Database Security Transactions

Database Data An essential corporate resource is a valuable resource Must be strictly controlled, managed and secured May have strategic importance Should be kept secure and confidential

DBMS Functions and Services Authorization: DBMS must ensure that only authorized users can access the database Secure the database against unauthorized access (intentional or accidental) Database security: The mechanisms that protect the database against intentional or accidental threats Security considerations apply not only to the data, considerations apply to other parts as well, which may in turn affect the database. E.g. Hardware Software People

DBMS Function and Services Three closely related functions of the DBMS that ensure reliability and consistency. The reliability and consistency must be maintained in the presence of failure of both hardware and software components and when multiple users are accessing the database. Transaction support A logical unit of work on the database Concurrency control services Controls simultaneous operations on the database Recovery services The process of restoring the database to a correct state

Transaction support Transaction A logical unit of work on the database A transaction should always transform a database from one consistent state to another Consistency may be violated while the transaction is in progress. A transaction can have one of two outcomes Committed : if it completes successfully and the database reaches a new consistent state Aborted: if the transaction does not execute successfully. Rolled back/undone : If a transaction is aborted the database must be restored to the consistent state it was in before the transaction started. Compensating transaction: A committed transaction cannot be aborted. If we decide that the committed transaction was a mistake we must perform a compensating transaction to revers its effect.

Properties of transactions (ACID) ACID: The four conditions in which transactions ensure data integrity Atomicity The all or nothing property. The queries that make up the transaction must either all be carried out, or none at all. Consistency This refers to the rules of the data. For example, an article body may have an associated article heading. During the transaction, this rule may be broken, but the state of affairs should never be visible from outside of the transaction. A transaction must transform the database from one consistent state to another consistent state. Isolation Transactions execute independently of one another. Simply put, data being used for one transaction cannot be used by another transaction until the first transaction is complete. Durability Once a transaction has completed, its effects should remain, and not be reversible.

(ACID)Isolation Example Take this example below, where an account balance starts at 900. There is a single deposit of 100,and a withdrawal of 100, so the balance at the end should remain the same. Connection 1: SELECT balance FROM account1; Connection 2: SELECT balance FROM account1; Connection 1: UPDATE account1 SET balance = 900+100; Connection 2: UPDATE account1 SET balance = 900-100; The balance is now 800, so we have lost 100. These two transactions should have been isolated, and the result supplied to Connection 2 only when the transaction from Connection 1 was complete.

Database Architecture Transaction manager : coordinates transactions on behalf of application programs. It communicates with the scheduler Scheduler: the module responsible for implementing a particular strategy for concurrency control. The objective of the scheduler is to maximize concurrency without allowing concurrently executing transactions to interfere with one another. Lock manager: the scheduler is sometimes called the lock manager if the concurrency control protocol is a locking based. Recovery manager: Ensures that the database is restored to the state it was in before the start of the transaction i.e. the consistent state. Buffer manager: is responsible for the transfer of data between disk storage and main memory.

Concurrency Control The process of managing simultaneous operations on the database without having them interfere with one another Potential problems caused by concurrency Lost update problem Uncommitted dependency problem Inconsistent analysis problem

Lost update problem An apparently successfully completed operation by one user can be overwritten by another user

Uncommitted dependency problem/dirty read When one transaction is allowed to see the uncommitted intermediate results of another transaction Reading Dirty data

Inconsistent analysis problem When a transaction reads several values from the database but a second transaction updates some of them during the execution of the first.

Serializability Objective of concurrency control To avoid interference between transactions Solution Allow only one transaction to execute at a time However the aim is to maximize the d egree of concurrency and parallelism so that transactions that can execute without interfering with one another. Serializability is the right solution Serializability identifies those execution of transactions that are guaranteed to ensure consistency

Serializability First some difinitions Schedule Fine the definition in Database Systems by Thomas M.connoly Chapter 19 Serial schedule In serial execution there is no interference between transactios, since only one is executing at any given time. Nonserial schedule Now the objective of Serializability Is to find non serial schedules that allow transactions to execute concurrently without interfering with one another, and thereby produce a database state that could be produced by a serial execution. Serializable schedule Nonserial schedule that produces the same results as some serial execution.