International Journal of Computer Science & Network Security

국제컴퓨터통신보호논문지학회 (International Journal of Computer Science & Network Security)
권호 표지
DOI QR코드

DOI QR Code

Access Control Mechanism for CouchDB

  • Ashwaq A., Al-otaibi (Faculty of Computing and Information Technology, King Abdulaziz University) ;
  • Reem M., Alotaibi (Faculty of Computing and Information Technology, King Abdulaziz University) ;
  • Nermin, Hamza (Faculty of Graduate Studies of Statistical Research, Cairo University)
  • 투고 : 2022.12.05
  • 발행 : 2022.12.30
PDF 다운로드
⟨ 이전 논문 다음 논문 ⟩

초록

Recently, big data applications need another database different from the Relation database. NoSQL databases are used to save and handle massive amounts of data. NoSQL databases have many advantages over traditional databases like flexibility, efficiently processing data, scalability, and dynamic schemas. Most of the current applications are based on the web, and the size of data is in increasing. NoSQL databases are expected to be used on a more and large scale in the future. However, NoSQL suffers from many security issues, and one of them is access control. Many recent applications need Fine-Grained Access control (FGAC). The integration of the NoSQL databases with FGAC will increase their usability in various fields. It will offer customized data protection levels and enhance security in NoSQL databases. There are different NoSQL database models, and a document-based database is one type of them. In this research, we choose the CouchDB NoSQL document database and develop an access control mechanism that works at a fain-grained level. The proposed mechanism uses role-based access control of CouchDB and restricts read access to work at the document level. The experiment shows that our mechanism effectively works at the document level in CouchDB with good execution time.

키워드

과제정보

This work was supported by the Deanship of Scientific Research (DSR), King Abdulaziz University, Jeddah, under grant No. (DG-044-612-1440). The authors, therefore, gratefully acknowledge the DSR technical and financial support.

참고문헌

  1. M. Chen, S. Mao and Y. Liu, "Big data: A survey," Mobile networks and applications, vol.19, no. 2, pp. 171-209, 2014. https://doi.org/10.1007/s11036-013-0489-0
  2. E. Sahafizadeh and M. A. Nematbakhsh, "A survey on security issues in Big Data and NoSQL," Advances in Computer Science: an International Journal, vol. 4, no. 4, pp. 68-72, 2015.
  3. N. Dadapeer, G. Adarsh and M. Indravasan, "A Survey on Security of NoSQL Databases," International Journal of Innovative Research in Computer and Communication Engineering, vol. 4, no. 4, pp. 5250-5254, 2016.
  4. P. Noiumkar and T. Chomsiri, "A comparison the level of security on top 5 open source NoSQL databases," The 9th International Conference on Information Technology and Applications (ICITA2014), 2014.
  5. P. Colombo and E. Ferrari, "Fine-Grained Access Control Within NoSQL Document-Oriented Datastores," Data Science and Engineering, vol. 1, no. 3, pp. 127-138, 2016. https://doi.org/10.1007/s41019-016-0015-z
  6. L. Okman, N. Gal-Oz, Y. Gonen, E. Gudes and J. Abramov, "Security issues in nosql databases," Trust, Security and Privacy in Computing and Communications (TrustCom), 2011 IEEE 10th International Conference on, pp. 541-547, 2011.
  7. P. Colombo and E. Ferrari, "Evaluating the effects of access control policies within NoSQL systems," Future Generation Computer Systems, vol. 114, pp. 491-505, 2021. https://doi.org/10.1016/j.future.2020.08.026
  8. S. Rizvi, A. Mendelzon, S. Sudarshan and P. Roy, "Extending query rewriting techniques for fine-grained access control," Proceedings of the 2004 ACM SIGMOD international conference on Management of data, pp 551-562, 2004.
  9. A. Alotaibi, R. Alotaibi and N. Hamza, "Access Control Models in NoSQL Databases: An Overview," journal of king abdulaziz university computing and information technology sciences, vol. 8, no. 1, pp: 1 - 9, 2019.
  10. P. Colombo and E. Ferrari, "Access control in the era of big data: State of the art and research directions," Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies, pp: 185-192, 2018
  11. Fidels Cybersecurity, "Current Data Security Issues of NoSQL Databases", 2014.
  12. G. Vonitsanos, E. Dritsas, A. Kanavos, P. Mylonas and S. Sioutas, "Security and Privacy Solutions associated with NoSQL Data Stores," 2020 IEEE 15th International Workshop on Semantic and Social Media Adaptation and Personalization (SMA), pp. 1-5, 2020.
  13. D. Kulkarni, "A fine-grained access control model for key-value systems," Proceedings of the third ACM conference on Data and application security and privacy, pp. 161-164, 2013.
  14. L. Huang, Y. Zhu, X. Wang and F. Khurshid, "An Attribute-Based Fine-Grained Access Control Mechanism for HBase," International Conference on Database and Expert Systems Applications, Springer, pp. 44-59, 2019.
  15. C. Morgado, G. Busichia Baioco, T. Basso and R. Moraes, "A Security Model for Access Control in Graph-Oriented Databases," in 2018 IEEE International Conference on Software Quality, Reliability and Security (QRS), Lisbon, pp. 135-142, 2018.
  16. B. Crawford, "Granular security in a graph database," Master's thesis, Naval Postgraduate School Monterey United States, 2017.
  17. P. Colombo and E. Ferrari, "Enhancing MongoDB with purpose based access control," IEEE Transactions on Dependable and Secure Computing, 2015.
  18. D. Ferraiolo, R. Sandhu, S. Gavrilla and R. Kuhn, "Proposed NIST standard for role based access control," ACM Transactions on Information and System Security (TISSEC), vol.4, no.3, pp.224-274, 2001. https://doi.org/10.1145/501978.501980
  19. P. Colombo and E. Ferrari, "Towards virtual private NoSQL datastores," in Data Engineering (ICDE), 2016 IEEE 32nd International Conference on, pp. 193-204, 2016.
  20. J. Longstaff and J. Noble, "Attribute based access control for big data applications by query modification," Big Data Computing Service and Applications (BigDataService), 2016 IEEE Second International Conference on, pp. 58-65, 2016.
  21. V. Hu, D. Kuhn and D. Ferraiolo, "Attribute-based access control," Computer, vol. 48, no. 2, pp. 85-88, 2015. https://doi.org/10.1109/MC.2015.33
  22. P. Colombo and E. Ferrari, "Towards a unifying attribute based access control approach for NoSQL datastores," Data Engineering (ICDE), 2017 IEEE 33rd International Conference on, pp. 709-720, 2017.
  23. A. CouchDB, Documentation,", URL: https://docs.couchdb.org/en/stable/, 2017.