Reverse Engineering of Database Security Policies
Security is a critical concern for any database. Therefore, database systems provide a wide range of mechanisms to enforce security constraints. These mechanisms can be used to implement part of the security policies requested of an organization. Nevertheless, security requirements are not static, and thus, implemented policies must be changed and reviewed. As a first step, this requires to discover the actual security constraints being enforced by the database and to represent them at an appropriate abstraction level to enable their understanding and reenginering by security experts. Unfortunately, despite the existence of a number of techniques for database reverse engineering, security aspects are ignored during the process. This paper aims to cover this gap by presenting a security metamodel and reverse engineering process that helps security experts to visualize and manipulate security policies in a vendor-independent manner.
KeywordsAccess Control Security Policy Reverse Engineering Security Model Access Control Policy
Unable to display preview. Download preview PDF.
- 1.Astrova, I.: Towards the semantic web - an approach to reverse engineering of relational databases to ontologies. In: ADBIS Research Communications. CEUR Workshop Proceedings, vol. 152 (2005), CEUR-WS.org
- 2.Barker, S., Douglas, P.: RBAC policy implementation for SQL databases. In: DBSec, pp. 288–301 (2003)Google Scholar
- 7.Iuc Hainaut, J., Chandelon, M., Ch, M., Tonneau, C., Joris, M.: Contribution to a theory of database reverse engineering. In: Proc. of the IEEE Working Conf. on Reverse Engineering, pp. 161–170. IEEE Computer Society (1993)Google Scholar
- 8.Oh, S., Park, S.: Enterprise model as a basis of administration on role-based access control. In: CODAS 2001, pp. 165–174 (2001)Google Scholar
- 10.Sandhu, R., Ferraiolo, D., Kuhn, R.: The NIST model for role-based access control: towards a unified standard. In: Proceedings of the Fifth ACM Workshop on Role-Based Access Control, RBAC 2000, pp. 47–63. ACM (2000)Google Scholar