---

School of Computing

Department of Computer Science

CS5322:   Database Security  

---

[Announcements] [Instructor] [Course Objectives] [Lecture Schedule] [Reference Texts and Materials] [Assignment] [Project] [Assessment]

---

Lecture Schedule

---

1. Lecture 1 (17 Aug)

· Introduction [pdf slides(2)] [pdf slides(1)]

· Design Principles [pdf slides(2)] [pdf slides(1)]

2. Lecture 2 (24 Aug)

· Discretionary Access Control [pdf slides(2)] [pdf slides(1)]

a) Patricia P. Griffiths and Bradford W. Wade. An Authorization Mechanism for a Relational Database System. ACM Trans. Database Syst. 1, 3 (Sep. 1976), Pages 242 - 255.

b) R.Fagin. On an Authorization Mechanism. ACM Trans. Database Syst. 3, 3 (Sep. 1978), Pages 310-319.

· Virtual Private Database [pdf slides(2)] [pdf slides(1)]

a) Oracle VPD

· Review [pdf slides(1)]

3. Lecture 3 (31 Aug)

· Mandatory Access Control [pdf slides(2)] [pdf slides(1)]

a) S. Jajodia, R. S. Sandhu. Toward a Multilevel Secure Relational Data Model. Proc 1991 ACM Int'l. Conf. on Management of Data (SIGMOD), 50-59.

· Oracle Label Security [pdf slides(2)] [pdf slides(1)]

· Review [pdf slides(1)]

4. Lecture 4 (7 Sept)

· Role-based Access Control [pdf slides(2)] [pdf slides(1)]

a) R.S. Sandhu, E.J. Coyne, H.L. Feinstein, and C.E. Youman. Role-Based Access Control Models. IEEE Computer, 29(2):38--47, February 1996.

b) S. Osborn, R. Sandhu and Q. Munawer. Configuring Role-Based Access Control to Enforce Mandatory and Discretionary Access Control Policies. ACM Trans. Information and Systems Security. 3, 2 (May 2000), Pages 85-106.

· Review [pdf slides(1)]

5. Lecture 5 (14 Sept) – Database as a Service I – Query authentication [pdf slides(2)] [pdf slides(1)]

· P. T. Devanbu, M. Gertz, C. U. Martel, S. G. Stubblebine: Authentic Data Publication Over the Internet. Journal of Computer Security 11(3): 291-314 (2003)

· H.H. Pang, A. Jain, K. Ramamritham, K.L. Tan: Verifying Completeness of Relational Query Results in Data Publishing. 2005 International Conference on Management of Data (SIGMOD'2005), Baltimore, Maryland, June 2005, pp. 407-418.

· Review [pdf slides(1)]

6. Lecture 6 (21 Sept) – Encrypted Domain Keyword Search [pdf slides(2)] [pdf slides(1)]

· E. Goh. Secure Indexes. In the Cryptology ePrint Archive, Report 2003/216, March16, 2004. http://eprint.iacr.org/2003/216/

· Review [pdf slides(1)]

7. 28 Sept – Recess week

8. Lecture 7 (5 Oct) – Database as a Service II – Encryption-based [pdf slides(2)] [pdf slides(1)]

· H. Hacigumus, B. R. Iyer, C. Li, S. Mehrotra: Executing SQL over encrypted data in the database-service-provider model. 2002 International Conference on Management of Data (SIGMOD'2002), 216-227

· H. Hacigumus, B. R. Iyer, C. Li, S. Mehrotra: Efficient Execution of Aggregation Queries over Encrypted Relational Databases. DASFAA04, 125-136

· L. Bouganim, Y. Guo: Database Encryption. Encyclopedia of Cryptography and Security (2nd Ed.) 2011: 307-312

· Transparent_Data_Encryption (Extra Optional Reading)

a) Oracle TDE (White Paper)

· Review [pdf slides(1)]

9. Lecture 8 (12 Oct) – eLearning week (no face-to-face lecture) - Compliance Storage [pdf slides(2)] [pdf slides(1)]

· Review [pdf slides(1)]

· Q. Zhu, W. W. Hsu: Fossilized Index: The Linchpin of Trustworthy Non-Alterable Electronic Records. SIGMOD’2006,  395-406, 2006.

· S. Mitra, W. W. Hsu, M. Winslett: Trustworthy Keyword Search for Regulatory-Compliant Record Retention.VLDB’2006,  1001-1012, 2006

· S.Mitra, M. Winslett: Secure Deletion from Inverted Indexes on Compliance Storage. Proceedings of the 2006 ACM Workshop On Storage Security And Survivability, StorageSS 2006, Alexandria, VA, USA, October 30, 2006, pp. 67-72.

10. Lecture 9 (19 Oct) – Invited Guest Lecture on Data Privacy [Part I] [Part 2]

· Review [pdf slides(1)]

· L. Sweeney: Achieving k-anonymity privacy protection using generalization and suppression. Int. Journal on Uncertainty, Fuzziness and Knowledge-based Systems, 10 (5):571-588, 2002.

· A. Machanavajjhala, J. Gehrke, D. Kifer, M. Venkitasubramaniam: l-Diversity: Privacy Beyond k-Anonymity. In Proc. of ICDE, 2006.

· Ni. Li, T. Li, S. Venkatasubramanian: t-Closeness: Privacy Beyond k-Anonymity and l-Diversity. ICDE 2007: 106-115.

· C. Dwork: Differential Privacy. ICALP 2006: 1-12.

11. 26 Oct – Public Holiday (Hari Raya Haji) – No lecture

12. Lecture 10 (2 Nov) – Privacy in Location Based Service [pdf slides(2)] [pdf slides(1)]

· Review [pdf slides(1)]

· M. Mokbel, C-Y. Chow, W.G. Aref: The New Casper: Query Processing for Location Services without Compromising Privacy. In Proc of VLDB 2006.

· Man Lung Yiu, Christian S. Jensen, Xuegang Huang, Hua Lu: SpaceTwist: Managing the Trade-Offs Among Location Privacy, Query Performance, and Query Accuracy in Mobile Services. In Proc of ICDE 2008.

· G. Ghinita, P. Kalnis, A. Khoshgozaran, C. Shahabi, K.L. Tan: Private Queries in Location Based Services: Anonymizers are not Necessary. 2008 International Conference on Management of Data (SIGMOD'2008), Vancouver, Canada, June 2008, pp. 121-132.

13. Lecture 11 (9 Nov) – Steganographic File Systems [pdf slides(2)] [pdf slides(1)]

· H. Pang, K.L. Tan, X. Zhou: Steganographic Schemes for File System and B-Tree. IEEE Trans. Knowl. Data Eng. 16(6): 701-713 (2004)

· X. Zhou, H. Pang, K.L. Tan: Hiding Data Accesses in Steganographic File System. ICDE 2004: 572-583

· [pdf slides(1)]

14. Lecture 12 (16 Nov) – Insider Threat [pdf slides(2)] [pdf slides(1)]

· Review [pdf slides(1)]

· A. Kamra, E. Terzi, E. Bertino: Detecting anomalous access patterns in relational databases. VLDB J. 17(5): 1063-1077 (2008)

· A. Kamra, E. Bertino: Design and Implementation of an Intrusion Response System for Relational Databases. IEEE TKDE 23(6): 875-888 (June 2011)

· A. Kamra, E. Bertino: Privilege States Based Access Control for Fine-Grained Intrusion Response. RAID 2010: 402-421

15. Lecture 12 (16 Nov) – Review [pdf slide]

16. 27 Nov – Exam (Afternoon)

---