Skip to main content

Advertisement

SpringerLink
Log in
Menu
Find a journal Publish with us Track your research
Search
Cart
Book cover

IFIP Annual Conference on Data and Applications Security and Privacy

DBSec 2007: Data and Applications Security XXI pp 243–258Cite as

  1. Home
  2. Data and Applications Security XXI
  3. Conference paper
New Paradigm of Inference Control with Trusted Computing

New Paradigm of Inference Control with Trusted Computing

  • Yanjiang Yang1,
  • Yingjiu Li1 &
  • Robert H. Deng1 
  • Conference paper

  • 1137 Accesses

  • 4 Citations

Part of the Lecture Notes in Computer Science book series (LNISA,volume 4602)

Abstract

The database server is a crucial bottleneck in traditional inference control architecture, as it enforces highly computation-intensive auditing for all users who query the protected database. As a result, most auditing methods, though rigorously studied, can never be implemented in practice for protecting largescale real-world database systems. To shift this paradigm, we propose a new inference control architecture that will entrust inference control to each users platform, provided that the platform is equipped with trusted computing technology. The trusted computing technology is designed to attest the state of a users platform to the database server, so as to assure the server that inference control could be enforced as expected. A generic protocol is proposed to formalize the interactions between the users platform and database server. Any existing inference control technique can work with our protocol, for which the security properties are formally proven. Since each user’s platform enforces inference control for its own queries, our solution avoids the bottleneck.

Keywords

  • Inference control
  • trusted computing
  • auditing
  • security protocol

Chapter PDF

Download to read the full chapter text

References

  1. Achugbue, J.O., Chin, F.Y.: The Effectiveness of Output Modification by Rounding for Protection of Statistical Databases. INFOR 17(3), 209–218 (1979)

    Google Scholar 

  2. Adam, N.R., Wortmann, J.C.: Security-Control Methods for Statistical Databases: A Comparative Study. ACM Computing Surveys 21(4), 516–556 (1989)

    CrossRef  Google Scholar 

  3. Beck, L.L.: A Security Mechanism for Statistical Databases. ACM Trans. Database Systems 5(3), 316–338 (1980)

    CrossRef  MATH  Google Scholar 

  4. Chen, M., McNamee, L., Melkanoff, M.A.: A Model of Summary Data and Its Applications to Statistical Databases. In: Rafanelli, M., Svensson, P., Klensin, J.C. (eds.) Statistical and Scientific Database Management. LNCS, vol. 339, pp. 354–372. Springer, Heidelberg (1989)

    CrossRef  Google Scholar 

  5. Chin, F.Y.: Security Problems on Inference Control for SUM, MAX, and MIN queries. J. ACM 33, 451–464 (1986)

    CrossRef  MathSciNet  Google Scholar 

  6. Chin, F.Y., Kossowski, P., Loh, S.C.: Efficient Inference Control for Range Sum Queries. Theor. Comput. Sci. 32, 77–86 (1984)

    CrossRef  MathSciNet  MATH  Google Scholar 

  7. Chin, F.Y., Özsoyoglu, G.: Security in Partitioned Dynamic Statistical Databases. In: Proc. IEEE COMPSAC, pp. 594–601. IEEE Computer Society Press, Los Alamitos (1979)

    Google Scholar 

  8. Chin, F.Y., Özsoyoglu, G.: Statistical Database Design. ACM Trans. Dababase Systems 6(1), 113–139 (1981)

    CrossRef  Google Scholar 

  9. Chin, F.Y., Özsoyoglu, G.: Auditing and Inference Control in Statistical Databases. IEEE Trans. Softw. Eng. 6, 574–582 (1982)

    CrossRef  MathSciNet  MATH  Google Scholar 

  10. Cox, L.H.: Suppression Methodology and Statistical Disclosure Control. J. Am. Stat. Assoc. 75(370), 377–385 (1980)

    CrossRef  MATH  Google Scholar 

  11. Cox, L.H., Zayatz, L.V.: An Agenda for Research on Statistical Disclosure Limitation. J. Official Statistics 75, 205–220 (1995)

