Intentional resolution of privacy protection in database systems

ABSTRACT

Traditionally, privacy protection in database systems is understood to be the control over what information a given user can get from a database. This paper is concerned with another, independent, dimension of privacy protection, the control over what a user is allowed to do with a piece of information supplied to him by the database. The ability to condition the supply of information on its intended use is called here “intentional resolution” of privacy protection. The practical importance of intentional resolution is demonstrated by several examples, and its realization is discussed. It is shown that intentional resolution can be achieved, but that it involves a radical change from the traditional approach to the process of user-database interaction. In particular, it appears to be necessary for the database to impose a certain amount of control over the internal behavior of users' programs which interact with it. A model for user-database interaction which admits such a control is developed.

REFERENCES

• 1: CODASYL Data Base Task Group (DBTG) Report, April 1971. (Available from ACM.)
• 2: N. Minsky, On interaction with data bases, Proceedings of the 1974 ACM SIGFIDET (now SIGMOD) workshop on Data description, access and control, p.51-62, May 01-03, 1974, Ann Arbor, Michigan [doi>10.1145/800296.811504]
• 3: Summers, R.C., Coleman, C.D., and Fernandez, E.B. A programming language approach to secure data base access. IBM Tech. Rep. G320-2662, May 1974.
• 4: R. W. Conway , W. L. Maxwell , H. L. Morgan, On the implementation of security measures in information systems, Communications of the ACM, v.15 n.4, p.211-220, April 1972 [doi>10.1145/361284.361287]
• 5: W. Wulf , E. Cohen , W. Corwin , A. Jones , R. Levin , C. Pierson , F. Pollack, HYDRA: the kernel of a multiprocessor operating system, Communications of the ACM, v.17 n.6, p.337-345, June 1974 [doi>10.1145/355616.364017]
• 6: Codd, E. F. Relational completeness of data base sublanguage. Proc. Courant Institute Symp. on Data Base Systems, 1971, pp. 65-98.
• 7: Butler W. Lampson, A note on the confinement problem, Communications of the ACM, v.16 n.10, p.613-615, Oct. 1973 [doi>10.1145/362375.362389]
• 8: Naftaly Minsky, Another look at data-bases, ACM SIGMOD Record, v.6 n.4, p.9-17, 1974 [doi>10.1145/983082.983084]
• 9: Owens, R. C. Jr. Evaluation of access authorization for on line data management systems. ACM SIGFIDET Workshop, Nov. 1971, pp. 263-278.
• 10: Minsky, N. Protection of data bases, and the process of user-DB interaction. Tech. Rep. SOSAP-TR-11, Computer Sci. Dep., Rutgers U., 1974.
• 11: Barbara Liskov , Stephen Zilles, Programming with abstract data types, Proceedings of the ACM SIGPLAN symposium on Very high level languages, p.50-59, March 28-29, 1974, Santa Monica, California, United States

INDEX TERMS

Keywords:
intentional resolution of privacy, interaction with databases, privacy, protection in databases, protection in programming languages, security