1
CHAPTER 2: DATABASE SECURITY AND AUTHORIZATION
Introduction to DB Security Issues-Discretionary Access Control Based on Granting
/Revoking of Privileges-Mandatory Access Control for Multilevel Security-Statistical DB
Security
Memorize the following things from exercise book:
DB SECURITY
Discretionary access Mandatory control
Grant privilege revoke privilege (right) classified unclassified
Top secret secret
Confidential
DB security issues
I. Legal and ethical issues
II. Political issues
III. System related issues
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr
2
2.1 Introduction to DB Security Issues:
In this chapter we discuss the techniques used for protecting the database against
persons who are not authorized to access either certain parts of a database or the whole
database. Provides an introduction to security issues and an overview of the topics
covered in the rest of this chapter.
It discusses the mechanisms used to grant and revoke privileges in relational
database systems and in SQL—mechanisms that are often referred to as
discretionary access control offers an overview of the mechanisms for
enforcing multiple levels of security—a more recent concern in database system
security that is known as mandatory access control.
Briefly discusses the security problem in statistical databases. Readers who are
interested only in basic database security mechanisms will find it sufficient to
cover the material.
2.2 Discretionary Access Control Based on Granting /Revoking of Privileges:
Database security is a very broad area that addresses many issues, including the
following:
Legal and ethical issues regarding the right to access certain information. Some
information may be deemed to be private and cannot be accessed legally by
unauthorized persons. In the United States, there are numerous laws governing
privacy of information.
Policy issues at the governmental, institutional, or corporate level as to what
kinds of information should not be made publicly available—for example, credit
ratings and personal medical records.
System-related issues such as the system levels at which various security
functions should be enforced—for example, whether a security function should
be handled at the physical hardware level, the operating system level, or the
DBMS level.
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr
3
The need in some organizations to identify multiple security levels and to categorize the
data and users based on these classifications—for example, top secret, secret,
confidential, and unclassified. The security policy of the organization with respect to
permitting access to various classifications of data must be enforced.
In a multi-user database system, the DBMS must provide techniques to enable certain
users or user groups to access selected portions of a database without gaining access to
the rest of the database.
This is particularly important when a large integrated database is to be used by many
different users within the same organization. For example, sensitive information such as
employee salaries or performance reviews should be kept confidential from most of the
database system’s users
A DBMS typically includes a database security and authorization subsystem that is
responsible for ensuring the security of portions of a database against unauthorized
access. It is now customary to refer to two types of database security mechanisms:
Discretionary security mechanisms: These are used to grant privileges to users,
including the capability to access specific data files, records, or fields in a
specified mode (such as read, insert, delete, or update).
2.3 Mandatory Access Control for Multilevel Security
2.3.1 Integrity:
The typical method of enforcing discretionary access control in a database system is
based on the granting and revoking of privileges. Let us consider privileges in the
context of a relational DBMS. In particular, we will discuss a system of privileges
somewhat similar to the one originally developed for the SQL language. Many current
relational DBMSs use some variation of this technique. The main idea is to include
additional statements in the query language that allow the DBA and selected users to
grant and revoke privileges.
The tuples would be filtered to appear as shown in with Salary and Job Performance
appearing as null. For a user with security clearance U, the filtering allows only the
name attribute of Smith to appear, with all the other attributes appearing as null.
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr
4
Thus filtering introduces null values for attribute values whose security classification is
higher than the user’s security clearance. In general, the entity integrity rule for
multilevel relations states that all attributes that are members of the apparent key must
not be null and must have the same security classification within each individual tuple.
In addition, all other attribute values in the tuple must have a security classification
greater than or equal to that of the apparent key. This constraint ensures that a user can
see the key if the user is permitted to see any part of the tuple at all.
Other integrity rules, called null integrity and interinstance integrity, informally ensure
that, if a tuple value at some security level can be filtered (derived) from a higher-
classified tuple, then it is sufficient to store the higher-classified tuple in the multilevel
relation.
2.3.2 Consistency
To illustrate poly instantiation further, suppose that a user with security clearance C
tries to update the value of Job Performance of ‘Excellent’; this corresponds to the
following SQL update being issued: UPDATE EMPLOYEE SET Job Performance =
‘Excellent’ WHERE Name = ‘Smith’;
Since the view provided to users with security clearance C , permits such an update, the
system should not reject it; otherwise, the user could infer that some non null value
exists for the Job Performance attribute of Smith rather than the null value that appears.
This is an example of inferring information through what is known as a covert channel,
which should not be permitted in highly secure systems.
However, the user should not be allowed to overwrite the existing value of Job
Performance at the higher classification level. The solution is to create a poly
instantiation for the Smith tuple at the lower classification level “C”. This is necessary
since the new tuple cannot be filtered from the existing tuple at classification S. The
basic update operations of the relational model (insert, delete, and update) must be
modified to handle this and similar situations, but this aspect of the problem is outside
the scope of our presentation. We refer the interested reader to the end-of-chapter
bibliography for further details.
