Handbook of Database Security Applications and Trends

579 Pages·2007·7.52 MB·English

Handbook of
Database Security
Applications and Trends
Handbook of
Database Security
Applications and Trends
editedby
Michael Gertz
UniversityofCaliforniaatDavis
USA
Sushil Jajodia
GeorgeMasonUniversity
USA
MichaelGertz SushilJajodia
UniversityofCaliforniaatDavis GeorgeMasonUniversity
Dept.ofComputerScience CenterforSecureInformationSystems
OneShieldsAvenue ResearchI,Suite417
Davis,CA95616-8562 FairfaxVA22030-4444
[e-mail] [e-mail]
LibraryofCongressControlNumber:2007934795
ISBN-13:978-0-387-48532-4
e-ISBN-13:978-0-387-48533-1
Printedonacid-freepaper.
(cid:2)c2008SpringerScience+BusinessMedia,LLC.
Allrightsreserved.Thisworkmaynotbetranslatedorcopiedinwholeorinpartwithoutthewritten
permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York,
NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in
connectionwithanyformofinformationstorageandretrieval,electronicadaptation,computersoftware,
orbysimilarordissimilarmethodologynowknownorhereafterdevelopedisforbidden.
Theuseinthispublicationoftradenames,trademarks,servicemarksandsimilarterms,eveniftheyare
notidentifiedassuch,isnottobetakenasanexpressionofopinionastowhetherornottheyaresubject
toproprietaryrights.
9 8 7 6 5 4 3 2 1
springer.com
Preface
Motivationforthebook
Databasesecurityhasbeengainingagreatdealofimportanceasindustry,military,
and government organizations have increasingly adopted Internet-based technolo-
gies on a large-scale, because of convenience, ease of use, and the ability to take
advantage of rapid advances in the commercial market. Along with the traditional
security aspects of data integrity and availability, there is an increasing interest in
research and development in data privacy. This is because today’s often mission-
critical databases no longer contain only data used for day-to-day processing by
organization;asnewapplicationsarebeingadded,itispossiblefororganizationsto
collectandstorevastamountsofdataquicklyandefficientlyandtomakethedata
readilyaccessibletothepublic,typicallythroughWeb-basedapplications.Unfortu-
nately,ifsecuritythreatsrelatedtotheintegrity,availability,andprivacyofthedata
arenotproperlyresolved,databasesremainvulnerabletomaliciousattacksandac-
cidentalmisuse.Suchincidents,inturn,maytranslateintofinanciallossesorlosses
whosevaluesareobviouslyhighbutdifficulttoquantify,e.g.,thelossofthepublic’s
trustinthedatamanagementinfrastructureandservicesofferedbyanorganization.
Inassemblingthishandbook, wehavehadatwofoldobjective:first,toprovide
a comprehensive summary of the results of research and development activities in
various aspects of database security up to this point, and second, to point toward
directionsforfutureworkinthisimportantandfruitfulfieldofresearch.
This handbook offers twenty three essays contributed by a selected group of
prominent researchers. Given the dynamic nature of the field of database security,
wehaveattemptedtoobtainabalanceamongvariousviewpointsbyinvitingmulti-
plecontributionsonthesametopic.Webelievethatthisdiversityprovidesarichness
generallynotavailableinonebook.Insomecases,authorshavetriedtoreconcile
theirdifferencesbycontributingasingleessayonatopic.
v
vi Preface
Aboutthebook
Essaysinthishandbookcanberoughlydividedintofollowingeightareas:
FoundationsofAccessControl
• Recent Advances in Access Control by Sabrina De Capitani di Vimercati, Sara
Foresti,andPierangelaSamarati
• Access Control Models for XML by Sabrina De Capitani di Vimercati, Sara
Foresti,StefanoParaboschi,andPierangelaSamarati
• AccessControlPolicyLanguagesinXMLbyNaizhenQiandMichiharuKudo
TrustManagementandTrustNegotiation
• Database Issues in Trust Management and Trust Negotiation by Dongyi Li,
WilliamWinsborough,MarianneWinslett,andRagibHasan
SecureDataOutsourcing
• Authenticated Index Structures for Outsourced Databases by Feifei Li, Marios
Hadjileftheriou,GeorgeKollios,andLeonidReyzin
• TowardsSecureDataOutsourcingbyRaduSion
• Managing and Querying Encrypted Data by Bijit Hore, Sharad Mehrotra, and
HakanHacıgu¨mu¨s¸
SecurityinAdvancedDatabaseSystemsandApplications
• Security in Data Warehouses and OLAP Systems by Lingyu Wang and Sushil
Jajodia
• SecurityforWorkflowSystemsbyVijayalakshmiAtluriandJaniceWarner
• SecureSemanticWebServicesbyBhavaniThuraisingham
• GeospatialDatabaseSecuritybySoonAeChunandVijayalakshmiAtluri
• Security Re-engineering for Databases: Concepts and Techniques by Michael
GertzandMadhaviGandhi
DatabaseWatermarking
• DatabaseWatermarkingforCopyrightProtectionbyRaduSion
• DatabaseWatermarking:ASystematicViewbyYingjiuLi
TrustworthyRecordRetentionandRecovery
• TrustworthyRecordsRetentionbyRagibHasan,MarianneWinslett,Soumyadeb
Mitra,WindsorHsu,andRaduSion
• Damage Quarantine and Recovery in Data Processing Systems by Peng Liu,
SushilJajodia,andMengYu
Preface vii
Privacy
• HippocraticDatabases:CurrentCapabilitiesandFutureTrendsbyTyroneGran-
dison,ChristopherJohnson,andJerryKiernan
• Privacy-PreservingDataMining:ASurveybyCharuC.AggarwalandPhilipS.
