AN ARCHITECTURE OF A SECURE DATABASE FOR
NETWORKED COLLABORATIVE ACTIVITIESManabu Ando

Graduate School of Interdisciplinary Information Studies, University of Tokyo

Komaba 4-6-1, Meguro-ku, Tokyo 153-8505, JAPAN
Email: qq16206@iii.u-tokyo.ac.jp

Kanta Matsuura

Interfaculty Initiative in Information Studies, University of Tokyo

Komaba 4-6-1, Meguro-ku, Tokyo 153-8505, JAPAN
Email: kanta@iis.u-tokyo.ac.jp

Michiharu Kudo

IBM Japan Ltd., Tokyo Research Laboratory

Shimotsuruma 1623-14, Yamato-shi, Kanagawa 242-8502, JAPAN
Email: kudo@jp.ibm.com
Akira Baba

Interfaculty Initiative in Information Studies, University of Tokyo

Hongo 7-3-1, Bunkyo-ku, Tokyo 113-0033, JAPAN
Email: baba@hi.u-tokyo.ac.jp

Keywords:

Secure Database, Collaborative Activities, Virtual Private Laboratories (VPLs).

Abstract:

Open networks can be used for many purposes, for example, e-commerce, e-government, and so on. Different
from those conventional applications, we consider networked collaborative activities, for example networked
research activities. This application might be very useful and research activities could be significantly promoted. However, we must solve many security problems. Among those problems, we focus on an architectureof a secure database in this paper. The design of such an architecture is not a trivial task, since we want to use
multiple data types and the appropriate security operations should be exexuted. In addition to this problem,
some data may need multiple security properties. In this case, multiple security operations should be executedin a well-organized way (e.g. with the ensured order such as signature-then-encryption). Thus, we design anarchitecture of a secure database, considering multiple data types and various security operations.

1

INTRODUCTION

Recently, open networks such as Internet can be used
for wider range of applications. For example, electronic commerce is a well-known usage of Internet.
In this application, we can make on-line shopping or
digital payment securely. Another example is an egovernment. In these applications, it is a common
practice to tackle security problems with the help ofcryptographic protocols.
Here, we point out another important applicationof security technologies in the digital society: thatis, secure collaborative activities over open networks.
Suppose the following example; a joint research activity, in which many researchers can participate evenwhen they are distributed over different companies,
universities, or other organizations. Participants may
exchange ideas via e-mail, or they may browse digital

documents which describe a development specification. They may have a video conference. In addition
to those basic actions, they may want to share theirknowledge about the research. We can see that a lotof security problems would appear in such activities.
We can easily show some trivial security problems
in such application. For example, packets in open networks should be protected with respect to integrity,
confidentiality, data origin authentication, and so on.
Direct use of security primitives, or VPN (Virtual Private Network), which is equipped with the primitives,
can solve some of the trivial issues (Arbaugh et al.,1998). We then proceed to a non-trivial security problems in the application mentioned above.
One example of non-trivial issues is an architectureof a secure database designed for networked collaborative activities. In such activities, we usually want
to exchange multiple types of data; for example text,3

ICEIS 2003 - Databases and Information Systems Integration

image, numerical values, illustrations, mathematicalgraphs, and so on. Each data type needs its own security property (e.g. confidentiality, integrity, nonrepudiation, copyright-protection), so appropriate security operations should be executed. Text data may
have to be encrypted in order to achieve confidentiality, and digital images may have to be watermarked
for copyright protection. Graphs may have to be managed with their underlying numerical values in orderto achieve scientific integrity. To make matters more
complicated, there can be restrictions with respect tomultiple security operations required for protecting
a single object (e.g. not encryption-then-signature
but signature-then-encryption, not watermark-thenupdate but update-then-watermark, etc). Thus, it is
non-trivial but important to design a secure database
composed of multiple data types.
However, previous works of database security did
not solve, or insufficiently discussed at best, this problem. Most of the works of database security focus onaccess control. Access control is a significant technology in network security but multiple security properties could not be achieved by access control only.
Access control by itself does not support security operations appropriate for different data types.
In order to solve the problems above, we design a
new architecture of a secure database in this paper.
The architecture can be used in Virtual Private Laboratories (VPLs) as a basic component of them. VPLs
are the general concept of a total security system in
networked research activities (Matsuura, 2002). We
expect that our architecture will be used as the fundamental component in VPLs.

