See discussions, stats, and author profiles for this publication at: https://www.researchgate.

net/publication/340680715

Security of Relational Database Management System: Threats and Security

Techniques

Article · December 2018

CITATIONS READS

0 3,002

1 author:

Aurang Zeb
Government College University Faisalabad
1 PUBLICATION 0 CITATIONS

SEE PROFILE

All content following this page was uploaded by Aurang Zeb on 16 April 2020.

The user has requested enhancement of the downloaded file.

 Security of Relational Database Management System:
Threats and Security Techniques
Aurang Zeb
Department of Software Engineering
Govt. College University Faisalabad
Abstract Introduction
The field of the database has a history As known in the recent few years,
longer than 30 years in which the concept hardware ability and capacity of volumes,
of a relational database developed and the growing use of information systems
became the most fundamental strategy of World Wide Web platforms have forced to
organizations. With the evolution of use the relational database systems as
technology more advanced systems were basic infrastructure to the data repository.
developed that directly affect the economy A large amount of information and data
in the recent era. has become a core concern of security
challenges because the information
Organizations make sure the security and
management is not centralized.
confidentiality of their important data.
Therefore they implement the applications CIA security triangle that mentions the
and systems that provide the services, availability, confidentiality and integrity
functions and tools for data management commonly is the basic concept of
and maintenance at the same time named relational database security. The
Relational Database Management System application process must contain these
(RDBMS). Such functions consist of processes to assure the security and safety
services and privileges for authorization to of data.
keep the legal users (authorized) to use the Fraud and theft have an impact on the
database. The database must be secured. database environment and hence affect the
RDBMS means relational database whole corporation. It doesn’t make
management systems that are developed changes to the data itself, but it may
using the model of scientist Codd at IBM compromise the integrity and privacy of
lab. data. Confidentiality means to keep the
Database protection refers to preventing data secret; usually, this is the only critical
unauthorized users from accessing the task for an organization. Violations of
database and its core information whether security measures result in loss of
accidental or intentional [4]. Therefore all confidentiality may lead to
the organizations are paying special competitiveness and privacy loss. Integrity
attention to possible threats as steps to failure means the data is modified and
database systems. This paper addresses the corrupt. Most organizations are achieving
possible threats to relational database and the 24/7 availability (7 days a week, 24
prevention techniques including the hours in a day). Availability loss means
situations: threats, prevention strategies the data, or system, or both cannot be
(computer-based controls) and database accessed. Therefore relational database
security techniques. management system aims to minimize the
losses that are caused by anticipated events it doesn’t use any prevention mechanism.
or threats. Threat is an event or situation that An indirect attack is implemented by
may negatively affect a system, and hence the guessing the desired authorization from
whole organization. Organizations must invest given query combinations. The tracking
time and effort to identify and detect the most attack is performed by suppression of
serious threat [1, 8, 9]. influential results [3].

