Views for Multilevel Database Security

Abstract

Because views on relational database systems mathematically define arbitrary sets of stored and derived data, they have been proposed as a way of handling context-and contenbdependent classification, dynamic classification, inference, aggregation, and sanitization in multilevel database systems. This paper describes basic view concepts for a multilevelsecure relational database model that addresses the above issues. The model treats stored and derived data uniformly within the database schema. All data in the database is classified according to views called classification constraints, which specify security levels for related data. In addition, views called aggregation constraints specifies classifications for aggregates that are classified higher than the constituent elements. All data accesses are confined to a third set of views called access views, which higher than their declared 1.Introduction filter out all data classified view level.The objective of this paper is to describe basic view concepts for a multilevel-secure relational database model. The model is being developed as part of three-year project to design a system that will meet the criteria for class A1l. The project goals include producing a security policy, formal model, formal top level specifications, and implementation specifications.The concept of secure views originated in IBMs System R database system (now called SQL/DS), which was inspired by Codd's fundamental work on relational databaaes2. System R introduced a view as a stored or derived relation expressed in the query language SQL. It then tied its access control mechanism to views by making views the objects of authorization (see also Date' and Dennings). The rationale for this decision was that views, being at a CH2292-l/861X100/01 56$01.0001986IEEE higher level of abstraction than the physical data, simplify the spectlcation and enforcement of contextand content-dependent constraints. For the same reason, Stonebraker6 adopted a high-level approach in the INGRES relational system, though the strategy there uses query modification rather than views. The model we will describe uses features from both System R and INGRES. Concurrent with the development work at IBM, Neumann obsewed that views provided an attractive method for implementing a secure relational data management system on top of SRI's Provably Secure Operating System (PSOS)7. In the PSOS approach, a view is restricted to a subset of a single relation and serves as a capability for selective access to the relation.Neither the IBM nor SRI projects addressed the issues that would be raised if views were used to classify data and enforce mandatory security. Proposals to use secure views as a basis for multilevelsecure database systems were independently made by Clay brook8 and by Denning", who at that time was helping to organize the 1982 Woods Hole Summer Study on Multilevel Database Management Security sponsored hy the National Academy of Sciences, Air Force Studies Board. Denning observed that because views can define arbitr...

Precise, dynamic information flow for database-backed applications

“…There are many ways to avoid storing too much data in practice. Work on multi-level databases [21,30] suggests it is both useful and practically feasible to store multiple versions of data corresponding to different access levels. The question becomes, then, how to avoid storing too much data due to too id name location jid jvars 1 "Carol's ... party" "Schloss Dagstuhl" 1 "x=True" 2 "Private event"…”

Supporting Collaborative Privacy‐Observant Information Sharing Using RFID‐Tagged Objects

“…They allow users to manage data presentation without affecting underlying data. Views are also used to enhance database security [58,59]. We exploit and enhance views so as to provide users with lightweight methods for adjusting presentation of personal data and managing information flows.…”

Knowledge Required for Detecting and Defending against Denial of Service Attacks

“…Important:{1, 3,5,6,8,19,[23][24][25][26][27][28]32,33,35,36,[38][39][40][41]7,9,11,14,17,20,22,29,30,34,37> Unimportant: (4,12,13,15,16,18,19,21,3) Unimportant: (7,8,9,11,13,22,27,28,30,31,35,36,37, 40,41) Table 4. SVM detection efficacy for dos using different features obtained from svdf ranking…”

“…IDSs are classified, based on their functionality, as misuse detectors and anomaly detectors. Misuse detection systems use the attack of well-know patterns as the basis for detection [3,4,5,6,7]. Anomaly detection systems use user profiles as the basis for detection; any deviation from the normal user behavior is termed as intrusions [3,4,5,8,9,10].…”

“…Several intrusion detection systems are built with human intervention and without human intervention. Rule based intrusion detection systems; these systems are characterized by their expert system properties that fire the rules when audit records or system status begin to turn illegal [3,4,11,12]. Statistical based intrusion detection systems; these systems seek to identify the deviations from the normal looking at the state and audit records [8,13,14,15,16,17,18].…”