Database Security Mechanisms: A Comparative Review of Threats, Protection Strategies, and Modern Database Environments

1. S. Sicari, A. Rizzardi, and A. Coen-Porisini, “Security & privacy issues and challenges in NoSQL databases,” Computer Networks, vol.
206, Art. no. 108828, 2022, doi: 10.1016/j.comnet.2022.108828.
2. M. S. Aliero, I. Ghani, K. N. Qureshi, and M. F. A. Rohani, “An algorithm for detecting SQL injection vulnerability using black-box testing,” Journal of Ambient Intelligence and Humanized Computing, vol. 11, pp. 249–266, 2020, doi: 10.1007/s12652-019-01235-z.
3. P. R. McWhirter, K. Kifayat, Q. Shi, and B. Askwith, “SQL injection attack classification through the feature extraction of SQL query strings using a gap-weighted string subsequence kernel,” Journal of Information Security and Applications, vol. 40, pp. 199–216, 2018, doi: 10.1016/j.jisa.2018.04.001.
4. H. Gu, J. Zhang, T. Liu, M. Hu, J. Zhou, T. Wei, and M. Chen, “DIAVA: A traffic-based framework for detection of SQL injection attacks and vulnerability analysis of leaked data,” IEEE Transactions on Reliability, vol. 69, no. 1, pp. 188–202, 2020, doi: 10.1109/TR.2019.2925415.5. L. Zhang, D. Zhang, C.-H. Wang, J. Zhao, and Z. Zhang, “ART4SQLi: The ART of SQL injection vulnerability discovery,” IEEE Transactions on Reliability, vol. 68, no. 4, pp. 1470–1489, 2019, doi: 10.1109/TR.2019.2910285.
6. P. Colombo and E. Ferrari, “Fine-grained access control within NoSQL document-oriented datastores,” Data Science and Engineering, vol. 1, no. 3, pp. 127–138, 2016, doi: 10.1007/s41019-016-0015-z.
7. Y. Shalabi and E. Gudes, “Cryptographically enforced role-based access control for NoSQL distributed databases,” in Data and Applications Security and Privacy XXXI, Lecture Notes in Computer Science, vol. 10359. Cham, Switzerland: Springer, 2017, pp. 3–19, doi: 10.1007/978-3-319-61176-1_1.
8. M. Ahmadian, F. Plochan, Z. Roessler, and D. C. Marinescu, “SecureNoSQL: An approach for secure search of encrypted NoSQL databases in the public cloud,” International Journal of Information Management, vol. 37, no. 2, pp. 63–74, 2017, doi: 10.1016/j.ijinfomgt.2016.11.005.
9. H. Hacıgümüş, B. Iyer, and S. Mehrotra, “Efficient execution of aggregation queries over encrypted relational databases,” in Database Systems for Advanced Applications (DASFAA 2004), Lecture Notes in Computer Science, vol. 2973. Berlin, Germany: Springer, 2004,
pp. 125–136, doi: 10.1007/978-3-540-24571-1_10.
10. B. Arasteh, B. Aghaei, B. Farzad, K. Arasteh, F. Kiani, and M. Torkamanian-Afshar, “Detecting SQL injection attacks by binary gray wolf optimizer and machine learning algorithms,” Neural Computing and Applications, vol. 36, pp. 6771–6792, 2024, doi: 10.1007/s00521-024-09429-z.
11. P. Colombo and E. Ferrari, “Enhancing NoSQL datastores with fine-grained context-aware access control: A preliminary study on MongoDB,” International Journal of Cloud Computing, vol. 6, no. 4, pp. 292–305, 2017, doi: 10.1504/IJCC.2017.090197.
12. P. Colombo and E. Ferrari, “Enhancing MongoDB with purpose-based access control,” IEEE Transactions on Dependable and Secure Computing, vol. 14, no. 6, pp. 591–604, 2017, doi: 10.1109/TDSC.2015.2497680.
13. P. Colombo and E. Ferrari, “Evaluating the effects of access control policies within NoSQL systems,” Future Generation Computer Systems, vol. 114, pp. 491–505, 2021, doi: 10.1016/j.future.2020.08.026.
14. E. Gupta, S. Sural, J. Vaidya, and V. Atluri, “Attribute-based access control for NoSQL databases,” in Proceedings of the 11th ACM Conference on Data and Application Security and Privacy (CODASPY ’21), pp. 317–319, 2021, doi: 10.1145/3422337.3450323.
15. G. Xu, Y. Ren, H. Li, D. Liu, Y. Dai, and K. Yang, “CryptMDB: A practical encrypted MongoDB over big data,” in 2017 IEEE International Conference on Communications (ICC), pp. 1–6, 2017, doi: 10.1109/ICC.2017.7997105.
16. A. K. Zaki and M. Indiramma, “A novel Redis security extension for NoSQL database using authentication and encryption,” in 2015 IEEE International Conference on Electrical, Computer and Communication Technologies (ICECCT), pp. 1–6, 2015, doi: 10.1109/ICECCT.2015.7226101.
