Journal of Computer Security

A privacy violation occurs when the association between an individual identity and data considered private by that individual is obtained by an unauthorized party. Uncertainty and indistinguishability are two independent aspects that characterize the degree of this association being revealed. Indistinguishability refers to the property that the attacker cannot see the difference among a group of individuals, while uncertainty refers to the property that the attacker cannot tell which private value, among a group of values, an individual actually has. This paper investigates the notion of indistinguishability as a general form of anonymity, applicable, for example, not only to generalized private tables, but to relational views and to sets of views obtained by multiple queries over a private database table. It is shown how indistinguishability is highly influenced by certain symmetries among individuals, in the released data, with respect to their private values. The paper provides both theoretical results and practical algorithms for checking if a specific set of views over a private table provide sufficient indistinguishability.

Although the k-anonymity and ℓ-diversity models have led to a number of valuable privacy-protecting techniques and algorithms, the existing solutions are currently limited to static data release. That is, it is assumed that a complete dataset is available at the time of data release. This assumption implies a significant shortcoming, as in many applications data collection is rather a continual process. Moreover, the assumption entails “one-time” data dissemination; thus, it does not adequately address today's strong demand for immediate and up-to-date information. In this paper, we consider incremental data dissemination, where a dataset is continuously incremented with new data. The key issue here is that the same data may be anonymized and published multiple times, each of the time in a different form. Thus, static anonymization (i.e., anonymization which does not consider previously released data) may enable various types of inference. In this paper, we identify such inference issues and discuss some prevention methods.

We consider information disclosure caused by answering queries to an XML database. We introduce an audit framework to determine ‘suspicious’ user queries, i.e. those queries that returned results being sufficient to derive disclosed secret information. We describe secret information in form of a secret query and provide a formal definition of ‘suspicious’ user queries based on what we call ‘readset fragments’, i.e. XML fragments that have been read to produce certain query result nodes. Our approach performs two steps to detect ‘suspicious’ user queries. First, we analyze the structure of user queries and of the secret query to exclude ‘non-suspicious’ queries. Second, we derive a formula from user query, query result and secret query, which is satisfiable if and only if the query is ‘non-suspicious’.

In data outsourcing model, data owners engage third-party data servers (called publishers) to manage their data and process queries on their behalf. As these publishers may be untrusted or susceptible to attacks, it could produce incorrect query results to users. In this paper, we introduce an authentication scheme for outsourced multi-dimensional databases. With the proposed scheme, users can verify that their query answers from a publisher are complete (i.e., no qualifying tuples are omitted) and authentic (i.e., all the result values are legitimate). In addition, our scheme guarantees minimality (i.e., no non-answer points are returned in the plain). Our scheme supports window, range, kNN and RNN queries on multi-dimensional databases. We have implemented the proposed scheme, and our experimental results on kNN queries show that our approach is a practical scheme with low overhead.