Secure databases: constraints, inference channels, and monitoring disclosures
- 1 January 2000
- journal article
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Transactions on Knowledge and Data Engineering
- Vol. 12 (6) , 900-919
- https://doi.org/10.1109/69.895801
Abstract
Investigates the problem of inference channels that occur when database constraints are combined with non-sensitive data to obtain sensitive information. We present an integrated security mechanism, called the Disclosure Monitor, which guarantees data confidentiality by extending the standard mandatory access control mechanism with a Disclosure Inference Engine. This generates all the information that can be disclosed to a user based on the user's past and present queries and the database and metadata constraints. The Disclosure Inference Engine operates in two modes: a data-dependent mode, when disclosure is established based on the actual data items, and a data-independent mode, when only queries are utilized to generate the disclosed information. The disclosure inference algorithms for both modes are characterized by the properties of soundness (i.e. everything that is generated by the algorithm is disclosed) and completeness (i.e. everything that can be disclosed is produced by the algorithm). The technical core of this paper concentrates on the development of sound and complete algorithms for both data-dependent and data-independent disclosures.Keywords
This publication has 15 references indexed in Scilit:
- Specification and enforcement of classification and inference constraintsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- Inference aggregation detection in database management systemsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,2003
- Secure databases: constraints, inference channels, and monitoring disclosuresIEEE Transactions on Knowledge and Data Engineering, 2000
- Minimal data upgrading to prevent inference and association attacksPublished by Association for Computing Machinery (ACM) ,1999
- Inference in MLS database systemsIEEE Transactions on Knowledge and Data Engineering, 1996
- A Fast Algorithm for Detecting Second Paths in Database Inference Analysis*Journal of Computer Security, 1995
- Controlling FD and MVD inferences in multilevel relational database systemsIEEE Transactions on Knowledge and Data Engineering, 1991
- Security checking in relational database management systems augmented with inference enginesComputers & Security, 1987
- Commutative Filters for Reducing Inference Threats in Multilevel Database SystemsPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1985
- Unwinding and Inference ControlPublished by Institute of Electrical and Electronics Engineers (IEEE) ,1984