17. A. Golhar, S. Janvir, R. Chopade, and V. K. Pachghare, “Tamper detection in Cassandra and Redis database—A comparative study,” in Proceeding of International Conference on Computational Science and Applications, Algorithms for Intelligent Systems. Singapore: Springer, pp. 99–107, 2020, doi: 10.1007/978-981-15-0790-8_11.
18. G. Weintraub and E. Gudes, “Data integrity verification in column-oriented NoSQL databases,” in Data and Applications Security and Privacy XXXII, Lecture Notes in Computer Science, vol. 10980. Cham, Switzerland: Springer, pp. 165–181, 2018, doi: 10.1007/978-3-319-95729-6_11.
19. L. Liu and Q. Huang, “A framework for database auditing,” in 2009 Fourth International Conference on Computer Sciences and Convergence Information Technology, pp. 982–986, 2009, doi: 10.1109/ICCIT.2009.207.
20. T. Tsegaye and S. Flowerday, “A Clark-Wilson and ANSI role-based access control model,” Information & Computer Security, vol. 28, no. 3, pp. 373–395, 2020, doi: 10.1108/ICS-08-2019-0100.
21. J. P. Cruz, Y. Kaji, and N. Yanai, “RBAC-SC: Role-based access control using smart contract,” IEEE Access, vol. 6, pp. 12240–12251, 2018, doi: 10.1109/ACCESS.2018.2812844.
22. D. Servos and S. L. Osborn, “Current research and open problems in attribute-based access control,” ACM Computing Surveys, vol. 49, no. 4, Art. no. 65, pp. 1–45, 2017, doi: 10.1145/3007204.
23. V. C. Hu, “Access control on NoSQL databases,” NIST Interagency or Internal Report (IR) NIST IR 8504, National Institute of Standards and Technology, Gaithersburg, MD, 2024, doi: 10.6028/NIST.IR.8504.
24. V. C. Hu, “Overview and considerations of access control based on attribute encryption,” NIST Interagency or Internal Report (IR) NIST IR 8450-upd1, National Institute of Standards and Technology, Gaithersburg, MD, 2023, doi: 10.6028/NIST.IR.8450-upd1.
25. T. Waage, R. S. Jhajj, and L. Wiese, “Searchable encryption in Apache Cassandra,” in Foundations and Practice of Security: 8th International Symposium, FPS 2015, Lecture Notes in Computer Science, vol. 9482. Cham, Switzerland: Springer, pp. 286–293, 2016, doi: 10.1007/978-3-319-30303-1_19.
26. D. Vinayagamurthy, A. Gribov, and S. Gorbunov, “StealthDB: A scalable encrypted database with full SQL query support,” Proceedings on Privacy Enhancing Technologies, vol. 2019, no. 3, pp. 370–388, 2019, doi: 10.2478/popets-2019-0052.
27. B. Sun, S. Zhao, and G. Tian, “SQL queries over encrypted databases: A survey,” Connection Science, vol. 36, no. 1, Art. no. 2323059, 2024, doi: 10.1080/09540091.2024.2323059.
28. S. De Capitani di Vimercati, S. Foresti, and P. Samarati, “Protecting data and queries in cloud-based scenarios,” SN Computer Science, vol. 4, Art. no. 440, 2023, doi: 10.1007/s42979-023-01862-6.
29. S. Fugkeaw, P. Suksai, and L. Hak, “SSF-CDW: Achieving scalable, secure, and fast OLAP query for encrypted cloud data warehouse,” Journal of Cloud Computing, vol. 13, Art. no. 129, 2024, doi: 10.1186/s13677-024-00692-y.
30. K. Yang, X. Jia, and K. Ren, “Secure and verifiable policy update outsourcing for big data access control in the cloud,” IEEE Transactions on Parallel and Distributed Systems, vol. 26, no. 12, pp. 3461–3470, 2015, doi: 10.1109/TPDS.2014.2380373.
31. M. Carvalho, F. Sá, and J. Bernardino, “Evaluation of the impact of AES encryption on query read performance across Oracle, MySQL, and SQL Server databases,” Cryptography, vol. 9, no. 4, Art. no. 77, 2025, doi: 10.3390/cryptography9040077.
32. A. I. Khan, H. Saud, S. A. R. Kazmi, and M. I. Fakhir, “Database security empowered with independent field encryption,” VAWKUM Transactions on Computer Sciences, vol. 12, no. 1, pp. 125–135, 2024, doi: 10.21015/vtcs.v12i1.1775.
33. A. Mousa, E. Nigm, E.-S. El-Rabaie, and O. S. Faragallah, “Query processing performance on encrypted databases by using the REA algorithm,” International Journal of Network Security, vol. 14, no. 5, pp. 280–288, 2012.
34. A. Lutsch, M. El-Hindi, Z. István, and C. Binnig, “Towards high-performance and trusted cloud DBMSs,” Datenbank-Spektrum, vol. 25,
pp. 39–50, 2025, doi: 10.1007/s13222-025-00495-8.