CSC 316 Chapter 6b, Spring 2004

Chapter 6 Data Base Security Sawma V., Computer Security 2 Inference Problem Inference problem is to derive sensitive data from nonsensitive data. It’s a subtle vulnerability in database security. A sample table: Table 8-2 Sample Database Name Sex Race Aid Fines Drugs Dorm Adams M C 5000 45. 1 Holmes Bailey M B 0 0. 0 Grey Chin F A 3000 20. 0 West Dewitt M B 1000 35. 3 Grey Earhart F C 2000 95. 1 Holmes Fein F C 1000 15. 0 West Groff M C 4000 0. 3 West Hill F B 5000 10. 2 Holmes Koch F C 0 0. 1 West Liu F A 0 10. 2 Grey Majors M C 2000 0. 2 Grey Sawma V., Computer Security 3 Inference Problem  Direct Attack (1) Direct attack is an attempt to retrieve some values by directly querying some sensitive fields.  Example: SELECT Name FROM Sample WHERE Sex=‘M’ AND Drugs=1; Some trick may be used on direct attack.  Example: SELECT Name FROM Sample WHERE (Sex=‘M’ AND Drugs=1) OR (Sex<>’M’ AND Sex<>’F’) OR Dorm=‘Beirut’; Sawma V., Computer Security 4 Inference Problem  Direct Attack (2) The rule of “n items over k percent”: data should not be given if n items represent over k percent of the result reported.  In the previous example, the one person selected represents 100 percent of the data reported. Sawma V., Computer Security 5 Inference Problem  Indirect Attack (1) Indirect attack is to infer a result based on one or more statistical results. Several examples of indirect attack:  Sum: a reported sum may be used to infer a value. (Table 6-8: sums of financial aid by dorm and sex)  Count: the count can be combined with the sum to produce some even more revealing results. (Table 6-9: count of students by dorm and sex) Sawma V., Computer Security 6 Inference Problem  Indirect Attack (3)  Linear system vulnerability: with a little algebra and a little more luck in the distribution of the database contents, it’s possible to determine a series of queries that returns results relating to several different sets. q1 = c1 + c2 + c3 + c4 + c5 q2 = c1 + c2 + c4 q3 = c3 + c4 q4 = c4 + c5 q5 = c2 + c5 Sawma V., Computer Security 7 Inference Problem  Controls for Inference Attacks Query controls  Effective primarily against direct attacks Item controls  Suppression: query is rejected without sensitive data provided.  Concealing: the answer provided is close to but not exactly the actual value. Contrast b/w security and precision. Sawma V., Computer Security 8 Inference Problem  Examples of Controls (1) Limited response suppression:  Rule of n items over k percent: eliminate low-frequency elements.  More sufficient way: suppress additional cells on the same row and column. combined results:  To combine some rows and columns.  Or to present values in ranges.  Or to present values by rounding. Sawma V., Computer Security 9 Inference Problem  Examples of Controls (2) Random sample:  Result is computed on a random selected subset of the database but not the whole database. Random data perturbation:  Result is perturbed by a small error. Query analysis:  A query and its implications are analyzed.  Complexity:  Maintain a query history for each user.  Judge each query on the context of previous queries. Aggregation  Building sensitive results from less sensitive inputs  Usually involves finding the intersection of many insensitive inputs to get a sensitive data value Sawma V., Computer Security 10 Inference Problem  Conclusion No perfect solutions. Three paths to follow:  Suppress obvious sensitive information (easily).  Track what the user knows (costly).  They are used to limit queries accepted and data provided.  Disguise the data (problem with precision).  It’s applied only to the released data. Sawma V., Computer Security 11 Multilevel Databases  Differentiated Security An illusion: Sensitivity was determined just by attribute.  sensitive vs nonsensitive attributes The fact: differentiated data security Three characteristics of database security:  The security of a single element may be different from the others in the same row or column.  Several grades of security are needed.  The security of an aggregate (a sum, a count, or a group of values) may be different from the security of the individual elements. Sawma V., Computer Security 12 Multilevel Databases  Granularity An analogy: Defining the sensitivity of each value in a data base is similar to applying a sensitivity level to each individual word of a document. Both element and combination of elements may have a distinct sensitivity. In order to keep each value of a database being in its own sensitivity level:  An access control policy must define which users can have access to what data.  confidentiality (or secrecy)  Each value must be guaranteed NOT to be changed by any unauthorized person.  