A distributed federated database: GaianDB

I’m glad to see alphaWorks end the year with the launch of a technology I learned about in January at IBM’s Hursley Software Lab. Gaian Database is a dynamic distributed federated database. It was developed to provide a robust self-organizing distributed database on mobile ad-hoc networks, borrowing concepts from autonomic and grid computing, and adding many complex features. Developed as part of the USA-UK international technology alliance (ITA), this ambitious research project is worth checking out.

Advertisements

9 responses to “A distributed federated database: GaianDB

  1. What security issues need to be considered in order for a federated database to be feasible for financial transactions? For instance, how are possible man in the middle attacks handled?

    • Thanks for the question Rich. The GaianDB team has considered numerous security models, and you will see a reply here shortly from Patrick Dantressangle, the project lead, expanding on some of the models and issues.

  2. It would be helpful if the response included considerations such as:
    –man in the middle attacks (as mentioned previously)
    –HIPPA compliance
    –compliance with financial industry standards (which standards are felt to be relevant?)

    Thanks for whatever is added to the discussion.
    –Rich

  3. Rich
    Thank for your questions. At the moment we are focusing on the base infrastructure and database technology without considering specific security models.
    We have investigated a few of these models but we decided to not include any yet until we get proper requirements from customers who tried the GaianDB.
    The GaianDB architecture is very flexible and it is easy to add new plug-in capabilities that can include security.
    Your thoughts on different types of attack and industry standards are very relevant and we will take these into consideration in future releases. If you have any scenarios using GaianDB showing vulnerabilities, we would be very pleased to investigate implementing solutions.
    The GainDB Team.

  4. An embeddable, plug and play database is very appealing. Like Rich, I am concerned about data store and data-transmission security. (Yup, I read about the derby user authentication + password scramble)

    Patrick mentioned “plug-in” capabilities – does this extend to certificated communication (SSL)? Can one delegate the message mechanism to a framework stack (a la Spring)?

  5. M. Parker
    Thanks for your enthusiasm on embeddable plug and play federated databases. We need other independent people like you to confirm that this idea works in many different scenarios and contexts. We did some implementations and it works. We are looking eagerly to somebody independently trying it out as well. 😉
    We will be able to show some plug-in capabilities in the not so distant future.

  6. Is there a place to carry on discussions of security issues of federated databases, with GaianDB being a specific case, other than these comments?

    Regardless of the flexibility of the GaianDB architecture, there is some thought that federated databases in general can’t in principle meet the security requirements of such standards as PCI and HIPPA. (Others disagree, of course.) Auditors tend to stick with the most conservative reading of standards, especially compliance standards, as opposed to simply best practice standards.

  7. Hi Parker and Rich – Thank you for your interest in GaianDB. You raise some interesting points 😉

    To elaborate a little on ‘plug-in’ capability: GaianDB has the capability (currently not fully documented) to federate any type of data source (i.e. not just Files or JDBC data sources) using a custom built Derby Virtual Table Interface (VTI)… soon to be documented on developerworks. One of these data sources could do some encryption/decryption… We also have a patent on a method that addresses man-in-the-middle attacks to some extent but this has not been implemented yet.

    As Patrick said we are investigating different models, bearing in mind we look to implement distributed solutions (i.e. no central store for ssl keys) and optimise performance. Using an app-server as a layer around each GaianDB node to handle SSL might be a short term answer (although it still requires code changes in GaianDB) but I think we can do better performance-wise.

    You mention GaianDB is a ‘plug and play’ database. In fact we have already created a ‘bundled’ version of GaianDB for Lotus Expeditor, so that it can be used and managed easily alongside technologies like the micro-broker. Again, this will likely be the subject of another article on develperworks…!

    We are also looking to make it possible to install GaianDB as a service.

    Note there is now a new version GaianDB-1.01.zip available for download.. this has an API call ‘setltfornode’ which mirrors logical table definitions from other nodes, to make it easier to query data remotely.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s