1. Daniel O. Rice Loyola College in Maryland (with Robert Garfinkel and Ram Gopal University of Connecticut) The Protection of Numerical Information in Databases Presentation at Lomonosov Moscow State University Tuesday, 23 rd of October, 2007 Problems of Modern Information Systems Series

2. Database Security Objective Maximize the utility of information provided to users while maintaining the security of confidential information. User Query Original Database Secure Database Security Mechanism Query Answer

3. NameZIPGenderC-Reactive Protein (CRP) Cholesterol (Chol) Blood Pressure (BP) IncomeDiagnosis M. A.06040MNNN102Heart G. P.06269MNNN78 M. L.14260FLHL49 W. F.14260MNNH121Cancer R. H.06040FNHN97Heart F. J.06269MNHN80Heart M. G98195FLNV29 J. M.98195FNNH61 A. B.98195FHHL96Cancer J. R.14260MNHN48 R. S.98195MHHL59Heart Confidential Confidentiality-Related Identity-Related Security Considerations: Disclosure of Confidential Information Identity Disclosure

4. Protection of Confidential Information Perturbation Camouflage RecordNameIncome 1M. A.102 2G. P.78 3M. L.49 4W. F.121 5R. H.97 6F. J.80 7M. G29 8J. M.61 9A. B.96 10J. R.48 11R. S.59

5. Perturbation Recor d Nam e IncomePerturbed 1M. A.102 2G. P.78 3M. L.49 4W. F.121 5R. H.97 6F. J.80 7M. G29 8J. M.61 9A. B.96 10J. R.48 11R. S.59 -19.68 82.32 49.57 87.89 52.07 134.60 101.95 71.15 24.76 46.81 94.79 74.24 Data Swapping/Shuffling Binning

6. Perturbation RecordNamePerturbed 1M. A.82.32 2G. P.87.88 3M. L.52.06 4W. F.134.60 5R. H.101.95 6F. J.71.15 7M. G24.76 8J. M.46.81 9A. B.94.79 10J. R.49.57 11R. S.74.24 QueryPerturbed Answer SUM(1,2,3,4)357 SUM(1,3)134 SUM(1,2)170 VAR(1,2)15.47 True Answer 350 151 180 288

7. Camouflage Record 1 Record 2 Interval Answers Answer Guarantee Interval Protection Storage Efficiency Computational Efficiency “Good” Query Answers

8. Camouflage - Polytope RecordNameP1P2P3 1M. A.11090111 2G. P.628281 3M. L.446437 4W. F.117137106 5R. H.8210299 6F. J.638385 7M. G163629 8J. M.527255 9A. B.7999102 10J. R.456532 11R. S.507052 QueryInterval Answer SUM(1,2,3,4)[333, 373] SUM(1,3)[147, 153] SUM(1,2)[172, 192] VAR(1,2)[25, 1110] True Answer 350 151 180 288

9. Illustration of the CVC Approach Non-Confidential Data

10. Confidential Numeric Data

11. Protection

12. CVC-POL Example DB table ( a interior to )

13. CVC-POL – in 3-D Record 1 Record 2 Record 3

14. (55,31) Protection

16. Every query q : = f(a) is answered with the interval [ q -, q + ], such that CVC Basics and where and

17. Record 1 Record 2 u2u2 l1l1 l2l2 u1u1 Insider Threats - Data Camouflage - Polytope

19. CVC-STAR Protects against insider data information Vulnerable to insider algorithm information is not a convex set Flexibility

20. CVC-STAR – in 3-D Record 1 Record 2 Record 3

22. CVC-Star Example – SUM Query User’s Query: “What is the SUM of salaries of all employees of Company B?”

23. CVC-Star Example – SUM Query I = [ 219, 232 ] I 1 = [ 227, 229 ] I 2 = [ 229, 232 ] I 3 = [ 219, 230 ] I 4 = [ 229, 232 ] I 5 = [ 228, 232 ]

24. Solving SUM / MEAN Queries w/ CVC-STAR T = { 2, 4, 5, 9, 11 } I CVC-STAR = [ 43.8, 46.4 ] I CVC-POL = [ 44.2, 46.8 ] “What is the MEAN salary of all employees of Company B?”

25. Solving Regression Queries w/ CVC STAR:  MIN and MAX b 0 and b 1 at and, or the reverse.  R 2 is found by evaluating the below expression “What is the correlation between the salaries of all employees of Company B and some independent variable X?”

26. Regression Results Low Correlation Medium Correlation High Correlation

27. CVC-POL Vulnerable to insider data information threat Solved by 4 classes of efficient minimal access algorithms No need to store or use actual data CVC-STAR Vulnerable to insider algorithm threat Simpler to solve, no need for heuristics Actual data must be stored and used Can CVC be improved using combinations of techniques? Answering queries with techniques...

28. Computational Experience Evaluate the relative performance of CVC- STAR and CVC-POL DB of 1,000 record –5 Non-Confidential fields A 1,...,A 5 –1 Confidential field (log-normal dist.) 600 queries (selection criteria on A 1,...,A 5 )

29. Average Percent Improvement in Answers using CVC-STAR compared to CVC-POL Protection LevelSUM STANDARD DEVIATIONMIN 10%83%62%63% 20%69.50%36.80%30% 50%37%36.90%5%

30. Relative Performance of CVC-STAR and CVC-INTPOL

31. Conclusions / Ongoing Research CVC – POL and CVC-STAR can protect data confidentiality CVC-STAR outperforms CVC – POL in computational efficiency and answer quality Each is vulnerable to insider information threat CVC-POL vulnerable to insider data threats CVC-STAR vulnerable to insider algorithm threats CVC-STAR can be used to provide flexible quality query answers in a market for private information (IEEE Transactions on Systems, Man, and Cybernetics) The optimal choice of protecting sets for specific insider information threats.

32. End / Questions