Papers in PDF format

A Comprehensive System to Develop Secure Web Accessible Databases
1. Introduction
Robert Buccigrossi
Turner Consulting Group and the University of Pennsylvania, USA
butch@gradient.cis.upenn.edu
Albert Crowley
Turner Consulting Group, USA
crowley@www.tcg-inc.com
Daniel Turner
President - Turner Consulting Group, USA
tcg@us.net
Abstract: The World Wide Web (WWW) provides a unique opportunity for the development
of database applications that are system independent and accessible to everyone on the
Internet. Sometimes, though, an application is needed that has a distributed user base, but
will contain data that should not be accessible outside a given set of users.
In this paper, we describe a system of developing applications with Web front-ends which
constrain both the userbase and the allowable actions that individual users may take. This
system is composed of three main concepts: the secure loop, which is a method of passwordprotecting
Web pages, the swap, which retains the state of a user between execution of CGI
scripts, and the lifetime of an input form, which is a modularization of the tasks that a
general input form should complete. It is our hope that through the use of this system
platform independent application interfaces will flourish on the Internet.
The World Wide Web (WWW) [Berners-Lee et al. 1994] provides a unique opportunity for the development of
applications that are system independent and accessible to everyone on the Internet. For example, if the Web
were used as a front-end to a database, the capability of modifying and querying that database would become
open to everyone with access to a Web browser. Sometimes, though, an application is needed that has a
distributed user base, but will contain data that should not be accessible outside a given set of users.
In this paper, we describe a system of developing applications with Web front-ends that can be accessed only
by a given set of users. A graphical interpretation of this system is presented in [Figure 1]. Between the user
and the database lies the collection of Common Gateway Interface (CGI) scripts used to process form data,
access the database, and create new pages to be displayed to the user. [NCSA 1996]
With CGI scripts, we develop several layers of routines to implement the database application. One layer,
which we call the secure loop, is a method of verifying the user at every access. The swap is a method of
retaining the state of partially completed forms. Finally, the query routines are the actual procedures that
implement the database access.
This system has been used to successfully develop Web accessible databases for the National Institute of
Health. [TCG 1995] Through this experience, we have created simple guidelines for designing CGI scripts for
easier writing and maintenance. Finally, we compare this system of application development with other
existing methods.