Security Policy Implementation using Graph Database

“eXtensible Access Control Markup Language (XACML)” is a policy language and a request/response language. It is used to define general access control requirements. Typically, an XACML policy has configurable standard extension points to define new functions, data types and the ways to combine them as a single unit. With this language, we can query whether a given action can be performed and the result will be interpreted accordingly. Thus, the response always includes an answer about the request whether it should be allowed based on one of the following four values: • Permit – Permit the access • Deny – Deny the access • Indeterminate – When an error occurs or when some required value is missing, so that the action cannot be continued • Not Applicable - The request can't be reached or answered by this service Project focus: The main aim of this project is to implement XACML policies using graph database. This project, will parse a policy and use it in a graph database like Neo4j to verify whether a resource can be accessed based on the access control list. For example, a user who wants to access data in the graph database should have the necessary permissions from the access control list which will be defined in XACML policy. This project will build a parser to parse XACML policies. Generally, these policies contain attributes with operations like read, write. Then these attributes are parsed using the parse engine that is present and will be translated to the immediate level which will produce the nodes and relationships based on the graph database model and will also save the data in the graph database. The user’s request in the XACML format is also parsed and translated to CQL (Cypher Query Language). Then, this query will be validated in the graph database by identifying access rights allowed, denied or audited for that request. Project Flow: 1. Read from XACML files. 2. Generate a parser engine and output it to immediate level to produce nodes and relationships based on graph database model. 3. Import to neo4j with help of an interface. 4. Implement the Request part in accessing XACML permissions. 5. Query the neo4j to obtain results according to the structure in the graph database.