Fundamentals of Database systems 3th edition PHẦN 8 pot

21.8 Summary In this chapter we discussed the techniques for recovery from transaction failures. The main goal of recovery is to ensure the atomicity property of a transaction. If a transaction fails before completing its execution, the recovery mechanism has to make sure that the transaction has no lasting effects on the database. We first gave an informal outline for a recovery process and then discussed system concepts for recovery. These included a discussion of caching, in-place updating versus shadowing, before and after images of a data item, UNDO versus REDO recovery operations, steal/no-steal and force/no-force policies, system checkpointing, and the write-ahead logging protocol. Next we discussed two different approaches to recovery: deferred update and immediate update. Deferred update techniques postpone any actual updating of the database on disk until a transaction reaches its commit point. The transaction force-writes the log to disk before recording the updates in the database. This approach, when used with certain concurrency control methods, is designed never to require transaction rollback, and recovery simply consists of redoing the operations of transactions committed after the last checkpoint from the log. The disadvantage is that too much buffer space may be needed, since updates are kept in the buffers and are not applied to disk until a transaction commits. Deferred update can lead to a recovery algorithm known as NO-UNDO/REDO. Immediate update techniques may apply changes to the database on disk before the transaction reaches a successful conclusion. Any changes applied to the database must first be recorded in the log and force-written to disk so that these operations can be undone if necessary. We also gave an overview of a recovery algorithm for immediate update known as UNDO/REDO. Another algorithm, known as UNDO/NO- REDO, can also be developed for immediate update if all transaction actions are recorded in the database before commit. We discussed the shadow paging technique for recovery, which keeps track of old database pages by using a shadow directory. This technique, which is classified as NO-UNDO/NO-REDO, does not require a log in single-user systems but still needs the log for multiuser systems. We also presented ARIES, a specific recovery scheme used in some of IBM’s relational database products. We then discussed the two-phase commit protocol, which is used for recovery from failures involving multidatabase transactions. Finally, we discussed recovery from catastrophic failures, which is typically done by backing up the database and the log to tape. The log can be backed up more frequently than the database, and the backup log can be used to redo operations starting from the last database backup. Review Questions 21.1. Discuss the different types of transaction failures. What is meant by catastrophic failure? 21.2. Discuss the actions taken by the read_item and write_item operations on a database. 21.3. (Review from Chapter 19) What is the system log used for? What are the typical kinds of entries in a system log? What are checkpoints, and why are they important? What are transaction commit points, and why are they important? 21.4. How are buffering and caching techniques used by the recovery subsystem? 21.5. What are the before image (BFIM) and after image (AFIM) of a data item? What is the difference between in-place updating and shadowing, with respect to their handling of BFIM and AFIM? 21.6. What are UNDO-type and REDO-type log entries? 21.7. Describe the write-ahead logging protocol. 21.8. Identify three typical lists of transactions that are maintained by the recovery sub-system. 1 Page 611 of 893 21.9. What is meant by transaction rollback? What is meant by cascading rollback? Why do practical recovery methods use protocols that do not permit cascading rollback? Which recovery techniques do not require any rollback? 21.10. Discuss the UNDO and REDO operations and the recovery techniques that use each. 21.11. Discuss the deferred update technique of recovery. What are the advantages and disadvantages of this technique? Why is it called the NO-UNDO/REDO method? 21.12. How can recovery handle transaction operations that do not affect the database, such as the printing of reports by a transaction? 21.13. Discuss the immediate update recovery technique in both single-user and multiuser environments. What are the advantages and disadvantages of immediate update? 21.14. What is the difference between the UNDO/REDO and the UNDO/NO-REDO algorithms for recovery with immediate update? Develop the outline for an UNDO/NO-REDO algorithm. 21.15. Describe the shadow paging recovery technique. Under what circumstances does it not require a log? 21.16. Describe the three phases of the ARIES recovery method. 21.17. What are log sequence numbers (LSNs) in ARIES? How are they used? What information does the Dirty Page Table and Transaction Table contain? Describe how fuzzy checkpointing is used in ARIES. 21.18. What do the terms steal/no-steal and force/no-force mean with regard to buffer management for transaction processing. 21.19. Describe the two-phase commit protocol for multidatabase transactions. 