Enforcing data access control and privacy: The graph-driven data regulatory approach

Abstract

Comprehensive data-driven systems require the integration of various access control and privacy patterns to address the diverse needs of subjects. However, existing approaches often struggle to simultaneously support precise access control, privacy preservation, and efficient policy maintenance. This paper presents G2D (Graph to Data), a novel technique that employs a Data Regulatory Graph (DRG) to dynamically generate data authorization statements tailored to specific subjects. G2D unifies access control and privacy by producing authorized SQL queries and specifying necessary data transformations for sensitive fields. Experimental results demonstrate that G2D incurs minimal execution overhead, simplifies policy updates, and effectively balances system performance with data protection, even under high concurrency. These findings highlight G2D's potential to support scalable, privacy-aware data access in complex environments. © 2025 The Authors