XACML Extension for Graphs: Flexible Authorization Policy Specification and Datastore-independent Enforcement
Aya Mohamed, Dagmar Auer, Daniel Hofer, Josef K\"ung

TL;DR
This paper extends XACML to support flexible, graph-aware authorization policies that consider paths and edges, enabling datastore-independent enforcement for graph-structured data in multi-model databases.
Contribution
It introduces an improved graph-specific policy language and a datastore-independent enforcement method within the XACML framework.
Findings
Enhanced policy language with flexible path definitions
Prototype implementation demonstrating real-case applicability
Discussion on performance outlook
Abstract
The increasing use of graph-structured data for business- and privacy-critical applications requires sophisticated, flexible and fine-grained authorization and access control. Currently, role-based access control is supported in graph databases, where access to objects is restricted via roles. This does not take special properties of graphs into account such as vertices and edges along the path between a given subject and resource. In previous iterations of our research, we started to design an authorization policy language and access control model, which considers the specification of graph paths and enforces them in the multi-model database ArangoDB. Since this approach is promising to consider graph characteristics in data protection, we improve the language in this work to provide flexible path definitions and specifying edges as protected resources. Furthermore, we introduce a…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAccess Control and Trust · Privacy-Preserving Technologies in Data · Cryptography and Data Security