    Google Scholar 

  12. Delicata, R.: An Analysis of Two Protocols for Conditional Access in Mobile Systems, Technical Report CS-04-13, Department of Computing, University of Surrey (2005)

    Google Scholar 

  13. Denning, D.E.: Cryptography and Data Security. Addison-Wesley, Reading (1982)

    MATH  Google Scholar 

  14. Denning, D.E.: Secure Statistical Databases with Random Sample Queries. ACM Trans. Database Systems 5(3), 88–102 (1980)

    CrossRef  MATH  Google Scholar 

  15. Denning, D.E.: A Security Model for the Statistical Database Problem. In: Proc. 2nd International Workshop on Management, pp. 1–16 (1983)

    Google Scholar 

  16. Denning, D.E., Denning, P.J., Schwartz, M.D.: The Tracker: A threat to Statistical Database Security. ACM Trans. Database Systems 4(1), 76–96 (1979)

    CrossRef  Google Scholar 

  17. Denning, D.E., Schlörer, J.: Inference Control for Statistical Databases. Computer 16(7), 69–82 (1983)

    CrossRef  Google Scholar 

  18. Dobkin, D., Jones, A.K., Lipton, R.J.: Secure Databases: Protection Against User Influence. ACM Trans. Database Systems 4(1), 97–106 (1979)

    CrossRef  Google Scholar 

  19. Dolve, D., Yao, A.C.: On the Security of Public Key Protocols. IEEE Transactions on Information Technology 29(2), 198–208 (1983)

    CrossRef  MathSciNet  MATH  Google Scholar 

  20. Erickson, J.S.: Fair use, DRM, and trusted computing. Communications of ACM 46(4), 34–39 (2003)

    CrossRef  Google Scholar 

  21. Farkas, C., Jajodia, S.: The Inference Problem: A Survey. SIGKDD Explorations 4(2), 6–11 (2002)

    CrossRef  Google Scholar 

  22. Fellegi, I.P., Phillips, J.L.: Statistical Confidentiality: Some Theory and Applications to Data Dissemination. Ann. Ec. Soc. Meas. 3(2), 399–409 (1974)

    Google Scholar 

  23. Greenberg, B.G., Abernathy, J.R., Horvitz, D.G.: Application of Randomized Response Technique in Obtaining Quantitative Data. In: Proc. Social Statistics Section, America, Statistical Association, pp. 40-43 (1969)

    Google Scholar 

  24. Hoffman, L.J.: Modern Methods for Computer Security and Privacy. Prentice-Hall, Englewood Cliffs (1977)

    Google Scholar 

  25. Hui, M.L., Lowe, G.: Safe Simplifying Transformations for Security Protocols. In: Proc. 12th Computer Security Foundations Workshop, pp. 32–43 (1999)

    Google Scholar 

  26. Iliev, A., Smith, S.W.: Protecting User Privacy via Trusted Computing at the Server. IEEE Security and Privacy 3(2), 20–28 (2005)

    CrossRef  Google Scholar 

  27. Kleinberg, J., Papadimitriou, C., Raghavan, P.: Auditing Boolean Attributes. In: Proc. 9th ACM SIGMOD-SIGACT-SIGART Symposium on Principles of Database Systems, pp. 86–91. ACM Press, New York (2000)

    Google Scholar 

  28. LaGrande technology architecture: Intel Developer Forum (2003)

    Google Scholar 

  29. Lefons, D., Silvestri, A., Tangorra, F.: An Analytic Approach to Statistical Databases. In: Proc. 9th Very Large Databases, pp. 260–273 (1983)

    Google Scholar 

  30. Li, Y., Lu, H., Deng, R.H.: Practical Inference Control for Data. In: Proc. IEEE Symposium on Security and Privacy, pp. 115–120. IEEE Computer Society Press, Los Alamitos (2006)

    Google Scholar 

  31. Li, Y., Wang, L., Wang, X.S., Jajodia, S.: Auditing Interval-based Inference. In: Proc. 14th Conference on Advanced Information Systems Engineering, pp. 553–567 (2002)

