Fine-Grained Access Control for Database Management Systems

The pervasive nature of computing paradigm has made Database Management Systems (DBMS) a predominate technology for business and enterprise applications. With the explosion of information in the computing world and the extensive use of information services, the role of database systems is continuously growing. These rapid technological advances require companies to adopt Database Management Systems that should not only be fast, scalable and reliable but also provide security from internal and external threats. However, the proliferation of information systems in organizations worldwide (communication, transport, education, manufacturing, medicine, business etc.), has increased difficulty in controlling access to data which sometimes results in instigation of various security attacks. This increased reliance on information systems imposes different protection and privacy requirements on DBMSs. Moreover, the advancement in database technology (mainly including Object-Oriented and NoSQL) has made traditional security controls no longer adequate for providing effective security measures, since design and principles of such databases are completely different from those of traditional databases. These latest database paradigms invoke many provoking thoughts towards the security of data. The number of attacks including code injection, inference attacks, DoS attacks can be launched on these databases and basic database vulnerabilities such as unauthorized access, excessive privilege abuse, out-dated patches and misconfigurations may lead to avenues of attack on databases. In this tip, sensitive data of an organization needs to be protected through various security controls primarily by practicing Authentication, Authorization, Encryption, Intrusion Detection System, Auditing and Availability mechanisms. Among these mechanisms, Access Control is considered one of the strong driving forces for protecting the data of an organization as well as preserving the privacy of individual users. In order to provide the strong shield of protection in Database Management Systems, a fine-grained access control scheme, to control access at the row and column level or even at cell-level, should be effectively implemented for the traditional and the latest