Sebery J.Cryptography.An introduction to computer security.1989

The reader is directed to the last three cited works for further information on the model.

Composed encryption functions. A method put forward by Wagner [517] consists of a two stage encryption method for databases where no single agency or device can encrypt or decrypt data directly. It allows users to choose their own keys while all data in the database are nally encrypted using a secret key. The system employs a trusted central authority or Data Distributor (DD) that holds a complementary key for each user. Before accessing any part of the database a user n must cooperate with another user i (i < n) who acts as a sponsor to user n. In this scheme the rst user (user 1) has a special position in that he or she chooses half or the random key for the database encryption (user 1 is preferably a trusted user, such as the database administrator). User 1 then becomes the sponsor of user 2, and so on. The RSA cryptosystem and DES are suitable as cryptosystems for this model.

The rst step in the method is to perform key distribution where user 1 chooses a random secret X and the Data Distributor chooses also a random secret Y . User 1 then chooses his or her encryption key K1 and nds its inverse (decryption key K1 1 ) modulo '(N), where N is a large prime (public). User 1 then calculates

Z1 K1 1X mod '(N)

and sends Z1 to the Data Distributor who calculates

L1 Z1Y mod '(N) secretly. Note that L1 is in fact

L1 K1 1XY mod '(N)

and all data M is later encrypted as MXY mod N. The value Li Ki 1XY mod '(N) is stored in secret and is used later for access to the database by the user i. Also note that user 1 does not have a sponsor, hence he or she should be a trusted user or database administrator.

The key distribution for user n is the following. User n chooses a secret random pair U and V and calculates his or her key Kn = UV . He or she then sends V to the Data Distributor. User n then chooses a sponsor user i (i < n) and sends U to user i. User i calculates the inverse U 1 of U modulo '(N) and calculates

532 16 DATABASE PROTECTION AND SECURITY

Zn U 1Ki mod '(N)

on behalf of user n. In this step, the sponsor has attached his or her own key Ki. The sponsor then sends Zn to the Data Distributor. The Data Distributor now has both V and Zn, and proceeds to nd the inverse V 1 of V modulo '(N). Next, the Data Distributor calculates

Ln V 1ZnLi mod '(N)

and stores Ln in a secure place. This means that in fact Ln reduces to

Ln Kn 1XY mod '(N)

The storage and retrieval of a data M is performed as follows: User n stores data M by encrypting it using his or her key Kn and forms cryptogram C0 MKn mod N. This cryptogram is then given to the Data Distributor who further encrypts it using Ln giving C where C (C0)Ln mod N. Thus:

C (C0)Ln (MKn )ZnY MXY mod N

User n can retrieve data M by asking the Data Distributor to decrypt C into C00. The Data Distributor rst fetches the secret value Ln corresponding to user n and computes the inverse Ln 1 of Ln modulo '(N). Then the cryptogram

C00 is calculated by:

C00 CLn 1 mod N

and the Data Distributor passes C00 to user n. User n then nds M from C00 using Kn 1 by the following:

M (C00)Kn 1 (CLn 1 )Kn 1 ((MXY )(Kn 1XY ) 1 )Kn 1 mod N

One advantage of this method is the ease in changing the user keys. When user n wants to get a new key, he or she must choose a random secret V and send it to the Data Distributor who calculates its inverse V 1 modulo '(N). The Data Distributor then updates the secret Ln corresponding to user n and

generates

Ln0 V 1Ln mod '(N) and user n updates his or her key Kn into

Kn0 V Kn mod '(N)

.

Another advantage is the restructuring of the list of Li values when that list is compromised. The Data Distributor simply chooses a secret random W and for each Li in the list a new one is generated as:

Li0 W Li mod '(N)

All ciphertext C in the database is then encrypted into C by performing C CW mod N. Encryption and decryption of data by users then proceed as before.

Polynomial-based encryption. Cooper, Hyslop, and Patterson [105] suggested a method for database encryption based on polynomials in the eld GF(p), where p is prime. The contents of the database is viewed as consisting of xed-length character strings. These are in turn made up of substrings and users can have access to a select subset of these substrings, as in the usual situation where users may only have access to a subset of the records in the database.