21.20. Discuss how recovery from catastrophic failures is handled. Exercises 21.21. Suppose that the system crashes before the [read_item, , A] entry is written to the log in Figure 21.01(b). Will that make any difference in the recovery process? 21.22. Suppose that the system crashes before the [write_item, , D, 25, 26] entry is written to the log in Figure 21.01(b). Will that make any difference in the recovery process? 21.23. Figure 21.07 shows the log corresponding to a particular schedule at the point of a system crash for four transactions , , , and . Suppose that we use the immediate update protocol with checkpointing. Describe the recovery process from the system crash. Specify which transactions are rolled back, which operations in the log are redone and which (if any) are undone, and whether any cascading rollback takes place. 21.24. Suppose that we use the deferred update protocol for the example in Figure 21.07. Show how the log would be different in the case of deferred update by removing the unnecessary log entries; then describe the recovery process, using your modified log. Assume that only REDO operations are applied, and specify which operations in the log are redone and which are ignored. 21.25. How does checkpointing in ARIES differ from checkpointing as described in Section 21.1.4? 21.26. How are log sequence numbers used by ARIES to reduce the amount of REDO work needed for recovery? Illustrate with an example using the information shown in Figure 21.06. You can 1 Page 612 of 893 make your own assumptions as to when a page is written to disk. 21.27. What implications would a no-steal/force buffer management policy have on checkpointing and recovery? Choose the correct answer for each of the following multiple-choice questions: 21.28. Incremental logging with deferred updates implies that the recovery system must necessarily a. store the old value of the updated item in the log. b. store the new value of the updated item in the log. c. store both the old and new value of the updated item in the log. d. store only the Begin Transaction and Commit Transaction records in the log. 21.29. The write ahead logging (WAL) protocol simply means that a. the writing of a data item should be done ahead of any logging operation. b. the log record for an operation should be written before the actual data is written. c. all log records should be written before a new transaction begins execution. d. the log never needs to be written to disk. 21.30. In case of transaction failure under a deferred update incremental logging scheme, which of the following will be needed: a. an undo operation. b. a redo operation. c. an undo and redo operation. d. none of the above. 21.31. For incremental logging with immediate updates, a log record for a transaction would contain: a. a transaction name, data item name, old value of item, new value of item. b. a transaction name, data item name, old value of item. c. a transaction name, data item name, new value of item. d. a transaction name and a data item name. 21.32. For correct behavior during recovery, undo and redo operations must be a. commutative. b. associative. c. idempotent. d. distributive. 21.33. When a failure occurs, the log is consulted and each operation is either undone or redone. This is a problem because a. searching the entire log is time consuming. b. many redo’s are unnecessary. c. both (a) and (b). d. none of the above. 21.34. When using a log based recovery scheme, it might improve performance as well as providing a 1 Page 613 of 893 recovery mechanism by a. writing the log records to disk when each transaction commits. b. writing the appropriate log records to disk during the transaction’s execution. c. waiting to write the log records until multiple transactions commit and writing them as a batch. d. never writing the log records to disk. 21.35. There is a possibility of a cascading rollback when a. a transaction writes items that have been written only by a committed transaction. b. a transaction writes an item that is previously written by an uncommitted transaction. c. a transaction reads an item that is previously written by an uncommitted transaction. d. both (b) and (c). 21.36. To cope with media (disk) failures, it is necessary a. for the DBMS to only execute transactions in a single user environment. b. to keep a redundant copy of the database. c. to never abort a transaction. d. all of the above. 21.37. If the shadowing approach is used for flushing a data item back to disk, then a. the item is written to disk only after the transaction commits. b. the item is written to a different location on disk. c. the item is written to disk before the transaction commits. d. the item is written to the same disk location from which it was read. Selected Bibliography The books by Bernstein et al. (1987) and Papadimitriou (1986) are devoted to the theory and principles of concurrency control and recovery. The book by Gray and Reuter (1993) is an encyclopedic work on concurrency control, recovery, and other transaction-processing issues. Verhofstad (1978) presents a tutorial and survey of recovery techniques in database systems. Categorizing algorithms based on their UNDO/REDO characteristics is discussed in Haerder and Reuter (1983) and in Bernstein et al. (1983). Gray (1978) discusses recovery, along with other system aspects of implementing operating systems for databases. The shadow