How does GBase 8s ensure data security within the database?
As computer networks become widespread, the openness and sharing of online information increase, but information security issues become increasingly serious. Databases are the primary storage for such data, so ensuring the security of data stored and accessed in databases is paramount for network security. To address this, a security-focused architecture must be designed on top of a general-purpose database management system to enhance database security.
As a database widely used in large-scale sectors such as finance and telecommunications, how does GBase 8s achieve data security? This article unveils its approach from two aspects: "data security" and "security feature composition."
I. Data Security
· Data Confidentiality Protection
Protecting the confidentiality of stored data is one of the most important functions of a secure database. GBase 8s secure database uses in-database encryption, processing data encryption and decryption at the kernel storage engine level of the database management system—that is, encryption/decryption occurs during physical I/O operations.
Because data pages are only encrypted/decrypted during actual I/O, this process is completely transparent to legitimate users, hence it is also referred to as transparent storage encryption.
GBase 8s encrypts stored data by page, and page data integrity is ensured by a checksum in the page trailer. After decryption, the decrypted data is verified using the checksum in the page header to prevent tampering during the encryption/decryption process. When a user queries data, the system returns the decrypted data after confirming it meets the criteria.
· Data Integrity Protection
A GBase 8s instance can create multiple dbspaces; a dbspace can contain multiple physical chunks; a chunk is divided into multiple contiguous extents; the space occupied by a table or index is called a tablespace; and an extent contains multiple physical pages.
GBase 8s Storage Structure Diagram
Among them, dbspace, tablespace, and extent are logical storage units; chunk and page are physical storage units.
A data page is the most basic storage unit and the smallest I/O unit. The smallest unit for a GBase 8s I/O operation is a page; even if only one row within a page is modified, GBase 8s must read the entire page into memory and write it back to disk. When a data page is read from disk, an equally sized memory page is allocated. GBase 8s supports different page sizes: 2 KB, 4 KB, 8 KB, and 16 KB.
The internal storage structure of a data page consists of three parts: the page header, the page trailer, and the data portion.
GBase 8s Data Page Internal Structure
The chksum field in the page header is used to verify the integrity of the data stored in that page. When writing a page, the checksum of the page is written into the chksum field; when reading a page, the checksum is recalculated and compared with the stored value. If they do not match, the integrity of this page has been compromised; if they match, the data integrity is guaranteed and normal access is possible. GBase 8s uses the checksum saved in each page to check whether user data stored in page-structured format in the database has any integrity errors.
Inside the database service, user data exists in three states: ciphertext on disk, ciphertext in cache, and plaintext results. When the database service loads data from disk into cache, it performs an integrity check on the page using the checksum in the chksum field. When returning plaintext result sets to users, it verifies the integrity of plaintext data decrypted from the ciphertext using the checksum, preventing user data from being tampered with during the encryption/decryption process. When the database service receives a user write request, the above steps are executed in reverse.
For transaction processing, the GBase 8s secure database employs mature mainstream technologies to achieve efficient transaction handling, primarily including locking and multiversioning techniques. These technologies significantly enhance concurrent transaction processing while ensuring the ACID properties of transactions.
A lock is a software mechanism for controlling access to data in the database. In multi-user environments where data is concurrently read and updated, locks ensure that the atomicity, isolation, consistency, and durability (ACID) of each transaction are not threatened, and maintain data integrity.
The coarser the lock granularity, the more database objects it locks. For example, for a table that can fit 4 rows on one disk page, a lock placed on that page locks all 4 rows; conversely, using a row-level lock locks only one row. Therefore, coarser granularity reduces concurrency and can affect performance, especially when applications attempt to access the same set of rows. However, coarse granularity also means that in some cases fewer locks are needed to lock the same number of rows. For instance, locking an entire table requires only a single table lock.
1. Lock Granularity
GBase 8s provides six lock granularities:
2. Isolation Levels
GBase 8s offers the following five concurrency levels:
By detecting deadlocks, the GBase 8s secure database automatically detects a transaction deadlock and rolls back one or more transactions to prevent it, attempting to roll back the smallest transaction possible to reduce the performance impact caused by extensive disk writes.
II. Security Feature Composition
· User Authentication
DBMS user authentication consists of user identification and identity verification. Every user entering the DBMS must first have a unique user identifier throughout the DBMS lifecycle. User identity verification employs a dual authentication mechanism using both a password and a digital certificate.
· User Authorization
Each authorized user has a set of database security domain characteristics that determine the following: available privileges and authorized roles, available storage space quotas (such as tablespace quotas), and available system resource limits, among other security attributes.
· Access Control
1. Discretionary Access Control
When a subject accesses an object, discretionary access control checks an access control list to determine whether the subject's operation on the object is permitted.
2. Labeling and Mandatory Access Control
Both subjects and objects in the DBMS must have sensitivity labels, which consist of a security level label and a category label. The level label is represented by a positive integer, while the category label is represented by a set. The security administrator responsible for MAC management sets the classification and category for subjects and objects.
· Security Auditing
GBase 8s provides auditing tools that define relevant audit events, record user operations, and capture audit data related to identity authentication, discretionary access control, labeling, and mandatory access control. It supports related audit analysis, automatic alarms, and review of audit data.
· Data Security
1. Data Encryption
The GBase 8s secure database employs encryption cards approved by the State Cryptography Administration of China, supporting key generation, key destruction, and key operations.
2. Data Integrity
GBase 8s uses the hash algorithm of the cryptographic card hardware to protect the integrity of user data. Database data is stored in disk files as data pages, each containing a chksum field to safeguard its integrity. The checksum is generated by the hash algorithm of the cryptographic card, and the database verifies the checksum of each data page upon access to protect the integrity of that page.
· Backup and Recovery
After a failure, GBase 8s can quickly restore data. Depending on the level, GBase 8s supports the following three backup levels:
1. Level-0 backup: Full backup
2. Level-1 backup: Incremental backup since the last level-0 backup
3. Level-2 backup: Incremental backup since the last level-1 backup
· Role Management
The fundamental security philosophy behind the privilege separation in the GBase 8s secure database management system is the principle of least privilege, granting a subject (user) only the minimum privileges necessary to complete the intended task. Based on this security policy, the original single super database administrator role is split into three roles: security administrator, audit administrator, and data administrator. Each assumes different responsibilities, and none of them should be able to interfere with the powers of the others, thus achieving separation of duties across the database system—also known as the three-role separation principle.
· Resource Limits
Resource management mainly includes controlling the number of user connections, monitoring and alerting on server storage space, and monitoring data space usage.
· Communication Security
Information access between clients and the database server uses a security protocol based on SSL to establish a secure and confidential data transmission path. Encryption algorithms protect the link layer, and certificates enable mutual verification between the server and client, ensuring the confidentiality and integrity of communications between them.
· Trusted Path
GBase 8s's trusted path consists of two components: the initialization process of the system administrator in a secure state, and the secure channel between the administrator and the server during normal database operation.
Through strengthening both data security and security feature composition, GBase 8s has built a robust security mechanism that effectively safeguards the data in the database, delivering strong data security for China's financial and telecommunications industries.