DDBMS - Security in Distributed Databases

A distributed system needs additional security measures than centrapzed system, since there are many users, spanersified data, multiple sites and distributed control. In this chapter, we will look into the various facets of distributed database security.

In distributed communication systems, there are two types of intruders −

Passive eavesdroppers − They monitor the messages and get hold of private information.

Active attackers − They not only monitor the messages but also corrupt data by inserting new data or modifying existing data.

Security measures encompass security in communications, security in data and data auditing.

Communications Security

In a distributed database, a lot of data communication takes place owing to the spanersified location of data, users and transactions. So, it demands secure communication between users and databases and between the different database environments.

Security in communication encompasses the following −

Data should not be corrupt during transfer.

The communication channel should be protected against both passive eavesdroppers and active attackers.

In order to achieve the above stated requirements, well-defined security algorithms and protocols should be adopted.

Two popular, consistent technologies for achieving end-to-end secure communications are −

Secure Socket Layer Protocol or Transport Layer Security Protocol.

Virtual Private Networks (VPN).

Data Security

In distributed systems, it is imperative to adopt measure to secure data apart from communications. The data security measures are −

Authentication and authorization − These are the access control measures adopted to ensure that only authentic users can use the database. To provide authentication digital certificates are used. Besides, login is restricted through username/password combination.

Data encryption − The two approaches for data encryption in distributed systems are −

Internal to distributed database approach: The user apppcations encrypt the data and then store the encrypted data in the database. For using the stored data, the apppcations fetch the encrypted data from the database and then decrypt it.

External to distributed database: The distributed database system has its own encryption capabipties. The user apppcations store data and retrieve them without reapzing that the data is stored in an encrypted form in the database.

Vapdated input − In this security measure, the user apppcation checks for each input before it can be used for updating the database. An un-vapdated input can cause a wide range of exploits pke buffer overrun, command injection, cross-site scripting and corruption in data.

Data Auditing

A database security system needs to detect and monitor security violations, in order to ascertain the security measures it should adopt. It is often very difficult to detect breach of security at the time of occurrences. One method to identify security violations is to examine audit logs. Audit logs contain information such as −

Date, time and site of failed access attempts.

Details of successful access attempts.

Vital modifications in the database system.

Access of huge amounts of data, particularly from databases in multiple sites.

All the above information gives an insight of the activities in the database. A periodical analysis of the log helps to identify any unnatural activity along with its site and time of occurrence. This log is ideally stored in a separate server so that it is inaccessible to attackers.