1.1

Related Works

In database management system (DBMS), the trigger
function is used for defining a set of operations thatare executed when a delete, insert, or update action
is carried out. The trigger function can be also used
to execute security operations, only when those actions happen. However, the trigger is not used when
the other actions are required. For example, when thesubject requests the read action, the trigger function
could not be called, and thus the necessary operations
could not be executed.
Access control is another conventional approachof database security. Fernandez et al. developed
object-oriented database with access control (Fernandez et al., 1994). Jonscher and Dittrich developed
database system with access control, called “Argos”(Jonscher and Dittrich, 1996). The work of Disson etal. used Role-Based Access Control (RBAC) in orderto protect database (Disson et al., 2001). This work
also focuses on database with access control, and then
optimization or implementation issues were the main
topics. The work of Tzelepi and Pangalos was the4

only one to protect a particular data type (Tzelepi andPangalos, 2001). They focused on database composedof image data and RBAC to protect them. In orderto implement flexible RBAC to image data sets, metadata of original image data were used.
Jajodia et al. focused on another aspect. They
proposed the language for description of access control policy (Jajodia et al., 1997). Their purpose wasto unite multiple structures of access control. They
pointed out that there were multiple access control
policies: for example, policy for file systems, policy
for relational database, and so on.
In any case, all the security procedures their works
care about are: (1) submission of an access request
by an initiator, and (2) the response to the request
by the system (grant or deny). Access control is ofcourse an important function for database security, butaccess-control-only approaches are insufficient; access control by itself cannot provide multiple security
operations which are required according to different
data types.

1.2

Our Contribution

In this paper, we first construct an architecture of a secure database that can provide multiple security operations. We formalize the object and its attributes, anddefine the functions in DBMS. Those functions process the objects, and provide security operations thateach data type requires. A “data type” in a conventional sense may be classified into different data types
in our work; images which need confidentiality only
can be recognized as a data type different from thatof images which need copyright-protection as well.
Next, we define the process for links among security
operations because some objects may require multiple security operations. For example, one text datarequires encryption for secrecy, and also requires generation of Message Authentication Codes (MAC) for
integrity. In this case, two security operations should
be linked in a well-organized way. Most of the existing studies ignore this linking process. Our major
contribution in this paper is to provide a particular architecture for ensuring such process.
The rest of this paper is structured as follows. Section 2 describes the formalization of our architecture.
In Section 3, we introduce the important linking process in our architecture with appropriate semantics.
Section 4 provides a discussion on security analysis
of our architecture. Finally Section 5 concludes thepaper.

AN ARCHITECTURE OF A SECURE DATABASE FOR NETWORKED COLLABORATIVE ACTIVITIES2ARCHITECTURE OFDATABASE

2.1

Basic Concept of Architecture

As the problem of access control in database system,
suppose the following issue: if an attacker can breakaccess control, then the system depending solely on
access control turns to be insecure. In access control
system, each entity must show its authorization, andentity authentication protocols are often used. When apassword system is used for entity authentication, forexample, an attacker with the ability of off-line dictionary attack can be a significant threat. Once access
control is broken, contents in the database are not protected at all; the attacker who has broke it can easily
tamper with the contents by impersonation.
We design an architecture of secure databasesystem which can protect or manage contents indatabase. As a trivial method, one may think of contents encryption. However, encryption only is insufficient. Recently, wider range of data types or contents
could be used in computer and communication environment. Some data types may require encryption
but others may require different security operations.
Therefore, we construct an architecture of a securedatabase composed of multiple data types. Proposedarchitecture can provide multiple security operations
that each data requires.
Moreover, we add an important process to our architecture. When multiple data types have been employed, we often face a scenario in which not a single
but a series of security operations are required for processing a single data. For example, the data may require not only secrecy but also integrity. These properties are achieved by different security operations.
However, these properties should be guaranteed in awell-organized way. Thus, multiple security operations must be linked in a well-organized manner.

