1. Data Security and Integrity Developments and Directions Dr. Bhavani Thuraisingham The University of Texas at Dallas June 2009

2. Outline l Data Security and Integrity - Multilevel Data Management, Data and Applications Security, Data Integrity and Provenance l Policy Management - Confidentiality, Privacy Trust l Privacy and Data Mining l Secure Web Services and Semantic Web l Emerging Directions

3. Developments in Data and Applications Security: 1975 - Present l Access Control for Systems R and Ingres (mid 1970s) l Multilevel secure database systems (1980 – present) - Relational database systems: research prototypes and products; Distributed database systems: research prototypes and some operational systems; Object data systems; Inference problem and deductive database system; Transactions l Recent developments in Secure Data Management (1996 – Present) - Secure data warehousing, Role-based access control (RBAC); E- commerce; XML security and Secure Semantic Web; Data mining for intrusion detection and national security; Privacy; Dependable data management; Secure knowledge management and collaboration

4. Developments in Data and Applications Security: Multilevel Secure Databases - I l Air Force Summer Study in 1982 l Early systems based on Integrity Lock approach l Systems in the mid to late 1980s, early 90s - E.g., Seaview by SRI, Lock Data Views by Honeywell, ASD and ASD Views by TRW - Prototypes and commercial products - Trusted Database Interpretation and Evaluation of Commercial Products l Secure Distributed Databases (late 80s to mid 90s) - Architectures; Algorithms and Prototype for distributed query processing; Simulation of distributed transaction management and concurrency control algorithms; Secure federated data management

5. Developments in Data and Applications Security: Multilevel Secure Databases - II l Inference Problem (mid 80s to mid 90s) - Unsolvability of the inference problem; Security constraint processing during query, update and database design operations; Semantic models and conceptual structures l Secure Object Databases and Systems (late 80s to mid 90s) - Secure object models; Distributed object systems security; Object modeling for designing secure applications; Secure multimedia data management l Secure Transactions (1990s) - Single Level/ Multilevel Transactions; Secure recovery and commit protocols

6. Directions in Data and Applications Security - I l Secure semantic web - Security models l Secure Information Integration - How do you securely integrate numerous and heterogeneous data sources on the web and otherwise l Secure Sensor Information Management - Fusing and managing data/information from distributed and autonomous sensors l Secure Dependable Information Management - Integrating Security, Real-time Processing and Fault Tolerance l Data Sharing vs. Privacy - Federated database architectures?

7. Directions in Data and Applications Security - II l Data mining and knowledge discovery for intrusion detection - Need realistic models; real-time data mining l Secure knowledge management - Protect the assets and intellectual rights of an organization l Information assurance, Infrastructure protection, Access Control - Insider cyber-threat analysis, Protecting national databases, Role-based access control for emerging applications l Security for emerging applications - Geospatial, Biomedical, E-Commerce, etc. l Other Areas - Trust and Economics, Trust Management/Negotiation, Secure Peer-to-peer computing,

8. Data Integrity and Quality l Data Integrity maintains the accuracy of the data - E.g., When multiple transactions access the data, the action of one transaction cannot invalidate that of another - Solutions: Locking mechanism - Integrity also includes preventing unauthorized modifications to the data l Data quality provides some measure for determining the accuracy of the data - Is the data current? Can we trust the source? - Tools for data cleansing and handling incompleteness - Data quality parameters can be passed from source tom source l E.g., Trust A 50% and Trust B 30% l Data quality can be specified as part of the annotation to the data - Develop an annotation management system

9. Data Provenance l Keeping track of the entire history of the data - Who created the data - Who modified the data - Who read the data - Do we trust the data source? - Do we trust the person who handled the data - The organizations traveled by the data l Data annotations for data provenance - What is the model? - Design of the annotation management system l Using data analysis techniques, unauthorized modification and access, Misuse detection activities can be carried out

10. Coalition Data and Policy Sharing Export Data/Policy Component Data/Policy for Agency A Data/Policy for Federation Export Data/Policy Component Data/Policy for Agency C Component Data/Policy for Agency B Export Data/Policy

11. Need to Know to Need to Share l Need to know policies during the cold war; even if the user has access, does the user have a need to know? l Pose 9/11 the emphasis is on need to share - User may not have access, but needs the data l Do we give the data to the user and then analyze the consequences l Do we analyze the consequences and then determine the actions to take l Do we simply not give the data to the user l What are risks involved?

12. CPT: Confidentiality, Privacy and Trust l Before I as a user of Organization A send data about me to organization B, I read the privacy policies enforced by organization B - If I agree to the privacy policies of organization B, then I will send data about me to organization B - If I do not agree with the policies of organization B, then I can negotiate with organization B l Even if the web site states that it will not share private information with others, do I trust the web site l Note: while confidentiality is enforced by the organization, privacy is determined by the user. Therefore for confidentiality, the organization will determine whether a user can have the data. If so, then the organization van further determine whether the user can be trusted

13. RBAC l Access to information sources including structured and unstructured data both within the organization and external to the organization l Access based on roles l Hierarchy of roles: handling conflicts l Controlled dissemination and sharing of the data

14. UCON l RBAC model is incorporated into UCON and useful for various applications - Authorization component l Obligations - Obligations are actions required to be performed before an access is permitted - Obligations can be used to determine whether an expensive knowledge search is required l Attribute Mutability - Used to control the scope of the knowledge search l Condition - Can be used for resource usage policies to be relaxed or tightened

15. Dissemination Policies l Release policies will determine to whom to release the data - What is the connection to access control - Is access control sufficient - Once the data is retrieved from the information source (e.g., database) should it be released to the user l Once the data is released, dissemination policies will determine who the data can be given to - Electronic music, etc.