Millions of online activities are performed via RDBMS security threats can be
untrusted Internet connections like electronic
summarized as:
banking and electronic commerce. Those types The DBA could be granted the
of transactions place kind of exposing unnecessary user privileges. Abusive use
information and sensitive assets [2]. This is a of these privileges may lead to indirect
big challenge for service providers to trust of access to the application.
users. Therefore a strong protection is The user has been granted the legal
mandatory for data containers such an privileges to use the database. He/She may
RDBMS. Not all type of data needs strong utilize the system with abusively with bad
protection, but the most private and critical intentions.
data of users and funds transactions. One of the most critical threats is the
Organizations may specify the nature of data accountability of the operating system or
needs encryption with a high level of security software. This facilitates the attacker to
like defense ministry [8, 9]. violate the sensitive information as indirect
This paper shows some important redresses access.
that are computer-control nature such as 1.1. Mechanisms of Attack Control [3]
access control, authorization, encryption, and
 Rejection without providing any
recovery and backup. It must be taken into
response statement when a user or
account the encryption technique needs high
attacker accesses the database to show
performance of the system because it will
the results of core data.
require the decrypting of those data.
Therefore, the programmer must make sure to  The inability of the attacker to expect
use optimized security algorithms to code the the real values or information because
application. the system will show the responsive
statements close to real sensitive data.
1. What are Attacks?
 When the core data will be identified,
The rapid trend of violations of security the system should place limits to resist
measures urged the SME organizations to the intruder to reveal data.
adopt advanced security measures like the
CIA triangle (Confidentiality, Integrity,  Different result combinations will
Availability). However, it requires confuse the attack about revealing
maturity due to multiple types of attacks sensitive information.
either indirect or direct. 2. Security Measures (Computer-based
The unorganized user can have legal Control)
authorization to use public information of These kinds of security measures range
the database but he may expose the from physical access to administrative
classified information. There are three strategies. It can be categorized into
different attack levels to the relational different types of controls as [1]:
database: indirect, direct and by tracking.
The direct attack is clear. The attacking  Authorization
person can easily enter into your system if  Access Levels
 Views  An encryption algorithm that uses an
 Integrity encryption key to encode or convert
the plain text into cipher text.
 Backup Process
 A decryption algorithm uses the key to
Authorization is providing the rights or decode or transform the plain text from
access privileges to a legitimate program the cipher text.
or user to have legal access to the system’s
objects or system. It includes the subject There are two encryption techniques
authentication by requesting object access. known as asymmetric and symmetric. The
The administrator normally creates the symmetric encryption relies on the secure
access accounts with particular usage channel during the exchange of the key,
privileges taking into count the security
level of the respective user. more on, the encryption key is similar to
the decryption key being used for a
Access Controls into RDBMS can
particular instance, (IDEA) International
disallow/allow the user/program to get
access of the system. Relational Database Data Encryption Algorithm) [6,7]. The
Management System saves track of symmetric algorithm is very fast as
privileges process. compare to the Asymmetric algorithm that
Views are results or effects of extensible used two separate keys for encryption and
operations were being performed on the decryption (Public and Private keys) like
main database management system. It is RSA (the name was given on the names of
the structure of dynamic security researchers Ron Rivest, Adi Shamir, and
processes, in which it displays the specific Leonard Adleman). Normally they are
parts of the system and hides others applied at the same time in which public
according to the privileges of the user.
key (asymmetric) encrypts a randomly
Backup Process as we know, backup created key and that random key encrypts
refers to taking a copy of the relational the actual text (by using a symmetric
database and log files of instance
algorithm). The encryption to secure the
processes and saving either on cloud
storage or external storage to use later. database system should enable the data
sharing within the database without
Integrity means keeping the Relational
compromising the privacy of data [2, 6-9].
Database Management System secure by
the prevention of data from being useless. In order to improve the performance of the
3. Techniques of RDBMS Security encryption algorithm, data should be
classified into two categories insensitive
 Encryption is a process of
data and sensitive data. Sensitive data
encoding/converting the sensitive data
should be encrypted using encryption
into an unreadable format. Most of
algorithms while insensitive data can be
RDBMS use this technique to secure
accessed rapidly.
their sensitive data [4].
 The concept of encryption possesses Web-based database security: the data
four major factors defined as [5]: must be transferred securely from a server
 A specific encryption key to encrypt to a client machine. The authentication of
sensitive data (plaintext). a client must be performed via a HIP (Host
Identity Protocol). It establishes the trusted
relationship between the internet and hosts
by communicating with the webserver. There are two strategies for database
The web server and HIP both contribute to encryption that has its pros and cons.
the authentication procedure [2]. Encrypting the Relational Database
To monitor and online occurring activities Management Systems.
and operations log files is an important Applying the encryption from outside of
source. It saves the activity status after the database.
specific intervals to identify the
modifications caused by system failures. It 1. Encryption fundamentals:
also accommodates with an audit The encryption algorithm and key size
component to track the user’s log files to being used for encryption are major factors
assure the security of web databases. to encrypt data within the Relational
Negative Database: this operation depends Database Management System.
on the addition of false data to the original Application administrator may allocate
to confuse the malicious users, and make it legitimate usage to authorized persons for
available only to the legit users. It has four need.
components database cache, encryption 2. Effect of data encryption on RDBMS
algorithm, virtual database and conversion
Data encryption involves highly process
of negative database. The initial three
procedures. This results increase in
produce the required data for the
RDBMS size, then affecting the
conversion to produce the false data [2].
performance or utility. Consequently
4. How to develop a strategy to encrypt encryption of sensitive data.
relational database?
3. Data Stream into application:
It is a structure to enhance the ability of
Data commonly flows across the internet
data prevention. There are multiple factors
and over an internal network. Therefore
to enhance the secure encryption into
the chances of risk are high.
Relational Database Management
Systems. 4. The key management:

