Security Administration for Federations, Warehouses, and other Derived Data

Security administration is harder in databases that have multiple tiers of derived data, such as federations, warehouses, or systems with many views. Metadata (e.g., security requirements) expressed at each tier must be visible and understood at the other tier. We describe several use cases in which tiers negotiate to reconcile their business requirements. The sources must grant enough privileges for the derived tier to support the applications; the derived tier must enforce enough restrictions so that the sources’ concerns are met; and the relationship between the privileges at source and derived tier must be visible and auditable.