## 5 Case Study 1--ITMI: Non-IoT
### The Solution: HEAD Metamodel
#### 5.2.3 Phase 3: NGAC--The Policy Enforcement Point  
In this section, we explain how the AC policy is enforced over Cypher queries issued from a system that uses Cypher statements as NGAC inputs (we use Neo4j) and can generate NGAC authorization responses based on those queries. In Figure 12, in the left section the nodes shown in light and dark green color illustrate the assignment of users (Us) to their roles/groups (UAs), in addition to the role hierarchy which is indicated by the red arrows and 'has_child_content' relationship. The nodes indicated in light and dark blue color in the right section of the graph represent the assignment of objects (Os) to object containers (OAs) (and OAs-OAs), in addition to object hierarchy where the hierarchy of object containers is represented by the red arrows and 'include' relationship. The association relationships, the yellow arrows, represent users' permissions based on their roles/groups. Note that in this paper we use the term 'has_child_content' to indicate the hierarchy of roles, and the term 'include' to represent the hierarchy of objects. By assigning a user to a role (with the inheritance relation between roles), the user is indirectly associated with the access rights of that role's lower roles. Figure 13 illustrates permissions associated for some users on some objects such as in (a) [PERSON] is assigned to the role of director and also has the permission of the lower roles (manager, adviser...). In (b) [PERSON] is assigned to role manager also has the permission of the lower roles (adviser, technician...). In (c), [PERSON] is assigned to role adviser and also has the permission of the lower roles. In (d), [PERSON] is assigned to role specialist in addition to the permissions of groups B and C. For example, the user [PERSON] has the permission DirPermission to confirm and delete [c, d] ProjectDetails data through the Roy-Director assignment, [PERSON] also has the permission ManPermission to {r, w, u} ProjectDetails through the Director-Manager assignment which is expressed as 'has_child_content' relationship in Figure 12 to represent role hierarchy. Consequently, a manager with ManPermission also has AdvPermission, SpePermission, TecPermission, and so on. Note that, to simplify and minimize the number of association relationships between UAs and OAs in the graph of Figure 12, we use single association relationship instead of two or three. For example, in the association between  
Figure 12: Case Study 1: The NGAC policy graph. Manager(UA)-ProjectDetails(OA) which represents ManPermission with {r,w,u} operations, the operation {r} on ProjectDetails can unconditionally be performed by the manager, and the manager cannot perform {w,u} if the (non-contextual constraint) PrjConfirm value is true. In our illustration, we use a single association relationship, instead of two, and apply the constraints on all operations. In Figure 14 we illustrate an example for AdvPermission with its properties which include actions/operations and the contextual constraints. The adviser is able to perform {r,s,u,d} on project Requirements when the context LoginLocation=local' and the current date is before the endDate of the project. In Figure 15 we run some Cypher queries with some constraints using context, user, and object attributes to show NGAC authorization responses to Cypher statements. In (a) we show that the manager is able to perform the needed operations on ProjectDetails, (b) when the value of prjConfirm is updated (by the director) to 'true', (c) he would not be able to perform any operation on ProjectDetails. In (d) and (e) we show that an adviser is able to {r,w,u,d} project Requirements if the current date is less than the end project date.