A Toolkit for Automated Fine-Grained Access Control Policy Enforcement in Oracle 9i

Abstract

Database access control is indispensable to information system security. As enterprises expand their services to the Internet, it has been widely recognized that traditional relation-level or database-level access control is no longer adequate to handle increasingly complex access control requirements in modern information systems. Instead, fine-grained access control (i.e., row-level access control) is much desired. Though several commercial database management systems support fine-grained access control, it requires security policies to be hard-coded into applications by programmers, which is a very error-prone process. It is very difficult for policy makers to verify whether an application's security requirements are correctly enforced by hard-coded policies. If they fail to detect security flaws in policy implementation, the whole information system may be at grave risk.

To help effectively verify and analyze the enforcement of fine-grained access control, in this thesis we present the design and implementation of a policy management toolkit, access control enforcement toolkit (ACET), which is able to automatically translate formal access control policies to the enforcement program of database fine-grained access control. We discuss the desirable properties of formal policy languages when used to specify database fine-grained access control. We present an automated policy translation algorithm that effectively identifies access control components in formal policies and maps them into basic database access control elements. Our initial evaluation shows that the automatically generated policy enforcement program yields comparable performance to that developed by programmers. Thus, the toolkit enables policy makers to focus more on fine-grained security policy specification, without worrying the correct and efficient enforcement of database security policies.