Souripriya Das, Oracle America, Inc., Architect and Manager

Fine-Grained Access Control (FGAC) is critical not just for government or healthcare agencies but for any enterprise that stores confidential data. While FGAC tools already exist for relational data, the unique nature of RDF data requires RDF-aware customizations of such tools before they can be used. Consider this simple example: What should be the response of an FGAC-enabled RDF triplestore when a user attempts to insert a triple that already exists but is not visible to the user? Raising a "duplicate entry" exception would reveal the presence of the triple whereas simply ignoring the insertion attempt would have the same effect when that user tries (unsuccessfully) to access the (invisible) pre-existing triple. The problem is that, unlike a relational table row which typically has a primary key and several non-key columns, every component of an RDF triple is part of its primary key. In this presentation we will explain the various types of access control and the granularities at which they can be applied to RDF data, starting from dataset level access control and then going down all the way to the finest grain where visibility of not just a triple but every component of a triple can be controlled independently. After explaining the principles, we will illustrate their implementations in the Oracle Database, highlighting the customizations used for adapting the existing FGAC tools to enable support for arguably the finest-grained access control of RDF data.