Let the substrings Si (i = 1; : : : ; n) be concatenated into a single long string S. The long string is then encrypted using the following procedure. For the selected plaintext alphabet, a prime p c is chosen, where c is the number of characters in the alphabet. A bijection is then constructed from the plaintext alphabet to the integers in eld GF(p). Hence, under the bijection the representative substring belonging to users will correspond to the set of integers between 0 and p 1. Each sequence of integers Sk is then used to form a polynomial Sk(x) in x of degree at most d = l 1 where l is the length of the representative sequence Sk. A nite eld GFk = GF (pl) is then generated using an irreducible polynomial Ik(x) such that it contains Sk(x) as its element. Following this, a secret polynomial Rk(x) is calculated for each nite eld GFk, and is multiplied to produce the polynomial Tk(x) as follows:

Tk(x) Sk(x)Rk (x) mod Ik(x)

Encryption for the representative record S is equivalent to nding a polynomial A(x) using the Chinese Remainder Theorem where:

A(x) Tk(x) mod Ik(x)

for k = 1; : : : ; n. Decryption of a sequence Sk is performed by dividing A(x) by Ik(x), resulting in the remainder Tk (x). This remainder is further multiplied by

534 16 DATABASE PROTECTION AND SECURITY

Rk 1(x), producing the required Sk(x) that can be inverted back to the original plaintext using the initial bijection.

In [42] Blakley and Meadows presents an encryption scheme that allows the encrypted data to be used in some statistical computation involving counts, sums and higher-order moments. Given a Galois Field GF( ) where is a large prime, the ith record of the database is encrypted as the polynomial pi, where each pi is constructed so that pi(cj) is the jth data element of the ith record (i = 1; : : : ; d). Here the k elds are represented by the elements c1; : : : ; ck of the Galois Field GF( ).

A user who is authorized to access all the elds in a record can be given one polynomial and all cj (j = 1; : : : ; k). A user with access to a given number of elds of all the records gets all polynomials but only one cj . A user who is authorized to know the sum or the average value of the projection of the jth

eld can calculate

d

p = X pi

i=1

and evaluate it at cj , and divide by d. Here the division by d is over the reals and the summation is over GF( ). The reader is directed to [42] for further notes on how to encrypt the polynomials and how to do other statistical computations.

Joint encryption and error-control. In [365] Nam and Rao presents a database encryption scheme that allows decryption and control of errors in the database. The scheme is called Residue-Coded Cryptosystem (RCC) and is based on residue codes that presents an error detection capability based on (n; k) residue codes. The idea of error-detection is very attractive to distributed databases in which data in the form of records must be sent between sites through communications medium that is subject to noise and to illegal tampering.

Given a plaintext M that is one eld per record, the encrypted ciphertext C consists of n residues, including (n k) error-control residues. Thus,

C = C1; : : : ; Ck; Ck+1; : : : ; Cn

where C1; : : : ; Ck are the information residues and Ck+1; : : : ; Cn are the errorcontrol residues. The encryption stage consists of the selection of n encryption keys d1; : : : ; dn (relatively prime integers) for each of C1; : : : ; Cn, respectively, where

k

Y di max(M) Zc

i=1

and

dk+j > di

for j = 1; : : : ; n k and i = 1; : : : ; k, where Zc is an integer employed for security and max(M ) is the maximum value of M. Thus, the n pieces of information take the following form:

Ci (Z jj M) mod di

for i = 1; : : : ; n where Z is a xed length random number less that Zc and jj denotes concatenation.

The decryption stage consists of the calculation of Z concatenated to M as follows:

Z jj M

where

k

D = Y di

i=1

The decryption key ei is calculated as:

D ei = di bi

where bi is the inverse of D=di modulo di and

D

di bi 1 mod di

The value M can then be retrieved from the concatenation Z jj M.

The syndrome computation and error control can be done depending on the set-up of the scheme. Thus, for a single residue error correction capability the ciphertext would then require two error-control residue. The syndrome vector can be computed in the following manner:

Si (C M ) mod di

for i = k + 1; n. Here M = Z jj M before the M is extracted out of the concatenation. The assurance that no errors have occurred is gained when Si = 0 for all the syndrome vectors. The reader is directed to the work by Nam and Rao [365] for further information on the scheme and a comparison of the scheme with the Subkeys Model in [122].

