Overview. Database Security. Relational Database Basics. Semantic Integrity Controls. Access Control Rules- Name dependent access

Transcription

1 Database ecurity ione FischerHübner Applied ecurity, DAVC7 Overview eantic Integrity Controls Access Control Rules Multilevel ecure Databases RBAC in Coercial DBM tatistical Database ecurity Relational Database Basics A Relational Database is perceived as a collection o tables/relations John ith Prograer IT ecurity specialist ecretary A priary key is a unique and inial identiier or the tuples within a relation (e.g., eployee nae) eantic Integrity Controls Monitor: nit o DBM that checks value being entered to ensure consistency with rest o the database characteristics o the particular ield Entity Integrity Rule: No coponent o the priary key ay accept a null value (no entry). eantic Integrity Controls (II) Fors o Monitor checks: Range coparison: check that values are within acceptable range days in January: 3 salary o eployees < Access Control Rules Nae dependent access Nae dependent: based on object nae/id (e.g. nae o relations/tables, attributes) Can be enorced by underlying O tate constraints: describe conditions or entire database all eployees have dierent eployee nubers only one eployee is president Transition constraints: conditions necessary beore changes to be applied eployee who is arried cannot becoe single Alice Bob Exaple: Eployee Table R,W Course Table R R

2 Content dependent Access Contentdependent: based on object content Ipleentation: contentbased views, query odiication Exaple: Contentbased View DEFINE VIEW X (Eployeeno, salary) A ELECT Eployeeno, salary Fro Eployee WHERE ALARY < Contentdependent Access (II) Exaple: Query Modiication DENY (Nae, ALARY) WHERE ALARY > FIND alary WHERE Nae = ith > (is odiied to) FIND alary WHERE Nae = ith AND T alary > Contextdependent Access Contextdependent: based on syste variables such as data, tie, query source contextbased views Exaple: alary inoration can only be updated at the end o the year Multilevel ecure Databases Ipleent Bell LaPadula s Mandatory ( MultiLevel ) ecurity policy in a relational database First prototype in the eaview (ecure data VIEW) project (988) Major database vendors have DBM versions with ultilevel database security support (e.g. Trusted Oracle) Multilevel ecure Databases tructure Multilevel ecure Databases Exaple Labeling Objects: R: ultilevel relation with n attributes A tuple in R is o the or (v, c,, v n, c n, t c ) where v i : ith attribute value c i : security level o the ith ield (not visible to users) t c : security level o the tuple (not visible) Exaple: C nae C Dept Dept Virus prograer IT ecurity specialist ecretary C pro T : unclassiied : ecret T: Top ecret (For siplicity, we only consider the security classiication parts o the security level in this and in the ollowing exaples) tc T

3 Multilevel ecure Databases Instances Multilevel ecure Databses Instances (II) CInstance o a relation: Inoration in relation accessible by users at classiication C. Values not accessible are replaced by null values (no entry). Instance: Exaples: Instance: ecretary Dept IT ecurity specialist ecretary Consistent Addressing In order to address a data ite, you have to speciy a database D a relation R within D a priary key or a tuple r within D the attribute i, identiying eleent r i within r To get through to eleent r i, the ollowing ust hold: O (D) O (R) O (r i ) ( O : object security level) ince a user who has access to a tuple r has also access to all its eleents O (r i ) O (r) is required Multilevel Entity Integrity No tuples in an instance o R have null values or any o the priary key attributes All coponents o a priary key o a relation R have the sae security level, which is doinated by the security levels o all nonkey attributes Polyinstantiation Polyinstantiation: everal tuples ight exist or the sae priary key Polyinstantiated eleents: Eleents o an attribute which have dierent security levels, but are associated with the sae priary key and key security level Proble: Tradeo between conidentiality (covert channel protection) and integrity Polyinstantiation (II) How do polyinstantiated eleents arise? A subject updates what appears a null eleent in a tuple, but which actually hides data with a higher (or incoparable) security level Proble: ubject cannot be inored about existence o higher security level data (> covert channel) Overwriting the old value allows low users to unwittingly destroy high data Insertion ust be accepted 3