2.2

Object Formalization

In our architecture, multiple data types of objects are
employed. The database system should provide security operations that are appropriate to each data type.
In order to achieve this, we construct the database system that can evaluate the data type of the objects. For
identifying data type, we formalize the attributes ofobject.
The attributes are as follows:
identification (ID) is a unique identifier of object.
type (TP) is a data type of object, such as text orimage. Moreover, we deal with the data generated
by security operations as an object. For example,
MAC is also the object, and TP of this object is

described as MAC. Let m be the number of types
our system provides.
register flag (RF) is a flag which indicates a reg
istration status: “ ,” or “  ,” or otherwise “null”.
“ ” means that this type of object can be processedin the system. On the other hand, “  ” means thatthe system cannot process this data type. Finally,null is the initial value of this attribute.
state (STO) is a state of object. This value has
three types.
Completed This value indicates that all the required operations are completed.
Insufficient This value indicates that some of therequired operations are executed but that others
are not.
Not Executed This value indicates that none of
the required operations have been executed.
By using these attributes, we define an object as follows:
Definition 2.1. Object (OBJECT) consists of 4tuple, (ID, TP, RF, STO). This means that OBJECT
with a unique identifier ID is an object of type TP, andthe state of OBJECT is STO. If RF is “+”, this object
can be processed, whereas if “-”, this object cannot beprocessed in the system.
Example 2.1. Suppose the object, OBJECT=(0001,
text, +, Not Executed). This object is a text data,
which can be processed in the system, and security
operations have not been executed. On the other hand,the object described as OBJECT=(0002, image, +,Completed) is an image data, and security operations
have been completely executed.

2.3

Subject Formalization

In this paper, we assume that subjects belong togroups. Each subject may belong to more than one
group. Moreover, the groups may form a hierarchy.
Figure 1 illustrates an example of such hierarchy.

  
!#"       $# % $#

% "&#' ()   * (+!'          
,  ('- $#

Figure 1: An Example of Group Hierarchy

The authorization is assigned to group, not to eachsubject. Each subject is controlled by assigned authorization. The database system has the functionthat takes subject information as an input and returns

5

ICEIS 2003 - Databases and Information Systems Integration

the relationship between the subject and group. Thisfunction refers group hierarchy as is illustrated in Figure 1.

2.4

Class Structure

We define three types of classes: Control Class (CC),
Data Class (DC), and Operation Class (OC). The
outline of class structure is illustrated in Figure 2. We
define . DC’s and / OC’s, where /102. .

? C DA E6

3 4 5 674 8 3 89 ::JJ; 9 6 93 8 9 : :>? @ A 7 9 6 B 4 53 8 9 : :>; 9 6 93 8 9 : : =JJ; 9 6 93 8 9 : : <? @ A 7 9 6 B 4 53 8 9 : : =JJ? @ A 7 9 6 B 4 53 8 9 : :B
JJ? @ A 7 9 6 B 4 53 8 9 : : 5

F A G? C D A E 6

H 7 4 E A : : A I? C D A E 6
H 7 4 E A : : A I? C D A E 6

Figure 2: Outline of Class Structure: For 1 CC, m DC’sand n OC’s are defined. DC is defined for each data type.
If necessary, CC, DC, and OC are called recursively.

2.4.1

WX YZ []\ ^_a`WX YZ []\ ^b]_Pc
W]daef[gZ^hTi
WX [j\ kl]m\ ^nodv¨¶·¢T£ ¤ ¤w

KMLNPO QLRSKTR UVV

Data ClassDC mainly evaluates the state of objects, and decides
necessary OC’s (See Figure 4). This class has twofunctions:
Ident Operation:
This function takes Object Type and Object State as inputs. Evaluation
is processed as follows:
Case 1. If xzy|{~} TPST MS M !rSrS#S ,then this function returns Operations Need.
}o P#S , thenCase 2. If xzy|{
Ident Operation returns Not Need. The system finishes the process when Ident Operation
returns this value.
Instruct Operation: This function takes Object Type, Object State, and Operations Needas inputs. It evaluates the inputs, and decides necessary OC’s.
Different DC’s are defined for different data types.
For example, the DC for text and the DC for image
are defined independently.

Control ClassCC works mainly for identification of data type orstate of object. In addition to the identification, CC
decides necessary DC (See Figure 3). This class has
four functions:
Ident TP: This function takes ID and TP as inputs,
and identifies data type. After evaluating inputs, it
returns a 2-tuple, (ID,TP), as Object Type.
Ident STO: This function takes ID and STO as inputs. After evaluating inputs, it returns a 2-tuple,(ID,STO), as Object State.
Change RF: This function takes TP as an input,and evaluates it. It returns RF: “ ” or “  ”. Moreover, it changes the RF value of the object. If theevaluation result is “  ”, then this function returns“error”.
Instruct DC: This function takes Object Type as
an input, and returns necessary DC’s.

p U#OUqKrR UVV
WX YZ[\ ^crs#Z kf\ t u[WX [j \ kl]m \ ^c!dFigure 3: Control Class: CC identifies data type or state of
the object. Moreover, using the list of registered data type,
CC changes the value of RF. From the attributes of object
and the outputs of other functions, Instruct DC function
decides necessary DC’s.

