Security in Databases. 2 Srini & Nandita (CSE2500)DB Security Outline review of databases...

Security in Databases

2Srini & Nandita (CSE2500)DB Security

Outline

• review of databases• reliability & integrity• protection of sensitive data• protection against inference• multi-level security

CSE2500 System Security & Privacy

3Srini & Nandita (CSE2500)DB Security

Database

DBMS

DB Administrator

users

4Srini & Nandita (CSE2500)DB Security

Database concepts

• database– data + rules

• components of data– records: composed of fields / elements

• logical structure schema• attribute name of a column• relation a set of columns

5Srini & Nandita (CSE2500)DB Security

A sample database

NAME SEX AID FINES DRUGS DORM Adams M 5000 45.0 1 Holmes Bailey M 0 0.0 0 Grey Chin F 3000 20.0 0 West Dewitt M 1000 35.0 3 Grey Earhart F 2000 95.0 1 Holmes Fein F 1000 15.0 0 West

6Srini & Nandita (CSE2500)DB Security

DB should deliver (advantages)

• shared access• minimal redundancy• data consistency• data integrity• controlled access

7Srini & Nandita (CSE2500)DB Security

Security requirements

• physical DB integrity• logical DB integrity• element (field) integrity• auditability• access control• user authentication• availability

– (integrity, confidentiality & availability)

8Srini & Nandita (CSE2500)DB Security

Reliability & integrity

• three dimensions:– database integrity– element integrity– element accuracy

• various techniques– 2-phase update– introducing redundancy– recovery– concurrency/consistency control– using monitors

9Srini & Nandita (CSE2500)DB Security

2-phase update

• phase-1: Intent– gathering info & resources– no harm in the case of failure– writing of a commit flag to data base

• phase-2: Commit– set commit flag in the database– causing permanent changes– may be repairable in the case of failure

10Srini & Nandita (CSE2500)DB Security

2-Phase Update (Example)

• Suppose DB query asks to add 1 to fields X and Y.• Phase 1 (Intent):

– Compute updated values in temporary “Shadow” variables Xnew and Ynew:

> Xnew := X + 1, Ynew := Y + 1

• Phase 2 (Commit):– Set “Commit” flag (i.e. DB changes started, do not

repeat Intent phase!)– Copy shadow values into DB:

> X := Xnew, Y := Ynew– Write “Update Complete”, Clear Commit flag.

11Srini & Nandita (CSE2500)DB Security

Redundancy/internal consistency

• using error detection / correction codes– entire database

– records

– fields / elements

• shadow fields– duplication of attributes / records

12Srini & Nandita (CSE2500)DB Security

Recovery

• one way to achieve this is to have a log file for all recent changes (since last backup)

13Srini & Nandita (CSE2500)DB Security

Concurrency/Consistency

• In a multi-user/process/client environment, concurrency and consistency control is vitally important.

• Basic techniques– using “atomic operation”

> Read-then-(if OK)Write: A Write query to a field is conditioned on its current contents being as specified (in case it was modified recently by someone else)

– using “locking” mechanisms> Read queries to a record are blocked while a write is

performed to the record by someone else

14Srini & Nandita (CSE2500)DB Security

Monitors

• checking the structural consistency of data entered or modified

– range comparison -- field specific– state constraints

> describe of the condition of entire DB> (Properties which should be satisfied by DB contents at all times)

– transition constraints> describe the conditions necessary before a change can be made

• (Properties which should be satisfied by DB contents so that a change to DB is valid) Collectively called Integrity Constraints

15Srini & Nandita (CSE2500)DB Security

On sensitive data

• factors that make data sensitive– inherently sensitive

– from a sensitive source

– declared sensitive

– of a sensitive attribute or a sensitive record

– sensitive in relation to previously disclosed information

• sensitivity of data in a DB may vary !

