Evaluation of approaches for designing secure data warehouse

ABSTRACT

Data Warehouse (DW) systems maintain sensitive and crucial information integrated from various heterogeneous sources of the organization, that needs to be protected from unauthorized users. This motivates researchers to consider the issue of information security during the design and development of DW systems. It has also been recognized by the researchers that the information security issue must be considered from the early stages of DW systems development life cycle. In this paper, we survey different relevant approaches for DW design considering issues of information security. Having surveyed the various approaches in the DW literature, we observed that most of the approaches consider security issue right from the conceptual model and moves towards subsequent logical and physical model. However, very little work is seen in the DW literature that considers security aspect from requirements level, which is very important to arrive at subsequent models of DW. Further, we evaluated different approaches for DW design on various security specific parameters like confidentiality, integrity, availability, access control and audit measures, inference control, traceability, interoperability, etc. The proposed evaluation will help the designers while selecting the appropriate approach for designing a secure DW. This will also motivate readers to explore the possibility of proposing new approach for DW design considering security issues into account.

References

1. Kimball, R., Ross, M. 2002. The Data Warehouse Toolkit. Wiley & Sons.
2. Devanbu, P., Stubblebine S. 2002 Software engineering for security: a roadmap. In: A. Finkelstein, Editor, The Future of Software Engineering, ACM Press, New York, 227239.
3. Dhillon, G., Backhouse, J., 2000 Information system security management in the new millennium, Commun. ACM 437 125--128.
4. Toval, A., Nicolás, J., Moros, B., García, F. 2002. Requirement reuse for improving information systems security: a practitioner's approach, Requirement Engineering Journal 6 (4).
5. Ferrari, E., Thuraisingham, B. 2000 Secure database systems, in: M. Piattini, O. Díaz (Eds.), Advanced Databases: Technology Design, Artech House.
6. Rizzi, S., Abelló, A, Lechtenbörger, J., Trujillo, J. 2006 Research in data warehouse modeling and design: dead or alive? In: DOLAP, 3--10
7. Soler, E., Trujillo, J., Medina, F. 2008 Towards comprehensive requirement analysis for DW: Considering security requirement Published in IEEE Conference in.
8. Ponniah, P. 2006: Data Warehousing Fundamentals. Wiley & Sons.
9. Soler, E., Trujillo, J., Fernández-Medina, E., Piattini, M. 2008. "Building a secure star schema in data warehouses by an extension of the Relational Package from CWM", Computer Standards & Interfaces, 30, 6, 341--350.
10. Sapia, C., Blaschka, M., Hofling, G., Dinter, B., 1998. Extending the E/R model for the multidimensional paradigm. In Proc. ER Workshop on Data Warehousing and Data Mining, pages 105--116.
11. Tryfona, N., Busborg, F., Christiansen, J., 1999. starER: a conceptual model for data warehouse design, ACM 2nd International Workshop on Data Warehousing and OLAP (DOLAP'99), ACM, Missouri, USA.
12. Luján-Mora, S., Trujillo, J. Song, I., 2006. A UML profile for multidimensional modeling in data warehouses. In Data & Knowledge Engineering.
13. Abelló, A., Samos, J., Saltor, F., 2006 YAM2: a multidimensional conceptual model extending UML. Information Systems, 31(6):541--567.
14. Golfarelli, M., Maio, D., Rizzi, S., 1998. The Dimensional Fact Model: A conceptual model for data warehouses. International Journal of Cooperative Inf. System., 7(2--3):215--247.
15. Marks, D., Sell, P., Thuraisingham, B., 1996. MOMT: a multi-level object modeling technique for designing secure database applications, Journal of Object-Oriented Programming 9 (4).
16. Husemann, B., Lechtenborger, J., Vossen, G., 2000. Conceptual data warehouse design, Proceedings of the 2nd. International Workshop on Design and Management of Data Warehouses, Technical University of Aachen (RWTH), (Stockholm, Sweden).