paging technique is discussed in Lorie (1977), Verhofstad (1978), and Reuter (1980). Gray et al. (1981) discuss the recovery mechanism in SYSTEM R. Lockeman and Knutsen (1968), Davies (1972), and Bjork (1973) are early papers that discuss recovery. Chandy et al. (1975) discuss transaction rollback. Lilien and Bhargava (1985) discuss the concept of integrity block and its use to improve the efficiency of recovery. Recovery using write-ahead logging is analyzed in Jhingran and Khedkar (1992) and is used in the ARIES system (Mohan et al. 1992a). More recent work on recovery includes compensating transactions (Korth et al. 1990) and main memory database recovery (Kumar 1991). The ARIES recovery algorithms (Mohan et al. 1992) have been quite successful in practice. Franklin et al. (1992) discusses recovery in the EXODUS system. Two recent books by Kumar and Hsu (1998) and Kumar 1 Page 614 of 893 and Son (1998) discuss recovery in detail and contain descriptions of recovery methods used in a number of existing relational database products. Footnotes Note 1 Note 2 Note 3 Note 4 Note 5 Note 6 Note 1 This is somewhat similar to the concept of page tables used by the operating system. Note 2 In-place updating is used in most systems in practice. Note 3 The term checkpoint has been used to describe more restrictive situations in some systems, such as DB2. It has also been used in the literature to describe entirely different concepts. Note 4 Hence deferred update can generally be characterized as a no-steal approach. Note 5 The directory is similar to the page table maintained by the operating system for each process. Note 6 1 Page 615 of 893 The actual buffers may be lost during a crash, since they are in main memory. Additional tables stored in the log during checkpointing (Dirty Page Table, Transaction Table) allow ARIES to identify this information (see Section 21.5). Chapter 22: Database Security and Authorization 22.1 Introduction to Database Security Issues 22.2 Discretionary Access Control Based on Granting/Revoking of Privileges 22.3 Mandatory Access Control for Multilevel Security 22.4 Introduction to Statistical Database Security 22.5 Summary Review Questions Exercises Selected Bibliography Footnotes In this chapter we discuss the techniques used for protecting the database against persons who are not authorized to access either certain parts of a database or the whole database. Section 22.1 provides an introduction to security issues and an overview of the topics covered in the rest of this chapter. Section 22.2 discusses the mechanisms used to grant and revoke privileges in relational database systems and in SQL—mechanisms that are often referred to as discretionary access control. Section 22.3 offers an overview of the mechanisms for enforcing multiple levels of security—a more recent concern in database system security that is known as mandatory access control. Section 22.4 briefly discusses the security problem in statistical databases. Readers who are interested only in basic database security mechanisms will find it sufficient to cover the material in Section 22.1 and Section 22.2. 22.1 Introduction to Database Security Issues 22.1.1 Types of Security 22.1.2 Database Security and the DBA 22.1.3 Access Protection, User Accounts, and Database Audits 22.1.1 Types of Security Database security is a very broad area that addresses many issues, including the following: • Legal and ethical issues regarding the right to access certain information. Some information may be deemed to be private and cannot be accessed legally by unauthorized persons. In the United States, there are numerous laws governing privacy of information. • Policy issues at the governmental, institutional, or corporate level as to what kinds of information should not be made publicly available—for example, credit ratings and personal medical records. • System-related issues such as the system levels at which various security functions should be enforced—for example, whether a security function should be handled at the physical hardware level, the operating system level, or the DBMS level. • The need in some organizations to identify multiple security levels and to categorize the data and users based on these classifications—for example, top secret, secret, confidential, and unclassified. The security policy of the organization with respect to permitting access to various classifications of data must be enforced. 1 Page 616 of 893 In a multiuser database system, the DBMS must provide techniques to enable certain users or user groups to access selected portions of a database without gaining access to the rest of the database. This is particularly important when a large integrated database is to be used by many different users within the same organization. For example, sensitive information such as employee salaries or performance reviews should be kept confidential from most of the database system’s users. A DBMS typically includes a database security and authorization subsystem that is responsible for ensuring the security of portions of a database against unauthorized access. It is now customary to refer to two types of database security mechanisms: • Discretionary security mechanisms: These are used to grant privileges to users, including the capability to access specific data files, records, or