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr
5
Mandatory security mechanisms: These are used to enforce multilevel security by
classifying the data and users into various security classes (or levels) and then
implementing the appropriate security policy of the organization. For example, a typical
security policy is to permit users at a certain classification level to see only the data
items classified at the user’s own (or lower) classification level. We discuss
discretionary security.
A second security problem common to all computer systems is that of preventing
unauthorized persons from accessing the system itself—either to obtain information or
to make malicious changes in a portion of the database.
The security mechanism of a DBMS must include provisions for restricting access to the
database system as a whole. This function is called access control and is handled by
creating user accounts and passwords to control the log-in process by the DBMS. We
discuss access control techniques. A third security problem associated with databases is
that of controlling the access to a statistical database, which is used to provide statistical
information or summaries of values based on various criteria.
For example, a database for population statistics may provide statistics based on age
groups, income levels, size of household, education levels, and other criteria. Statistical
database users such as government statisticians or market research firms are allowed
to access the database to retrieve statistical information about a population but not to
access the detailed confidential information on specific individuals. Security for
statistical databases must ensure that information on individuals cannot be accessed. It
is sometimes possible to deduce certain facts concerning individuals from queries that
involve only summary statistics on groups; consequently this must not be permitted
either. This problem, called statistical database security.
A fourth security issue is data encryption, which is used to protect sensitive data—such
as credit card numbers—that is being transmitted via some type of communications
network. Encryption can be used to provide additional protection for sensitive portions
of a database as well. The data is encoded by using some coding algorithm. An
unauthorized user who accesses encoded data will have difficulty deciphering it, but
authorized users are given decoding or decrypting algorithms (or keys) to decipher the
data.
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr
6
Encrypting techniques that are very difficult to decode without a key have been
developed for military applications. We will not discuss encryption algorithms here. A
complete discussion of security in computer systems and databases is outside the scope
of this textbook.
We give only a brief overview of database security techniques here.
Database Security and the DBA As we discussed earlier, the database administrator
(DBA) is the central authority for managing a database system. The DBA’s
responsibilities include granting privileges to users who need to use the system and
classifying users and data in accordance with the policy of the organization.
The DBA has a DBA account in the DBMS, sometimes called a system or superuser
account, which provides powerful capabilities that are not made available to regular
database accounts and users.
DBA privileged commands include commands for granting and revoking privileges to
individual accounts, users, or user groups and for performing the following types of
actions:
1. Account creation: This action creates a new account and password for a user or a
group of users to enable them to access the DBMS.
2. Privilege granting: This action permits the DBA to grant certain privileges to certain
accounts.
3. Privilege revocation: This action permits the DBA to revoke (cancel) certain
privileges that were previously given to certain accounts.
4. Security level assignment: This action consists of assigning user accounts to the
appropriate security classification level.
The DBA is responsible for the overall security of the database system. Action 1 in the
preceding list is used to control access to the DBMS as a whole, whereas actions 2 and 3
are used to control discretionary database authorizations, and action 4 is used to
control mandatory authorization.
2.4 Statistical DB Security
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr
7
Whenever a person or a group of persons needs to access a database system, the
individual or group must first apply for a user account. The DBA will then create a new
account number and password for the user if there is a legitimate need to access the
database.
The user must log in to the DBMS by entering the account number and password
whenever database access is needed.
The DBMS checks that the account number and password are valid; if they are, the user
is permitted to use the DBMS and to access the database.
Application programs can also be considered as users and can be required to supply
passwords. It is straightforward to keep track of database users and their accounts and
passwords by creating an encrypted table or file with the two fields Account-Number
and Password.
This table can easily be maintained by the DBMS. Whenever a new account is created, a
new record is inserted into the table. When an account is canceled, the corresponding
record must be deleted from the table.
The database system must also keep track of all operations on the database that are
applied by a certain user throughout each log-in session, which consists of the sequence
of database interactions that a user performs from the time of logging in to the time of
logging off.
When a user logs in, the DBMS can record the user’s account number and associate it
with the terminal from which the user logged in. All operations applied from that
terminal are attributed to the user’s account until the user logs off.
It is particularly important to keep track of update operations that are applied to the
database so that, if the database is tampered with, the DBA can find out which user did
the tampering. To keep a record of all updates applied to the database and of the
particular user who applied each update, we can modify the system log.
If any tampering with the database is suspected, a database audit is performed, which
consists of reviewing the log to examine all accesses and operations applied to the
database during a certain time period.
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr
8
When an illegal or unauthorized operation is found, the DBA can determine the account
number used to perform this operation. Database audits are particularly important for
sensitive databases that are updated by many transactions and users, such as a banking
database that is updated by many bank tellers. A database log that is used mainly for
security purposes is sometimes called an audit trail.
********************************End-Chapter-2***************************************
Not for sale @Copyright is reserved for the text book authors and printers – Database Systems –
Elmari &Nivetha [Prepared by [Link] Sirajudeen, The course Instructor ]-[Link] IT -2 nd Yr