Chapter 4
Database Security
and Authorization
Security Objectives
Prevent/detect/deter improper
Disclosure of information
Prevent/detect/deter Secrecy
Improper modification
of information
Integrity Availability
Prevent/detect/deter improper
Denial of access to services
2 Database Security
Secrecy: Users should not be able to see
things they are not supposed to.
E.g., A student can’t see other students’
grades.
Integrity: Users should not be able to
modify things they are not supposed to.
E.g., Only instructors can assign grades.
Availability: Users should be able to see
and modify things they are allowed to.
3 Database Security 02/10/25
Databases
Collection of
interrelated data and
set of programs to access the data
Convenient and efficient way of protecting the
data that
Requires:
- Proper user identification
- Information specifying the access rights is
protected from modification
4 Database Security
Access Control
A security policy specifies who is authorized
to do what.
A security mechanism allows us to enforce
a chosen security policy.
Two main mechanisms at the DBMS level:
Discretionary access control(allows each user to
control access to their own data)
Mandatory access control(where access to system
resources is controlled by the operating system (under the control of
a system administrator)
5 Database Security
Access Control
Subject: active entity that requests access to an object
- e.g., user or program
Object: passive entity accessed by a subject
- e.g., record, relation, file
Access right (privileges): how a subject is allowed to
access an object
- e.g., subject s can read object o
6 Database Security
Protection of object at different granularity levels
Database
Relation
Record
Attribute
Element
7 Database Security
Relation-Level
Granularity
Confidential relation
Person- Company- Salary
name name
Smith BB&C $43,982
Dell Bell $97,900
Black BB&C $35,652
8 Database Security
Tuple-level Granularity
Works
Person-name Company- Salary
name
Smith BB&C $43,982 Public
Dell Bell $97,900 Conf.
Black BB&C $35,652 Public
9 Database Security
Attribute-Level
Granularity
Works
Person- Company- Salary
name Publ. name Publ. Conf.
Smith BB&C $43,982
Dell Bell $97,900
Black BB&C $35,652
10 Database Security
Cell-Level Granularity
Works
Person- Company- Salary
name name
Smith P BB&C P $43,982 C
Dell C Bell C $97,900 C
Black P BB&C C $35,652 C
11 Database Security
Discretionary Access Control (DAC)
For each subject access right to the objects are
defined
(subject, object, +/- access mode)
(Kebede, Employee_relation, read)
User based
Grant and Revoke
Problems:
- Propagation of access rights
- Revocation of propagated access rights
12 Database Security
DAC by Grant and Revoke
GRANT SELECT ON Employee GRANT SELECT ON Employee
TO Belay TO Melaku
Belay Melaku
WITH GRANT OPTION
?
Haile revokes grant
given to Belay
?
Haile does not want
Haile (owner) Melaku to access the
Employee relation
GRANT UPDATE(Salary) ON
Employee TO Berhanu
Berhanu
13 Database Security
Implementation
File 1 File 2
Access Control List (column) Joe:Read Joe:Read
(ACL) Joe:Write Sam:Read
Joe:Own Sam:Write
Capability List (row) Sam:Own
Joe: File 1/Read, File 1/Write, File 1/Own, File 2/Read
Sam: File 2/Read, File 2/Write, File 2/Own
Subject Access Object
Access Control Triples Joe Read File 1
Joe Write File 1
Joe Own File 1
Joe Read File 2
Sam Read File 2
Sam Write File 2
Sam Own File 2
14 Database Security
Grant and Revoke
GRANT <privilege> ON <relation>
To <user>
[WITH GRANT OPTION]
------------------------------------------------------------------------------------------------------------------------------------
GRANT SELECT * ON Student TO Matthews
GRANT SELECT * UPDATE(GRADE) ON Student TO
FARKAS
GRANT SELECT(NAME) ON Student TO Brown
GRANT command applies to base relations as well
as views
15 Database Security
Grant and Revoke
REVOKE <privileges> [ON <relation>]
FROM <user>
-------------------------------------------------------------------------------------------------------------------------
REVOKE SELECT* ON Student FROM Blue
REVOKE UPDATE ON Student FROM Black
REVOKE SELECT(NAME) ON Student FROM Brown
16 Database Security
Non-cascading Revoke
B E
A D
C F
A revokes D’s privileges
E
B
A
C F
17 Database Security
Cascading Revoke
B E
A D
C F
A revokes D’s privileges
B
A
18 Database Security
Query Modification
GRANT SELECT(NAME) ON Student TO Blue
WHERE COURSE=“CSCE 590”
Blue’s query:
SELECT *
FROM Student
Modified query:
SELECT NAME
FROM Student
WHERE COURSE=“CSCE 590”
19 Database Security
DAC Overview
Advantages:
Easy to implement
Disadvantages:
Inherent vulnerability
Maintenance of ACL or Capability lists
Maintenance of Grant/Revoke
20 Database Security
Mandatory Access Control (MAC)
Security label
- Top-Secret, Secret, Public
Objects:
Objects security classification
- File 1 is Secret, File 2 is Public
Subjects:
Subjects security clearances
- Brown is cleared to Secret, Black is cleared to Public
Dominance ()
- Top-Secret Secret Public
21 Database Security
MAC
Access rights:
rights defined by comparing the security
classification of the requested objects with the
security clearance of the subject
If access control rules are satisfied, access is
permitted
Otherwise access is rejected
Granularity of access rights!
22 Database Security
Multilevel Relation
Example
SSN (SSN) Course (Course) Grade (Grade)
111-22-3333 S CSCE 786 S A TS
444-55-6666 S CSCE 567 S C TS
Top-secret user sees all data
Secret user sees Secret-View:
Secret-View
SSN (SSN) Course (Course) Grade (Grade)
111-22-3333 S CSCE 786 S null S
444-55-6666 S CSCE 567 S null S
24 Database Security
Statistical DB Security
Statistical DB: Contains information about
individuals, but allows only aggregate queries
(e.g., average age, rather than Joe’s age).
New problem: It may be possible to infer
some secret information!
E.g., If I know Joe is the oldest sailor, I can ask
“How many sailors are older than X?” for different
values of X until I get the answer 1; this allows me
to infer Joe’s age.
Idea: Insist that each query must involve at
least N rows, for some N. Will this work?
(No!)
