Download - Day2
CSE 136 Lecture 2
Database design steps for the enterprise Logical Design Overview Physical Design Logical design in detail
Conceptual Modeling Model to Schema
Database Security Enterprise Database Environment Continuous Integration DB – build DB
project
Database Design Step
Determine requirements
RequirementAnalysis
Logical Design
Physical Design
Implementation
Model Integrated views
Transform to SQL tablesIf there aremultiple dbdesigners
Normalize
normalize until ithurts
select indexes
Implementation
de-normalize untilit works
De-normalize
Monitor and detect changing requirements
ER Model
Using MS SQL 2008
Logical Design Overview 1
Conceptual data modeling
The data requirements are analyzed and modeled using an ER orUML diagram that includes, for example, semantics for optionalrelationships, ternary relationships, supertypes, and subtypes(categories).
Outcome ofyour analysis
UML diagram
customer orders product
customer served-by salesperson
product sold-by salesperson
Logical Design Overview 2
View Integration
Usually, when the design is large and more than oneperson is involved in requirements analysis, multipleviews of data and relationships result
Multiple Views,but one final
design
Logical Design Overview 3
Tranformation (model to SQL tables)
Based on a categorization of data modeling constructs and a set ofmapping rules, each relationship and its associated entities aretransformed into a set ofDBMS- specific candidate relational tables
Data Definition Language(DDL)
More details later
Logical Design Overview 4
Normalization
Functional dependencies (FDs) are derived from theconceptual data model diagram and the semantics ofdata relationships in the requirements analysis.
job-level 10employees are
allowed 30 days ofvacation days per
year
10 3010
EntityRelationships
Physical Design
Physical Design
involves the selection of indexes (access methods),partitioning, and clustering of data
Indexing
performance
index is based on binary-tree
Clustering
fail-over for reliability
Partitioning
different disks for performance
Materialized viewers
caching remote data
Denormalization
faster retrieval - combine normalized tables into larger tables
Conceptual Modeling - generalization
If there is a generalization hierarchy among entities, then put theidentifier and generic descriptors in the super-type entity and putthe same identifier and specific descriptors in the subtype entities
grad undergrad international professional
phd/ma/ms 1st, 2nd.. nationality company
Conceptual Modeling - relationships connectivity
The connectivity of a relationship describes a constraint on theconnection of the associated entity occurrences in the relationship
1 manager
many employees
Isaac C.Doug N.Tim L.Trevor S.
IRADmilitarymaps
Existence of an entity occurrence in a relationship is defined as eithermandatory or optional
dept is optional
Office is required
Model to SQL schema
Data Definition Language Why use data definition language?
Multiple database designers modifying DDL Version Control Build the database script from scratch (for unit
testing) Examples
Create table Alter table Drop table Create/drop view
Model to SQL 1
One-to-one, both entities mandatory
1-to-1relationship
Deleting a report also deletes abbreviationentry with the same report_no
update report.report_no will also updatethe abbreviation.report_no
Model to SQL 2
Many-to-many, both entities optional
combination keys
Enrollment example
Step 1. CreateStudent table
Student
student_idfirst_namelast_name
etc
"A0123456789""Becky""Smith"
Step 2. CreateCourse table
Course
course_idcourse_number
course_titledepartment_id
100001"CSE 132A"
"Database Systems I"20001
Step 3. CreateCourse_ScheduleTable
Course_Schedule
schedule_idquarter
yearcourse_id
section_number
course_id
200015"fall"2011
100001"A00"
Step 4. CreateEnrollment table
Enrollment
student_idschedule_id
"A0123456789"200015
student_id
schedule_id
Enrollment table contains all the students enrollment
Commonly known as a join-table (combo-key; many-to-many)
Enrollment example
Student
student_idfirst_namelast_name
etc
Course
course_idcourse_number
course_titledepartment_id
Course_Schedule
schedule_idquarter
yearcourse_id
section_number
Enrollment
student_idschedule_id
student_id
course_id
schedule_id
Which table should "grade" column be added?
grade
Which table should "instructor" column be added to?
Instructor_id
Instructor
instructor_idfirst_namelast_name
titledegree
instructor_id
What about pre-requisites?
prereq_course_id
How about 100,both 140 & 141 are
pre-req for 136?
Pre_ req
course_idprereq_course_id
course_idcourse_id
---- -----136 100136 140136 141
SQL Security
Secure Configuration Authentication
login/password Authorization
What you can access after you login
Data Encryption Protecting sensitive
data from internal and external hackers
SQL Security - Secure Configuration
Physically secure the server behind firewall Enable only the minimum network protocols
required Use Windows Update to apply patches Surface Area Configuration - turn off default
SQL features CLR Integration Database mirroring Debugging Service broker E-Mail functions
SQL Security - Authentication Use simple connection strings containing user names
and passwords during development Create SQL user for test-user (shows password in web.config &
app.config) Use windows authentication in production with more
security SQL 2008 uses encryption of the channel by default
(avoid data sniffing) Windows Group Policy
password complexity password history password age expiration lockout after failed attempts
SQL Security - Authorization
After authentication, what can you access?
