Unauthorized inferences in semistructured databases

Information Sciences

Volumn 176, Issue 22, 2006, Pages 3269-3299

  Farkas, Csilla ^a   Brodsky, Alexander ^b   Jajodia, Sushil ^b  

^a University of South Carolina   (United States)

^b George Mason University   (United States)

Author keywords

Completeness; Entailment; Inference problem; Privacy; Semistructured data; Soundness

Indexed keywords

ALGORITHMS; CONSTRAINT THEORY; CONTROL SYSTEMS; DATA PRIVACY; DATA STRUCTURES; INFORMATION ANALYSIS; QUERY LANGUAGES;

COMPLETENESS; DOMAIN KNOWLEDGE; ENTAILMENT; INFERENCE PROBLEM; PRIVACY; SEMISTRUCTURED DATA; SOUNDNESS;

DATABASE SYSTEMS;

EID: 33747774836     PISSN: 00200255     EISSN: None     Source Type: Journal    
DOI: 10.1016/j.ins.2006.01.004     Document Type: Article

References (77)

1. S. Abiteboul, Querying semi-structured data, in: ICDT, 1997, pp. 1-18.
2. R. Agrawal, R. Srikant, Privacy-preserving data mining, in: Proceedings of the 2000 ACM SIGMOD International Conference on Management of Data, Dallas, TX, 2000, pp. 439-450.
3. Anderson J.G. Clearing the way for physicians' use of clinical information systems. Commun. ACM 40 8 (1997) 83-90
4. D.E. Bell, L.J. LaPadula, Secure computer systems: Mathematical foundation and model, Technical Report, Mitre Corp. Report No. M74-244, Bedford, Mass., 1975.
5. S. Benferhat, F. Autrel, F. Cuppens, A possibilistic logic encoding of access control, in: FLAIRS Conf., 2003, pp. 481-485.
6. S. Benferhat, R.E. Baida, F. Cuppens, A stratification-based approach for handling conflicts in access control, in: SACMAT, 2003, pp. 189-195.
7. E. Bertino, S. Castano, E. Ferrari, M. Mesiti, Controlled access and dissemination of XML documents, in: Workshop on Web Information and Data Management, 1999, pp. 22-27.
8. Bettini C., Jajodia S., Wang S., and Wijesekera D. Provisions and obligations in policy rule management. J. Networks Syst. Manage. 3 (2003)
9. J. Biskup, H.H. Bruggemann, The personal model of data - towards a privacy oriented information system (extended abstract), in: Proceedings of the Fifth International Conference of Data Engineering, February 6-10, 1989, Los Angeles, California, USA, IEEE Computer Society, 1989, pp. 348-355.
10. Braithwaite B. National health information privacy bill generates heat at SCAMC. J. Amer. Informat. Assoc. 3 1 (1996) 95-96
11. Brodsky A., Farkas C., and Jajodia S. Secure databases: Constraints, inference channels, and monitoring disclosure. IEEE Trans. Knowledge Data Eng. 12 6 (2000) 900-919
12. Buczkowski L.J. Database inference controller. In: Spooner D.L., and Landwehr C. (Eds). Database Security III: Status and Prospects (1990), North-Holland, Amsterdam 311-322
13. P. Buneman, S. Davidson, G. Hillebrand, D. Suciu, A query language and optimization techniques for unstructured data, in: Proceedings of ACM SIGMOD International Conference on Management of Data, 1996, pp. 505-516.
14. Buneman P., Fan W., Simeon J., and Weinstein S. Constraints for semi-structured data and XML. SIGMOD Record 30 1 (2001) 47-54
15. Buneman P., Fan W., and Weinstein S. Path constraints on semistructured and structured data. Proceedings of the seventeenth ACM SIGACT-SIGMOD-SIGART symposium on Principles of database systems (1998), ACM Press 129-138
16. Buneman P., Fan W., and Weinstein S. Path constraints in semistructured databases. J. Comput. System Sci. 61 2 (2000) 146-193
17. Chen S., Wang X., Rishe N., and Weiss M.A. A web-based spatial data access system using semantic r-trees. Informat. Sci. 167 (2004) 41-61
18. Chin F.Y. Security in statistical databases for queries with small counts. ACM Trans. Database Syst. 3 1 (1978) 92-104
19. L. Cholvy, F. Cuppens, C. Saurel, Towards a logical formalization of responsibility, in: ICAIL, 1997, pp. 233-242.
20. C. Clifton, M. Kantarcioglu, J. Vaidya, Defining privacy for data mining, in: Proceedings of the National Science Foundation Workshop on Next Generation Data Mining, Baltimore, MD, 2002, pp. 126-133.
21. Clifton C., Kantarcioglu M., Vaidya J., Lin X., and Zhu M.Y. Tools for privacy preserving distributed data mining. SIGKDD Explorat. 4 2 (2002) 28-34
22. National Research Council, For the record: Protecting electronic health information, Technical Report, National Academy of Sciences, 1997.
