A Comprehensive Framework Integrating Attribute-Based Access Control and Privacy Protection Models

NoSQL databases have recently become increasingly popular as data platforms for big data and real-time web applications. Due to the simplicity in design but effectiveness in horizontal scaling and performance, NoSQL databases can be a better alternative approach in comparison with traditional relational databases. However, the lack of a fine-grained access control system together with a data privacy protection mechanism is one of the most important issues in NoSQL databases. In this paper, we investigate the attribute based access control model (ABAC) and use it as the main access control system in NoSQL databases. Moreover, we propose and implement a comprehensive framework for enforcing attribute-based security policies stored in JSON document together with a data privacy protection mechanism in the fine-grained level. We use Polish notation for modeling conditional expressions (i.e., the combination of subject, resource, and environment attributes) so that ABAC policies can be flexible, dynamic and fine grained. Moreover, for data privacy protection, privacy rules of the policies are constrained not only by access and intended purpose but also by subject, resource, and environment attributes as well as data disclosure level. The experiment is carried out to show the relationship between the processing time for access decision together with the privacy protection mechanism and the complexity of access and privacy policies.