4 Polyinstantiation Exaple Polyinstantiation Exaple (cont.) Instance o our Exaple Database: ecretary C nae Dept C Dept Virus Prograer IT ecurity specialist ecretary C pro T tc T Priary key: Eployee Nae nclassiied ubject requests the ollowing operation: pdate eployee ET proession = Prograer WHERE nae = C nae Dept C Dept Virus Prograer IT ecurity specialist Prograer ecretary C pro T tc T nique Identiication RBAC Features in Coercial DBM Extended priary key: Priary key + security levels o all ields in a tuple needed or a unique identiication o tuples Ability or a role grantee to grant that role to other users Multiple active roles or a user session peciy a deault active role set or a user session Build a role hierarchy Feature peciy static separation o duty constraints on roles peciy dynaic separation o duty constraints on roles peciy axiu or iniu cardinality or role ebership Grant DBM yste Privileges to a role GRANT DBM Object Privileges to a role Inorix () ybase Oracle tatistical Database ecurity tatistical Database: Inoration is retrieved by eans o statistical queries on an attribute (colun) o a table Attributes directly identiying persons (e.g., naes, personal nubers) are usually not allowed or statistical queries Record No tatistical Database Exaple Nae Mayer ith neyer Hall Bob Fisher Knuth ilver Cohn veniek ex Age Major C C C C C GP 3 Nae: identity data (identiying the persons) ex, Age, Major: deographic data (generally known to any people) GP(student grades): analysis data (not publicly known, o interest or attackers)

5 tatistical Queries tatistical query: q(c,) (or siply: q(c)) q: statistical unction C: characteristic orula, logical orula over the values o attributes using the operators OR, AND, T : subset o attributes Exaple: CONT (( EX = MALE ) AND ( MAJOR = C )) M(( EX = MALE ) AND ( MAJOR = C ), GP) query set (C) = set o records whose values atch a characteristic orula C ALL = orula whose query set is the entire database iple Attacks all Query et Attacks: Attacker knows that ith is a eale C student: CONT (( EX = FEMALE ) AND ( MAJOR = C )) = => ith is the only eale C student. M(( EX = FEMALE ) AND ( MAJOR = C ), GP) = ith s GP = iple Attacks (II) Large Query et Attacks: It is not suicient to suppress only sall query sets! The sae statistics can be calculated by: CONT(ALL) CONT(T ((EX = FEMALE) AND (MAJOR = C))) = M(ALL, GP) M(T((EX = FEMALE) AND (MAJOR = C)),GP) = Query et ize Control A statistic q(c) is peritted only i n query set (C) Nn or paraeter n, N: size (No. o tuples) o database q(all) can be coputed ro: q (All) = q (C) + q (T C) or C with n query set (C) Nn However: Tracker attacks can still coproise security! Individual Tracker Attack Individual Tracker: uppose: q (C) is rejected, because query set (C) = C = C AND C, n query set (C) N n n query set (C AND T C) N n Individual Tracker: { C, C AND T C} Individual Tracker Attack: (or q : M or CONT)) q(c) = q(c AND C) = q(c) q (C AND T C) Individual Tracker Attack (II) Venn Diagra: C C x z y C= C AND C q(c) = x + z = q(c AND T C) + q(c) => q(c) = q(c AND C) = q(c) q (C AND T C) 5

6 Individual Tracker Exaple Exaple: n =, Individual Tracker = { (Major = C), (Major = C) AND T (EX = ))} M((Major = C) AND (ex = ),GP) = M (Major = C, GP) M ((Major = C) AND T (ex = ), GP) = 0 = A new Individual Tracker has to be ound or each person! General Tracker Attack General Tracker: Characteristic Forula T such that *n query set (T) N *n, n N/ General Tracker Attack: q(all) = q(t) + q(not T) I query set (C) < n: q(c) = q(c or T) + q(c or not T) q(all) General Tracker Attack (II) VennDiagra: T not T C w x not C y z q(all) = w + x + y + z = q(t) + q(not T) q(c or T) + q(c or not T) = (w+x+y) + (w+x+z) = (w+x) + (w+x+y+z) = q(c) + q(all) => q(c) = q(c or T) + q(c or not T) q(all) General Tracker Attack Exaple Exaple: n =, T = (ex= Male) M ((EX = FEMALE) AND (MAJOR = C), GP) = M((EX = FEMALE) AND (MAJOR = C)) OR (EX = MALE),GP) + M (((EX = FEMALE) AND (MAJOR = C)) OR (T (EX = MALE)), GP) M (ALL, GP) = = M (ALL, GP) = M (EX = MALE, GP) + M (T (EX = MALE), GP) Inerence Controls ecurity Controls or tatistical Databases: Data Pertubation (slightly odiies data values in database) Output Controls Output Modiication (odiies statistics, adds sall relative errors to outputs, e.g, rounding, adding rando nubers) Output election (rejects sensitive statistics, e.g. query set size control, axiu order control) Exercise Find a General Tracker Individual Tracker to coproise Mayer s GP (see exaple DB above) 6