16. Risk Based Data Sharing/Access Control l What are the risks involved in releasing/disseminating the data l Risk modeling should be integrated with the access control model l Simple method: assign risk values l Higher the risk, lower the sharing l What is the cost of releasing the data? l Cost/Risk/Security closely related

17. Trust Management l Trust Services - Identify services, authorization services, reputation services l Trust negotiation (TN) - Digital credentials, Disclosure policies l TN Requirements - Language requirements l Semantics, constraints, policies - System requirements l Credential ownership, validity, alternative negotiation strategies, privacy l Example TN systems - KeyNote and Trust-X (U of Milan), TrustBuilder (UIUC)

18. Credentials and Disclosure l Credentials can be expressed through the Security Assertion Mark-up Language (SAML) l SAML allows a party to express security statements about a given subject - Authentication statements - Attribute statements - Authorization decision statements l Disclosure policies govern: Access to protected resources Access to sensitive information Disclosure of sensitive credentials l Disclosure policies express trust requirements by means of credential combinations that must be disclosed to obtain authorization

19. What is Privacy l Medical Community - Privacy is about a patient determining what patient/medical information the doctor should be released about him/her l Financial community - A bank customer determine what financial information the bank should release about him/her l Government community - FBI would collect information about US citizens. However FBI determines what information about a US citizen it can release to say the CIA

20. Data Mining as a Threat to Privacy l Data mining gives us “facts” that are not obvious to human analysts of the data l Can general trends across individuals be determined without revealing information about individuals? l Possible threats: - Combine collections of data and infer information that is private l Disease information from prescription data l Military Action from Pizza delivery to pentagon l Need to protect the associations and correlations between the data that are sensitive or private

21. Some Privacy Problems and Potential Solutions l Problem: Privacy violations that result due to data mining - Potential solution: Privacy-preserving data mining l Problem: Privacy violations that result due to the Inference problem - Inference is the process of deducing sensitive information from the legitimate responses received to user queries - Potential solution: Privacy Constraint Processing l Problem: Privacy violations due to un-encrypted data - Potential solution: Encryption at different levels l Problem: Privacy violation due to poor system design - Potential solution: Develop methodology for designing privacy- enhanced systems

22. Privacy Constraint Processing l Privacy constraints processing - Based on prior research in security constraint processing - Simple Constraint: an attribute of a document is private - Content-based constraint: If document contains information about X, then it is private - Association-based Constraint: Two or more documents taken together is private; individually each document is public - Release constraint: After X is released Y becomes private l Augment a database system with a privacy controller for constraint processing

23. Architecture for Privacy Constraint Processing User Interface Manager Constraint Manager Privacy Constraints Query Processor: Constraints during query and release operations Update Processor: Constraints during update operation Database Design Tool Constraints during database design operation Database DBMS

24. Semantic Model for Privacy Control Patient John Cancer Influenza Has disease Travels frequently England address John’s address Dark lines/boxes contain private information

25. Privacy Preserving Data Mining l Prevent useful results from mining - Introduce “cover stories” to give “false” results - Only make a sample of data available so that an adversary is unable to come up with useful rules and predictive functions l Randomization - Introduce random values into the data and/or results - Challenge is to introduce random values without significantly affecting the data mining results - Give range of values for results instead of exact values l Secure Multi-party Computation - Each party knows its own inputs; encryption techniques used to compute final results

26. Platform for Privacy Preferences (P3P): What is it? l P3P is an emerging industry standard that enables web sites to express their privacy practices in a standard format l The format of the policies can be automatically retrieved and understood by user agents l It is a product of W3C; World wide web consortium www.w3c.org l When a user enters a web site, the privacy policies of the web site is conveyed to the user; If the privacy policies are different from user preferences, the user is notified; User can then decide how to proceed l Several major corporations are working on P3P standards including

27. Data Mining and Privacy: Friends or Foes? l They are neither friends nor foes l Need advances in both data mining and privacy l Need to design flexible systems - For some applications one may have to focus entirely on “pure” data mining while for some others there may be a need for “privacy-preserving” data mining - Need flexible data mining techniques that can adapt to the changing environments l Technologists, legal specialists, social scientists, policy makers and privacy advocates MUST work together

28. 28 WS-* security Standards framework

29. Inference/Privacy Control with Semantic Web Technologies Policies Ontologies Rules RDF Database RDF Documents Web Pages, Databases Inference Engine/ Rules Processor Interface to the Semantic Web Technology By UTD

30. Emerging Directions l Digital Identity Management l Identity Theft Management l Digital Forensics l Digital Watermarking l Risk Analysis l Economic Analysis l Secure Electronic Voting Machines l Biometrics l Social network security