security and privacy in dbms and in sql database

By:-Gourav Kottawar 1

Chapter 8Security and Privacy

Database security issues Discretionary access control based on grant &

revoking privilege Mandatory access control and role based access control for multilevel security Encryption & public key infrastructures

Security and privacy


Types of Security: Legal & Ethical issues regarding the right to access certain

information. System related issues such as the system levels at which

various security functions should be enforced , for e.g whether a security function should be handled at the physical hardware level, the operating system level or the DBMS level.

The need in some organizations to identify multiple security levels & to categorize the data & users based on these classifications , for e,g top secret, secret, confidential, & unclassified.

Policy issues at the governmental, institutional or corporate level as to what kind of information should be made publicly available, for e.g credit ratings & personal medical records.

Database Security Issues


Threats to database result in loss or degradation of following security goals:

Loss of Integrity: Database Integrity refers to the requirement that information be protected from improper modification.

Loss of Availability: Database availability refers to making objects available to the user or a program to which they have a legitimate right.

Loss of Confidentiality: Refers to the protection of data from unauthorized disclosure.

Unauthorized , unanticipated or unintentional disclosure could result in loss of public confidence

Modification of data includes creation, insertion , modification, changing the status of data & deletion.

Integrity is lost if unauthorized changes are made to the data by either intentional or accidental acts.

Threats to Database


To protect database against these types of threats four countermeasures can be implemented:

Access Control Flow Control Encryption


In a multi-user Database System , DBMS must provide techniques to enable certain users or user groups to access selected portions of a database without granting access to the rest of the database.

There are two types of security mechanisms: Discretionary security Mechanisms: These are used to

grant privileges to users , including the capability to access specific data files, records , or fields in a specific mode (such as read , insert , delete or update)

Mandatory Security Mechanisms: These are used to enforce multilevel security by classifying data & users into various security classes.

For e.g a role based security , which enforces policies & privileges based on the concept of roles.

Methods for Database Security


A major problem to all computer systems is that of preventing unauthorized persons from accessing the system itself.

The security mechanisms of DBMS must include provisions for restricting access to the database system as a whole.

The function is called Access Control & is handled by creating user accounts & passwords to control the login process by the DBMS.

DBA is the central authority for managing a database system. DBA’s responsibilities include: Account Creation Privilege granting Privilege revocation Security level assignment

Access Control


Whenever a person or a group of persons needs to access a database system, the individual or group must first apply for a user account.

The DBA will then create a new account & password for the user if there is a legal need to access the database.

The user must login to the DBMS by entering the account name/number & password whenever database access is needed.

The database system must also keep track of all operations on the database that are applied by a certain user throughout each login session.


The typical method of enforcing discretionary access control in a database system is based on the granting & revoking of privileges.

The main idea is to include statements in the query language that allow the DBA & selected users to grant & revoke privileges.

Types of Discretionary Privileges: There are two levels for assigning privileges to use

the database system.:◦The account level: DBA specifies the particular

privileges that each account holds independently of the relations in the database.

◦The relation (table) level: DBA can control the privileges to access each individual relation in the database.

Discretionary Access Control


Privileges at account level apply to the capabilities provided to the account itself & can include the CREATE TABLE / VIEW PREVILAGE, ALTER privilege , DROP privilege, MODIFY, SELECT privilege

Account level privileges are not defined as part of SQL ; they are left to the DBMS implementers to define.

The second level of privilege applies to the relation level, whether they are base relations or virtual relations.

In SQL the following types of privileges can be granted on each individual relation R.

SELECT: Gives the account retrieval privilege. MODIFY: This gives the account the capability to modify

tuples of R. In SQL this is divided into UPDATE, DELETE & INSERT privileges.


A user who creates a view has precisely those privileges on the view that he or she has on the base tables used to define the view.

The user creating the view must have the SELECT privilege on each underlying table ,so is always granted the SELECT privilege on the view.

The creator of the view has the SELECT privilege with the grant option only if he or she has the SELECT privilege with the grant option on every underlying table.

The user automatically gets the same privilege on the view. A view may be dropped as a SELECT privilege is revoked from

the user who created the view. If the creator of the view gains additional privilege on the

underlying tables, he or she automatically gains additional privileges on the view.

Grant & Revoke on Views & Integrity Constraints


In this method a user either has or does not have a certain privilege.

In many applications an additional security policy is needed that classifies data & users based on security classes.

This approach is known as mandatory access control. It is important to note that most of the commercial DBMSs

currently provide mechanisms only for discretionary access control.

However the need for multilevel security exists in government , military & intelligence applications , as well as in many industrial & corporate applications.

Typical security classes are ◦ Top secret (TS)◦ Secret (S)◦ Confidential( C)◦ Unclassified (U)

MANDATORY ACCESS CONTROL


TS is the highest level & U the lowest.

The system uses four security classification levels , where TS>S>C>U.

The commonly used model for multilevel security , known as Bell-Lapadula model.

It classifies each subject (user, account, program) & object (table, tuple,column,view,operation) into one of the security classifications.

The classification of subject S is referred as class(S) & classification of object is referred as class(O)


MAC is based on system wide policies that can not be changed by individual user.

In this approach each database object is assigned a security class.

Each user is assigned a clearance for a security class. Rules are imposed on reading & writing of database

objects by users. The DBMS determines whether a given user can read

or write a given object based on certain rules that involve the security level of that object & the clearance of the user.

These rules seek to ensure that sensitive data can never be ’passed on’ to a user without the necessary clearance.

SQL standard does not include any support for MAC.


Clearance is the security level to which an individual user or client can access information.