    Google Scholar 

  32. Liew, C.K., Choi, W.J., Liew, C.J.: A Data Distortion by Probability Distribution. ACM Trans. Database Systems 10(3), 395–411 (1985)

    CrossRef  MATH  Google Scholar 

  33. Malvestuto, F.M., Mezzini, M.: Auditing Sum-Queries. In: Proc. International Conference on Database Theory, pp. 504–509 (2003)

    Google Scholar 

  34. Malvestuto, F.M., Moscarini, M.: An Audit Expert for Large Statistical Databases, Statistical Data Protection, EUROSTAT, pp. 29-43 (1999)

    Google Scholar 

  35. Mitchell, C.: Trusted Computing. The Institution of Electrical Engineers, London, UK (2005)

    Google Scholar 

  36. Özsoyoglu, G., Chung, J.: Information Loss in the Lattice Model of Summary Tables Due To Suppression. In: Proc. IEEE Symposium on Security and Privacy, pp. 75–83. IEEE Computer Society Press, Los Alamitos (1986)

    Google Scholar 

  37. Perrig, A., Smith, S.W., Song, D., Tygar, J.D.: SAM: A Flexible and Secure Auction Architecture using Tusted Hardware. eJETA.org: The Electronic Journal for E-Commerce Tools and Applications 1(1) (2002)

    Google Scholar 

  38. Reiss, J.P.: Practical Data Swapping: The First Step. In: Proc. IEEE Symposium on Security and Privacy, pp. 36–44. IEEE Computer Society Press, Los Alamitos (1980)

    Google Scholar 

  39. Sailer, R., Jaeger, T., Zhang, X., van Doorn, L.: Attestation-Based Policy Enforcement for Remote Access. In: Proc. ACM Conference on Computer and Communications Security, pp. 308–317. ACM Press, New York (2004)

    Google Scholar 

  40. Sailer, R., Zhang, X., Jaeger, T., van Doorn, L.: Design and Implementation of a TCG-based Integrity Measurement Architecture. In: USENIX. USENIX Security Symposium, pp. 223–238 (2004)

    Google Scholar 

  41. Sande, G.: Automated Cell Supperssion to Reserve Confidentiality of Business Statistics. In: Proc. 2nd Workshop on Statistical Database Management, pp. 346–353 (1983)

    Google Scholar 

  42. Sandhu, R., Zhang, X.: Peer-to-Peer Access Control Architecture Using Trusted Computing Technology. In: Proc. ACM Symposium on Access Control Models and Technologies, pp. 147–158. ACM Press, New York (2005)

    Google Scholar 

  43. Schlörer, J.: Confidentiality of Statistical Records: A Threat Monitoring Scheme of On-line Dialogue. Methods Inform. Med. 15(1), 36–42 (1976)

    Google Scholar 

  44. Schlörer, J.: Disclosure from Statistical Databases: Quantitative Aspects of Trackers. ACM Trans. Database Systems 5(4), 467–492 (1980)

    CrossRef  MATH  Google Scholar 

  45. Schlörer, J.: Information Loss in Partitioned Statistical Databases. Comput. J. 26(3), 218–223 (1983)

    CrossRef  Google Scholar 

  46. Schneider, S.: Verifying Authentication Protocols with CSP. In: Proc. 10th Computer Security Foundation Workshop, pp. 3–17 (1997)

    Google Scholar 

  47. Schneider, S.: Concurrent and Real-time Systems: the CSP Approach. Addison-Wesley, Reading (1999)

    Google Scholar 

  48. Smith, S.W., Safford, D.: Practical Server Privacy Using Secure Coprocessors. IBM Systems Journal (special issue on End-to-End Security) 40, 683–695 (2001)

    Google Scholar 

  49. TCG. TPM Main: Part 1 Design Principles, TCG Specification Ver. 1.2, Revision 62 (2003), http://www.trustedcomputinggroup.org

  50. TCG. TPM Main: Part 2 TPM Data Structure, TCG Specification Ver. 1.2, Revision 62 (2003), http://www.trustedcomputinggroup.org

