Take a look at the new version of this page: [ beta version ]. Tell us what you think.

ABSTRACT

The use of any modern computer system leaves unintended traces of expired data and remnants of users' past activities. In this paper, we investigate the unintended persistence of data stored in database systems. This data can be recovered by forensic analysis, and it poses a threat to privacy.

First, we show how data remnants are preserved in database table storage, the transaction log, indexes, and other system components. Our evaluation of several real database systems reveals that deleted data is not securely removed from database storage and that users have little control over the persistence of deleted data.

Second, we address the problem of unintended data retention by proposing a set of system transparency criteria: data retention should be avoided when possible, evident to users when it cannot be avoided, and bounded in time.

Third, we propose specific techniques for secure record deletion and log expunction that increase the transparency of database systems, making them more resistant to forensic analysis.

REFERENCES

• 1: A. Ailamaki, S. Krishnamurthy, S. Papadimitriou, and B. Schroeder. "PostgreSQL", Chapter 26 of Database System Concepts. McGraw-Hill, 5th edition, 2006.
• 2: Berkeley db xml. Available at www.sleepycat.com.
• 3: Steven Bauer , Nissanka B. Priyantha, Secure data deletion for Linux file systems, Proceedings of the 10th conference on USENIX Security Symposium, p.12-12, August 13-17, 2001, Washington, D.C.
• 4: P. A. Bernstein and E. Newcomer. Principles of Transaction Processing. Morgan Kaufmann, 1997.
• 5: D. Boneh and R. J. Lipton. A revocable backup system. In USENIX Security Symposium, pages 91--96, 1996.
• 6: S. Byers. Scalable Exploitation of, and Responses to Information Leakage Through Hidden Data in Published Documents, April 2003.
• 7: R. Card, T. Tso, and S. Tweedie. Design and implementation of the second extended filesystem. In Proc. Dutch International Symposium on Linux, 2004.
• 8: B. Carrier. Sleuth toolkit / Autopsy forensic browser. Available at www.sleuthkit.org.
• 9: Brian Carrier, File System Forensic Analysis, Addison-Wesley Professional, 2005
• 10: E. Casey. Digital Evidence and Computer Crime. Elsevier, 2nd edition, 2004.
• 11: Jim Chow , Ben Pfaff , Tal Garfinkel , Kevin Christopher , Mendel Rosenblum, Understanding data lifetime via whole system simulation, Proceedings of the 13th conference on USENIX Security Symposium, p.22-22, August 09-13, 2004, San Diego, CA
• 12: Jim Chow , Ben Pfaff , Tal Garfinkel , Mendel Rosenblum, Shredding your garbage: reducing data lifetime through secure deallocation, Proceedings of the 14th conference on USENIX Security Symposium, p.22-22, July 31-August 05, 2005, Baltimore, MD
• 13: National Industrial Security Program Operating Manual DoD 5220.22-M. www.dss.mil/isec/nispom_0195.pdf, Jan 1995.
• 14: Encase forensic. Available at www.guidancesoftware.com.
• 15: R. Edmonds. Justice department hid parts of report criticizing diversity effort. Associated Press/USA Today, October 2003.
• 16: U.S. Family Educational Rights and Privacy Act (FERPA). www.ed.gov/offices/OII/fpco/ferpa.
• 17: S. L. Garfinkel. Design Principles and Patterns for Computer Systems That Are Simultaneously Secure and Usable. PhD thesis, M.I.T., 2005.
• 18: Simson L. Garfinkel , Abhi Shelat, Remembrance of Data Passed: A Study of Disk Sanitization Practices, IEEE Security and Privacy, v.1 n.1, p.17-27, January 2003 [doi>10.1109/MSECP.2003.1176992]
• 19: Tal Garfinkel , Ben Pfaff , Jim Chow , Mendel Rosenblum, Data lifetime is a systems problem, Proceedings of the 11th workshop on ACM SIGOPS European workshop, September 19-22, 2004, Leuven, Belgium [doi>10.1145/1133572.1133599]
