accumulo-user mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Robert Vesse <>
Subject Re: Cell-level visibility use case
Date Wed, 28 Mar 2012 21:39:15 GMT
Every user would have a login - I'm not saying this is a realistic usage example I was just
trying to illustrate the use of cell level security.

But yes cell level security obviously ties in quite closely with user accounts since you can
assign users scan authorizations and if they haven't been assigned those authorizations any
attempt to use those authorizations (even if they know the correct visibility label) results
in a security error.


On Mar 28, 2012, at 2:18 PM, Jason Axelson wrote:

> So Robert in that example every user has an actual login into
> Accumulo? Or would they log into some internal web site that then logs
> in on behalf of them? Or perhaps uses a shared users login versus a
> managers login?
> Jason
> On Wed, Mar 28, 2012 at 5:36 AM, Robert Vesse <> wrote:
>> An even more general sector agnostic example
>> You are maintaining an employee database that doubles as the employee
>> internal directory.  Anyone can look up another employee's phone
>> number/email but only HR and management should be able to look up an
>> employees salary/bonus
>> Rob
>> On Mar 28, 2012, at 8:30 AM, Cardon, Tejay E wrote:
>> Yes, thank you John.  That certainly opens up some possibilities.
>> tejay
>> From: John Vines []
>> Sent: Wednesday, March 28, 2012 10:48 AM
>> To:
>> Subject: EXTERNAL: Re: Cell-level visibility use case
>> An off the top of my head example, which may not be valid, but seems
>> reasonable to me.
>> You have one piece of information, HIPAA related. So data gets tagged for
>> insurance, doctors, and nurses lets say. But along comes a researcher who
>> wants to do data mining on medical records. Some users may consent, others
>> may not. Those who consent can get their data tagged for insurance, doctors,
>> nurses, and researchers. And if we want to get more detailed, maybe there's
>> different types of research going on. Perhaps researcher1 is looking at
>> heart conditions relative to ancestry whereas researcher2 is looking at
>> diabetes in relation to income. A person may consent to one, but not the
>> other, and then have their data tagged for researcher1, but not necessarily
>> researcher2.
>> Hope this example sheds some light on the possibilities with this visibility
>> design.
>> John
>> On Wed, Mar 28, 2012 at 8:51 AM, Cardon, Tejay E <>
>> wrote:
>> All,
>>                 I’m trying to wrap my head around the cell-level security
>> model.  When is it more useful than row or column level?  Is it useful with
>> regards to analytics or machine learning, or only for row by row manual
>> access?  I’d really appreciate any examples of where it is used in an
>> unclassified domain (perhaps medical?)
>> Thanks,
>> Tejay

View raw message