TAILIEUCHUNG - Database Security—Concepts, Approaches, and Challenges

Databases are encapsulated by business logic. Before the advent of stored-procedures, all the business logic ran in the transaction processing monitor which was the middle tier of the classic three- tier presentation-application-data architecture. With stored pro- cedures, the TP-monitors were disintermediated by two-tiered client/server architectures. The emergence of web-servers and HTTP brought three-tier architectures back to center stage – in part . | 2 IEEE TRANSACTIONS ON DEPENDABLE AND SECURE COMPUTING VOL. 2 NO. 1 JANUARY-MARCH 2005 Database Security Concepts Approaches and Challenges Elisa Bertino Fellow IEEE and Ravi Sandhu Fellow IEEE Abstract As organizations increase their reliance on possibly distributed information systems for daily business they become more vulnerable to security breaches even as they gain productivity and efficiency advantages. Though a number of techniques such as encryption and electronic signatures are currently available to protect data when transmitted across sites a truly comprehensive approach for data protection must also include mechanisms for enforcing access control policies based on data contents subject qualifications and characteristics and other relevant contextual information such as time. It is well understood today that the semantics of data must be taken into account in order to specify effective access control policies. Also techniques for data integrity and availability specifically tailored to database systems must be adopted. In this respect over the years the database security community has developed a number of different techniques and approaches to assure data confidentiality integrity and availability. However despite such advances the database security area faces several new challenges. Factors such as the evolution of security concerns the disintermediation of access to data new computing paradigms and applications such as grid-based computing and on-demand business have introduced both new security requirements and new contexts in which to apply and possibly extend current approaches. In this paper we first survey the most relevant concepts underlying the notion of database security and summarize the most well-known techniques. We focus on access control systems on which a large body of research has been devoted and describe the key access control models namely the discretionary and mandatory access control models and the role-based access control RBAC

• Cơ sở dữ liệu
• existing enterprises
• Specifically
• employment impact
• Corporate Contact
• Service Categories
• Business Plan Submission
• Target capital structure
• Cost of capital
• Capital in existing enterprises
• Method to determine cost
• attracting large
• strategies aimed
• new firm locations
• building businesses
• supporting
• complementary features
• develop and support
• small businesses
• ncreasingly
• economic development
• abandoning traditional
• complicated analysis
• multiple levels
• dominate the domain