6

2.4.2

¥¸ ¹©¨]¯ ª«T¬#©­®¯ ° §¨¥¸ ¨º ¯ ­ »#¼ ¯ ª«M±½

!  ¡ ¢T£ ]¤¤¥¦r§ ¨]© ª«T¬©­®¯ ° §¨¥#±²®¨]³© ª´µP«

Figure 4: Data Class: DC is defined for each data type.
Instruct DC function in CC calls DC. DC evaluates thestate of object, and Instruct OC decides necessary OC’s.

2.4.3

Operation ClassOC mainly calls necessary functions or modules forsecurity operations (See Figure 5). For example,
when encryption is required, encryption module, such
as Java Cryptography Extension, is called. In addition
to this, OC changes STO value. This class has twofunctions:Done Operation: This function takes the object
as an input and it calls functions or modules for
executing security operations. It returns processed
objects and Done Flag which means all operations
are completely executed.
Change STO: This function takes Done Flag as
an input, and it changes the value STO as Completed.

3

LINK AMONG OPERATIONS

In our architecture, a series of security operations
should be executed properly in order to achieve mul-

AN ARCHITECTURE OF A SECURE DATABASE FOR NETWORKED COLLABORATIVE ACTIVITIESÛ Ü Í Ý ÔÕÌ Í ÞÇ Å Æ ÃÁ Å È Ç ÈÂ É ÉÊÊ àà áá ÎÎ ÍÍ ÔÔ ÏÏ ÚÙ Úâ ÐÊÊ àÖ Í × ä Ó Ô ÍÒ Ü Ø Ý Î Ô Ï Ï ã Ë Û Ö¾ ¿ À Á Â ÃÄÅ Æ Ç ÈÂ É ÉÊÊ ËÖ ×Ì Í Ó ÍÎ Ï Ø Ð Î Ï Ñ Ù Î ÚÒ Ó Ð Ô Õ Ì ÍàÍ Ñ Ü ÔÐ å æÎ ÝÔàÍ Ñ Ü ÔÛ Ü Í Ý ÔÕÌ Í ßÐ Ü ÔÑ Ü ÔÐ Ü ÔÑ Ü Ôâ ÒÌ Ý Î ä äÎ á Ð å æÎÝ Ôç Î èÐ å æ Î Ý ÔFigure 5: Operation Class: OC calls necessary modules for
executing security operations, and changes STO value inthe object. When some operations generate a new object,
CC and DC are recursively called.

3.1.1

Table 1 shows component primitives in PBAC. Functions in PBAC are described as follows.
eval pvn: eval pvn takes an access request as an
input. After evaluating access request using access
control rules, eval pvn returns provisional actions
specified in the selected rules.
eval prm: eval prm works similar to eval pvn,
except that eval prm returns the permission flag
specified in the selected rules.
provisions:tiple security properties. Simple example is describedas follows:
Example 3.1. Suppose TP of an object is text andthe object requires secrecy and integrity. In this case,encryption and generation of MAC are the appropriate
security operations. Thus, the database system should
provide these security operations for the object.
However, it is insufficient even if each property isachieved independently. For security reasons, multiple different operations, which satisfy different properties, should be linked in a well-organized way.
This tip is well known for secure communication(Bellovin, 1996), (Kent and Atkinson, 1998), (Madson and Glenn, 1998a), and (Madson and Glenn,
1998b) but most of the studies in database security
ignore this process. In order to construct link process
in our architecture, we use the access control method,
called Provision-Based Access Control (PBAC). Notethat we do not use PBAC itself, but use the concept
and functions of PBAC. We refer to our proposed process as “Provision-Based Linking Process.”