17. Smith, G. W., 1991. Modeling security-relevant data semantics, IEEE Transactions on Software Engineering 17 (11).
18. Jajodia, S., Wijesekera D., 2004. Securing OLAP data cubes against privacy breaches. In Proc. IEEE Symp. on Security and Privacy, pages 161--178.
19. Kirkgöze, R., Katic, N., Stolda, M., Tjoa, A. M,. 1997. A security concept for OLAP. In Proc. DEXA, pages 619--626.
20. Fernandez-Medina, E., Trujillo, J., Villaroel, P., Piattini, M. 2006. Extending UML for designing secure data warehouses. In Decision Support Systems.
21. Priebe, T., Pernul, G., 2000. A pragmatic approach to conceptual modeling of OLAP security. In Proc. ER, pages 311--324.
22. Fernandez-Medina, E., et al., 2006. Access Control and Audit Model for the Multidimensional Modeling of Data Decision Support Systems, 42: p. 1270--1289.
23. Fernandez-Medina, E., Trujillo, J., Villarroel, R., 2006. "Developing a secure data warehouses with a UML extension" Science Direct 0306--4376.
24. Soler, E., Villarroel, R., Trujillo, J., 2006. "Representing security and audit rules in Data warehouse at the logical levels by using the common warehouse met model" Proceedings of the First International Conference on Availability, Reliability and Security (ARES'O6)0-7695-2567-9106 IEEE.
25. Miller, J., Mukerji, J., 2003. "MDA guide version 1.0.1,.
26. OMG, MOF QVT. 2005 final adopted specification.
27. Giorgini, P., Mouratidis, H., Zannone, Z.: 2006. Modelling Security and Trust with Secure Tropos, Integrating Security and Software Engineering: Advances and Future Visions, Idea Group Publishing.
28. Soler, E., Trujillo, J., Fernández-Medina, E., Piattini, M. 2007. A set of QVT relations to transform PIM to PSM in the Design of Secure Data warehouses", Second international Conference on Availability, Reliability and Security (ARES'07), Vienna, Austria, 644--654.
29. Soler, E., Trujillo, J., Fernández-Medina, E., Piattini, M. 2007a "Application of QVT for the Development of Secure Data Warehouses: A case study", Second International Conference on Availability, Reliability and Security (ARES'07), Vienna, Austria, 829--836.
30. Soler, E., Trujillo, J., Fernández-Medina, E., Piattini, M. 2007b. "Framework for the Development of Secure Data Warehouses based on MDA and QVT", Second International Conference on Availability, Reliability and Security (ARES'07), Vienna, Austria, 294--300.
31. Blanco, C., et al., 2008. Applying QVT in order to implement Secure Data Warehouses in SQL Server Analysis Services. Journal of Research and Practice in Information Technology,.
32. Blanco, C., Guzman, I. G. R., Medina, E. F., Trujillo, J. and Piattini, M. 2008. Automatic generation of secure Multidimensional Code for Data Warehouses: An MDA Approach, In OTM 2008, Part II, LNCS 5332, 1052--1068.
33. Fernández-Medina, E. et. al., 2009. Designing secure Data warehouses by using MDA and QVT. Journal of Universal Computer science, vol 15, no 8, 1607--1641.
34. Juan Trujillo et al., 2009. Applying an MDA based approach to consider security rules in the development of secure DW's, International conference on Availability, Reliability and Security.
35. Rosenthal, A., Sciore, E. 2000. View security as the basic for data warehouse security, In Proceedings of 2nd International Workshop on Design and Management of Data Warehouse, 28, Sweden, pp. 8.1--8.8.
36. Katic, N., Quirchmayr, G., Schiefer, J., Stolba, M., Tjoa, A. M. 1998. "A Prototype Model for DWSecurity Based on Metadata", Proc. 9th Int. Workshop on DB and Expert Systems Applications, Vienna, Austria, 300--308.
37. Carlos et. al.. 2010. Towards the secure modeling of OLAP user's behaviour, springer-verlag Berlin Heidelberg SDM 2010, LNCS 6538, pp 101--112.

Index Terms

• Information systems

  • Data management systems

    • Information integration

      • Data warehouses

  • Information systems applications

    • Decision support systems

      • Data warehouses

• Security and privacy

  • Database and storage security

• Theory of computation

  • Theory and algorithms for application domains

    • Database theory

      • Theory of database privacy and security