Database Security: Access Control

Limiting Horizontal Propagation

• Limiting horizontal propagation to an integer number i means that an account B with the GRANT OPTION can grant the privilege to at most i other accounts.

Mandatory Access Control and Role-Based Access Control for Multilevel Security

• Traditional discretionary access control techniques are not sufficient for many applications, and additional security policies are needed to classify data and users based on security classes.
• Mandatory access control classifies data and users into security classes, such as top secret (TS), secret (S), confidential (C), and unclassified (U), where TS is the highest level and U is the lowest.

Bell-LaPadula Model

• The Bell-LaPadula model classifies each subject (user, account, program) and object (relation, tuple, column, view, operation) into one of the security classifications, T, S, C, or U.
• Two restrictions are enforced on data access based on the subject/object classifications:
  • Simple security property: a subject S is not allowed read access to an object O unless class(S) ≥ class(O).
  • • property (or star property): a subject S is not allowed to write an object O unless class(S) ≤ class(O).

Multilevel Security in Relational Database Model

• In the relational database model, attribute values and tuples are considered as data objects.
• Each attribute A is associated with a classification attribute C in the schema, and each attribute value in a tuple is associated with a corresponding security classification.
• A multilevel relation schema R with n attributes is represented as R(A1, C1, A2, C2, …, An, Cn, TC).
• The value of the TC attribute in each tuple provides a general classification for the tuple itself, while each Ci provides a finer security classification for each attribute value within the tuple.

Multilevel Relations

• A multilevel relation appears to contain different data to subjects with different clearance levels.
• In some cases, it is possible to store a single tuple in the relation at a higher classification level and produce the corresponding tuples at a lower-level classification through filtering.
• Polyinstantiation occurs when several tuples can have the same apparent key value but have different attribute values for users at different classification levels.

Entity Integrity Rule for Multilevel Relations

• The entity integrity rule for multilevel relations states that all attributes that are members of the apparent key must not be null and must have the same security classification within each individual tuple.
• All other attribute values in the tuple must have a security classification greater than or equal to that of the apparent key.

Null Integrity and Interinstance Integrity

• Null integrity and interinstance integrity ensure that if a tuple value at some security level can be filtered (derived) from a higher-classified tuple, then it is sufficient to store the higher-classified tuple in the multilevel relation.

Comparing Discretionary Access Control and Mandatory Access Control

• Discretionary Access Control (DAC) policies are characterized by a high degree of flexibility, making them suitable for a large variety of application domains.
• The main drawback of DAC models is their vulnerability to malicious attacks, such as Trojan horses embedded in application programs.
• Mandatory policies ensure a high degree of protection by preventing any illegal flow of information.