Research Statement

The techniques to create a translucent database are readily available to any application
developer. However, implementing translucency in the application layer creates an
undesirable dependency between the application and the database. There are also
database performance considerations. Finally, application developers are not given time
to implement security features and when time is allocated for security, few developers
have the necessary skills to implement security features correctly. The goal of my
research is to extend database management systems to provide native support for
translucency thereby increasing data security and privacy and reducing data leakage.
Plan
The Oracle Database 10g provides a built-in package named DBMS_CRYPTO that
provides functions for generating keys, managing keys, and encrypting and decrypting
data [10]. However, Oracle’s DBMS_CRYPTO package uses a block cipher rather than
applying encryption to specific data columns as discussed in [4]. A block cipher requires
the DBMS to encrypt and decrypt data as the data moves between main memory and
disk. Therefore, the data in main memory is exposed as clear text and the query
execution engine does not operate on encrypted data. Hence, Oracle 10g does not
provide native support for data encryption. I plan to build on the research presented
above by: (1) developing native DBMS support for cryptography, (2) extending the
cryptographic functions supported by the DBMS to include one-way hash algorithms, and
(3) developing a framework that makes security far more accessible to practitioners. To
my knowledge, no similar work exists in the published literature. Furthermore, I am
optimistic the recent NSF CyberTrust and CyberInfrastructure programs will continue to
support such security-related research.
The first step in my research plan is to extend the Data Definition Language (DDL) and
Data Manipulation Language (DML) to support policy-based security. Consider a
security policy stating that all HIPAA data must be encrypted. The database
administrator (DBA) should be able to define a HIPAA data type and when a database
table is defined with a column of type HIPAA the DBMS should automatically encrypt
the data. The DDL statements used to create the table should allow the DBA to select the
cryptographic algorithm from a set of algorithms natively supported by the DBMS. The
first step of my research will create a mechanism for implementing policy-based security
within the DBMS that is easily accessible to practitioners.
The theoretical constructs developed in the first step of my research will lack significant
impact unless they can be implemented and tested in realistic scenarios. My 15 years of
database experience are rife with examples of promising ideas that have been shelved due
to the absence of rigorous testing academic research requires. Drawing on this
experience, the second step of my research plan is to implement a system that supports
the constructs developed in the first step. This system will serve as a tool to evaluate the
results of the first step and guide further research. This system may be developed by
extending an existing open source database such as MySQL. This work should provide
interesting projects for students and challenging programming assignments for computer
science classes.