fields in a specified mode (such as read, insert, delete, or update). • Mandatory security mechanisms: These are used to enforce multilevel security by classifying the data and users into various security classes (or levels) and then implementing the appropriate security policy of the organization. For example, a typical security policy is to permit users at a certain classification level to see only the data items classified at the user’s own (or lower) classification level. We discuss discretionary security in Section 22.2 and mandatory security in Section 22.3. A second security problem common to all computer systems is that of preventing unauthorized persons from accessing the system itself—either to obtain information or to make malicious changes in a portion of the database. The security mechanism of a DBMS must include provisions for restricting access to the database system as a whole. This function is called access control and is handled by creating user accounts and passwords to control the log-in process by the DBMS. We discuss access control techniques in Section 22.1.3. A third security problem associated with databases is that of controlling the access to a statistical database, which is used to provide statistical information or summaries of values based on various criteria. For example, a database for population statistics may provide statistics based on age groups, income levels, size of household, education levels, and other criteria. Statistical database users such as government statisticians or market research firms are allowed to access the database to retrieve statistical information about a population but not to access the detailed confidential information on specific individuals. Security for statistical databases must ensure that information on individuals cannot be accessed. It is sometimes possible to deduce certain facts concerning individuals from queries that involve only summary statistics on groups; consequently this must not be permitted either. This problem, called statistical database security, is discussed briefly in Section 22.4. A fourth security issue is data encryption, which is used to protect sensitive data—such as credit card numbers—that is being transmitted via some type of communications network. Encryption can be used to provide additional protection for sensitive portions of a database as well. The data is encoded by using some coding algorithm. An unauthorized user who accesses encoded data will have difficulty deciphering it, but authorized users are given decoding or decrypting algorithms (or keys) to decipher the data. Encrypting techniques that are very difficult to decode without a key have been developed for military applications. We will not discuss encryption algorithms here. A complete discussion of security in computer systems and databases is outside the scope of this textbook. We give only a brief overview of database security techniques here. The interested reader can refer to one of the references at the end of this chapter for a more comprehensive discussion. 22.1.2 Database Security and the DBA As we discussed in Chapter 1, the database administrator (DBA) is the central authority for managing a database system. The DBA’s responsibilities include granting privileges to users who need to use the system and classifying users and data in accordance with the policy of the organization. The DBA has a 1 Page 617 of 893 DBA account in the DBMS, sometimes called a system or superuser account, which provides powerful capabilities that are not made available to regular database accounts and users (Note 1). DBA privileged commands include commands for granting and revoking privileges to individual accounts, users, or user groups and for performing the following types of actions: 1. Account creation: This action creates a new account and password for a user or a group of users to enable them to access the DBMS. 2. Privilege granting: This action permits the DBA to grant certain privileges to certain accounts. 3. Privilege revocation: This action permits the DBA to revoke (cancel) certain privileges that were previously given to certain accounts. 4. Security level assignment: This action consists of assigning user accounts to the appropriate security classification level. The DBA is responsible for the overall security of the database system. Action 1 in the preceding list is used to control access to the DBMS as a whole, whereas actions 2 and 3 are used to control discretionary database authorizations, and action 4 is used to control mandatory authorization. 