Controlled query evaluation enforces security policies for confidentiality in information systems. It deals with users who
may apply background knowledge to infer additional information from the answers to their queries. For each query the correct
answer is first judged by some censor and then - if necessary - appropriately modified to preserve security. In previous approaches,
modification has been done uniformly, either by lying or by refusal. A drawback of lying is that all disjunctions of secrets
must always be protected. On the other hand, refusal may hide an answer even when the correct answer does not immediately
reveal a secret.
In this paper we introduce a hybrid answer modification method that appropriately combines lying and refusal. We prove that
the new method is secure under the models of known potential secrets and of known secrecies, respectively. Furthermore, we
demonstrate that the combined approach can be more cooperative than uniform lies and uniform refusal, and enjoyes the advantages
of both.
Keywords Inference control - Controlled query evaluation - Secrecy - Potential secret - User log - Refusal - Lying - Reliability