Security Administration for Federations, Warehouses, and other Derived Data

Security administration is harder in databases that have multiple layers of derived data, such as federations, warehouses, or systems with many views. Meta-data (e.g., security requirements) expressed at each layer must be visible and understood at the other layer. We describe several use cases in which layers negotiate to reconcile their business requirements. The sources must grant enough privileges for the derived layer to support the applications; the derived layer must enforce enough restrictions so that the sources’ concerns are met; and the relationship between the privileges at source and derived layer must be visible and auditable.