Multilevel Security for Relational Databases - Notes

Multilevel Security for Relational Databases

This document provides a comprehensive overview of multilevel security (MLS) in relational databases, covering concepts, models, implementation, encryption, formal analysis, concurrency control, and instance-based security.

Concepts of Database Security

A database system is a computerized system designed to store, organize, access, manage, and modify data on demand. It enhances an organization's ability to manage critical data. Key benefits include:

  • Reducing data redundancy.
  • Improving data access through host and query languages.
  • Enhancing data security.
  • Decreasing data entry, storage, and retrieval costs.
  • Providing flexibility in data manipulation.
  • Ensuring greater data integrity and independence from applications.

The database management system (DBMS) is a software system that enables users to capture and analyze stored data.

Relational Database Security Concepts

Databases are commonly organized using the relational model, where data is stored in relations. A relation is a table consisting of rows (tuples) and columns (attributes). All data within an attribute share the same domain and constraints. A primary key uniquely identifies each tuple in a relation. A foreign key establishes a link between data in two relations.

Relationships between relations can be one-to-many, many-to-many (requiring an associative relation), or one-to-one.

SQL (Structured Query Language) is the standard language for managing data in relational databases. Basic SQL operations include:

  • Select: Retrieves tuples from a relation.
    SELECT[A1,A2,…,An]FROMRWHEREPSELECT [A1, A2, …, An] FROM R WHERE P
  • Insert: Adds tuples to a relation.
    INSERTINTOR[A1,A2,…,An]VALUES[a1,a2,…,an]INSERT INTO R [A1, A2, …, An] VALUES [a1, a2, …, an]
  • Update: Modifies tuples in a relation.
    UPDATERSET[A1=a1,A2=a2,…,An=an]WHEREPUPDATE R SET [A1=a1, A2=a2, …, An=an] WHERE P
  • Delete: Removes tuples from a relation.
    DELETEFROMRWHEREPDELETE FROM R WHERE P

SQL statement processing involves parsing, validation, optimization, execution plan generation, and execution.

Relational database security aims to protect the confidentiality, integrity, and availability of data. Confidentiality prevents unauthorized access, integrity prevents unauthorized alteration, and availability prevents loss of access.

  • Confidentiality: Prevent unauthorized access to sensitive data via encryption.
    • Data in transit.
    • Data at rest.
  • Integrity: Prevent unauthorized alteration of data by ensuring accuracy and consistency.
  • Availability: Prevent loss of access to database services; ensure no unplanned downtime.

Security layers include authentication, access controls, integrity constraints, and auditing.

Access Control in Relational Databases

Access control mechanisms ensure data confidentiality by checking user rights against authorizations. Three main approaches exist:

Discretionary Access Control (DAC)

DAC involves granting and revoking privileges for system objects (relations, views, columns). Privileges are granted to subjects (users, accounts, programs). The data owner has discretion over granting/revoking access. The Database administrator (DBA) is responsible for:

  • Creating user accounts
  • Granting/revoking privileges
  • Monitoring performance
  • Managing backup and recovery

DAC privileges include account privileges (e.g., CREATE TABLE) and relation privileges (e.g., SELECT). Access control can be data-dependent. Two approaches exist for implementing access controls:

  • View-based access control: Defines logical views on the data.
  • Query modification: Alters user queries based on privileges.

SQL GRANT statement:

GRANTprivileges[ONrelation]TOusers[WITHGRANTOPTION]GRANT privileges [ON relation] TO users [WITH GRANT OPTION]

SQL REVOKE statement:

REVOKEprivileges[ONrelation]FROMusersREVOKE privileges [ON relation] FROM users

DAC drawbacks include enforcement dependency on data ownership, cascading authorization issues, Trojan horse attacks, and update problems.

Mandatory Access Control (MAC)

MAC ensures the flow of data based on security levels associated with objects (classification) and users (clearance). It is also known as multilevel security (MLS). Security levels are defined as labels, containing a hierarchical component (security levels) and unordered categories (sensitivity).

Limitations of traditional isolated databases:

  • Redundant databases
  • Redundant workstations
  • High IT infrastructure cost
  • Inefficiency

MLS addresses these issues by allowing data at different classification levels to be accessed by users with different clearance levels.

The Bell and LaPadula model is a basic MLS model with objects (passive entities) and subjects (active processes). LaPadula rules:

  • Simple property (no read up): A subject can read an object if its clearance level is greater than or equal to the object's classification level.
  • Star property (no write down): A subject can write to an object if the object's classification level is greater than or equal to the subject's clearance level.
  • Strong star property: A subject is allowed to write to an object if the subject’s security clearance level is equal to the object’s security classification level.
Role-Based Access Control (RBAC)

RBAC simulates an organization's natural security policies based on user roles. A role is a group of actions and duties belonging to a specific activity. Permissions are defined for roles, and users assigned to a role can perform authorized actions. RBAC components include role-permission, user-role, and role-role relationships. RBAC principles:

  • Least privilege.
  • Separation of duties.
  • Data abstraction.

RBAC uses role hierarchies:

  • General hierarchical RBAC (multiple inheritances).
  • Limited hierarchical RBAC (single descendant).

Work Objectives

Database security is vital for protecting information. Multilevel security provides internal security based on user access types. The book addresses problems of complexity in designing MLS and increasing database size due to classification level columns.

Objectives:

  • Introduce MLS concepts in relational databases.
  • Present a comparative study of previous models.
  • Implement a prototype for performance evaluation of MLS/DBMS models.
  • Present an encryption-based MLS database model.

This model aims to increase robustness against attacks and enhance performance using encryption as a second security layer and reducing the MLS database size.

The effectiveness will be verified through mathematical proofs of soundness, completeness, and security. The model achieves integrity properties, and C# and Microsoft SQL Server source codes will be shown.

Concurrency control manages concurrent execution. Its impact on MLS databases will be explained, and a prototype will be implemented to measure performance costs. The implementation of data manipulation operations for the instance-based multilevel security model (IBMSM) will also be defined.

Book Organization

  • Chapter 2: Basic concepts of multilevel relational database security.
  • Chapter 3: Implementation of multilevel relational database security models and performance study.
  • Chapter 4: Overview of encryption algorithms.
  • Chapter 5: Encryption-based multilevel security database model and prototype implementation.
  • Chapter 6: Formal model for data manipulation operations and mathematical proofs.
  • Chapter 7: Concurrency control in MLS for relational databases.
  • Chapter 8: Implementation of data manipulation operations for IBMSM.
  • Chapter 9: C# and Microsoft SQL Server source codes.