SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Database Security Mandatory Access Model with Temporal Authorizations

primo avatar
primo
24 diapositives · 413 Views · Aug 24, 2014

Database Security Mandatory Access Model with Temporal Authorizations. Pooja Bajracharya Pratibha Katuri Richard Neidermyer. Database Security. Applicable In Many Environments E-Commerce, Medical, and Military Various Implementation Levels Storage Transmission Authorization Inference

Database Security Mandatory Access Model with Temporal Authorizations - slide 1
01 / 24Database Security Mandatory Access Model with Temporal Authorizations
1 / 17

Télécharger la présentation

Database Security Mandatory Access Model with Temporal Authorizations
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Database SecurityMandatory Access Model with Temporal Authorizations Pooja Bajracharya Pratibha Katuri Richard Neidermyer

  2. Database Security • Applicable In Many Environments • E-Commerce, Medical, and Military • Various Implementation Levels • Storage • Transmission • Authorization • Inference • Why? • There is a need for a robust and efficient mechanisms to overcome threats to these implementation environments.

  3. Loss of Integrity Defense from Invalid Modification Loss of Availability Database Access Time Proper User Authentication Loss of Confidentiality Protection from Disclosure Covert Channels Security Threats

  4. Function of Security • Right of Access to Information • Legal • Ethical • Organizational Policy • Public vs. Private • Governmental \ Corporate • Organizational Multilevel Policy • User and Data Classifications

  5. Access Controls • Focus on Organization Multilevel Policy • DBMS Consists of: • Subjects (Users) • Objects • Access Relationships Define Privileges • Privilege Implies Specific Accesses • Privilege Has Access Type • Read, Write, and Modify

  6. Discretionary Access Control • Access Matrix Model • Rows represent subjects • Columns represent objects

  7. Mandatory Access Control • Assigns Sensitivity Levels • Top Secret, Secret, Confidential, Unclassified • Typical Security Policy • class (S) >= class (O) • Imposed Restrictions • Simple Security Property • Read (O) iff class (S) >= class (O) • Star Property • Write (O) iff class (S) <= class (O)

  8. Temporal Authorization • Temporary Privileges • Time Interval for Subject \ Object Privilege • Temporal Dependency • Whenever, Aslongas, Whenever Not, Unless • Authorization Type • Positive \ Negative • Example • [t1, t2] {User1, Object1, Read}

  9. Problem Statement • Merge MAC with Temporal Authorizations • Issues to Address • Maintain MAC Restrictions • Detect Request (Grant) Conflicts • Handle Generated Hierarchy Authorizations • Cascade Temporal Authorization • Overlapping Temporal Authorizations • Identified and Marked During Cascade • Checked During Revocation

  10. Solution • Develop Temporal Authorization Definition • General Validation of Request • Introduce Object Families • Cascade Validation • Recursive Cascade Validation • Final Grant Procedure • Revocation Procedure

  11. HTA • Hierarchical Temporal Authorization • Adds ‘a’ Parent Authorization Attribute

  12. Restriction Validation • Validates Initial Request • Class (S) versus Class (O)

  13. Validation Example • Employee Relation Schema UserS – Read UserC - Read

  14. Object Families • Introduces Third Dimension of Object • Defines Authorization Domain • Family Access Function • Family[O] returns F = {Oxf1, Oxf2, …, OxfN}

  15. Cascade HTA • Without Family Attribute – or NULL • With Family Attribute • 5, 6, 7, 9, 12 • 1, 2, 8, 11 • 3, 10, 13

  16. Recursive Cascade Validation • Verifies Hierarchical Restrictions • Cascade Domain Is Object Family • Supports Multiple Family Objects

  17. Cascade Example • Database Objects with Families • Request State • Result • No higher class object can have a READ with user. • With A this does not cause conflict. • EMPLOYEE branches to B and LOCATIONS conflicts.

  18. Grant Procedure • High-level Execution for Every Request • Uses Recursive Cascade Authorization • Applies Cascade HTAs to HTAR

  19. Revoke Algorithm • Validates Revoke Request • Removes HTAs from HTAR • Implicitly Handles Overlapping HTAs

  20. Conclusion • Presented an Authorization Model with Temporal Capabilities for MAC • Maintain Mandatory Security Policies • Simple Security Property • Start Property • Introduced Two New Concepts • Hierarchical Temporal Authorizations • Object Family Assigment

  21. Conclusion • Defined Authorization Grant Procedure • Validation • Cascade Validation • Recursive Cascade Validation • Defined Authorization Revoke Procedure • Handles Overlapping HTA • Uses HTA Registry for Execution

  22. Future WorkHierarchical Temporal Authorization Registry • Repository of Granted, Un-expired HTA • HTA Parent Association Must Exist • Define Storage and Access Mechanisms • Stress HTAR Execution Efficiency

  23. Future WorkFurther Evaluation of Family Assignment • Provides Distribution Mechanism to DBA • Effect of Family Assignment on Relation Authorization Access • Achieve Balance Database Object Count and Family Count

  24. QuestionsandComments Thank You