mGuard

Wiki » Design Elements »

Access Control » History » Revision 6

Revision 5 (Suravi Regmi, 11/25/2025 05:44 PM) → Revision 6/10 (Suravi Regmi, 11/25/2025 05:49 PM)

 
 # Access Control + Policy Structure 

 ## Access Control 
 ![](ck-flow.png){width:450px} New policy structure (requester, allow/deny filters) 

 --- 

 ## Policy 
 Goal: limit data access to only authorized users based on terms of use and privacy risks 
 Default access: Data owner 

 ``` yaml 

 policy-id          <unique-id> requesters-names <names> 
 attribute-filters 
 { 
   allow  
   { 
     <attribute 1> 
     <attribute 2> 
     … 
   }   
   deny 
   { 
     <attribute 1> 
     <attribute 2> 
     … 
   } 
 } 
 ``` 

 ``` yaml 


 policy-id            A 
 requesters-names     /ndn/uofm, /edu/mit/alice 
 attribute-filters 
 { 
   allow  
   { 
     /org/md2k/mperf/dd40c 
     /org/md2k/ATTRIBUTE/location/home 
     /org/md2k/ATTRIBUTE/location/gym 
     /org/md2k/ATTRIBUTE/date > 20210901 
   }   
   deny 
   { 
     /org/md2k/ATTRIBUTE/activity/sleeping 
   } 
 } 



 ``` 

 Policy Structure and Components 
 policy-id 
 requester-names 
 attribute-filters 
 Allow 
 Deny (optional) 


 --- 

 Example policy with evolution from old → new format 

 Filter semantics 

 Mapping to attributes 

 
 ![](ck-flow.png) 
 ![](old_policy_used.png) 
 ![](old_access_control_policy_structure.png)