0

For a web application (with some real private data) we want to use privacy enhancing technology to prevent big risks when someone gets permission to our database.

The application is build with different layers, and we use (as said in the topic title) Fluent NHibernate to connect to our database and we've created our own wrapper class to create query's.

Security is a big issue for the kind of application we're building. I'll try to explain the setting by a simple example:

  • Our customers got some clients in their application (each installation of the application uses its own database), for which some sensitive data is added, there is a client table, and a person table, that are linked.
  • The base table, which links to the other tables (there will be hundreds of them soon), probably containing sensitive data, is the client table
  • At this moment, the client has a cleint_id, and a table_id in the database, our customer only knows the client_id, the system links the data by the table_id, which is unknown to the user.

What we want to ensure: A possible hacker who would have gained access to our database, should not be able to see the link between the customer and the other tables by just opening the database. So actually there should be some kind of "hidden link" between the customer and other tables. The personal data and all sensitive other tables should not be obviously linked together. Because of the data sensitivity we're looking for a more robust solution then "statically hash the table_id and use this in other tables", because when one of the persons is linked to the corresponding client, not all other clients data is compromised too. Ultimately, the customer table cannot be linked to the other tables at all, just by working inside the database, the application-code is needed to link the tables.

To accomplish this we've been looking into different methods, but because of the multiple linked tables to this client, and further development (thus probably even more tables) we're looking for a centralised solution. That's why we concluded this should be handled in the database connector. Searching on the internet and here on Stack Overflow, did not point us in the right direction, perhaps we couldn't find this because of wrong search terms (PET, Privacy enhancing technology, combined with NHibernate did not give us any directions.

How can we accomplish our goals in this specific situation, or where to search to help us fix this.

Robert Deiman
  • 1
  • 2

1 Answers1

0

We have a similar requirement for our application and what we ended up with using database schema's.

We have one database and each customer has a separate schema, where all the data for that customer is stored. It is possible to link from the schema to the rest of the database, but not to different schema's. Security can be set for each schema separately so you can make the life of a hacker harder.

That being said I can also imagine a solution where you let NHibernate encrypt every peace of data it will send to the database and decrypt everything it gets back. The data will be store savely, but it will be very difficult to query over data.

So there is probably not a single answer to this question, and you have to decide what is better: Not being able to query, or just making it more difficult for a hacker to get to the data.

David Perfors
  • 1,273
  • 13
  • 15
  • By "using database schema's" do you mean you store a bit of the actual data (for example the "person" table) in the database schema, or do you mean you have something else in the schema that solves this issue? – Robert Deiman Aug 21 '14 at 10:43
  • I mean the concept 'database schema' in SQLServer. It is created with the CREATE SCHEMA command and all the tables are accessed by [Schema].[Table1] – David Perfors Aug 21 '14 at 10:57
  • But how does that solve my issue? Perhaps I dit not explain the problem as well, there are separate applications AND databases for each of our customers. Inside each database should some kind of PET be active, so when the database is compromised, the hacker has no data of interest. – Robert Deiman Aug 21 '14 at 11:21
  • I didn't understand that every customer had it's own database, so I guess my answer won't help you. – David Perfors Aug 21 '14 at 11:24
  • I'm sorry, I've added that to my question now, didn't think about it because I thought it wasn't of much importance. Thanks anyway! – Robert Deiman Aug 21 '14 at 11:26