Temporal Implications of Database Information Accountability

Abstract

Abstract-Information restriction controls access and renders records immutable; information accountability requires data transparency to easily and efficiently determine when a particular use is appropriate. Information accountability in the context of relational databases is associated with time in a surprising number of ways, as is summarized in this paper. Notarization and validation of a database exploit the temporal semantics of a transaction-time database. A corruption can be associated with multiple times. Forensic analysis determines the when: bounds on the corruption time, and the where: also specified in terms of time. These bounds are depicted in a two-dimensional corruption diagram, with both axes denoting time. The various kinds of corruption events are defined in terms of time. A parameter termed the regret interval has significant security and performance implications. This paper emphasizes the deep connections between time and the definition, detection, forensic analysis, and characterized extent of a database corruption within the context of information accountability.Keywords-information accountability; temporal semantics; transaction-time databases; forensic analysis;The prevailing approach to achieving privacy and security for databases is information restriction. For example, ensuring record compliance, or information compliance in general, usually entails rendering retained records immutable and controlling access to them. We feel that the means of addressing security and compliance should be viewed as constituting a spectrum. If one asserts that information restriction lies at one end of the spectrum then the question which inevitably arises is what lies at the other end? In a recent article Weitzner et al. [1] argue that access control and cryptography are not capable of protecting information privacy and that there is a true dearth of mechanisms for effectively addressing information leaks. They propose that as an alternative information accountability "must become a primary means through which society addresses appropriate use" [1]. Information accountability assumes that information should be transparent so as to easily determine whether a particular use is appropriate under a given set of rules. A related concept is continuous assurance technology, defined as "technology-enabled auditing which produces audit results simultaneously with, or a short period of time after, the occurrence of relevant events" [2]. This concept is crucial because it can be used to achieve a meaningful operationalization of information accountability. This paper studies the overlap of time, databases, and security, as shown in Figure 1. We have encountered time in this context in many different places and under many different guises. This suggests a deep connection between the general topics of (i) temporal databases and (ii) information accountability. Our purpose here is to identify the many instances where time appears in the definition and implementation of information accountability and to discuss new ti...