16Srini & Nandita (CSE2500)DB Security

A sample database

NAME SEX AID FINES DRUGS DORM Adams M 5000 45.0 1 Holmes Bailey M 0 0.0 0 Grey Chin F 3000 20.0 0 West Dewitt M 1000 35.0 3 Grey Earhart F 2000 95.0 1 Holmes Fein F 1000 15.0 0 West

17Srini & Nandita (CSE2500)DB Security

Access decisions on sensitive data

• factors to be considered when permitting “user x to access data y”

– availability of data> Record is blocked from read while it is modified

– acceptability of access> No disclosure (even ‘partial’) of sensitive values to

unauthorized users

– assurance of authenticity of user> Limit access based on other considerations (time of

access, previous accesses,…)

18Srini & Nandita (CSE2500)DB Security

Types of disclosure of sensitive data

• exact data (field = x)• Bounds

– x < field < y• negative result

– field is not equal to x• Existence

– an Attribute of a field exists in DB• probable value

– reducing the number of possible values for a field, Improving knowledge of their relative likelihoods.

19Srini & Nandita (CSE2500)DB Security

Inference Problem

• definition:– infer or derive sensitive data from non-

sensitive or (seemingly) un-related data

• “inference” is a subtle vulnerability in database security

20Srini & Nandita (CSE2500)DB Security

A sample database

NAME SEX AID FINES DRUGS DORM Adams M 5000 45.0 1 Holmes Bailey M 0 0.0 0 Grey Chin F 3000 20.0 0 West Dewitt M 1000 35.0 3 Grey Earhart F 2000 95.0 1 Holmes Fein F 1000 15.0 0 West

21Srini & Nandita (CSE2500)DB Security

Direct attack

• list NAME where SEX = M & DRUGS = 1

• list NAME where(SEX = M & DRUGS = 1) |(SEX != M & SEX != F) |(DORM != East)

22Srini & Nandita (CSE2500)DB Security

Indirect attack (statistical inference)

• Sum

sum of financial aid by dorm & sex

Holmes Grey West Total M 5000 1000 0 6000F 2000 0 4000 6000Total 7000 1000 4000 12000

23Srini & Nandita (CSE2500)DB Security

Indirect attack (cont.)

• Count– count of students by dorm & sex

Holmes Grey West Total M 1 2 0 3F 1 0 2 3 Total 2 2 2 6

– can be used in combination with “sum”

24Srini & Nandita (CSE2500)DB Security

Indirect attack (cont.)

• Median

highest value forattribute 1

lowest value forattribute 1

lowest value forattribute 2

highest value forattribute 2

median forattribute 1 &median forattribute 2

25Srini & Nandita (CSE2500)DB Security

revealing Earhart’s drug

• Earhart is the only person who has the median of AID and DRUGS, so if data on AID is known, the following query reveals Earhart’s DRUGS:

p = median (DRUGS where AID=2000)

26Srini & Nandita (CSE2500)DB Security

Indirect attack (cont.)

• Linear system attack– by solving a set of equations

e.g.

q1 = c1 + c2 + c3

q2 = c2 + c3

q3 = c1 + c3

27Srini & Nandita (CSE2500)DB Security

Controls for statistical inference

• 2 types of control– applied to queries --- very hard !

– applied to data items --- relatively easy> suppression --- sensitive data are not

provided> concealing --- precise data are not provided

28Srini & Nandita (CSE2500)DB Security

Summary of inference

• no perfect solution to inference problem• 3 common approaches

– suppress obviously sensitive data fairly easy

– track what the user knows costly

– disguise data may result in incorrect or wrong responses to legitimate queries

29Srini & Nandita (CSE2500)DB Security

Multi-level security

• The 2 level security model, sensitive or non-sensitive, is inadequate in many practical applications:

– The security of a data element may be different from that of other elements in the same row or column.

– In practice many grades of security may be needed.

– The security of an aggregate may be different from that of the individual elements

30Srini & Nandita (CSE2500)DB Security

Realising Multi-level Security

• Partitioning– each sub-database corresponds to a security level

• Encryption– each record (or field) can be encrypted using a

different key

• Integrity lock• Trusted Front End• Commutative Filter• Window/View