Title:Sieve: A Middleware Approach to Scalable Access Control for Database Management Systems

Abstract:This paper considers the challenge of scalable implementation of fine-grained access control over large corpus of policies in database systems. Current approach to enforcing fine-grained policies based on rewriting queries does not scale when number of policies may be in the order of thousands. Our work identifies one such use case in the context of emerging smart spaces wherein systems may be required by legislation such as Europe's GDPR and California's CCPA to empower users ways to specify who can have access to their data and for what purposes. We present Sieve, a layered approach to implementing fine-grained access control in existing database systems, that exploits a variety of features (index support, UDFs, hints) to scale to large number of policies. Given a set of policies, Sieve generates guarded expressions that might exploit database indices to filter tuples and given a query exploit context to filter policies that need to be checked. Our experimental results show that SIEVE scales to large data sets and large policy corpus to support real-time access in applications including emerging smart environments.