们的实验表明，当评估使用Nano-Cypher可表达的查询时，我们的评估算法比Neo4j的查询评估引擎执行得更快。
Neo4j is a popular graph database that offers two versions; a paid enterprise edition and a free community edition. The enterprise edition offers customizable Role-Based Access Control (RBAC) features through custom developed procedures, while the community edition does not offer any access control support. Being a graph database, Neo4j is a natural application for Relationship-Based Access Control (ReBAC), an access control paradigm where authorization decisions are based on relationships between subjects and resources in the system. In this paper we present AReBAC, an attribute-supporting ReBAC model for Neo4j (applicable to both editions) that provides finer grained access control. AReBAC employs Nano-Cypher, a declarative policy language based on Neo4j»s Cypher query language, the result of which allows us to weave database queries with access control policies and evaluate both simultaneously. Evaluating the combined query and policy produces a result that i) matches the search criteria, and ii) the requesting subject has access to. Our experiments show that our evaluation algorithm performs faster than Neo4j»s query evaluation engine when evaluating queries that are expressible using Nano-Cypher.