1 / 39

Security Features Preview Field Level Access Control

Security Features Preview Field Level Access Control. James Kerr. Senior Solutions Architect, MongoDB. Key Security Considerations. Reference Architecture. Authentication. Authorization. Auditing. Encryption. Clients. Administrators. Storage. Authentication. Authentication.

lucian
Download Presentation

Security Features Preview Field Level Access Control

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Security Features PreviewField Level Access Control James Kerr Senior Solutions Architect, MongoDB

  2. Key Security Considerations

  3. Reference Architecture Authentication Authorization Auditing Encryption Clients Administrators Storage

  4. Authentication Authentication Authorization Auditing Encryption Clients Administrators Which nodes are joining the cluster Which users/apps are accessing the DB Which users are accessing the DB Storage

  5. Authorization Authentication Authorization Auditing Encryption Clients Administrators What permissions does an App have? What permissions does an Admin have? What data can an admin see? What data can a user see? Storage

  6. Auditing Authentication Authorization Auditing Encryption Clients Administrators Who made which changes and when? Who made which changes and when? Storage

  7. Encryption Authentication Authorization Auditing Encryption Clients Administrators SSL Encryption SSL Encryption File system Encryption Storage

  8. Today - Authorization Authorization Clients What permissions does an App have? What data can a user see?

  9. Authorization

  10. Authorization Features • Database Level Access Control (2.4) • Admin roles – DB, user, cluster • Application roles – reader, reader/writer • Collection Level Access Control (coming soon) • User defined roles • Privileges granted to roles for actions on resources • Database, collection and system resource types • Field Level Access Control (2.5 nightly) • Redact documents and/or fields based on security labels

  11. Field Level Access Control Goals • Restrict access to certain documents within a collection • Restrict access to certain fields within documents • Provide a generic capability to handle different marking schemes • Describe policies in terms of existing MongoDB query languages, or extensions thereof

  12. FLAC Features and Functionality • New $redact aggregation framework phase • Performs a pre-order traversal of the document tree • For each node, the expression conditionally returns one of • "$$KEEP” , "$$PRUNE” or "$$DESCEND” • New query language operators • Sets (⊆, =, ∖, ∩, ∪) • Arrays (any true, all true) • Variables (let, map)

  13. FLAC Features and Functionality (cont.) • Aggregation can return a cursor • Have to use "aggregate" command until 2.5 is feature-complete • Can use the the temporary mongo shell helper db.collection.aggregateCursor() • Aggregation can write directly to another collection • $out phase

  14. Redaction Logic • Expression is evaluated as the nodes in the document are traversed • $$KEEP – inserts the node and the node's children into the output • $$PRUNE – puts no node in the output document, and continues the traversal of the sibling nodes • $$DESCEND – inserts a corresponding node in the output document and continues the traversals of the node's children

  15. Set Operators • $setIsSubset • $setEquals • $setDifference • $setIntersection • $setUnion

  16. Array Operators • $allElementsTrue • $anyElementTrue

  17. Variable Operators • $let • Binds variables for use in sub-expressions • $map • Applies a sub-expression to each item in an array and returns an array with the result of the sub-expression • Available the in $project, $group, and $redact pipeline stages

  18. $let Example { $project: { remaining: { $let : { vars: { tally: 75, count: 50 } , in: { $subtract: [ "$$tally", "$$count" ] } } } } }  { remaining: 25 } Bind the "tally" and "count" variables Evaluate the subexpression defined by the "in" field with the bound variables

  19. $map Example { skews: [ 1, 2, 3 ] } { $project: { adjusted: { $map: { input: "$skews", as: "adj", in: { $add: [ "$$adj", 12 ] } } } } }  { adjusted : [ 13, 14, 15 ] } Use the "skews" field as the input to the $map operation Assign each element in the input array to the "adj" variable Execute expression for each element in the input array

  20. $redact Example { $redact: { $cond: [{ $anyElementTrue: { $map: { input: "$sl", as: "setNeeded", in: { $setIsSubset: ["$$setNeeded", ["A", "B", "D"]] } } } }, "$$DESCEND", "$$PRUNE"] } } Field security labels are in the "sl" field Input labels. IE, these would come from the user's attributes

  21. FLAC Pipeline – Basic Query $redact $match Redaction Expression User Attributes

  22. FLAC Pipeline – Optimized Query $match $redact $match Redaction Expression To make the pipeline more selective, parts of the $match may be promoted by the execution engineor manually.* Don't promote negative queryterms ($ne, $nin, $nor, etc) User Attributes

  23. FLAC Pipeline – Document Level Filters Query $match $redact $match Security Match Expression Redaction Expression Document level accessmay be selective and benefit from index usein the first $match phase User Attributes

