Lecture Notes in Computer Science, 2002, Volume 2513/2002, 49-60, DOI: 10.1007/3-540-36159-6_5

Security against Inference Attacks on Negative Information in Object-Oriented Databases

Yasunori Ishihara, Shuichiro Ako and Toru Fujiwara

View Related Documents

Abstract

Inference attacks mean that a user derives information on the execution results of unauthorized queries from the execution results of authorized queries. Although many studies so far focus on only inference of positive information (i.e., which object is the execution result of a given unauthorized query), negative information (i.e., which object is never the execution result of a given unauthorized query) is also sensitive. In this paper, we define the following two types of security problems against inference attacks on given negative information: (1) Is the information secure under a given database instance? (2) Is it secure under any database instance of a given database schema? It is shown that the first problem is decidable in polynomial time in the description size of the database instance while the second one is undecidable. A decidable sufficient condition for given negative information to be secure under any database instance of a given database schema is also proposed.

Fulltext Preview

Image of the first page of the fulltext document