Satisfying Least Privilege Through Database Decomposition

The Multilevel Database Decomposition Framework aims to enhance the robustness and minimize data leakage of intrusions into healthcare databases. To this purpose, the framework decomposes a database into smaller ones to restrict user access according to the least privilege principle. Each database this decomposition returns is uniquely associated with a distinct set of users so that each user can access all and only the data his/her operations need. Furthermore, the framework minimize the impact of impersonation attacks by confining an intrusion to just one of the databases the decomposition returns. This is achieved by mapping the databases the decomposition returns onto distinct virtual or physical machines according to the robustness of the confinement to be achieved. Beside increasing robustness, this allocation reinforces defenses against evolving cyber threats. As a counterpart of better robustness, the decomposition replicates some tables across the databases it returns. To prevent possible inconsistencies updates of a table are spread to its copies in distinct databases. We present a performance analysis to evaluate the overhead of each allocation due to multiple copy updates. The analysis supports a fine-tuning of the final performance of alternative database allocation to the resulting robustness. We exemplify the application of the framework to a simple healthcare database.