Database Security

John A. Springer, PhD

Assistant Professor
Department of Computer and Information Technology
College of Technology
 Motivation
• Product Lifecycle Management (PLM) initiatives
frequently make extensive use of Product Data
Management (PDM) systems to manage product
information
• A PDM system typically uses a relational
database to store its information
• Software known as a Relational Database
Management System (RDBMS) manages
access to the relational database
• This module discusses database security
concerns of the PDM systems
Traditional Life Cycle
Database Security Concerns
in Traditional Life Cycle
Database Development
Life Cycle
Database Development
Life Cycle
 Security Concerns
• Distributed Environments
– Database interactions across network
– Network may be public
• Sensitivity of Data
– For instance, Social Security Numbers and Credit
Card Numbers
• User Management
– Which users are allowed to connect to the database?
– Which users have which privileges
 Distributed Environments
• Database interaction is typically across a
network
• The network may actually be public, such as the
Internet
• Encrypting data that moves across the network –
for instance, via Secure Sockets Layer (SSL) –
may mitigate this particular concern
• Encryption schemes involve keys; who is
managing the keys?
 Distributed Database Interaction
UNENCRYPTED
DATA
DATABASE
CLIENT SERVER

UNENCRYPTED
DATA
UNENCRYPTED
RESPONSE
UNENCRYPTED
READS/WRITES

In this scenario, all

data is unencrypted DATABASE
ON DISK
 Sensitivity of Data
• Some data is naturally sensitive
• Rarely is data in database encrypted
• Unencrypted data is insecure
• Simply encrypting data is not always the
solution
– Encryption schemes involve keys; who is
managing the keys?
– Encryption can degrade performance
 Encrypted Network Data,
Unencrypted Data in Database

In this
scenario, all
data inside the
database is
unencrypted
 User Management
• Must consider access and security needs when
devising user management approach
• Must also consider the manner in which
authentication will occur
– DBMS vendors provide various methods for handling
authentication
• Role-based Access Controls use roles to control
users’ access rights
– Roles are given privileges and then users are
assigned roles
 References
• Elmasri, R., & Navathe, S. B. (2006).
Fundamentals of Database Systems. Boston:
Addison Wesley.
• Garcia-Molina, H., Ullman, J. D., & Widom, J.
(2001). Database Systems: The Complete Book.
Upper Saddle River, NJ: Pearson/Prentice-Hall.
• Ramakrishnan, R., & Gehrke, J. (2002).
Database Management Systems. New York:
McGraw-Hill.
 Acknowledgments
The author wishes to acknowledge the
support from the Society for Manufacturing
Engineers - Education Foundation, SME-EF
Grant #5004 for “Curriculum Modules in
Product Lifecycle Management.”