CSC 316 Chapter 6a, Spring 2004

Chapter 6 Data Base Security Sawma V., Computer Security and Their Data 2 Outline Integrity in data bases (6.1-6.3) Security in data bases (6.4, 6.5) Multilevel data bases (6.6, 6.7) Sawma V., Computer Security and Their Data 3 Data base Introduction Data base Data base administrator Data base management system (DBMS)  Informally known as “Front end” Data base server Sawma V., Computer Security and Their Data 4 Data base Introduction Schema (or logical structure)  Subschema (part of the database schema) Records (rows) Attributes (columns) Fields (or elements, cells) Queries: retrieval, change (insert, delete, update), aggregate functions Sawma V., Computer Security and Their Data 5 Data Base Security Requirements Physical data base integrity  Immune to physical problems: power failure Logical data base integrity  Structure of database is preserved: modifying one element does not modify another (or vice versa) Element integrity  Data in element is accurate Auditability  Keep track of access information  Keep track of who made what, when, where, and how Sawma V., Computer Security and Their Data 6 Data Base Security Requirements Access control  Control authorized access  Block unauthorized access User authentication  Ensure positive user identification Availability  Access all data if authorized  Access no data if NOT authorized Database Integrity  Applies to individual elements of the database Sawma V., Computer Security and Their Data 7 Data Base Security Requirements Confidentiality  Related to data (mainly deals with inference problem) Availability  Important due to shared access motivation that underlies the usage of databases. Other requirements? (for mission critical systems)  Fault tolerance  highly available Sawma V., Computer Security and Their Data 8 Data Base Reliability Three dimensions of data base reliability/integrity: 1. Data base integrity – Protection of database as a whole – OS responsibility – integrity control and recovery procedures – ex. Backup 2. Element integrity – Data written or changed only by authorized users – DBMS responsibility: Access control 3. Element accuracy – Only correct values are written into elements – DBMS responsibility: field check and constraint conditions Sawma V., Computer Security and Their Data 9 Database Reliability Redundancy / Internal Consistency  Error detection and correction codes  Shadow fields Recovery Concurrency / Consistency Monitors Range Comparisons State Constraints Transition Constraints Sawma V., Computer Security and Their Data 10 The 2-Phase Update Protocol Goal: To prevent inconsistent data base states Two steps: 1. The intent phase – Check to make sure that each step can be done – Save final results in a temporary place – This phase can be repeated many times with no harm 2. The update phase – Set COMMIT flag – All checks have been made successfully in previous phase – Move temporary values to real places – Unset COMMIT flag – This phase can be repeated many times with no harm Sensitive Data Sawma V., Computer Security and Their Data 12 Sensitive Data  Introduction (1) Sensitive data is data that should not be public. Three kinds of databases:  One that contains nothing sensitive  One that contains everything sensitive  One that contains some but not all sensitive Sensitive data may be in varying degrees of sensitivity. Sawma V., Computer Security and Their Data 13 Sensitive Data  Introduction (2) The access control problem is to limit users’ access so that they can obtain only the data to which they have legitimate access. Several factors that make data sensitive:  inherently sensitive (value itself is sensitive)  from a sensitive source  declared sensitive  of a sensitive attribute or a sensitive record  sensitive in relation to previously disclosed information (composite data) Sawma V., Computer Security and Their Data 14 Sensitive Data  Access Decisions (1) Access decisions are made by database administrator and based on an access policy. The DBMS implements the access decisions. There are several factors when deciding whether to permit an access. They are:  Availability of the data: some required data may not be accessible.  Example: locking of tuples when updating  Serious problem may result: Denial of Service Sawma V., Computer Security and Their Data 15 Sensitive Data  Access Decisions (2)  Acceptability of access: some data may be sensitive and not accessible by some user.  This control is not as simple as it sounds, because:  the sensitive fields may not be directly requested but only be referenced  some user may want a nonsensitive statistic from the sensitive data Sawma V., Computer Security and Their Data 16 Sensitive Data  Access Decisions (3)  Assurance of Authenticity: certain characteristics of the user that is external to the database may also be considered.  access the database only during the working time  previous request made by the user may be considered (because sensitive data can sometimes be revealed by combining less sensitive data) Sawma V., Computer Security and Their Data 17 Sensitive Data  Types of Disclosures (1) Data can be sensitive, but even information about data is also a form of disclosure. So a successful security strategy must protect from both direct and indirect disclosure. Exact data: sensitive data itself Bounds: sometimes by knowing the bounds on a sensitive data and using a narrowing technique the user may determine the sensitive data in any desired precision. Sawma V., Computer Security and Their Data 18 Sensitive Data  Types of Disclosures (2) Negative Result: some query may be made to determine a negative result from which sensitive data may be disclosed. Existence: the existence of data is itself a sensitive data, regardless of the actual value. Probable value: it may be possible to determine the probability that a certain element has a certain value. Sawma V., Computer Security and Their Data 19 Sensitive Data  Security vs. Precision Sharing of nonsensitive data:  Security: To disclose only nonsensitive data, and reject any query that mentions a sensitive field.  Precision: To protect all sensitive data while disclose as much nonsensitive data as possible. The ideal combination is to maintain perfect security with maximum precision. In fact, we often must sacrifice precision in order to maintain security.