Access Control + Policy Structure¶

Access Control¶

{width:450px}

Policy¶

Goal: limit data access to only authorized users based on terms of use and privacy risks
Default access: Data owner

policy-id        <unique-id> requesters-names <names>
attribute-filters
{
  allow 
  {
    <attribute 1>
    <attribute 2>
    …
  }  
  deny
  {
    <attribute 1>
    <attribute 2>
    …
  }
}

policy-id          A
requesters-names   /ndn/uofm, /edu/mit/alice
attribute-filters
{
  allow 
  {
    /org/md2k/mperf/dd40c
    /org/md2k/ATTRIBUTE/location/home
    /org/md2k/ATTRIBUTE/location/gym
    /org/md2k/ATTRIBUTE/date > 20210901
  }  
  deny
  {
    /org/md2k/ATTRIBUTE/activity/sleeping
  }
}

Policy Structure and Components
policy-id
requester-names
attribute-filters
Allow
Deny (optional)

Example policy with evolution from old → new format

Filter semantics

Mapping to attributes