Computer architectures, database security, and an evaluation metric

Abstract

There are various computer architectures that will support database management applications. The distinction between the security concerns of a database management system and an operating system are not well defined. Both can provide same data security to user applications. The question is how to divide the security controls between the two. This paper details the fundamental security requirements for a database management system, and the operating system security features that a database management system could take advantage of to enhance its own security. A metric for quantifying the security functions of an operating system, the Department of Defense Trusted Computer Systems Evaluation Criteria, is discussed, as is its potential application to database security assessment.