Abstract: A method, apparatus and computer program product for policy-based access control in association with a sorted, distributed key-value data store in which keys comprise a cell-level access control. In this approach, an information security policy is used to create a set of pluggable policies. A pluggable policy may be used during data ingest time, when data is being ingested into the data store, and a pluggable policy may be used during query time, when a query to the data store is received for processing against data stored therein. Generally, a pluggable policy associates one or more user-centric attributes (or some function thereof), to a particular set of data-centric attributes. By using pluggable policies, preferably at both ingest time and query time, the data store is enhanced to provide a seamless and secure policy-based access control mechanism in association with the cell-level access control enabled by the data store.

Abstract: Policy-based, cell-level access control is provided in association with a sorted, distributed key-value data store. As data representing a hierarchical document is ingested into the data store, the data is interpreted to identify fields and any sub-fields in the document, each identified field and its associated protection level as identified are translated into a set of one or more fieldname and visibility label pairs. Each fieldname and visibility label pair has a fieldname identifying a field and its zero or more sub-fields, together with a visibility label that is a function of the associated protection levels of the field and any sub-fields therein. At query time, and in response to receipt of a query including an authorization label, the fieldname and visibility labels are applied against the authorization label in the query to control which fields in the document are retrieved and used to generate the response to the query.