3.1

Provision-Based Access Control

In most access control systems, authorization is specified using binary decisions, “yes” or “no.” Such systems assume the following model: “A user makes anaccess request of a system, and the system either authorizes the access request, or denies it.”
However, today’s rapid expansion of Internet or
network makes traditional access control models
cumbersome and inflexible (Ghosh, 2000). In thissituation, some other operations are also required,in addition to binary access decisions.
In order to realize such requirements, Kudo and Hada
proposed Provision-Based Access Control (PBAC)
model, which expands traditional access control
model and adds necessary actions as provisional actions (Kudo and Hada, 2001). Using PBAC, flexible or fine-grained access control and policy specifications are realized. Next, we introduce the summaryof PBAC model.

Primitives and Functions

#]éS#êìëí

î#ï ðñ#ò óð]ôõö#÷øMùMú!  zû Púréo SúozûüMý]ýaþoÿ

provisions takes an access request ü as an input
and returns SEQ. state function generates a SEQ
from a set of operations, and assigns
the currentstate  to the first CMD of SEQ. represents theunion of arguments.
provision:










ü }





Mùù]ûüMý
ü} 

M


ù
M

ú
M


ù
 ûüMý } !M
î#ï ðñ#ò óð]ôõö#÷ø MùMú!  zû Púréo SúozûüMý]ýü


ü }

MùMú Mù ûüMý } ùéoS

provision is inductively defined. The first formulameans that if a command is empty, then return theempty SEQ. The second formula means that if thecommand is not empty and prov prm function returns deny, then return err showing that an error
occurred in evaluating provisional actions. The
third formula is a recursive definition that means
provision calls itself recursively with the results ofeval pvn( ü ) as the argument.
prov prm: prov prm takes a command as an input,
and returns grant if the permission flags of all provisional actions are grant, or returns deny if any
permission flag of the provisional actions is deny.
Based on these primitives, the following two components are defined.
Definition 3.1. Access Control Policy Information(ACPI) is a 7-tuple, (OBJ, SBJ, ACT, PRM, OPS,
CXT, SBJ2). This means that if PRM is grant, then
SBJ can perform ACT on OBJ under CXT, provided
that all of OPS are executed. If PRM is deny, then
SBJ cannot perform ACT on OBJ under CXT, but
all of OPS must still be executed. SBJ2 refers to thepermission grantor.
Definition 3.2. Access Request (AR) is a 4-tuple,(OBJ, SBJ, ACT, CXT). AR indicates whether SBJ
can perform ACT on OBJ under CXT or not.

7

ICEIS 2003 - Databases and Information Systems Integration

ST
SBJ
OBJ
ACT
PRM
CXT
OP
OPS
CMD
SEQ

A symbol that represents the state of access control system. This symbol changes whenever any ofthe data in the system is changed.
An initiator information, such as user ID.
A resource identifier, such as file name.
An access mode permitted on the target object, such as write, read. A flag indicating whether the access can be granted or denied. PRM= grant, deny Context data, such as time.
(OBJ,SBJ,ACT,CXT), which means that SBJ performs ACT on OBJ under CXT
A set of OP’s.
( xzy {!#"x$#"&% qy'$( y'xzy )+* ), which means SBJ performs ACT on OBJ under CXT
in state xzy and state is changed to xzy, )+* .
An ordered list of CMD’s.
Table 1: Component Primitives in PBAC

3.1.2

Semantics of PBAC ModelIn this section, we introduce the semantics of PBAC
model with a concrete example. Suppose the following example:
Example 3.2. The user, Alice, belongs to the group of
Researcher, and Alice submits Access Request R1.
R1(document1, Alice, write, -)Suppose there are two access control rules P1, P2 in
ACPI.
P1(log, Researcher, create, grant, -, -, -)P2(document1, Researcher, write, grant,(log, Researcher, create, -), -, -)When the system receives R1, it evaluates R1,
using eval prm and provisions functions. First,
eval prm(R1) returns grant, since eval prm function selects P2 as an appropriate rule for R1. Second, provisions(R1) function calls provision function with the argument (log, Researcher, create, -) asa new access request. In this case, the third formula ofthe provision function matches this argument. Thus,
provision function is called recursively, and P1 isselected as an appropriate rule. Finally, provisions
function returns permission grant and a command sequence SEQ.

