A Study on Database Access Control using Least-Privilege Account Separation Model
0
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
In addition to enabling access, database accounts play a protective role by defending the database from external attacks. However, because only a single account is used in the database, the account becomes the subject of vulnerability attacks. This common practice is due to the lack of database support, large numbers of users, and row-based database permissions. Therefore if the logic of the application is wrong or vulnerable, there is a risk of exposing the entire database. In this paper, we propose a Least-Privilege Account Separation Model (LPASM) that serves as an information guardian to protect the database from attacks. We separate database accounts depending on the role of application services. This model can protect the database from malicious attacks and prevent damage caused by privilege escalation by an attacker. We classify the account control policies into four categories and propose detailed roles and operating plans for each account.
Abstract
In addition to enabling access, database accounts play a protective role by defending the database from external attacks. However, because only a single account is used in the database, the account becomes the subject of vulnerability attacks. This common practice is due to the lack of database support, large numbers of users, and row-based database permissions. Therefore if the logic of the application is wrong or vulnerable, there is a risk of exposing the entire database. In this paper, we propose a Least-Privilege Account Separation Model (LPASM) that serves as an information guardian to protect the database from attacks. We separate database accounts depending on the role of application services. This model can protect the database from malicious attacks and prevent damage caused by privilege escalation by an attacker. We classify the account control policies into four categories and propose detailed roles and operating plans for each account.
참고문헌 (11)
- S.M. Groomer, "Continuous Auditing: Theory and Application", pp.105~124 (2018)
- "Separation of system resources guideline"[URL]
- M. Malik, "Database security attacks and control methods", International Journal of Information, 6, pp.175~183 (2016)
- P. Colombo, "Enforcement of purpose based access control within relational database management systems", IEEE Transactions on Knowledge and Data Engineering, 26(11), pp.2703~2716 (2014)
- SU. Moon, "System and method for authentication", U.S. Patent and Trademark Office, ~ (2016)
- M. Guarnieri, "Strong and provably secure database access control", 2016 IEEE Euro S&P, pp.163~178 (2016)
- CK. Wee, "Modern Approaches for Intelligent Information and Database Systems", pp.505~516 (2018)
- N. Batra, "Autonomous multilevel policy based security configuration in distributed database", International Journal of Computer Science Issues, 9(6), pp.170~176 (2012)
- YS. Jang, "Detecting SQL injection attacks using query result size", Comput. Sec., 44, pp.104~118 (2014)
- 박종순, "빅데이터 연구동향 분석: 토픽 모델링을 중심으로", (사)디지털산업정보학회 논문지, 15(1), pp.1~7 (2019), (사)디지털산업정보학회
- 조은숙, "딥러닝을 통한 의미ㆍ주제 연관성 기반의 소셜 토픽 추출 시스템 개발", (사)디지털산업정보학회 논문지, 14(4), pp.35~45 (2018), (사)디지털산업정보학회[DOI]