536 16 DATABASE PROTECTION AND SECURITY

16.3.1 Privacy Homomorphisms

A major hustle with encryption for information protection in databases is the necessity of decryption every time information is needed for either processing or retrieval. It can be argued that during processing, the decryption can be eliminated if operations can be performed on cryptograms. In other words, instead of clear data, the operation uses ciphertext and generates a cryptogram of the result that can be then decrypted in the time of retrieval.

Given an operation OP : Mn ! M that takes n arguments and produces result from the set M and a cryptographic algorithm de ned by its encryption and decryption functions Ek and Dk, respectively. It is said that a cryptographic transformation preserves an operation OP on n variables if

OP (m1; : : : ; mn) = Dk(OP(Ek(m1); : : : ; Ek(mn)))

for each cryptographic key k 2 K. This concept can be extended to algebraicelds when a cryptographic algorithm preserves both eld operations h+; i. Di erent candidates for cryptographic transformation preserving eld operations are discussed in [457]. If processing involves not only addition and multiplication but other operation such as comparison operations, then the class of cryptographic transformations preserving the operations is rather small and thus its practical usage is limited.

Rivest, Adleman and Dertouzos [428] de ned a broader class of cryptographic transformations that preserve operations and called them privacy homomorphisms. The class of privacy homomorphisms is de ned as the quadruple:

(EK; DK; OP; OP ) such that:

OP (m1; : : : ; mn) = Dk(OP (Ek(m1); : : : ; Ek(mn)))

for each cryptographic key k and any sequence of m1; : : : ; mn in the message space M. OP and OP are operations that are permissible in the message and cryptogram spaces, respectively. Notice that the de nition says that we get the correct result after decryption of the operation OP .

Recall that the enciphering transformation in the RSA system is Ee(m) = mepmodN, where e is the enciphering key, m is the message, and the modulus N = pq (p; q are primes). Note that:

Ee(m1 m2) = (m1 m2)e = me1 me2 = Ee(m1) Ee(m2)

Thus, the enciphering transformation of the RSA system has the multiplication property. In other words, it is possible to de ne the multiplicative homomorphism (Ee, Dd, OP, OP ) for which Ee; Dd are cryptographic transformations de ned in the RSA system and OP = OP . This privacy homomorphism is as secure as the RSA system.

Other protection methods. An interesting idea was presented by Brandt, Damgard, and Landrock [58] whereby individuals could submit data concerning themselves to a centralized database without the need to trust the register of the database. The data of each individual is protected from one another, and each individual has the power to ensure that data about him or her in the register database is correct and not modi ed illegally. This scheme applies very attractively to scenarios such as in centralized medical databases with data from various hospitals, and in centralized government taxation databases. Given a number of institution, which have to send data about a particular individual to the centralized database the scheme aims at keeping the individual anonymous and making the registration veri able.

Carroll and Jurgensen [77] present a relational database structure in which access is controlled by cryptographic means, while data in the database are stored in an encrypted format. Information about the clearance of users are placed in individual user pro les that can be hierarchical and non-hierarchical. A number of rules concerning read, write and read/write operations is also suggested. The results of a simulation is also provided, which indirectly points out the practical diÆculties of the ?-property of the Bell-La Padula security model [19, 20]. Based on the access control mechanism and the database encryption scheme a formal model of systems security is also provided.

16.4 Database Machines and Architectures

Database machines or database computers provide some advantages in security depending on their con guration with respect to the host operating system. Following the work by Hsiao [248] and by Henning and Walker [237], the four database machine architectures that may provide security are:

{Intelligent disk controller { Here the database management system resides on the host computer and employs the main memory of the host, but interacts with the intelligent controller. The controller usually has built into it enough

538 16 DATABASE PROTECTION AND SECURITY

processing logic so that raw data can be preprocessed before it is placed in the main memory of the host [248]. The security of the database provided by this architecture depends heavily on the security mechanisms provided by the host operating system. This includes user authentication that is performed by the host operating system. The advantage of this con guration comes from the increase in performance due to the speed of data retrieval by the controller, independent of the data storage mechanisms of the host. In this case it is required that the path between the controller and the host be a trusted one.

{Host independent hardware backend database machine { All security responsibilities belong to the database machine. All access can be controlled by the machine since it is physically separated from the host (frontend) computer. The database management routines and the on-line I/O capabilities are built into hardware, thus o ering an increase in performance during normal database operations. The backend machine only receives the queries and returns answers to the host computer [248]. User authentication may be performed independent of the authentication by the host operating system. The backend machine must rely on the operating system to pass to it data and queries from users, hence a trusted path must exist between the backend and the host. Such a database machine would be trusted to a level at least equal to the highest level of trust in the host operating system.