3.2

Provision-Based Linking Process

In order to implement Provision-Based Linking Process, we can use functions in PBAC. Suppose the following examples:
Example 3.3. The user, Alice, belongs to the groupResearcher, and Alice submits Access Request, R1,
to database.
R1(document1, Alice, write, -)For this Access Request, the system administrator
forces Alice to execute additional security operations;encryption of document1 and generation of MAC of
document1. In this case, the specifications of ACPI

8

are:
P1(document1, Researcher, write, grant,((document1, Researcher, encrypt, -),(MAC, Researcher, generate, -)),-, -)P2(document1, Researcher, encrypt, grant, -, -, -)P3(MAC, Researcher, generate, grant, -, -, -)These rules show that Alice has write permission
on document1, provided Alice executes encrypt action of document1 and generate action of MAC. This
process is similar to that in PBAC, so we can use
functions in PBAC to construct our Provision-Based
Linking Process. In the following sections, we define
Provision-Based Linking Process.
Note that we define the database architecture andits functions in Section 2. These functions and PBAC
functions must interact in order to implement flexible
process.
Provision-Based Linking Process mainly works
on Instruct OC in DC, Done Operation andChange STO in OC.

3.2.1

Instruct OC Function

Instruct OC function decides necessary OC’s which
can execute required operations. During this process,Instruct OC function refers to rules which define therequired operations. As these rules, we can use thespecification of ACPI in PBAC. ACPI is describedas (OBJ, SBJ, ACT, PRM, OPS, CXT, SBJ2) (seeDefinition 3.1).
Instruct OC function takes Object Type, Object State, and Operations Need as inputs, andrefers to (OBJ,ACT,OPS) in ACPI. From the data
type, state, and required operations specified in OPS,
Instruct OC can decide an appropriate OC which executes proper security operations.

3.2.2

Done Operation Function

Done Operation function executes security opera-

AN ARCHITECTURE OF A SECURE DATABASE FOR NETWORKED COLLABORATIVE ACTIVITIES

tions, or calls necessary modules. Required security operations can be multiple, and Done Operation
function should execute a series of security operations
in a well-organized way.
In this process, we use ACPI, eval prm, provisions, and provision in PBAC. These functions
process in accordance with the model of PBAC.
Done Operation function calls functions in PBAC if
necessary and receives output values.
Detail process is as follows:
1. Done Operation takes the object as input (seeSection 2). It creates Access Request, using theobject and required access mode.
2. Done Operation calls eval prm, and it returns
permission flag using ACPI.
3. provisions is called, and it processes Access Request (provision function is also called).
4. provisions returns permission flag and required
operations as provisional action.
5. Receiving
theoutputofprovisions,Done Operation calls necessary modules. If
the permission flag is deny, Done Operation
stops process.
Done Operation function also returns Done Flag
which means all operations have been executed (seeSection 2). However, if some operations generate
new objects, then all of the operations are not completely executed. In such a case, Done Operation
function returns Insufficient Flag which means that
all the operations have not been completely executed.
Change State function takes this flag as input andchanges the value of STO into Insufficient, and theprocess to original object is stopped.

3.2.3

Change STO Function

Change STO function evaluates the output ofDone Operation function. However, if an operation
generates another object, this object may also require
another operation. In this case, CC is called recursively, and new object must be processed in DBMS.
STO of new object may be Not Executed. In such asituation, the original object has not been completely
processed, since all of the required operations are notexecuted. Change STO function should stop theprocess to the original object.
In PBAC, the following policy is defined: the access is not granted, provided all required operations
are completely executed. In Change STO, we define the following policy: STO value of the original
object is not changed, provided STO values of all derived objects turn into Completed.
In
order
to
implement
thispolicy,Done Operation function returns Done Flag
or Insufficient Flag. If Change STO function takes

Insufficient Flag, it changes STO value of the original object into Insufficient and stops process to theoriginal object. After processing all derived objects,
Done Operation function returns Done Flag. If
Change STO function takes this flag, it changes
STO value of the original object into Completed.

4

DISCUSSION

4.1

Attacker

In this paper, breaking access control does not imply
a complete tampering with the system. Breaking access control implies: (1) the attacker can break access
control which works on database access, and (2) the
attacker can impersonate to the authorized subject, but(3) the attacker cannot always compromise whole thesystem. When the attacker can break the access control, he can control the contents in the database but hedoes not compromise all of the system. We refer tothis attack as breaking access control.
Suppose the traditional access control for databasesystem. If this system is attacked by breaking access
control, the contents in the database are easily controlled, since the contents are not protected at all. The
attacker could not control whole the system but he cancontrol the contents.
Our architecture can provide security for the contents in the database, once the system is attacked bybreaking access control. In order to demonstrate thisfeature, we discuss security of our architecture in thissection.

