Database Security
Dr. Ali El-Bastawissy

Textbooks
Elmasri/Navathe (3rd ed.) Chapter 22 Elmasri/Navathe (2nd ed.) Chapter 20 Connolly, Begg (3rd ed.) Chapter 18 and Chapter 6 (sec. 6.6)

Security & Integrity Security is to ensure that:
Users are allowed to do the things they are trying to do.

Integrity is to ensure that:
Things that users are trying to do are correct

Security & Integrity Similarities
Security To protect data against intruders (unauthorized users) Described using DCL Maintained in systems Catalog Integrity To ensure data accuracy or validity Described using constraints in DDL Maintained in systems Catalog

DBMS must know Who is authorized to do What Example:
Emp(e#, ename, addr, d#, Salary, Assessment) Types of security controls:
Operations Subset of Rows Subset of columns Time interval Terminal Location Statistical Functions Etc.

Identification & Authentication
Identification users have to identify themselves by:
Identity Number/Name Machine Readable Identity Card/Badge ..

Authentication users have to authenticate their identifications;
Password ٍSecret Number Signature Voice Print Finger Print Answers Recognition …

Data Classification Approach
Each data object is assigned a Classification Level:
Top Secret Secret Confidential Unclassified

Each user is assigned a Clearance level Control Rules:
User I can see object j if: Clearance level (i) >= Classification level (j) User I can modify object j if: Clearance level (i) = Classification level (j)

Authorization Matrix
Data Object 1 Select, Update All
User id m

User Id 1

Data object 2 All Null Insert

Run Run, Modif Null

Data object n Delete, Insert Select All

Null

Data Object Profile User Profile

Authorization Matrix
Subject Ed Ed Ed Ed Bill Sally Sally Object Employee Employee Employee Employee Employee PurchaseOrder PurchaseOrder