Optimality and Complexity of Inference-Proof Data Filtering and CQE

Abstract

The ample literature on confidentiality-preserving data publishing -and controlled query evaluation (CQE) in particular -leaves several questions open. Are the greedy data-filtering algorithms adopted in the literature maximally cooperative? Can novel secure view formats or answer distortion methods improve security or cooperativeness? What is the inherent complexity of confidentiality-preserving data publishing under different constraints, such as cooperativeness and availability? Can the theoretical results on CQE be systematically extended to more general settings? In this paper we answer the above questions using a completely generic, abstract data filtering framework, independent from any syntactic details and data source encodings, and compatible with all possible distortion methods. Some of the main results are: Refusal-based filterings can be adopted as a normal form for all kinds of filterings; greedy refusal-based filterings are optimal; cooperativeness checks and some availability checks are coNP-hard in the simplest case.

Confidentiality enforcement by hybrid control of information flows

“…Such queries, here called basic information requests, are the only way how the program may get data from the abstract information state. Moreover, the information owner declares a partner-specific confidentiality policy pol as sets of abstract information states, as described in [7].…”

“…[25], and inference-usability confinement with dynamic tracking of information flows from the abstract information state to generated message data sent to the partner and with a filter and modification method that employs generalization of declassified values, e.g. [5,6,7].…”

Constructing Inference-Proof Belief Mediators

“…More specifically, these temporary views are initialized when storing a basic belief reaction as an object in a local container and for an evaluation further tracked according to the operators in the code annotation. In abstract terms, such an information content is represented as a mapping of possible values to sets of belief states such that all these sets together form a partition of the possible belief states, similarly as in [6]. Moreover, the mapping is complemented with an identification of the actual value and block, respectively.…”

“…Called by the FlowTracker with the tentative addition, the CIECensor checks whether the combined information content of the tentative addition resulting from preceding processing and the previous view resulting from the history could possibly violate the security policy. In abstract terms, this combination is obtained by taking all nonempty intersections of a block in (the partition of) the tentative addition with the previous view, and a possible violation occurs if there is a block in the combination that is completely contained in an element of the security policy, assuming that a policy element is abstractly represented as a set of belief states, as described in [6]. If the check confirms harmlessness, the previous view is updated to its intersection with the actual block and the FlowTracker is informed accordingly, and the FlowTracker then temporarily opens the flow lock in turn.…”

“…Elaborating seminal proposals for inference control in information systems, and being in the spirit of many similar approaches to secrecy as concisely exposed in [14], previous work on Controlled Interaction Execution, CIE, originally only dealt with a single owner of a logic-oriented database system like a relational one solely employed for querying, and later also included updates and non-monotonic belief management, see the summaries [4,5], and the abstraction [6]. Based on that, and grossly summarized, in our vision [7] we proposed an architecture of an inference control front-end for uniformly shielding a possibly heterogeneous collection of data sources.…”