ALASCA: Function-Driven Advanced Access Control for Big Cold Data

Large datasets collected over a long time and only accessed on an infrequent basis – called Big Cold Data herein – play an important role in a broad variety of data-driven applications. In managing such data and the access to it, implementing advanced access control schemes beyond mere role-based yes/no-decisions becomes decisive, given the often sensitive or personal nature of the data as well as the multitude of regulatory requirements and other constraints applying to it. Current, mostly cloud-based technologies for storing and managing Big Cold Data, however, lack that advanced access control functionalities, such as consent-based transformations, while existing approaches for implementing such functionalities do not pay sufficient regard to the particularities of Big Cold Data to offer efficient access on an infrequent basis. We therefore propose an architecture and framework (ALASCA) following the function-as-a-service (FaaS) paradigm for implementing versatile access services on cloud-managed Big Cold Data. Towards that end, we offer a first characterization of Big Cold Data and raise challenges in access control, specifically in performing custom and infrequent transformations on large heterogeneous datasets. We demonstrate the applicability of ALASCA by implementing and evaluating it for AWS and Google Cloud. Our preliminary evaluation shows the promise and practical applicability of FaaS-based access control, especially for advanced access control schemes to be applied to Big Cold Data.