Selective partial access to a database

ABSTRACT

A system to support a multi-function, shared-access database requires the capability of defining for each user an arbitrary subset of the fields of a logical record to which access is allowed. The feasibility of such a capability has already been demonstrated by several operational systems. This paper is concerned with the possibility of granting something less than complete access to a specified field of a record. The purpose would be to allow a user to perform various summary and statistical tasks over controlled fields without allowing identification of the exact value of a field in a particular record. Three different strategies are examined: 1. An arbitrary partition of values is defined for each restricted field. A user granted this type of access can determine only which class of the partition contains the field value. 2. The actual field value is distorted by a random perturbation. 3. Access to actual field values is allowed—but values are dissociated from the actual record in which they occur. The third strategy—dissociation—appears to be the most interesting, potentially useful, but potentially vulnerable. In each case, the utility of incomplete access is examined and various implementation alternatives are explored. The degree of protection against persistent assault is determined.

REFERENCES

• 1: C. R. Attanasio, P. W. Markstein, and R. J. Phillips, Penetrating an operating system: a study of VM/370 integrity, IBM Systems Journal, vol. 15, no. 1, 1976.
• 2: ASAP System Reference Manual, Compuvisor, Inc., Ithaca, N.Y., 1971.
• 3: R. Conway, W. Maxwell, and H. Morgan, Selective security capabilities in ASAP, SJCC 1972, pg. 1181.
• 4: CODASYL Data Base Task Group, October 1969 report.
• 5: M. H. Hansen, Insuring confidentiality of individual records in data storage and retrieval for statistical purposes, FJCC 1971, pg. 579.
• 6: IBM: Information Management System, GH20-0765.

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.2 Physical Design
          Subjects: Access methods

Additional Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

General Terms:
Design, Management, Security