23. F. Cuppens, R. Demolomba, A deontic logic for reasoning about confidentiality, in: Proceedings of 3rd International Workshop on Deontic Logic in Computer Science, 1996.
24. F. Cuppens, R. Demolomba, A modal logical framework for security policies, in: ISMIS, 1997, pp. 579-589.
25. Damiani E., De Capitani di Vimercati S., Paraboschi S., and Samarati P. Design and implementation of an access control processor for XML documents. WWW9 Comput. Networks 33 1-6 (2000) 59-75
26. S. Dawson, S. De Capitani di Vimercati, P. Samarati, Minimal data upgrating to prevent inference and association attacks, in: Proceedings of the 18th ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, 1999, pp. 114-125.
27. S. Dawson, S. De Capitani di Vimercati, P. Samarati, Specification and enforcement of classification and inference constraints, in: Proceedings of IEEE Symposium on Security and Privacy, 1999.
28. Denning D.E. Cryptography and Data Security (1982), Addison-Wesley, Mass
29. D.E. Denning, Commutative filters for reducing inference threats in multilevel database systems, in: Proceedings of IEEE Symposium on Security and Privacy, 1985, pp. 134-146.
30. Dennning D.E., Denning P.J., and Schwartz M.D. The tracker. ACM Trans. Database Syst. 4 1 (1979) 75-95
31. Dennning D.E., and Schlorer J. A fast procedure for finding a tracker in a statistical database. ACM Trans. Database Syst. 5 1 (1980) 88-102
32. Dobkin D., Jones A.K., and Lipton R.J. Secure databases: Protection against user influence. ACM Trans. Database Syst. 4 1 (1979) 97-106
33. L.C.J. Dreyer, M.S. Olivier, Dynamic aspect of the infopriv model, in: Proceedings of 9th Database and Expert Systems Applications DEXA 98, IEEE Computer Society, Los Alamitos, 1998, pp. 340-345.
34. J.A. Goguen, J. Meseguer, Unwinding and inference control, in: Proceedings of IEEE Symposium on Security and Privacy, 1984, pp. 75-86.
35. T.H. Hinke, Inference aggregation detection in database management systems, in: Proceedings of IEEE Symposium on Security and Privacy, 1988, pp. 96-106.
36. Hsu T.S., Liau C.J., Wang D.W., and Chen J.K. Quantifying privacy leakage through answering database queries. Proceedings of 5th Information Security Conference (ISC). LNCS 2433 (2002), Springer-Verlag 162-175
37. Hsu T.S., Liau C.J., and Wang D.W. A logical model for privacy protection. Proceedings of 4th Information Security Conference (ISC). LNCS 2200 (2001), Springer-Verlag 110-124
38. Jajodia S., and Meadows C. Inference problems in multilevel secure database management systems. In: Abrams M.D., Jajodia S., and Podell H. (Eds). Information Security: An Integrated Collection of Essays (1995), IEEE Computer Society Press, Los Alamitos, Calif. 570-584
39. Jajodia S., Samarati P., Sapino M.L., and Subrahmanian V.S. Flexible support for multiple access control policies. ACM Trans. Database Syst. 26 2 (2001) 214-260
40. Kam J.B., and Ullman J. A model of statistical databases and their security. ACM Trans. Database Syst. 2 1 (1977) 1-10
41. M. Kudo, S. Hada, XML document security based on provisional authorization, in: Proceedings of the 7th ACM Conference on Computer and Communication Security, November 2000.
42. Madria S.K., Mohania M., Bhowmick S.S., and Bhargava B. Mobile data and transaction management. Informat. Sci. 141 (2002) 279-309
43. Marks D.G. Inference in MLS database systems. IEEE Trans. Knowledge Data Eng. 8 1 (1996) 46-55
44. S. Mazumdar, D. Stemple, T. Sheard, Resolving the tension between integrity and security using a theorem prover, in: Proceedings of ACM International Conference on Management of Data, 1988, pp. 233-242.
45. McHugh J., Abiteboul S., Goldman R., Quass D., and Widom J. Lore: A database management system for semistructured data. SIGMOD Rec. 26 3 (1997) 54-66
46. C. Meadows, Extending the Brewer-Nash model to a multilevel context, in: Proceedings of IEEE Symposium on Security and Privacy, 1990, pp. 95-102.
47. Meeks B.N. Privacy lost, anytime, anywhere. Communications of ACM 40/8 (1997) 11-13
48. M. Morgenstern, Controlling logical inference in multilevel database systems, in: Proceedings of IEEE Symposium on Security and Privacy, 1988, pp. 245-255.
49. Department of Justice, Genetic information and the workplace, Technical Report, Department of Labor, Department of Health and Human Services, Equal Employment Opportunity Commission Department of Justice, 1998.