22.1.3 Access Protection, User Accounts, and Database Audits Whenever a person or a group of persons needs to access a database system, the individual or group must first apply for a user account. The DBA will then create a new account number and password for the user if there is a legitimate need to access the database. The user must log in to the DBMS by entering the account number and password whenever database access is needed. The DBMS checks that the account number and password are valid; if they are, the user is permitted to use the DBMS and to access the database. Application programs can also be considered as users and can be required to supply passwords. It is straightforward to keep track of database users and their accounts and passwords by creating an encrypted table or file with the two fields AccountNumber and Password. This table can easily be maintained by the DBMS. Whenever a new account is created, a new record is inserted into the table. When an account is canceled, the corresponding record must be deleted from the table. The database system must also keep track of all operations on the database that are applied by a certain user throughout each log-in session, which consists of the sequence of database interactions that a user performs from the time of logging in to the time of logging off. When a user logs in, the DBMS can record the user’s account number and associate it with the terminal from which the user logged in. All operations applied from that terminal are attributed to the user’s account until the user logs off. It is particularly important to keep track of update operations that are applied to the database so that, if the database is tampered with, the DBA can find out which user did the tampering. To keep a record of all updates applied to the database and of the particular user who applied each update, we can modify the system log. Recall from Chapter 19 and Chapter 21 that the system log includes an entry for each operation applied to the database that may be required for recovery from a transaction failure or system crash. We can expand the log entries so that they also include the account number of the user and the on-line terminal ID that applied each operation recorded in the log. If any tampering with the database is suspected, a database audit is performed, which consists of reviewing the log to examine all accesses and operations applied to the database during a certain time period. When an illegal or unauthorized operation is found, the DBA can determine the account number used to perform this operation. Database audits are particularly important for sensitive databases that are updated by many transactions and users, such as a banking database that is updated by many bank tellers. A database log that is used mainly for security purposes is sometimes called an audit trail. 1 Page 618 of 893 22.2 Discretionary Access Control Based on Granting/Revoking of Privileges 22.2.1 Types of Discretionary Privileges 22.2.2 Specifying Privileges Using Views 22.2.3 Revoking Privileges 22.2.4 Propagation of Privileges Using the GRANT OPTION 22.2.5 An Example 22.2.6 Specifying Limits on Propagation of Privileges The typical method of enforcing discretionary access control in a database system is based on the granting and revoking of privileges. Let us consider privileges in the context of a relational DBMS. In particular, we will discuss a system of privileges somewhat similar to the one originally developed for the SQL language (see Chapter 8). Many current relational DBMSs use some variation of this technique. The main idea is to include additional statements in the query language that allow the DBA and selected users to grant and revoke privileges. 22.2.1 Types of Discretionary Privileges In SQL2, the concept of authorization identifier is used to refer, roughly speaking, to a user account (or group of user accounts). For simplicity, we will use the words user or account interchangeably in place of authorization identifier. The DBMS must provide selective access to each relation in the database based on specific accounts. Operations may also be controlled; thus having an account does not necessarily entitle the account holder to all the functionality provided by the DBMS. Informally, there are two levels for assigning privileges to use the database system: 1. The account level: At this level, the DBA specifies the particular privileges that each account holds independently of the relations in the database. 2. The relation (or table) level: At this level, we can control the privilege to access each individual relation or view in the database. The privileges at the account level apply to the capabilities provided to the account itself and can include the CREATE SCHEMA or CREATE TABLE privilege, to create a schema or base relation; the CREATE VIEW privilege; the ALTER privilege, to apply schema changes such as adding or removing attributes from relations; the DROP privilege, to delete relations or views; the MODIFY privilege, to insert, delete, or update tuples; and the SELECT privilege, to retrieve information from the database by using a SELECT query. Notice that these account privileges apply to the account in general. If a certain account does not have the CREATE TABLE privilege, no relations can be created from that account. Account-level privileges are not defined as part of SQL2; they are left to the DBMS implementers to define. In earlier versions of SQL, a CREATETAB privilege existed to give an account the privilege to create tables (relations). The second level of privileges applies to the relation level, whether they are base relations or virtual (view) relations. These privileges are defined for SQL2. In the following discussion, the term relation may refer either to a base relation or to a view, unless we explicitly specify one or the other. Privileges at the relation level specify for each user the individual relations on which each type of command can be applied. Some privileges also refer to individual columns (attributes) of relations. SQL2 commands provide privileges at the relation and attribute level only. Although this is quite general, it makes it difficult to create accounts with limited privileges. The granting and revoking of privileges generally follows an authorization model for discretionary privileges known as the access matrix model, where the rows of a matrix M represent subjects (users, accounts, programs) and the columns represent objects (relations, records, columns, views, operations). Each position M(i, j) in the matrix represents the types of privileges (read, write, update) that subject i holds on object j. 1 Page 619 of 893 [...]