• 20: Matthew Geiger , Lorrie Faith Cranor, Scrubbing Stubborn Data: An Evaluation of Counter-Forensic Privacy Tools, IEEE Security and Privacy, v.4 n.5, p.16-25, September 2006 [doi>10.1109/MSP.2006.132]
• 21: M. Goodrich, M. Atallah, and R. Tamassia. Indexing information for data forensics. In Applied Cryptography and Network Security Conference (ACNS), pages 206--221, 2005.
• 22: T. Grieve. The decline and fall of the enron empire. Salon Magazine, October 2003.
• 23: P. Gutmann. Secure Deletion of Data from Magnetic and Solid-State Memory. In Proc. USENIX Security Symposium, July 1996.
• 24: U.S. health insurance portability and accountability act (HIPAA). www.hhs.gov/ocr/hipaa.
• 25: N. M. Haller. The S/Key One-Time Password System. In Proc. ISOC Symposium on Network and Distributed System Security, Feb. 1994.
• 26: B. Klimt and Y. Yang. Introducing the Enron Corpus. In Proc. Conference on Email and Anti-Spam (CEAS), July 2004.
• 27: Daniele Micciancio, Oblivious data structures: applications to cryptography, Proceedings of the twenty-ninth annual ACM symposium on Theory of computing, p.456-464, May 04-06, 1997, El Paso, Texas, United States [doi>10.1145/258533.258638]
• 28: C. Mohan , Don Haderle , Bruce Lindsay , Hamid Pirahesh , Peter Schwarz, ARIES: a transaction recovery method supporting fine-granularity locking and partial rollbacks using write-ahead logging, ACM Transactions on Database Systems (TODS), v.17 n.1, p.94-162, March 1992 [doi>10.1145/128765.128770]
• 29: Magnetic storage device procedures. The National Security Agency Central Security Service (NSA/CSS) Policy Manual.
• 30: M. Naor and V. Teague. Anti-persistence: History Independent Data Structures. In Proc. Symposium Theory of Computing, May 2001.
• 31: Kyriacos Pavlou , Richard T. Snodgrass, Forensic analysis of database tampering, Proceedings of the 2006 ACM SIGMOD international conference on Management of data, June 27-29, 2006, Chicago, IL, USA [doi>10.1145/1142473.1142487]
• 32: R. Perlman. The ephemerizer: Making data disappear. Technical Report TR-2005-140, Sun Microsystems, 2005.
• 33: Z. Peterson, R. Burns, J. Herring, A. Stubblefield, and A. Rubin. Secure Deletion for a Versioning File System. In Proc. File And Storage Technologies (FAST), pages 143--154, December 2005.
• 34: R. Ramakrishnan and J. Gehrke. Database Management Systems. McGraw-Hill, 2000.
• 35: R L. Rivest. The RC4 encryption algorithm, Mar 1992.
• 36: Ronald L. Rivest , Adi Shamir, PayWord and MicroMint: Two Simple Micropayment Schemes, Proceedings of the International Workshop on Security Protocols, p.69-87, April 10-12, 1996
• 37: J. M. Rosenbaum. In defense of the delete key. The Green Bag, 3, 2000.
• 38: Sqlite. Available at www.sqlite.org.
• 39: Secure hash standard. Federal Information Processing Standards Publication (FIPS PUB), 180(1), April 1995.
• 40: J. Shetty and J. Adibi. The enron email dataset database schema and brief statistical report. Technical report, Information Sciences Institute, 2004.
• 41: A. Silberchatz, H. Korth, and S. Sudarshan. Database System Concepts. McGraw-Hill, 5th edition, 2006.
• 42: R. T. Snodgrass, S. S. Yao, and C. Collberg. Tamper detection in audit logs. In VLDB Conference, 2004.
• 43: Michael Stonebraker , Lawrence A. Rowe, The design of POSTGRES, Proceedings of the 1986 ACM SIGMOD international conference on Management of data, p.340-355, May 28-30, 1986, Washington, D.C., United States

INDEX TERMS

Primary Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.4 Systems
          Subjects: Relational databases

Additional Classification:
  H. Information Systems
  H.2 DATABASE MANAGEMENT
      H.2.7 Database Administration
          Subjects: Security, integrity, and protection

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Unauthorized access (e.g., hacking, phreaking)

General Terms:
Reliability, Security

Keywords:
forensics, privacy, transparency