Statistical Database Security

1
Statistical Database Security

• Duc Ngo
• CS 6400
• Spring 2005

2
Definition and Problems

• Statistical Database A collection of records
  whereby queries concerning certain subsets of
  records maybe answered
• Privacy the ability of a person to control the
  availability of information about and exposure of
  him- or herself
• Non-sensitive queries when analyzed together can
  infer sensitive data
• Sensitive data vulnerable to unauthorized
  intruders

3
Solutions

• Private Inference Control (PIC)
• Access Control ensures queries of sensitive
  data are not answered
• Inference Control ensures queries of
  non-sensitive data when put together do not
  reveal sensitive information
• Encryption ensures privacy during transfer of
  sensitive data

4
Solutions

• Random Sample Queries
• A type of inference control
• Safeguards confidential data of online
  statistical database
• Prevents user from controlling formation of query
  sets
• Decreases relative errors as query set size
  increases
• Partitioned Sets
• Data Perturbation - dummy records are added to
  the partitioned sets
• Random Rounding

5
Future

• Private Inference Control
• Collusion Resistance Control
• Internet Content Distribution
• Random Sample Queries
• Small and Medium Scale Statistical Databases
• Partitioned Sets
• Median queries

6
References

• Chin, F. Security in statistical databases for
  queries with small counts, ACM Transactions on
  Database Systems, Vol. 3, No. 1, March 1978.
• D. Denning, Secure statistical databases with
  random sample queries, ACM Transactions on
  Database Systems (TODS), Vol. 5, No. 3, September
  1980.
• M. McLeish, Further results on the security of
  partitioned dynamic statistical databases, ACM
  Transactions on Database Systems, Vol. 14, No. 1,
  March 1989.
• Schatz, J. Survey of Techniques for Securing
  Statistical Databases, University of California
  at Davis.
• D. Woodruff, and J. Staddon, Private inference
  control, Proceedings of the 11th ACM conference
  on Computer and communications security, 2004.