Download slides - cse.sc.edu

Introduction
Database Security
Overview
Readings


This lecture:
– Textbook: Chapter 5.2
– Lecture materials from CSCE 522, Nov. 3,
Lecture 20 at
http://www.cse.sc.edu/~farkas/csce5222010/lectures.htm
For next class:
– Textbook: Chapter 10.1, 10.2
CSCE 824
2
Database Security
Requirements







CSCE 824
Physical database integrity
Logical database integrity
Element integrity
Auditability
Access control
User authentication
Availability
3
Sensitive data





CSCE 824
Inherently sensitive
From a sensitive source
Declared sensitive
Part of a sensitive attribute or
record
In relation to previously disclosed
information
4
Types of disclosures





CSCE 824
Exact data
Range of data
Negative results
Existence
Probable values
5
Access control



CSCE 824
Operating system
Database Management System
Granularity!
6
Granularity





CSCE 824
Database
Relation Advantages vs. disadvantages
of supporting
Record
different granularity levels
Attribute
Element
7
Granularity





CSCE 824
Database
Relation
Record
Attribute
Element
Advantages vs. disadvantages
of supporting
different granularity levels
8
Relation-Level
Granularity
(Works)= Secret
Personname
Smith
Companyname
BB&C
Salary
Dell
Bell
$97,900
Black
BB&C
$35,652
CSCE 824
9
$43,982
Tuple-level Granularity
Works
Personname
Smith
Companyname
BB&C
Salary

$43,982
P
Dell
Bell
$97,900
S
Black
BB&C
$35,652
P
CSCE 824
10
Attribute-Level
Granularity
Works
PersonCompanySalary
name
=P name
=P
Smith
BB&C
$43,982
Dell
Bell
$97,900
Black
BB&C
$35,652
CSCE 824
11
=S
Cell-Level Granularity
Works
Personname
Smith
Salary
P
Companyname
BB&C
P
$43,982
S
Dell
S
Bell
$97,900
S
Black
P BB&C
S $35,652
S
CSCE 824
S
12
Access Control Mechanisms




CSCE 824
Security through Views
Stored Procedures
Grant and Revoke
Query modification
13
Security Through Views

Assign rights to access predefined views
CREATE VIEW Outstanding-Student
AS SELECT NAME, COURSE, GRADE
FROM Student
WHERE GRADE > B
Problem:
Difficult to maintain updates.
CSCE 824
14
Security Through Views
Student relation
NAME
White
COURSE
CSCE 122
GRADE
C+
SEMESTER
Fall 2000
Black
Brown
Green
Blue
CSCE 313
CSCE 580
CSCE 850
CSCE 122
A
A
B+
B
Fall 2000
Spring 2000
Fall 2000
Fall 2000
CSCE 824
15
Security Through Views
CREATE VIEW Outstanding-Student
AS SELECT NAME, COURSE, GRADE
FROM Student
WHERE GRADE > B
Outstanding-Student
CSCE 824
NAME
Black
Brown
COURSE
CSCE 313
CSCE 580
GRADE
A
A
Green
CSCE 850
B+
16
Security Through Views
CREATE VIEW Fall-Student
AS SELECT NAME, COURSE
FROM Student
WHERE SEMESTER=“Fall 2000”
Fall-Student
CSCE 824
NAME
COURSE
White
CSCE 122
Black
CSCE 313
Green
Blue
CSCE 850
CSCE 122
17
Stored Procedures


Assign rights to execute compiled programs
GRANT RUN ON <program> TO <user>
Problem:
Programs may access resources for which the
user who runs the program does not have
permission.
CSCE 824
18
Grant and Revoke
GRANT <privilege> ON <relation>
To <user>
[WITH GRANT OPTION]
-----------------------------------------------------------------------------------------------------------------------------------



GRANT SELECT * ON Student TO Matthews
GRANT SELECT *, UPDATE(GRADE) ON
Student TO FARKAS
GRANT SELECT(NAME) ON Student TO
Brown
GRANT command applies to base relations as
well as views
CSCE 824
19
Grant and Revoke
REVOKE <privileges> [ON
<relation>]
FROM <user>
------------------------------------------------------------------------------------------------------------------------



CSCE 824
REVOKE SELECT* ON Student FROM Blue
REVOKE UPDATE ON Student FROM Black
REVOKE SELECT(NAME) ON Student FROM
Brown
20
Query Modification



CSCE 824
GRANT SELECT(NAME) ON Student TO Blue
WHERE COURSE=“CSCE 590”
Blue’s query:
SELECT *
FROM Student
Modified query:
SELECT NAME
FROM Student
WHERE COURSE=“CSCE 580”
21
Indirect Information Flow Channels


CSCE 824
Covert channels
Inference channels
22
Communication Channels


CSCE 824
Overt Channel: designed into a
system and documented in the user's
manual
Covert Channel: not documented.
Covert channels may be deliberately
inserted into a system, but most such
channels are accidents of the system
design.
23
Covert Channel



CSCE 824
Timing Channel: based on system times
Storage channels: not time related
communication
Can be turned into each other
24
Inference Channels
Non-sensitive
information
CSCE 824
+
Meta-data
25
=
Sensitive
Information
Inference Channels