... for the design and protection of statistical databases These include McLeish (1 989 ), Chin and Ozsoyoglu (1 981 ), Leiss (1 982 ), Wong (1 984 ), and Denning (1 980 ) Ghosh (1 984 ) discusses the use of statistical databases for quality control There are also many papers discussing cryptography and data encryption, including Diffie and Hellman (1979), Rivest et al (19 78) , and Akl (1 983 ) Multilevel security is discussed... administrators, allowing access to restricted operating systems commands Note 2 This is similar to the notion of having multiple versions in the database that represent the same realworld object © Copyright 2000 by Ramez Elmasri and Shamkant B Navathe 1 Page 629 of 89 3 Part 6: Advanced Database Concepts & Emerging Applications (Fundamentals of Database Systems, Third Edition) Chapter 23: Enhanced Data Models for... are met Many commercial packages already have some of the functionality provided by active databases in the form of triggers (Note 1) In Section 23.2, we will introduce the concepts of temporal databases, which permit the database system to store a history of changes, and allow users to query both current and past states of the database Some temporal database models also allow users to store future expected... salary of ‘Smith’ to $50,000; what would be the result of this action? Selected Bibliography 1 Page 6 28 of 89 3 Authorization based on granting and revoking privileges was proposed for the SYSTEM R experimental DBMS and is presented in Griffiths and Wade (1976) Several books discuss security in databases and computer systems in general, including the books by Leiss (1 982 a) and Fernandez et al (1 981 ) Denning... briefly discussed the problem of controlling access to statistical databases to protect the privacy of individual information while concurrently providing statistical access to populations of records Review Questions 22.1 Discuss what is meant by each of the following terms: database authorization, access control, 1 Page 627 of 89 3 data encryption, privileged (system) account, database audit, audit trail... for many of the concepts of generalized active databases within its framework Section 23.1.4 discusses possible applications of active databases 23.1.1 Generalized Model for Active Databases and Oracle Triggers The model that has been used for specifying active database rules is referred to as the EventCondition-Action, or ECA model A rule in the ECA model has three components: 1 Page 631 of 89 3 1 2... Exercises Selected Bibliography Footnotes As the use of database systems has grown, users have demanded additional functionality from these software packages, with the purpose of making it easier to implement more advanced and complex user applications Object-oriented databases and object-relational systems do provide features that allow users to extend their systems by specifying additional abstract data... 23.1.1) allows the user to choose which of the above two options is to be used for each rule, whereas STARBURST uses statement-level semantics only We will give examples of how statement-level triggers can be specified in Section 23.1.3 One of the difficulties that may have limited the widespread use of active rules, in spite of their potential to simplify database and software development, is that there... complexity of temporal database applications Section 23.2.1 gives an overview of how time is represented in databases, the different types of temporal information, and some of the different dimensions of time that may be needed Section 23.2.2 discusses how time can be incorporated into relational databases Section 23.2.3 gives some additional options for representing time that are possible in database models... version of Smith is now the current one It is important to note that in a valid time relation, the user must generally provide the valid time of an update For example, the salary update of Smith may have been entered in the database on May 15, 19 98 at 8: 52:12am, say, even though the salary change in the real world is effective on June 1, 19 98 This is called a proactive update, since it is applied to the database . protection of statistical databases. These include McLeish (1 989 ), Chin and Ozsoyoglu (1 981 ), Leiss (1 982 ), Wong (1 984 ), and Denning (1 980 ). Ghosh (1 984 ) discusses the use of statistical databases. Kumar and Hsu (19 98) and Kumar 1 Page 614 of 89 3 and Son (19 98) discuss recovery in detail and contain descriptions of recovery methods used in a number of existing relational database products relational database systems and in SQL—mechanisms that are often referred to as discretionary access control. Section 22.3 offers an overview of the mechanisms for enforcing multiple levels of security—a