Handbook of Database Security Applications and Trends PDF
Preview Handbook of Database Security Applications and Trends
Handbook of Database Security Applications and Trends Handbook of Database Security Applications and Trends editedby Michael Gertz UniversityofCaliforniaatDavis USA Sushil Jajodia GeorgeMasonUniversity USA MichaelGertz SushilJajodia UniversityofCaliforniaatDavis GeorgeMasonUniversity Dept.ofComputerScience CenterforSecureInformationSystems OneShieldsAvenue ResearchI,Suite417 Davis,CA95616-8562 FairfaxVA22030-4444 [email protected] [email protected] LibraryofCongressControlNumber:2007934795 ISBN-13:978-0-387-48532-4 e-ISBN-13:978-0-387-48533-1 Printedonacid-freepaper. (cid:2)c2008SpringerScience+BusinessMedia,LLC. Allrightsreserved.Thisworkmaynotbetranslatedorcopiedinwholeorinpartwithoutthewritten permission of the publisher (Springer Science+Business Media, LLC, 233 Spring Street, New York, NY 10013, USA), except for brief excerpts in connection with reviews or scholarly analysis. Use in connectionwithanyformofinformationstorageandretrieval,electronicadaptation,computersoftware, orbysimilarordissimilarmethodologynowknownorhereafterdevelopedisforbidden. Theuseinthispublicationoftradenames,trademarks,servicemarksandsimilarterms,eveniftheyare notidentifiedassuch,isnottobetakenasanexpressionofopinionastowhetherornottheyaresubject toproprietaryrights. 9 8 7 6 5 4 3 2 1 springer.com Preface Motivationforthebook Databasesecurityhasbeengainingagreatdealofimportanceasindustry,military, and government organizations have increasingly adopted Internet-based technolo- gies on a large-scale, because of convenience, ease of use, and the ability to take advantage of rapid advances in the commercial market. Along with the traditional security aspects of data integrity and availability, there is an increasing interest in research and development in data privacy. This is because today’s often mission- critical databases no longer contain only data used for day-to-day processing by organization;asnewapplicationsarebeingadded,itispossiblefororganizationsto collectandstorevastamountsofdataquicklyandefficientlyandtomakethedata readilyaccessibletothepublic,typicallythroughWeb-basedapplications.Unfortu- nately,ifsecuritythreatsrelatedtotheintegrity,availability,andprivacyofthedata arenotproperlyresolved,databasesremainvulnerabletomaliciousattacksandac- cidentalmisuse.Suchincidents,inturn,maytranslateintofinanciallossesorlosses whosevaluesareobviouslyhighbutdifficulttoquantify,e.g.,thelossofthepublic’s trustinthedatamanagementinfrastructureandservicesofferedbyanorganization. Inassemblingthishandbook, wehavehadatwofoldobjective:first,toprovide a comprehensive summary of the results of research and development activities in various aspects of database security up to this point, and second, to point toward directionsforfutureworkinthisimportantandfruitfulfieldofresearch. This handbook offers twenty three essays contributed by a selected group of prominent researchers. Given the dynamic nature of the field of database security, wehaveattemptedtoobtainabalanceamongvariousviewpointsbyinvitingmulti- plecontributionsonthesametopic.Webelievethatthisdiversityprovidesarichness generallynotavailableinonebook.Insomecases,authorshavetriedtoreconcile theirdifferencesbycontributingasingleessayonatopic. v vi Preface Aboutthebook Essaysinthishandbookcanberoughlydividedintofollowingeightareas: FoundationsofAccessControl • Recent Advances in Access Control by Sabrina De Capitani di Vimercati, Sara Foresti,andPierangelaSamarati • Access Control Models for XML by Sabrina De Capitani di Vimercati, Sara Foresti,StefanoParaboschi,andPierangelaSamarati • AccessControlPolicyLanguagesinXMLbyNaizhenQiandMichiharuKudo TrustManagementandTrustNegotiation • Database Issues in Trust Management and Trust Negotiation by Dongyi Li, WilliamWinsborough,MarianneWinslett,andRagibHasan SecureDataOutsourcing • Authenticated Index Structures for Outsourced Databases by Feifei Li, Marios Hadjileftheriou,GeorgeKollios,andLeonidReyzin • TowardsSecureDataOutsourcingbyRaduSion • Managing and Querying Encrypted Data by Bijit Hore, Sharad Mehrotra, and HakanHacıgu¨mu¨s¸ SecurityinAdvancedDatabaseSystemsandApplications • Security in Data Warehouses and OLAP Systems by Lingyu Wang and Sushil Jajodia • SecurityforWorkflowSystemsbyVijayalakshmiAtluriandJaniceWarner • SecureSemanticWebServicesbyBhavaniThuraisingham • GeospatialDatabaseSecuritybySoonAeChunandVijayalakshmiAtluri • Security Re-engineering for Databases: Concepts and Techniques by Michael GertzandMadhaviGandhi DatabaseWatermarking • DatabaseWatermarkingforCopyrightProtectionbyRaduSion • DatabaseWatermarking:ASystematicViewbyYingjiuLi TrustworthyRecordRetentionandRecovery • TrustworthyRecordsRetentionbyRagibHasan,MarianneWinslett,Soumyadeb Mitra,WindsorHsu,andRaduSion • Damage Quarantine and Recovery in Data Processing Systems by Peng Liu, SushilJajodia,andMengYu Preface vii Privacy • HippocraticDatabases:CurrentCapabilitiesandFutureTrendsbyTyroneGran- dison,ChristopherJohnson,andJerryKiernan • Privacy-PreservingDataMining:ASurveybyCharuC.AggarwalandPhilipS. Yu • PrivacyinDatabasePublishing:ABayesianPerspectivebyAlinDeutsch • Privacy Preserving Publication: Anonymization Frameworks and Principles by YufeiTao PrivacyinLocation-basedServices • Privacy Protection through Anonymity in Location-based Services by Claudio Bettini,SergioMascetti,andX.SeanWang • Privacy-enhancedLocation-basedAccessControlbyClaudioA.Ardagna,Marco Cremonini,SabrinaDeCapitanidiVimercati,andPierangelaSamarati • EfficientlyEnforcingtheSecurityandPrivacyPoliciesinaMobileEnvironment byVijayalakshmiAtluriandHeechangShin Intendedaudience Thishandbookissuitableasareferenceforpractitionersandresearchersinindus- tryandacademiawhoareinterestedinthestate-of-the-artindatabasesecurityand privacy.Instructorsmayusethishandbookasatextinacourseforupper-levelun- dergraduateorgraduatestudents.Anygraduatestudentwhoisinterestedindatabase securityandprivacymustdefinitelyreadthisbook. Acknowledgements We are extremely grateful to all those who contributed to this handbook. It is a pleasure to acknowledge the authors for their contributions. Special thanks go to SusanLagerstrom-Fife,SeniorPublishingEditorforSpringer,andSharonPalleschi, EditorialAssistantatSpringer,whoseenthusiasmandsupportforthisprojectwere mosthelpful. Davis,California,andFairfax,Virginia MichaelGertz September2007 SushilJajodia Contents 1 RecentAdvancesinAccessControl ............................ 1 SabrinaDeCapitanidiVimercati,SaraForesti,andPierangelaSamarati 2 AccessControlModelsforXML............................... 27 SabrinaDeCapitanidiVimercati,SaraForesti,StefanoParaboschi,and PierangelaSamarati 3 AccessControlPolicyLanguagesinXML ....................... 55 NaizhenQiandMichiharuKudo 4 DatabaseIssuesinTrustManagementandTrustNegotiation....... 73 DongyiLi,WilliamWinsborough,MarianneWinslettandRagibHasan 5 AuthenticatedIndexStructuresforOutsourcedDatabases ......... 115 FeifeiLi,MariosHadjileftheriou,GeorgeKollios,andLeonidReyzin 6 TowardsSecureDataOutsourcing ............................. 137 RaduSion 7 ManagingandQueryingEncryptedData ....................... 163 BijitHore,SharadMehrotra,andHakanHacıgu¨mu¨s¸ 8 SecurityinDataWarehousesandOLAPSystems................. 191 LingyuWangandSushilJajodia 9 SecurityforWorkflowSystems ................................ 213 VijayalakshmiAtluriandJaniceWarner 10 SecureSemanticWebServices ................................ 231 BhavaniThuraisingham 11 GeospatialDatabaseSecurity ................................. 247 SoonAeChunandVijayalakshmiAtluri ix x Contents 12 SecurityRe-engineeringforDatabases:ConceptsandTechniques... 267 MichaelGertzandMadhaviGandhi 13 DatabaseWatermarkingforCopyrightProtection................ 297 RaduSion 14 DatabaseWatermarking:ASystematicView .................... 329 YingjiuLi 15 TrustworthyRecordsRetention ............................... 357 RagibHasan,MarianneWinslett,SoumyadebMitra,WindsorHsu,and RaduSion 16 DamageQuarantineandRecoveryinDataProcessingSystems ..... 383 PengLiu,SushilJajodia,andMengYu 17 HippocraticDatabases:CurrentCapabilitiesandFutureTrends.... 409 TyroneGrandison,ChristopherJohnson,andJerryKiernan 18 Privacy-PreservingDataMining:ASurvey...................... 431 CharuC.AggarwalandPhilipS.Yu 19 PrivacyinDatabasePublishing:ABayesianPerspective........... 461 AlinDeutsch 20 PrivacyPreservingPublication:AnonymizationFrameworksand Principles .................................................. 489 YufeiTao 21 PrivacyProtectionthroughAnonymityinLocation-basedServices .. 509 ClaudioBettini,SergioMascetti,andX.SeanWang 22 Privacy-enhancedLocation-basedAccessControl ................ 531 Claudio A. Ardagna, Marco Cremonini, Sabrina De Capitani di Vimercati,andPierangelaSamarati 23 EfficientlyEnforcingtheSecurityandPrivacyPoliciesinaMobile Environment ............................................... 553 VijayalakshmiAtluriandHeechangShin Index .............................................................575 List of Contributors CharuC.Aggarwal IBMT.J.WatsonResearchCenter,Hawthorne,NY,e-mail:[email protected] ClaudioA.Ardagna DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano, Crema,Italy,e-mail:[email protected] VijayalakshmiAtluri RutgersUniversity,Newark,NJ,e-mail:[email protected] ClaudioBettini DICo,UniversityofMilan,Italy,e-mail:[email protected] SabrinaDeCapitanidiVimercati DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano, Crema,Italy,e-mail:[email protected] SoonAeChun CityUniversityofNewYork,CollegeofStatenIsland,StatenIsland,NY,e-mail: [email protected] MarcoCremonini DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano, Crema,Italy,e-mail:[email protected] AlinDeutsch DepartmentofComputerScienceandEngineering,UniversityofCaliforniaSan Diego,LaJolla,CA,e-mail:[email protected] SaraForesti DipartimentodiTecnologiedell’Informazione,Universita` degliStudidiMilano, Crema,Italy,e-mail:[email protected] xi
Description:The list of books you might like