50. United States General Accounting Office, Medical records privacy, access needed for health research, but oversight of privacy protections is limited, Technical Report, United States General Accounting Office, Report to Congressional Requesters GAO/HEHS-99-55, 1999.
51. O'Leary D.E. Some privacy issues in knowledge discovery: Oecd personal privacy guidelines. IEEE Expert/Intell. Syst. Appl. 10 2 (1995)
52. S.R.M. Oliveira, O.R. Zaiane, Privacy preserving clustering by data transformation, in: Proceedings of the 18th Brazilian Symposium on Databases, Brazil, 2003, pp. 304-318.
53. S.R.M. Oliveira, O.R. Zaiane, Y. Saygin, Secure association rule mining, in: Proceedings of the 8th Pacific-Asian Conference on Knowledge Discovery and Data Mining, Sydney, Australia, 2004, pp. 74-85.
54. Rindfleisch T.C. Privacy, information technology, and health care. Commun. ACM 40 8 (1997) 93-100
55. Rine D. Human exploration and development of space: using xml database space wide web: Space wide web by adapters in distributed systems configuration from reusable components. Informat. Sci. 150 (2003) 123-151
56. Rubin A.D., Geer D., and Ranum M.J. WEB Security Sourcebook (1997), John Wiley and Sons, Inc.
57. R. Sandhu, D. Ferraiolo, R. Kuhn, The NISI model for role-based access control: Towards a unified standard, in: ACM RBAC 2000, 2000, pp. 47-64.
58. Sandhu R., and Samarati P. Access control: Principles and practices. IEEE Commun. 29 2 (1996) 38-47
59. Sicherman G.L., de Jonge W., and van de Riet R.P. Answering queries without revealing secret. ACM Trans. Database Syst. 8 1 (1983) 41-59
60. G.W. Smith, Modeling security-relevant data semantics, in: Proceedings of IEEE Symposium on Research in Security and Privacy, 1990, pp. 384-391.
61. Stachour P.D., and Thuraisingham B. Design of LDV: A multilevel secure relational database management system. IEEE Trans. Knowledge Data Eng. 2 2 (1990) 190-209
62. Stein L.D. Web Security - A Step-by-Step Reference Guide (1998), Addison-Wesley Longman, Inc.
63. Su T., and Ozsoyoglu G. Inference in MLS database systems. IEEE Trans. Knowledge Data Eng. 3 4 (1991) 474-485
64. H. Subramaniam, Z. Yang, Report on DIMACS working group on privacy/confidentiality of health data, Technical Report, DIMACS Center, CoRE Building, Rutgers University, Piscataway, NJ, 2003.
65. D. Suciu, Semistructured data and XML, in: Handbook of Massive Data Sets, 2002, pp. 743-788.
66. Hinke T.H., Delugach H.S., and Chandrasekhar A. A fast algorithm for detecting second paths in database inference analysis. J. Comput. Security 3 2-3 (1995) 147-168
67. Thuraisingham B.M. Security checking in relational database management systems augmented with inference engines. Comput. Security 6 (1987) 479-492
68. Ting T.C. Privacy and confidentiality in healthcare delivery information system. Proceedings of the 12th IEEE Symposium on Computer-Based Medical Systems (1999), IEEE Computer Society 2
69. Tsumoto S. Mining diagnostic rules from clinical databases using rough sets and medical diagnostic model. Informat. Sci. 162 (2004) 65-80
70. Ullman J.D. Principles of Database and Knowledge-Base Systems vols. 1 and 2 (1988), Computer Science Press, Rockville, MD
71. Wang D.W., Liau C.J., Hsu T.S., and Chen J.K. On the damage and compensation of privacy leakage. 18th Annual IFIP WG 11.3 Working Conference on Data and Applications Security (2004), Kluwer Inc.
72. Wang P.P., and Sullivan K.M. Medical expert systems. Informat. Sci. 162 (2004) 63-64
73. Westin A.F. Privacy and Freedom (1967), Atheneum, New York, NY
74. Wiederhold G., Bilello M., and Donahue C. Web implementation of a security mediator for medical databases. In: Lin T.Y., and Qian S. (Eds). Database Security XI Status and Prospent (1998), Chapman and Hall 60-67
75. G. Wiederhold, M. Bilello, V. Sarathy, X.L. Qian, Protecting collaboration, in: Proceedings of the NISSC 1996 National Information Systems Security Conference, 1996, pp. 561-569.
76. G. Wiederhold, M. Bilello, V. Sarathy, X.L. Qian, A security mediator for health care information, in: Proceedings of the 1996 AMIA Conference, 1996, pp. 120-124.
77. Yi S., Huang B., and Chan W.T. Xml application schema matching using similarity measure and relaxation labeling. Informat. Sci. 169 (2005) 27-46