Re: how to extend a capability on a data source?

Capabilities don't need to be opaque. They only need to be unforgeable, and
to couple access with authority.

The "doesn't need to be opaque" property is useful for modeling some kinds
of capabilities. For example, it has been proposed that URLs expose their
query properties then protect them with an HMAC. An interesting variation
is to protect only some parts of the URL, and properties starting with a
prefix like `$`, with the HMAC.

In your case, a variation of this same approach should work. You could use
a protected (signed or encrypted) query or description of access rights as
a capability, and perhaps accepting some additional arguments (the message).




On Thu, Oct 31, 2013 at 9:25 PM, Rob Withers <[email protected]> wrote:

> Good evening, all, I hope you are well,
>
> If you have a big data source, like HBase, with over an exabyte going on,
> and the contents of a table, with column families (CF) and columns (C),
> have granular security requirements, how would you provide access in the
> form of a capability?
>
> For example, if you have a customer table, spread cross over 131 nodes,
> with a customer CF and an unencrypted customer profile C’U, as well as an
> encrypted profile C'E, the requirement to allow some people to decrypt the
> C’E, as well as impose a filter on the values found therein during scans,
> is a security situation.  How could such security filtering be perceived as
> a capability, without leakage and revocable and so on.  Furthermore, it
> would be efficient, I would think, if this capability filter be applied
> during access through the presentation layer, interleaved with HBase column
> scan processing.
>
> Is there any research done in the area of capability access to a
> finely-grained, secure data-source?  Is it useful to somehow think of a
> capability as an execution barrier, “there is no bus”, as opposed to an
> ACL, which is “can I check your ticket, please”?  A capability on top of a
> data-source should be an opaque bus, where only certain seats are even
> visible, as you walk down the aisle, but there is no need to check the
> capability owner's ticket when she boards the bus.  During execution, any
> access is "checking the ticket" of every column value, within a row, so
> it’s an ACL, supporting all your profile management services.  It is like a
> dynamic view on the underlying data or something, I do not know.
>
> thankyou for your thoughts,
> rob
> _______________________________________________
> cap-talk mailing list
> [email protected]
> http://www.eros-os.org/mailman/listinfo/cap-talk
>

_______________________________________________
cap-talk mailing list
[email protected]
http://www.eros-os.org/mailman/listinfo/cap-talk