Yu
• PrivacyinDatabasePublishing:ABayesianPerspectivebyAlinDeutsch
• Privacy Preserving Publication: Anonymization Frameworks and Principles by
YufeiTao
PrivacyinLocation-basedServices
• Privacy Protection through Anonymity in Location-based Services by Claudio
Bettini,SergioMascetti,andX.SeanWang
• Privacy-enhancedLocation-basedAccessControlbyClaudioA.Ardagna,Marco
Cremonini,SabrinaDeCapitanidiVimercati,andPierangelaSamarati
• EfficientlyEnforcingtheSecurityandPrivacyPoliciesinaMobileEnvironment
byVijayalakshmiAtluriandHeechangShin
Intendedaudience
Thishandbookissuitableasareferenceforpractitionersandresearchersinindus-
tryandacademiawhoareinterestedinthestate-of-the-artindatabasesecurityand
privacy.Instructorsmayusethishandbookasatextinacourseforupper-levelun-
dergraduateorgraduatestudents.Anygraduatestudentwhoisinterestedindatabase
securityandprivacymustdefinitelyreadthisbook.
Acknowledgements
We are extremely grateful to all those who contributed to this handbook. It is a
pleasure to acknowledge the authors for their contributions. Special thanks go to
SusanLagerstrom-Fife,SeniorPublishingEditorforSpringer,andSharonPalleschi,
EditorialAssistantatSpringer,whoseenthusiasmandsupportforthisprojectwere
mosthelpful.
Davis,California,andFairfax,Virginia MichaelGertz
September2007 SushilJajodia
Contents
1 RecentAdvancesinAccessControl ............................ 1
SabrinaDeCapitanidiVimercati,SaraForesti,andPierangelaSamarati
2 AccessControlModelsforXML............................... 27
SabrinaDeCapitanidiVimercati,SaraForesti,StefanoParaboschi,and
PierangelaSamarati
3 AccessControlPolicyLanguagesinXML ....................... 55
NaizhenQiandMichiharuKudo
4 DatabaseIssuesinTrustManagementandTrustNegotiation....... 73
DongyiLi,WilliamWinsborough,MarianneWinslettandRagibHasan
5 AuthenticatedIndexStructuresforOutsourcedDatabases ......... 115
FeifeiLi,MariosHadjileftheriou,GeorgeKollios,andLeonidReyzin
6 TowardsSecureDataOutsourcing ............................. 137
RaduSion
7 ManagingandQueryingEncryptedData ....................... 163
BijitHore,SharadMehrotra,andHakanHacıgu¨mu¨s¸
8 SecurityinDataWarehousesandOLAPSystems................. 191
LingyuWangandSushilJajodia
9 SecurityforWorkflowSystems ................................ 213
VijayalakshmiAtluriandJaniceWarner
10 SecureSemanticWebServices ................................ 231
BhavaniThuraisingham
11 GeospatialDatabaseSecurity ................................. 247
SoonAeChunandVijayalakshmiAtluri
ix
x Contents
12 SecurityRe-engineeringforDatabases:ConceptsandTechniques... 267
MichaelGertzandMadhaviGandhi
13 DatabaseWatermarkingforCopyrightProtection................ 297
RaduSion
14 DatabaseWatermarking:ASystematicView .................... 329
YingjiuLi
15 TrustworthyRecordsRetention ............................... 357
RagibHasan,MarianneWinslett,SoumyadebMitra,WindsorHsu,and
RaduSion
16 DamageQuarantineandRecoveryinDataProcessingSystems ..... 383
PengLiu,SushilJajodia,andMengYu
17 HippocraticDatabases:CurrentCapabilitiesandFutureTrends.... 409
TyroneGrandison,ChristopherJohnson,andJerryKiernan
18 Privacy-PreservingDataMining:ASurvey...................... 431
CharuC.AggarwalandPhilipS.Yu
19 PrivacyinDatabasePublishing:ABayesianPerspective........... 461
AlinDeutsch
20 PrivacyPreservingPublication:AnonymizationFrameworksand
Principles .................................................. 489
YufeiTao
21 PrivacyProtectionthroughAnonymityinLocation-basedServices .. 509
ClaudioBettini,SergioMascetti,andX.SeanWang
22 Privacy-enhancedLocation-basedAccessControl ................ 531
Claudio A. Ardagna, Marco Cremonini, Sabrina De Capitani di
Vimercati,andPierangelaSamarati
23 EfficientlyEnforcingtheSecurityandPrivacyPoliciesinaMobile
Environment ............................................... 553
VijayalakshmiAtluriandHeechangShin
Index .............................................................575
List of Contributors
CharuC.Aggarwal
IBMT.J.WatsonResearchCenter,Hawthorne,NY,e-mail:[e-mail]
ClaudioA.Ardagna
DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano,
Crema,Italy,e-mail:[e-mail]
VijayalakshmiAtluri
RutgersUniversity,Newark,NJ,e-mail:[e-mail]
ClaudioBettini
DICo,UniversityofMilan,Italy,e-mail:[e-mail]
SabrinaDeCapitanidiVimercati
DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano,
Crema,Italy,e-mail:[e-mail]
SoonAeChun
CityUniversityofNewYork,CollegeofStatenIsland,StatenIsland,NY,e-mail:
[e-mail]
MarcoCremonini
DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano,
Crema,Italy,e-mail:[e-mail]
AlinDeutsch
DepartmentofComputerScienceandEngineering,UniversityofCaliforniaSan
Diego,LaJolla,CA,e-mail:[e-mail]
SaraForesti
DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano,
Crema,Italy,e-mail:[e-mail]
xi