 The encryption must be applied to the It narrates how to handle the key being
application or database. used into RDBMS in terms of multiple
 The access to the unique encryption keys, the location and security of the keys
key. while accessing the encrypted keys
 The data amount that needs encryption. 4.1. Solutions of enforcing encryption:
 Is there any factor affecting the
1. Inside the Relational Database
performance.
Management System (RDBMS)
There are more duties of the developer and
It is a simple process of applying the
programmer through developing or
encryption/decryption technique in
creating DBMS.
RDBMS. It is extremely transparent to
The developer must avoid creating the database applications. Data will be
loopholes that can be produced during encrypted while inserting in RDBMS and
creating the procedures and policies. will be decrypted while retrieving from
RDBMS.
 A disadvantage of using this technique in Implementation, and Management”, 4th
RDBMS is the additional processing ed., Ed. England: Person Education
burden and decrease in performance. Limited, 2005, pp. 542-547, 550-551.
2. Out-side the Relational Database [2] Burtescu, E. (2009). Database
Management System (RDBMS) Security-Attacks and Control Methods.
Journal of Applied Quantitative Methods,
This protection technique varies from one
4(4), 449-454.
application to another. In this process a
client/server security protocol (SSL) [3] Kayarkar, H. (2012). Classification of
secure server layer is used for data Various Security Techniques in Databases
encryption or decryption in destination or and their Comparative Analysis. arXiv
source. This technique of using the preprint arXiv:1206.4124.
encryption server facilitates the centralized [4] Kahate, A. (2013). Cryptography and
encryption services for the overall network security. Tata McGraw-Hill
database. Its drawback involves the Education.
administration of more servers and
applications and communication overhead. [5] Stallings, W., & Brown, L. (2008).
Computer security. Principles and
Conclusion Practice.
This paper explains different database [6] Shaefer, E. F. (1996). A Simplified
security techniques. Exposure of data is Data Encryption Standard Algorithm.
increases the security threats to database. Journal of Cryptologia, 20 (1), 77-84.
RDBMS programmers are responsible to
enhance and improve security measures to [7] Chang, H. S. (2004). International Data
databases without compromising the Encryption Algorithm. Retrieved from
performance factor. Further-more, it is http://scholar.googleusercontent.com/schol
ethical responsibility of user for legitimate ar?q=cach
usage of sensitive data. We have pointed e:WXJPT0eEM7EJ:scholar.google.com/+I
out the possible threats to Relational nternation
Database Management Systems. Then, it al+Data+Encryption+Algorithm&hl=en&a
explained some security mechanisms of s_sdt=0,5 on 15 February 2013.
attack control. It has mentioned about [8] Almasri, O., & Jani, H. M. Introducing
computer-based countermeasures and an Encryption Algorithm based on IDEA.
focused on encryption technique. In the
[9] Almasri, O., Jani, H. M., Ibrahim, Z.,
same way, it has explained security
& Zughoul, O. (2013). Improving Security
techniques or procedures for database. The
Measures of ELearning Database.
last part describes the pros and drawbacks
International Organization of Scientific
of applying encryption either outside or
Research-Journal of Computer
inside the Relational Database
Engineering (IOSR-JCE), 10(4), 55-62.
Management System.
References:
[1] T.Connolly, C. Begg. “Database
Systems A Practical Approach to Design,

View publication stats