  51. TCG. TPM Main: Part 3 Commands, TCG Specification Ver. 1.2, Revision 62 (2003), http://www.trustedcomputinggroup.org

  52. Trusted Computing Group (2006), http://www.trustedcomputinggroup.org

  53. Traub, J.F., Yemini, Y., Wozniakowski, H.: The Statistical Security of A Statistical Database. ACM Trans. Database Systems 9(4), 672–679 (1984)

    CrossRef  Google Scholar 

  54. Wang, L., Li, Y., Wijesekera, D., Jajodia, S.: Precisely Answering Multi-dimensional Range Queries without Privacy Breaches. In: Snekkenes, E., Gollmann, D. (eds.) ESORICS 2003. LNCS, vol. 2808, pp. 100–115. Springer, Heidelberg (2003)

    CrossRef  Google Scholar 

  55. Wang, L., Wijesekera, D., Jajodia, S.: Cardinality-based Inference Control in Sum-only Data Cubes. In: Gollmann, D., Karjoth, G., Waidner, M. (eds.) ESORICS 2002. LNCS, vol. 2502, pp. 55–71. Springer, Heidelberg (2002)

    CrossRef  Google Scholar 

  56. Warner, S.L.: Randomized Response: A Survey Technique for Eliminating Evasive Answer Bias. J. Am. Stat. Asso. 60(309), 63–69 (1965)

    CrossRef  MATH  Google Scholar 

  57. Warner, S.L.: The Linear Randomized Response Model. J. Am. Stat. Asso. 66(336), 884–888 (1971)

    CrossRef  Google Scholar 

  58. Willenborg, L., Waal, T.: Statistical Discolure Control in Practice. Lecture Notes in Statistics, vol. 111. Springer, Heidelberg (1996)

    CrossRef  MATH  Google Scholar 

  59. Willenborg, L., Waal, T.: Elements of Statistical Discolure. Lecture Notes in Statistics, vol. 155. Springer, Heidelberg (2000)

    Google Scholar 

  60. Yu, C.T., Chin, F.Y.: A Study on the Protection of Statistical Databases. In: Proc. ACM SIGMOD, pp. 169–181. ACM Press, New York (1977)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. School of Information Systems, Singapore Management University, 80 Stamford Road,178902, Singapore

    Yanjiang Yang, Yingjiu Li & Robert H. Deng

Authors
  1. Yanjiang Yang
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Yingjiu Li
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Robert H. Deng
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Steve Barker Gail-Joon Ahn

Rights and permissions

Reprints and Permissions

Copyright information

© 2007 IFIP International Federation for Information Processing

About this paper

Cite this paper

Yang, Y., Li, Y., Deng, R.H. (2007). New Paradigm of Inference Control with Trusted Computing. In: Barker, S., Ahn, GJ. (eds) Data and Applications Security XXI. DBSec 2007. Lecture Notes in Computer Science, vol 4602. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-73538-0_18

Download citation

  • .RIS
  • .ENW
  • .BIB

  • DOI: https://doi.org/10.1007/978-3-540-73538-0_18

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-540-73533-5

  • Online ISBN: 978-3-540-73538-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Share this paper

Anyone you share the following link with will be able to read this content:

Sorry, a shareable link is not currently available for this article.

Provided by the Springer Nature SharedIt content-sharing initiative

Publish with us

Policies and ethics

search

Navigation

  • Find a journal
  • Publish with us
  • Track your research

Discover content

  • Journals A-Z
  • Books A-Z

Publish with us

  • Publish your research
  • Open access publishing

Products and services

  • Our products
  • Librarians
  • Societies
  • Partners and advertisers

Our imprints

  • Springer
  • Nature Portfolio
  • BMC
  • Palgrave Macmillan
  • Apress
  • Your US state privacy rights
  • Accessibility statement
  • Terms and conditions
  • Privacy policy
  • Help and support
  • Cancel contracts here

167.114.118.210

Not affiliated

Springer Nature

© 2023 Springer Nature