integrity Sawma V., Computer Security 13 Multilevel Databases  Security Issues (1) Integrity  In multilevel databases a high-level user should not be able to write a lower-level data element.  Problem: Sometimes read and write must happen to the same process, like DBMS.  Solution: Either the process cleared at a high level cannot write to a lower level, or the process must be a “trusted process”. Sawma V., Computer Security 14 Multilevel Databases  Security Issues (2) Confidentiality  In multilevel databases two different users from different levels of security may get two different answers to the same query.  Unknowing redundancy, known as polyinstantiation, may be introduced; that is, one record can appear many times, with different level of secrecy each time. Sawma V., Computer Security 15 Proposals for multilevel security  Partitioning Model: The database is divided into separate databases, each at its own security level. Weakness:  Destroy basic advantage of a database: elimination of redundancy. Sawma V., Computer Security 16 Proposals  Encryption Model: Each level of sensitive data is stored in a table encrypted under a key unique to the level of sensitivity. Weakness:  Chosen plaintext attack may increase.  High overhead of processing a query: decrypting required fields. Encryption is not often used to implement separation in data bases. Sawma V., Computer Security 17 Proposals  Integrity and Sensitivity Locks (1) Integrity lock (spray paint): The protection is made with elements, not with tables. Each data item includes:  Data itself: stored in plaintext for efficiency of access.  Sensitivity label: defines the sensitivity of the data.  Sensitivity labels are unforgeable, unique, and concealed.  Checksum: computed across both data and sensitivity label. (Cryptographic checksum) Sawma V., Computer Security 18 Proposals  Integrity and Sensitivity Locks (2) Sensitivity lock: is a combination of a unique identifier and the sensitivity level.  Sensitivity lock = E(Key, Sensitivity label, unique identifier) Intention:  Use any (untrusted) database manager with a trusted procedure that handles access control. Sawma V., Computer Security 19 Proposals  Integrity and Sensitivity Locks (3) It’s only a short-term solution for multilevel security. Weakness: – Efficiency of integrity locks is a serious drawback.  The space required is expanded. – The processing time of decoding sensitivity label is a problem. – Trojan horse attack: database manager sees all data. Sawma V., Computer Security 20 Proposals  Trusted Front-End Model (Figure 6-11):  A trusted front-end (known as a guard) is added.  Interaction b/w user, front-end, and DBMS (page368) c.f., Commutative filters:  Reformat user’s request if necessary and return only data of appropriate sensitivity to the user.  Advantage:  Database manager can do as much as possible, like selection, optimization, subquery …  Overall efficiency of the system. Sawma V., Computer Security 21 Proposals  Distributed/federated Database Operation of a trusted front-end:  Control access to two database managers with different sensitivity.  Take user’s query and formulate single-level queries to the databases as appropriate.  Return results to user, combining results appropriately if they are obtained from different databases. Weakness: – The front-end is potentially including most of the functionality of a full database manager. – Data must be kept in separate databases according to their different sensitivity degrees. Sawma V., Computer Security 22 Proposals  Window/View Window – A window is a subset of a database, containing exactly the information that a user is entitled to access. View – A view can represent a single user’s subset database, so that all of a user’s queries access only that subset database and sensitive data to the user may be filtered. – Layered system (TCB, trusted computing base): • First layer: access control & user authentication. • Second layer: index & computation of database. • Third layer: translate views into the base relations. Sawma V., Computer Security 23 Concluding Remarks Partitioning and Distributed databases are not popular, mainly because there is a difficulty in combined usage of different databases. Integrity lock is just a short-term solution for the security of multilevel databases. Trusted front-end and Commutative filter look like more practical, but more complicated. Encryption is used, but big problem is overhead of processing. Window and View are concepts more related to the functionality of database itself.