mGuard

# Access Control + Policy Structure

## Access Control

![](ck-flow.png){width:450px}

---

## Policy

Goal: limit data access to only authorized users based on terms of use and privacy risks

Default access: Data owner

``` yaml

policy-id        <unique-id> requesters-names <names>

attribute-filters

{

  allow 

  {

    <attribute 1>

    <attribute 2>

    …

  }  

  deny

  {

    <attribute 1>

    <attribute 2>

    …

  }

}

```

``` yaml

policy-id          A

requesters-names   /ndn/uofm, /edu/mit/alice

attribute-filters

{

  allow 

  {

    /org/md2k/mperf/dd40c

    /org/md2k/ATTRIBUTE/location/home

    /org/md2k/ATTRIBUTE/location/gym

    /org/md2k/ATTRIBUTE/date > 20210901

  }  

  deny

  {

    /org/md2k/ATTRIBUTE/activity/sleeping

  }

}

```

Policy Structure and Components

policy-id

requester-names

attribute-filters

Allow

Deny (optional)

---

Example policy with evolution from old → new format

Filter semantics

Mapping to attributes

![](old_policy_used.png)

![](old_access_control_policy_structure.png)