CSCE 824
Statistical Database Inferences
General Purpose Database Inferences
26
Statistical Databases

Goal: provide aggregate information about
groups of individuals
– E.g., average grade point of students

Security risk: specific information about a
particular individual
– E.g., grade point of student John Smith

Meta-data:
– Working knowledge about the attributes
– Supplementary knowledge (not stored in database)
CSCE 824
27
Types of Statistics
Macro-statistics: collections of related statistics
presented in 2-dimensional tables

Sex\Year
1997
1998
Sum
Female
4
1
5
Male
6
13
19
Sum
10
14
24

CSCE 824
Micro-statistics: Individual data records used for
statistics after identifying information is removed
Sex
Course
GPA
Year
F
CSCE 590
3.5
2000
M
CSCE 590
3.0
2000
F
CSCE 790
4.0
2001
28
Statistical Compromise


CSCE 824
Exact compromise: find exact value of
an attribute of an individual (e.g., John
Smith’s GPA is 3.8)
Partial compromise: find an estimate of
an attribute value corresponding to an
individual (e.g., John Smith’s GPA is
between 3.5 and 4.0)
29
Methods of Attacks and Protection

Small/Large Query Set Attack
– C: characteristic formula that identifies groups of
individuals
If C identifies a single individual I, e.g., count(C) =
1
– Find out existence of property


If count(C and D)=1 means I has property D
If count(C and D)=0 means I does not have D
OR
– Find value of property
CSCE 824

Sum(C, D), gives value
30 of D
Small/Large Query Set Attack
cont.


CSCE 824
Protection from small/large query set
attack: query-set-size control
A query q(C) is permitted only if
N-n  |C|  n , where n  0 is a parameter
of the database and N is all the records in
the database
31
Tracker attack
q(C) is disallowed
C=C1 and C2
T=C1 and ~C2
Tracker
C
C2
C1
q(C)=q(C1) – q(T)
CSCE 824
32
Tracker attack
q(C and D) is disallowed
C=C1 and C2
T=C1 and ~C2
C
Tracker
C2
C1
C and D
q(C and D)=
q(T or C and D) – q(T)
CSCE 824
D
33
Query overlap attack
Q(John)=q(C1)-q(C2)
C1
C2
Kathy
John
Paul
Eve
Max
Fred
CSCE 824
Mitch
34
Protection:
query-overlap control
Insertion/Deletion Attack

Observing changes overtime
–
–
–
–

CSCE 824
q1=q(C)
insert(i)
q2=q(C)
q(i)=q2-q1
Protection: insertion/deletion performed
as pairs
35
Statistical Inference Theory

CSCE 824
Give unlimited number of statistics and
correct statistical answers, all statistical
databases can be compromised (Ullman)
36
Inferences in GeneralPurpose Databases



CSCE 824
Queries based on sensitive data
Inference via database constraints
Inferences via updates
37
Queries based on sensitive data


Sensitive information is used in selection
condition but not returned to the user.
Example: Salary: secret, Name: public
NameSalary=$25,000

CSCE 824
Protection: apply query of database
views at different security levels
38
Database Constraints



CSCE 824
Integrity constraints
Database dependencies
Key integrity
39
Integrity Constraints



CSCE 824
C=A+B
A=public, C=public, and B=secret
B can be calculated from A and C, i.e.,
secret information can be calculated
from public data
40
Database Dependencies
Metadata:
 Functional dependencies
 Multi-valued dependencies
 Join dependencies
 etc.
CSCE 824
41
Functional Dependency


FD: A  B, that is for any two tuples in the
relation, if they have the same value for A,
they must have the same value for B.
Example: FD: Rank  Salary
Secret information: Name and Salary together
– Query1: Name and Rank
– Query2: Rank and Salary
– Combine answers for query1 and 2 to reveal Name
and Salary together
CSCE 824
42
Key integrity



CSCE 824
Every tuple in the relation have a unique
key
Users at different levels, see different
versions of the database
Users might attempt to update data that
is not visible for them
43
Example
Secret View
Name (key)
Black P
Red S
Salary
38,000 P
42,000 S
Address
Columbia S
Irmo S
Name (key)
Salary
Address
Black P
38,000 P
Null P
Public View
CSCE 824
44
Updates
Public User:
Name (key)
Black P
Salary
38,000 P
Address
Null P
1. Update Black’s address to Orlando
2. Add new tuple: (Red, 22,000, Manassas)
If
Refuse update: covert channel
Allow update:
• Overwrite high data – may be incorrect
• Create new tuple – which data it correct
(polyinstantiation) – violate
key constraints
CSCE 824
45
Updates
Secret user:
Name (key)
Salary
Address
Black P
38,000 P
Columbia S
Red S
42,000 S
Irmo S
1. Update Black’s salary to 45,000
If
Refuse update: denial of service
Allow update:
• Overwrite low data – covert channel
• Create new tuple
– which data it correct
(polyinstantiation) – violate key constraints
CSCE 824
46
Inference Problem



CSCE 824
No general technique is available to
solve the problem
Need assurance of protection
Hard to incorporate outside knowledge
47
Next Class

Transaction Processing
CSCE 824
48