On finding an inference-proof complete database for controlled query evaluation

  • Authors:
  • Joachim Biskup;Lena Wiese

  • Affiliations:
  • Universität Dortmund, Dortmund, Germany;Universität Dortmund, Dortmund, Germany

  • Venue:
  • DBSEC'06 Proceedings of the 20th IFIP WG 11.3 working conference on Data and Applications Security
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

Controlled Query Evaluation (CQE) offers a logical framework to prevent a user of a database from inadvertently gaining knowledge he is not allowed to know. By modeling the user's a priori knowledge in an appropriate way, a CQE system can control not only plain access to database entries but also inferences made by the user. A dynamic CQE system that enforces inference control at runtime has already been investigated. In this article, we pursue a static approach that constructs an inference-proof database in a preprocessing step. The inference-proof database can respond to any query without enabling the user to infer confidential information. We illustrate the semantics of the system by a comprehensive example and state the essential requirements for an inference-proof and highly available database. We present an algorithm that accomplishes the preprocessing by combining SAT solving and “Branch and Bound”.