Inference and Flow Control

Inference Control Often databases contain information that is sensitive as individual rows, but not sensitive as a group. Example: Salary data across the company, individuals want their salary private, but knowing the average salary for each department is fine. Statistical database security involves allowing aggregate functions (count, sum, min, max, avg, std_dev) to be run on subsets of the data, but not allowing individual records. However, it is possible to infer the state of particular rows if you are allowed to do repeated statistics on small subsets of rows. Example: If a department only has 2 people (and you are one of them), you can infer the salary of the other.

How could you protect against inference? 1. Disallow queries that involve a small number of rows. 2. Add noise to the results returned. 3. Track which queries are being performed and determine if they can reveal additional information. 4. Lobby for the reduction of statistics education in the US to reduce the problem.

Flow Control Some databases have only parts of themselves that contain sensitive information. In such cases, it is important that the sensitive information is not allowed to move from the protected regions (tables) into the less protected regions. A flow policy specifies the channels along which information is allowed to move. Even if an authorized user is allowed to access and write to both sides of a database, flow control prevents the authorized movement of information. http://www.valve.bz/Flow_Control_Valve.html

Covert Channels A covert channel allows information to pass from a protected level to a less protected level though improper means. Tracking the SELECT and modification queries stops the easy attacks, but there are more subtle mechanisms. A timing channel relies on timing how long a query takes to respond. The time a query takes can be indicative of what rows exist in a table, even if a query doesn't yield any data. Example: I can query the "Bad Reviews" table for a particular student, and longer response times means the student wrote a bad review of me. A storage channel uses information conveyed by system information or other means to determine information about a protected region. Example: A query on the table "Bad Reviews" uses up more memory if a row exists than if it doesn't.