4.2

Security Analysis

In Done Operation function, we use functions in
PBAC (eval prm, provisions, and so on) in order
to construct Provision-Based Linking Process. In
these functions, provisions function returns permission flag, grant or deny. Moreover, if any permission
flag of the provisional actions is deny, then Access
Request is also denied (See Section 3).
Even if the attacker can break access control andimpersonate to the authorized subject, he cannot tamper with all of the contents in database. ProvisionBased Linking Process can protect the contents in the
database from the attacker. The attacker only can tamper with the contents which impersonated subject has
the authorization to.
Moreover, the attacker cannot tamper with the contents which the impersonated subject is authorized to.
Suppose that the encryption key used by ProvisionBased Linking Process is stored in an IC card, andthat the authorized subject must use this key in orderto process an object. The assignment of such a rule9

ICEIS 2003 - Databases and Information Systems Integration

could be used for the protection of the contents. If theattacker can break access control, but cannot get theencryption key stored in an IC card, then the attacker
cannot tamper with the contents which the subject has
the authorization for.
Therefore, Provision-Based Linking Process canprovide security for the contents, even if the attacker
can break access control. This security property cannot be achieved in most of the previous works indatabase security.

5

CONCLUDING REMARKS

In order to promote collaborative activities overopen networks, we introduced an architecture of asecure database. In such activities, multiple typesof data may be used, and each data type requires
its own security properties achieved by a series ofproper security operations. However, previous works
in database security cannot achieve this. In our architecture, wider range of data types in the context of information security can be employed and necessary security operations can be executed in a well-organizedway.
Moreover, we introduced the notion of ProvisionBased Linking Process, which can realize links
among multiple security operations. This process isbased on Provision-Based Access Control but it is not
an access control technology. The main contribution
is well-organized linking processes among security
operations; for example, if an update process of a text
file needs subsequent generation of a digital signature
by a particular subject, this signature generation is ensured by the mechanism of Provision-Based Linking
Process. Thus a wide range of security properties canbe achieved. Furthermore, the system administrator
can assign the rules or policies about operations flexibly, so fine-grained requirements can be achieved.
The proposed architecture can be employed in Virtual
Private Laboratories (VPLs) as a basic component.

REFERENCES
Arbaugh, W. A. et al. (1998). Security for Virtual Private
Intranets. IEEE Computer, 31(9):48–55.
Bellovin, S. M. (1996). Problem Areas for the IP Security
Protocols. In the Sixth USENIX Security Symposium.
Disson, E. et al. (2001). A Role-Based Model for Access Control in Database Federations. In Information and Communications Security–ICICS2001, pages
429–440. LNCS2229.
Fernandez, E. B. et al. (1994). A Model for Evaluation
and Administration of Security in Object-Oriented

10

Databases. IEEE Transactions on Knowledge andData Engineering, 6(2):275–292.
Ghosh, A., editor (2000). E-Commerce Security andPrivacy, chapter 8. Kluwer Academic Publishers,
Boston.
Jajodia, S. et al. (1997). A Unified Framework for Enforcing Multiple Access Control Policies. In International
Conference on Management of Data, pages 474–486.
Jonscher, D. and Dittrich, K. R. (1996). Argos–A Configurable Access Control System for Interoperable Environments. In Ninth Annual IFIP TC11 Working Conference on Database Security, pages 43–60.
Kent, S. and Atkinson, R. (1998). IP Encapsulating Security Payload(ESP). RFC2406.
Kudo, M. and Hada, S. (2001). Access Control Model with
Provisional Actions. IEICE Transactions on Fundamentals of Electronics, Communications and Computer Sciences, E84-A:295–302.
Madson, C. and Glenn, R. (1998a). The Use of HMACMD5-96 within ESP and AH. RFC2403.
Madson, C. and Glenn, R. (1998b). The Use of HMACSHA-1-96 within ESP and AH. RFC2404.
Matsuura, K. (2002). Virtual Private Laboratories: Concept
and Two Building Blocks. In the 2002 IEEE International Engineering Management Conference (IEMC2002).
Tzelepi, S. and Pangalos, G. (2001). A Flexible Role-Based
Access Control Model for Multimedia Medical Image
Database Systems. In Information Security–ISC2000,
pages 335–346. LNCS2200.