Lecture 12: Database Security
Database System Concepts, 6th Ed.
©Silberschatz, Korth and Sudarshan
See www.db-book.com for conditions on re-use
Database Security
Authentication
Trusted Context
Authorization
Authorities
Privileges
Label-Based Access Control (LBAC)
Roles
Database System Concepts - 6th Edition 16.2 ©Silberschatz, Korth and Sudarshan
Security Overview
Database System Concepts - 6th Edition 16.3 ©Silberschatz, Korth and Sudarshan
Authentication
Database System Concepts - 6th Edition 16.4 ©Silberschatz, Korth and Sudarshan
Authentication
Authentication is the process of verifying a user's identity.
There are several authentication types that DB2 accepts, such
as:
SERVER: authenticates users at the DB2 server. This is the
default value.
SERVER_ENCRYPT: authenticates users at the DB2
server. When the user ID and password are sent to the
server, they are both encrypted.
CLIENT: authenticates users at the DB2 client depending
on the settings of two other configuration parameters:
TRUST_CLNTAUTH and TRUST_ALLCLNTS.
KERBEROS: authenticates users at a Kerberos server.
Database System Concepts - 6th Edition 16.5 ©Silberschatz, Korth and Sudarshan
Authentication Configuration on DB2 Server
To configure the authentication type at a DB2 server, you can
use the Database Manager (DBM) Configuration parameter
AUTHENTICATION.
Command “GET DBM CFG” can be used to display the current
DBM parameter settings.
Look for the <authentication> parameter for the current
authentication type used.
Database System Concepts - 6th Edition 16.6 ©Silberschatz, Korth and Sudarshan
Authentication Configuration on DB2 Server
To change the authentication type, you can use DB2 command
“UPDATE DBM CFG USING AUTHENTICATION <type>”
Database System Concepts - 6th Edition 16.7 ©Silberschatz, Korth and Sudarshan
Trusted Context
The three-tiered application model places a middle tier between the
client application and the database server. (e.g. IBM WAS).
In a three-tiered application model, the middle tier is responsible for
authenticating the users running the client applications and for
managing the interactions with the database server.
While the three-tiered application model provides many benefits,
having all interactions with the database server occur under the
middle tier's authorization ID raises several security concerns, which
can be summarized as follows:
Loss of user identity
Diminished user accountability
Over granting of privileges to the middle tier's authorization ID
Weakened security
"Spill over" between users of the same connection
Database System Concepts - 6th Edition 16.8 ©Silberschatz, Korth and Sudarshan
Trusted Context
Database System Concepts - 6th Edition 16.9 ©Silberschatz, Korth and Sudarshan
Authorization
Database System Concepts - 6th Edition 16.10 ©Silberschatz, Korth and Sudarshan
Authorities
Instance level authorities enable you to perform instance-
wide functions, such as creating and upgrading databases,
managing table spaces, and monitoring activity and
performance on your instance.
No instance-level authority provides access to data in
database tables.
Database level authorities enable you to perform functions
within a specific database, such as granting and revoking
privileges, inserting, selecting, deleting and updating data, and
managing workloads.
Database System Concepts - 6th Edition 16.11 ©Silberschatz, Korth and Sudarshan
Authorities
Database System Concepts - 6th Edition 16.12 ©Silberschatz, Korth and Sudarshan
Authorities
Database System Concepts - 6th Edition 16.13 ©Silberschatz, Korth and Sudarshan
Authorities
Database System Concepts - 6th Edition 16.14 ©Silberschatz, Korth and Sudarshan
Authorities
Database System Concepts - 6th Edition 16.15 ©Silberschatz, Korth and Sudarshan
Privileges
Database System Concepts - 6th Edition 16.16 ©Silberschatz, Korth and Sudarshan
Privileges
Database System Concepts - 6th Edition 16.17 ©Silberschatz, Korth and Sudarshan
Granting Privileges
Database System Concepts - 6th Edition 16.18 ©Silberschatz, Korth and Sudarshan
Granular Privileges
Database System Concepts - 6th Edition 16.19 ©Silberschatz, Korth and Sudarshan
Granular Privileges
Database System Concepts - 6th Edition 16.20 ©Silberschatz, Korth and Sudarshan
Granular Privileges
Database System Concepts - 6th Edition 16.21 ©Silberschatz, Korth and Sudarshan
Roles
Database System Concepts - 6th Edition 16.22 ©Silberschatz, Korth and Sudarshan
Roles
Database System Concepts - 6th Edition 16.23 ©Silberschatz, Korth and Sudarshan
Summary
Database System Concepts - 6th Edition 16.24 ©Silberschatz, Korth and Sudarshan
End of Lecture 12
Database System Concepts, 6th Ed.
©Silberschatz, Korth and Sudarshan
See www.db-book.com for conditions on re-use
