Secure databases: An analysis of Clark-Wilson model in a database environment

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 3084, Issue , 2004, Pages 234-247

  Ge, Xiaocheng ^a   Polack, Fiona ^a   Laleau, Régine ^b  

^a UNIVERSITY OF YORK   (United Kingdom)

^b UNIVERSITÉ PARIS EST CRÉTEIL   (France)

Author keywords

Access control; Data integrity; Databases; Development methods; Security models

Indexed keywords

ACCESS CONTROL; INFORMATION SYSTEMS; MOBILE SECURITY; NETWORK SECURITY;

CLARK-WILSON; CONVENTIONAL DATABASE; DATA INTEGRITY; DEVELOPMENT METHOD; INFORMATION SYSTEMS SECURITY; MALICIOUS ATTACK; SECURE DATABASE; SECURITY MODEL;

DATABASE SYSTEMS;

EID: 35048864767     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: 10.1007/978-3-540-25975-6_18     Document Type: Article

References (23)

1. M. Abrams, E. Amoroso, L. LaPadula, T. Lunt, and J. Williams. Report of an integrity research study group. Computers and Security, 12:679-689, 1993.
2. E. Amoroso. Fundamentals of Computer Security Technology. Prentice Hall, 1994.
3. D. E. Bell and L. J. LaPadula. Secure computer systems: Mathematical foundations and model. Technical Report MTR 2547 v2, MITRE Corporation, 1973.
4. K. J. Biba. Integrity constraints for secure computer systems. Technical Report EST TR-76-372, Hanscom AFB, 1977.
5. S. Castano, M. Fugini, G. Martella, and P. Samarati. Database Security. Addison-Wesley, 1994.
6. D. D. Clark and D. R. Wilson. A comparison of commercial and military computer security policies. In IEEE Symposium on Security and Privacy, pages 184-194, Oakland, April 1987.
7. F. Cuppens. Modélisation formelle de la sécurité des systèmes d'informations. Habilitation, Paul Sabatier University, Toulouse, France, 2000.
8. F. Cuppens and G. Saurel. A logical formalization of integrity policies for database management systems. In S. Jajodia, W. List, G. W. McGregor, and L. Strous, editors, Integrity and Internal Control in Information Systems. Kluwer, 1998.
9. DOD. TCSEC: Trusted computer system evaluation criteria. Technical Report 5200.28-STD, U.S. Department of Defense, 1985.
10. R. Elmasri and S. B. Navathe. Fundamentals of Database Systems. Benjamin Commings, 2nd edition, 1994.
11. S. N. Foley. The specification and implementation of " commercial" security requirements including dynamic segregation of duties. In 4th ACM Conf. on Computer and Communications Security, pages 125-134. ACM Press, April 1997.
12. IBM. DB2 universal database: SQL reference, release 7. IBM Corporation, 2000.
13. ISO. International standard - SQL. Technical report, ISO/IEC 9075-1, 1999.
14. J. Jürjens. Towards development of secure systems using UML. In FASE 2001, Genova, Italy, volume 2029 of LNCS, pages 187-201. Springer Verlag, April 2001.
15. J. Jürjens. UMLsec: Extending UML for secure systems development. In UML 2002. Dresden, Germany, volume 2460 of LNCS, pages 412-425. Springer Verlag, Sept-Oct 2002.
16. T. M. P. Lee. Using mandatory integrity to enforce "commercial" security. In IEEE Symposium on Security and Privacy, pages 140-146, Oakland, April 1988.
17. S. B. Lipner. Non-discrentionary controls for commercial applications. In IEEE Symposium on Security and Privacy, pages 2-10, Oakland, May 1982.
18. Microsoft. SQL server, version 7.0. Microsoft Corporation, 1999.
19. Oracle. Oracle8i SQL reference, release 8.1.6. Oracle Corporation, 1999.
20. G. Pernul, W. Winiwarter, and A. Min Tjoa. The entity-relationship model for multilevel security. In Int. Conf. on Conceptual Modeling / the Entity Relationship Approach, pages 166-177, 1993.
21. C. P. Pfleeger and S. L. Pfleeger. Security in Computing. Prentice Hall, 3rd edition, 2003.
22. F. Polack and R. Laleau. A rigorous metamodel for UML static conceptual modelling of information systems. In CAiSE 2001, Interlaken, Switzerland, volume 2068 of LNCS, pages 402-416. Springer Verlag, June 2001.
23. W. R. Shockley. Implementing the Clark/Wilson integrity policy using current technology. In 11th National Computer Security Conference, pages 29-37, Baltimore, October 1988.