Aggregation in relational databases: Controlled disclosure of sensitive information

  • Amihai Motro
  • Donald G. Marks
  • Sushil Jajodia
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 875)


It has been observed that often the release of a limited part of an information resource poses no security risks, but the relase of a sufficiently large part of that resource might pose such risks. This problem of controlled disclosure of sensitive information is an example of what is known as the aggregation problem. In this paper we argue that it should be possible to articulate specific secrets within a database that should be protected against overdisclosure, and we provide a general framework in which such controlled disclosure can be achieved. Our methods foil any attempt to attack these predefined secrets by disguising queries as queries whose definitions do not resemble secrets, but whose answers nevertheless “nibble” at secrets. Our methods also foil attempts to attack secrets by breaking queries into sequences of smaller requests that extract information less conspicuously. The accounting methods we employ to thwart such attempts are shown to be both accurate and economical.


  1. 1.
    D. E. Denning. Cryptography and Data Security. Addison Wesley, Reading, Massachusetts, 1982.Google Scholar
  2. 2.
    J.T. Haigh, R.C. O'Brian, P.D. Stachour, and D.L. Toups. The LDV approach to security. In D.L. Spooner and C. Landwehr, editors, Database Security III: Status and Prospects, pages 323–339. North Holland, Amsterdam, 1990.Google Scholar
  3. 3.
    T.N. Hinke. Inference aggregation deduction in database management systems. In Proceedings of IEEE Symposium on Security and Privacy, pages 96–106, April 1988.Google Scholar
  4. 4.
    S. Jajodia. Inference problems in secure database management systems. Technical Report MTR 92W0000052, The MITRE Corporation, McLean, Virginia, June 1992.Google Scholar
  5. 5.
    T.Y. Lin. Database, aggregation and security algebra. In Proceedings of the 4th IFIP Working Conference on Database Security, September 1990.Google Scholar
  6. 6.
    T.F. Lunt. Aggregation and inference: Facts and fallacies. In Proceedings of IEEE Symposium on Security and Privacy, pages 102–109, May 1989.Google Scholar
  7. 7.
    T.F. Lunt and R.A. Whitehurst. The Sea View formal top level specifications. Technical report, Computer Science Laboratory, SRI International, February 1988.Google Scholar
  8. 8.
    A. Motro. Integrity = validity + completeness. ACM Transactions on Database Systems, 14(4):480–502, December 1989.CrossRefGoogle Scholar
  9. 9.
    A. Motro. Intensional answers to database queries. IEEE Transactions on Knowledge and Data Engineering, 6(3):444–454, June 1994.CrossRefGoogle Scholar
  10. 10.
    D. C. Tsichritzis and F. H. Lochovsky. Data Models. Prentice Hall, Englewood Cllifs, New Jersey, 1982.Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 1994

Authors and Affiliations

  • Amihai Motro
    • 1
  • Donald G. Marks
    • 1
  • Sushil Jajodia
    • 1
  1. 1.Department of Information and Software Systems EngineeringGeorge Mason UniversityFairfax

Personalised recommendations