Maximizing Sharing of Protected Information

Abstract

Despite advances in recent years in the area of mandatory access control in database systems, today's information repositories remain vulnerable to inference and data association attacks that can result in serious information leakage. Without support for coping against these attacks, sensitive information can be put at risk because of release of other (less sensitive) related information. The ability to protect information diclosure against such improper leakage would be of great benefit to governmental, public, and private institutions, which are, today more than ever, required to make portions of their data available for external release. In this paper we address the problem of classifying information by enforcing explicit data classification as well as inference and association constraints. We formulate the problem of determining a classification that ensures satisfaction of the constraints, while at the same time guaranteeing that information will not be overclassified. We present an approach to the solution of this problem and give an algorithm implementing it which is linear in simple cases, and quadratic in the general case. We also analyze a variant of the problem that is NP-complete. © 2002 Elsevier Science (USA)

Combining fragmentation and encryption to protect privacy in data storage

“…Our work may bring some resemblance with the work of classifying information while maximizing visibility [Dawson et al 2002]. However, while the two lines of work share the goal of ensuring protection and minimizing security measures enforcement, the consideration of fragmentation and encryption on the one side and security labeling on the other make the problems considerably different.…”

Protecting Privacy in Data Release

“…Function Re_Assign receives as input the set To_Empty of non-empty but underquota groups, and tries to reallocate their tuples to other groups (lines [30][31][32][33][34][35][36][37][38]. Tuples in under-quota groups that cannot be reallocated will be removed from the fragmentation and are inserted into To_Remove (lines [39][40].…”

“…Data dependencies can cause inference channels to arise, allowing a recipient to either precisely determine, or reduce the uncertainty about, the values of sensitive, not released, information that is somehow dependent on the released one. This problem has been under the attention of researchers for decades and has been analyzed from different perspectives, resulting in a large body of research that includes: statistical databases and statistical data publications (e.g., [1]); multilevel database systems with the problem of establishing proper classification of data, capturing data relationships and corresponding inference channels (e.g., [35,66]); ensuring privacy of respondents' identities or of their sensitive information when publishing macro or micro data (e.g., [24,25]); protection of sensitive data associations due to data mining (e.g., [2]). Several approaches have been proposed addressing all these aspects, and offering solutions to block or limit the exposure of sensitive or private information.…”

Selective data outsourcing for enforcing privacy*

“…The work presented in this paper has some affinity with the work in [17]. Although this approach shares with our problem the common goal of enforcing confidentiality constraints on data, it is concerned with retrieving a data classification (according 564 V. Ciriani et al / Selective data outsourcing for enforcing privacy to a multilevel mandatory policy) that ensures sensitive information is not disclosed.…”