Depends on your roles (owner, admin, operator, reader, etc)
Principal Any individual, group, or process that can
request access to a protected resource Securable
object that you can secured by granting or denying of permissions
SQL Security - Principal
Windows-level principals Domain, local, group
SQL Server-level principals SQL login login mapped to a windows login login mapped to a certificate login mapped to a asymmetric key
Database-level principals Database user user mapped to SQL server login user mapped to windows login, certificate, asymmetric key Database role Application role etc...
SQL Security - Securables
Server
DatabaseEndpointRemote BindingRouteLogin
Database
Application RoleAssemblyAsymmetric KeyCertificateDatabase userFixed Database RoleFull-text catalogMessage typeServiceService ContractSymmetric Key
Schema
DefaultFunctionProcedureStatsQueueRuleSynonymTableTriggerTypeViewXML Schema
Assigning or refusing permissions on a securable object to a principal
GRANT DENY
REVOKE - remove previously assigned permission (grant or deny)
Creating database with security in mind requires detail analysis
SQL Security – Dynamical SQL Execute(@sql)
@sql is a dynamically generate SQL statement @sql = ‘select * from course where name = ‘’‘ + @search + ‘’’’
Open for SQL injection attack @search = ‘cse’’’; delete from users‘
Use sp_executesql (@sql, @search_text)
SQL Security – Encryption
Built-in SQL encryption methods: EncryptByPassPhrase(),
DecryptByPassPhrase() EncryptByCertificate(),
DecryptByCertificate() Encryption side-effects:
Storage (encrypted values are larger size) Performance
Create Index on encrypted data Create Index on hash value
Review question
Difference between db logic design and physical design?
Difference between deny vs revoke? Can you think of a generalization scenario for
your project? How many entities will you have in your db
design? Can you identify where you would need indexes
in your db? What db objects would you want to provide
more security in your db design?
Break time
Enterprise DB – availability & load
Availability = (Total Units of Time – Downtime) / Total Units of Time 8,760 hours (365 days 24 hours) in a calendar
year 100 hours of downtime during the year (8760 – 100) / 8,760 (98.9% uptime)
Fail-over When one db fails, another becomes active
DB Load Balance Distribute data across different servers (multiple
active databases)
Enterprise DB - architecture
Clustering Log shipping Mirroring Snapshot replication Merge replication Peer-to-peer replication (transactional) Combinations
Cluster & mirror Cluster & log-shipping Cluster & replication
Enterprise DB - clustering
client 1
client 2
client 3
One IP address forall clients
Node 1 Node 2 Node 3
Private Network Private Network
Node - SQLServer
ClusteredInstance
Shared Storage
Internally replicated files in the SAN(storage area network) box
Enterprise DB - log shipping
Primary
Back uptransaction
log
Copy transactionlog (FTP?)
Secondary
Restoretransaction
log
Enterprise DB - mirroring
Principal
1. write transaction to log
2. Transmit transaction
Mirror
3. write transaction to log
4. acknowledgement
5. Commit data 6. Commit data
Witness
Enterprise DB – snapshot replication
Publisher
Snapshot agentDistribution agent
Distributor Subscriber
CreateSnapshot
snapshot folder
Apply snapshot
Enterprise DB – merge replication
ClientsClients
Distributor
Merge Agent
Enterprise DB – peer-to-peer
China
U.S.
Spain
Setup in softwareconfiguration
Each databasehas its owndistributor
DB Architecture comparison
Distance
Serverswitch
Downtimeduring switch
Data Lossduring switch
Single pointof failure
# of fail-overservers
Schemadependency
LoadBalance
Limited None None None
Automatic AutomaticManual Manual
Seconds SecondsMinutes Minutes
No RarelyLikely Likely
Disk None NoneNone
up to 16 1Unlimited Unlimited
No NoNo Yes
Yes NoNo Yes
Enterprise DB – cluster & mirror
Mirror
No Witness Server
Enterprise DB – cluster & log-shipping
SQL Cluster
Copy transaction log
Secondary
Restoretransaction
log
Enterprise DB – cluster & replication
SQL Cluster with replication and a remote distributor
Remote Distributor
Subscriber
DB for Continuous Integration Database needs to be built locally
For individual C# developers coding locally For running unit tests locally Database code needs to be in the source
control (version control) Nightly builds on the server
Solution: Database Solution in VS 2010 (cse 136) Database build script (*.sql) Command shell (CreateDB.cmd)
Review question
Difference between fail-over and load balance?
What are the pros and cons of clustering?
What scenario would you recommend logging shipping instead of mirroring?
What scenario would you recommend mirroring instead of replication?
Demo
SQL Mixed mode Create SQL user Show Day 2 tutorial Run .cmd to generate db
Assignment
Due Day 4 Create a database in SQL 2008 Create a database diagram Create SQL Stored Procedures based on
your activity diagram(s) for your entire project’s features.
Create a database solution using VS 2010 (see day 2 tutorial)
Run the db command script
References
Database Modeling and Design Pro SQL Server 2008 Failover Clustering