This clearance is associated with ‘need to know’ requirement.

The Bell-Lapadula model imposes two restrictions on all reads & writes of database objects:

Simple-security property: A subject can read an object only if the security level of the subject is higher or equal to the security level of object. (read –down)

*-property: A subject can write on an object only if the security level of the object is higher or equal to the security level of the subject. (write up)

It is usually assumed that the security levels on subjects & objects once assigned cannot be changed (except DBA)

This is the reason that the MAC is mandatory.


Subjects: Individuals who perform some activity on the database. Might include specific people or a group of users

Objects: Database units that require authorization in order to manipulate. Database units might include an entire table, specific columns in a table, specific rows in a table, etc.

Actions: Any activity that might be performed on an object by a subject. For example: Read, Modify, Insert, Write, Delete, Grant (the ability to grant authorizations to others)

Constraint: A more specific rule regarding an aspect of the object and action.


For e.g a user with TS clearance can read a table with C clearance , but a user with C clearance is not allowed to read a table with TS classification. (Simple Security Property)

*_Property: For e.g a user with S clearance can write only objects with S or TS classification.

In case of Multilevel security notions into the relational database model, it is common to consider attribute values & tuples as data objects.

Each attribute is associated with a classification C. Each attribute value is associated with a corresponding

security classification.


RBAC emerged in 1990s as a proven technology for managing & enforcing security in large scale enterprise wide systems.

Its basic notion is that permissions are associated with roles, & users are assigned to appropriate roles.

Roles can be created using CREATE ROLE & DESTROY ROLE commands.

RBAC appears to be a viable alternative to traditional discretionary & mandatory access controls; it ensures that only authorized users are given access to certain data or resources.

User create sessions during which they may activate a subset of roles to which they belong.

Each session can be assigned to many roles, but it maps to only one user.

Many DBMSs have allowed the concept of roles , where privileges can be assigned to roles.

Role Based Access Control


Another important consideration in RBAC systems is the possible temporal constraints that may exist on roles, such as the time & duration of role activations & time triggering of a role by an activation of another role.

RBAC models have several desirable features , such as flexibility , better support for security management & administration.

RBAC can be effectively used for developing secure Web based applications , however MAC & DAC lack capabilities needed to support a secure web based application.


The previous access control mechanisms being strong countermeasures, may not be able to protect databases from some threats.

Suppose we communicate data, but our data falls into the hands of some invalid user.

In this situation , by using encryption we can disguise the message so that even if the transmission is diverted, the message will not be revealed.

Encryption is a means of securing data in a insecure environment.

Encryption consists of applying an encryption algorithm to data using some pre specified encryption key.

The resulting data has to be decrypted using a decryption key.

Encryption & Public Key Infrastructure


The DES (Data Encryption Standard )is a system developed by the U.S government for use by the general public.

It has been widely accepted as a cryptographic standard both in the United States & abroad.

DES can provide end-to-end encryption on the channel between the sender A & receiver B.

The DES algorithm is a careful & complex combination of two of the fundamental building blocks of encryption: Substitution & Transposition

The algorithm derives its strength from repeated application of these two techniques for a total of 16 cycles.

The Data & Advanced Encryption Standards


substitution :For example: a is replaced with D, b with E, c with F and z with C. In this way attack becomes DWWDFN. The substitution ciphers are not much secure because intruder can easily guess the substitution characters.

Transposition:Plaintext: this is a testt h i si s a t tiehssiatst!e s t !


In 1976 Diffie & Hellman proposed a new kind of cryptosystems ,which they called public key encryption.

This algorithm uses two separate keys, in contrast to conventional encryption , which uses only one key.

The two keys are referred to as public key , & private key. The private key is kept secret . The Public key Encryption scheme:

◦ Plain Text◦ Encryption Algorithm◦ Pubilc key & Private key : Public key is used for

encryption & Private key used for decryption.◦ Cipher Text◦ Decryption Algorithm

Public Key Encryption


When John wants to send a secure message to Nipun, he uses Nipun 's public key to encrypt the message. Nipun then uses her private key to decrypt it. An important element to the public key system is that the public and private keys are related in such a way that only the public key can be used to encrypt messages and only the corresponding private key can be used to decrypt them. Moreover, it is virtually impossible to figure out the private key if you know the public key.

Public-key systems are becoming popular for transmitting information via the Internet. They are extremely secure and relatively simple to use. The only difficulty with public-key systems is that you need to know the recipient's public key to encrypt a message for him or her.

Public-key

http://www.webopedia.com/TERM/E/encryption.html

http://www.webopedia.com/TERM/D/decryption.html

http://www.webopedia.com/TERM/I/Internet.html


ciphertext (or cyphertext) is the result of encryption performed on plaintext using an algorithm, called a cipher .Ciphertext is also known as encrypted or encoded information because it contains a form of the original plaintext that is unreadable by a human or computer without the proper cipher to decrypt it. Decryption, the inverse of encryption, is the process of turning ciphertext into readable plaintext.

ciphertext

http://en.wikipedia.org/wiki/Encryption

http://en.wikipedia.org/wiki/Plaintext

http://en.wikipedia.org/wiki/Cipher

http://en.wikipedia.org/wiki/Decryption


plaintext is information a sender wishes to transmit to a receiver. Cleartext is often used as a synonym. Plaintext has reference to the operation of cryptographic algorithms, usually encryption algorithms

Plaintext

http://en.wikipedia.org/wiki/Synonym

http://en.wikipedia.org/wiki/Cryptography

http://en.wikipedia.org/wiki/Encryption

security and privacy in dbms and in sql database

Education