{Software backend database machine { A software approach can be taken in the implementation of a backend database system, in which all database management tasks and online I/O routines are performed by software residing in a stand-alone general purpose computer. In this manner the resources of the host operating system is free from any database functions. The security of the database system in this con guration follows the security of the operating system, hence portability to di erent hosts may prove to be diÆcult. Additional security measures can be implemented on the backend computer independent of the security measures of the host.

{Multibackend software database machine { The software-based backend database machines can be adapted to a multiprocessor multibackend con guration. The same piece of software can be used in all instances of the backend without requiring any modi cations to the hardware. A software control module is located between the single host and the multiple backends. In a multilevel security classi cation of data each backend can be used to stored data of differing sensitivity. The software control module can then route queries to these

backends depending on the security clearance of the user. In terms of performance this con guration allows queries to be processed in parallel. However, the very nature of replicated data makes the control of these backends diÆcult. The security of this con guration is no di erent from that of the single backend software database machine. However, the fact that one backend may interact with another in the course of processing a query means that a covert channel may also exists between the backends.

16.4.1 Experimental Backend Database Systems

Two of the early experimental systems using backend database systems are the Data Base Computer (DBC) [13] developed at the Ohio State University, and MULTISAFE [511] developed by Virginia Tech and the University of South Carolina.

MULTISAFE. In MULTISAFE [511] the data management system is divided functionally into three major hardware-software module. There are the User and Application Module UAM, the Protection and Security Module (PSM) and the data Storage and Retrieval Module (SRM). Logically, each of these modules is separated, but physically they may be implemented on the same underlying hardware. However, performance needs suggest that each module should be implemented on physically di erent processors. Although the three modules are treated as a separate and independent processes, they are precisely connected to achieve a combination of multiprocessing, pipelining, and parallelism.

The UAM is essentially the interface between the user and the system. The UAM can be realized in a number of ways. It can be seen as a large conventional multiprogrammed processor with disjoint user address space or it can be viewed as a collection of intelligent terminals, each with a private memory and processor. Independent of its actual implementation, the UAM has the task of analyzing user queries and formatting results, and providing working storage and computation abilities to the user. The UAM does not provide any security or I/O tasks to the user.

The PSM encapsulates the security mechanism away from the other modules. It makes access decisions based on three dependency classes:

{Data-independent access { This access condition depends on user and/or terminal identi cation information and dynamic system variables.

540 16 DATABASE PROTECTION AND SECURITY

{Data-de nition-dependent access. This access depends on attribute names and relations, independent of their actual value.

{Data-value-dependent access { This requires the checking of attribute values before any access.

The PSM is dedicated to security-related tasks and is free from any operating system or database system functions. This includes audit-trail maintenance, integrity checking, cryptographic functions and the control of backup and recovery.

The SRM is dedicated to perform database accesses on behalf of the UAM and PSM. The SRM processor can be realized in terms of conventional computer hardware and/or a conventional DBMS software. Alternatively, a backend processor or a database machine can be employed. The SRM can perform other additional tasks, such as data manipulation operations and the materialization of database views. Furthermore, it can maintain private les associated with other non-DBMS applications belonging to the user. The reader is directed to [511] for more information on the communication of messages between the modules of MULTISAFE and other security-related issues.

Data Base Computer (DBC). The Ohio State University Data Base Computer (DBC) [13] employs the idea of back-end computers and associative processors. The developers of DBC recognized a number of problems found in common database systems in relation to data security. Some of the problems they set out to solve are:

{the complexity of name-mapping operations in answering queries

{the performance bottleneck caused by di erent functional software modules being implemented on the same underlying hardware

{the data security overhead due to the need to perform multiple name-mapping operations in order to enforce security

The key design concepts employed in the DBC to overcome these problems include the use of a partitioned content-addressable memory (PCAM), the use of structure and mass memories, area pointers, functional speci cation, look aside bu ering, and the integration of security into the design. The aim of the PCAM is to reduce the need for name-mapping data structures. The PCAM is implemented by splitting a storage system into many blocks or partitions.