An Efficient User–Kernel Access Control Scheme for Lightweight Data Connectors

Data connectors are key components for enabling controllable data exchange in data marketplaces and constitute one of the foundational technologies for realizing data sovereignty. To support controllable data exchange in lightweight data connectors, it is crucial to design an efficient and scalable access control mechanism. However, user-space access control suffers from high decision latency, whereas kernel-space access control is limited by constrained policy capacity and inflexible policy updates. To address these challenges, we propose an efficient user–kernel access control scheme for lightweight data connectors. The scheme leverages extended Berkeley Packet Filter (eBPF) to load high-frequency access control rules into the kernel while retaining low-frequency rules in user space. To further improve access control efficiency, we design a Bloom-filter-based kernel admission filter to block invalid requests before they enter the policy decision point (PDP). To prevent long-tail requests from polluting the kernel cache, we develop a set-associative, access-frequency-aware cache replacement mechanism. To determine the optimal memory allocation between these two kernel-side components, we model access control decisions as an M/D/1 queueing system, and analyze the relationship between end-to-end policy decision latency and cache miss probability to guide the memory partitioning between the two kernel-side components. We implement a prototype based on eBPF. Experimental results show that, under the same policy set size, our system reduces the average service time by approximately 25 10^6 policies, it reduces the average service time by up to 85.6 γ > 80% , the proposed design reduces latency by up to 65