  24. Markings Reference Implementation • Field visibility is controlled by the "sl" field • Top level "sl"applies to the whole document • Restrictive markings on a parent field removes it and any children

  25. Markings Reference Implementation { _id: 1, sl: [ ["A", "B"], ["C"] ], field1 : { sl : [ ["A", "B"] ], data : “field1 value” }, field2 : { sl: [ ["C"] ], data : “field2 value” }, field3 : { sl : [ ["A", "C"], ["B", "D"] ], data : “field3 value” } } User needs A&B|Cto see the document User needs A&B to see field1 User needs C to see field2 User needs A&C|B&D to see field3

  26. Markings Reference Implementation { _id: 2, sl: [ ["A", "B", "C"], ["A", "B", "D"] ], field1 : { sl : [ ["A", "B"] ], field2 : { sl : [ ["C"] ], data : "field2 value" }, field3 : { sl : [ ["D"] ], data : "field3 value" } } } User needs A&B&C|A&B&D to see the document User needs A&B to see field1 User needs A&B&C to see field1.field2 User needs A&B&D to see field1.field3

  27. $redact Reference Example { $redact: { $cond: [{ $anyElementTrue: { $map: { input: "$sl", as: "setNeeded", in: { $setIsSubset: ["$$setNeeded", ["A", "B", "D"]] } } } }, "$$DESCEND", "$$PRUNE"] } } Field security labels are in the "sl" field User has labels "A" , "B" and "D"

  28. $redact Output { _id: 1, sl: [ ["A", "B"], ["C"] ], field1 : { sl : [ ["A", "B"] ], data : “field1 value” }, field2 : { sl : [ ["C"] ], data : “field2 value” }, field3 : { sl : [ ["A", "C"], ["B", "D"] ], data : “field3 value” } } { _id: 1, sl: [ ["A", "B"], ["C"] ], field1 : { sl : [ ["A", "B"] ], data : “field1 value” }, field3 : { sl : [ ["A", "C"], ["B", "D"] ], data : “field3 value” } } User labels = ["A", "B", "D"]

  29. $redact Output { _id: 2, sl: [ ["A", "B", "C"], ["A", "B", "D"] ], field1 : { sl : [ ["A", "B"] ], field2 : { sl : [ ["C"] ], data : “field2 value” }, field3 : { sl : [ [“D"] ], data : “field3 value” } } } { _id: 2, sl: [ ["A", "B", "C"], ["A", "B", "D"] ], field1 : { sl : [ ["A", "B"] ], field3 : { sl : [ [“D"] ], data : “field3 value” } } } User labels = ["A", "B", "D"]

  30. FLAC Design – Trusted Middleware Untrusted User/Application Identity Management Trusted Middleware/ Application Collection Query + $redact Trusted user Driver Authenticate Untrusted User Retrieve User Attributes Create query and $redact Expression Authenticate Trusted User Run Query Apply $redact Expression

  31. Disclaimer Statements about future releases, availability dates, and feature content reflect plans only, and MongoDBis under no obligation to include, develop or make available, commercially or otherwise, specific features discussed in a future MongoDB build. Information is provided for general understanding only, and is subject to change at the sole discretion of MongoDBin response to changing market conditions, delivery schedules, customer requirements, and/or other factors.

  32. Integrated FLAC (Conceptual)* • Collection Views • Read-only Views • Parameterized Views • Configurable redaction expression • Document content based on the user attributes and field markings * See Disclaimer

  33. FLAC Design – Views* Untrusted User/Application Identity Management Trusted Middleware/ Application Collection View ($redact) Query + attributes Trusted user Driver Authenticate Untrusted User Retrieve User Attributes Authenticate Trusted User Run Query Create/Apply $redact Expression * See Disclaimer

  34. FLAC Design – Fully Integrated* Untrusted User/Application Identity Management Untrusted Middleware/ Application Collection View ($redact) Query Untrusted user Driver Authenticate Untrusted User Authenticate Untrusted User Retrieve User Attributes Run Query Create/Apply $redact Expression * See Disclaimer

  35. Parameterized View Concept* { $redact: { $cond: [{ $anyElementTrue: { $map: { input: "$sl", as: "setNeeded", in: { $setIsSubset: ["$$setNeeded", "$$USER.security.tags"] } } } }, "$$DESCEND", "$$PRUNE"] } } User labels retrieved from security "context" * See Disclaimer

  36. Other Features* • LDAP Authentication • x.509 Authentication • Keyfile alternative • Auditing (admin functions – DDL, DCL) • User defined roles • Collectionlevel access control * See Disclaimer

  37. Next Steps • Looking for customers to evaluate • Trusted middleware example code

  38. References • http://docs.mongodb.org/manual/release-notes/2.6/ • http://docs.mongodb.org/manual/security/

  39. Thank You James Kerr james.kerr@mongodb.com

More Related