Dynamic inference control

An inference problem exists in a multilevel database if knowledge of some objects in the database allows information with a higher security level to be inferred. Many such inferences may be prevented prior to any query processing by raising the security level of some of the objects, however this inevitably impedes information access, as a user with low authorization who queries just one of the objects with raised security must seek clearance even when not in danger of making the inference. More flexible access control is possible when inferences are prevented during query processing, however this practice can result in slow query response times. We demonstrate that access control can be made sufficiently dynamic to ensure easy access to the information users are entitled to, while retaining fast query processing. Our inference control schemes provide collusion resistance and have a query processing time that depends only on the length of the inference channels (not on the length of user query histories). In addition, our schemes provide a property we call crowd control that goes beyond collusion resistance to ensure that if a large number of users have queried all but one of the objects in an inference channel, then no one will be able to query the remaining object regardless of the level of collusion resistance provided by the scheme.

[1]  Karl N. Levitt,et al.  Data level inference detection in database systems , 1998, Proceedings. 11th IEEE Computer Security Foundations Workshop (Cat. No.98TB100238).

[2]  Moni Naor,et al.  Revocation and Tracing Schemes for Stateless Receivers , 2001, CRYPTO.

[3]  Mark E. Stickel.  Elimination of inference channels by optimal upgrading , 1994, Proceedings of 1994 IEEE Computer Society Symposium on Research in Security and Privacy.

[4]  Russ Bubley,et al.  Randomized algorithms , 1995, CSUR.

[5]  Harry S. Delugach,et al.  A Fast Algorithm for Detecting Second Paths in Database Inference Analysis , 1995, J. Comput. Secur..

[6]  J. H. van Lint,et al.  Introduction to Coding Theory , 1982 .

[7]  Amit Sahai,et al.  Coding Constructions for Blacklisting Problems without Computational Assumptions , 1999, CRYPTO.

[8]  Douglas R. Stinson,et al.  Key Preassigned Traceability Schemes for Broadcast Encryption , 1998, Selected Areas in Cryptography.

[9]  Bhavani M. Thuraisingham,et al.  Data mining, national security, privacy and civil liberties , 2002, SKDD.

[10]  Bhavani M. Thuraisingham,et al.  Secure query-processing strategies , 1989, Computer.

[11]  Sujeet Shenoi,et al.  Catalytic inference analysis: detecting inference threats due to knowledge discovery , 1997, Proceedings. 1997 IEEE Symposium on Security and Privacy (Cat. No.97CB36097).

[12]  Harry S. Delugach,et al.  Layered Knowledge Chunks for Database Inference , 1993, DBSec.

[13]  Teresa F. Lunt,et al.  Access Control Policies for Database Systems , 1988, DBSec.

[14]  Tsau Young Lin,et al.  Inference Secure Multilevel Databases , 1993, DBSec.

[15]  Bhavani M. Thuraisingham,et al.  The Use of Conceptual Structures for Handling the Inference Problem , 1991, DBSec.

[16]  Dorothy E. Denning,et al.  A Multilevel Relational Data Model , 1987, 1987 IEEE Symposium on Security and Privacy.

[17]  Peter D. Karp,et al.  Detection and elimination of inference channels in multilevel relational database systems , 1993, Proceedings 1993 IEEE Computer Society Symposium on Research in Security and Privacy.

[18]  Leonard J. Binns.  Implementation Considerations for Inference Detection: Intended vs. Actual Classification , 1993, Database Security.

[19]  Thomas H. Hinke,et al.  Database Inference Engine Design Approach , 1988, DBSec.

[20]  Bhavani Thuraisingham,et al.  Recursion theoretic properties of the inference problem in database security , 1991 .

[21]  Sushil Jajodia,et al.  Enhancing the Controlled Disclosure of Sensitive Information , 1996, ESORICS.

[22]  Bhavani M. Thuraisingham.  Towards the Design of a Secure Data/Knowledge Base Management System , 1990, Data Knowl. Eng..

[23]  Gary W. Smith,et al.  Modeling security-relevant data semantics , 1990, Proceedings. 1990 IEEE Computer Society Symposium on Research in Security and Privacy.

[24]  Barry Sowerbutts,et al.  Database Architectonics and Inferential Security , 1990, DBSec.