Security-control methods for statistical databases: a comparative study

Reviewer: Mary McLeish

A statistical database (SDB) is any traditional database system in which queries are restricted to statistical aggregates (such as sample mean and count); an example is the US Census Bureau database. It is often required that the system be secure from users' attempts to infer confidential information about an individual from the aggregate query responses. Considerable work has been carried out over the last 15 years to discover sufficient conditions on the queries to keep these databases secure. This has been found to be a very difficult task. With the increasing use of large database systems and knowledge bases for expert systems, the issue has become even more relevant in recent years. This careful survey of work on statistical database security examines the different approaches that have been used—conceptual, query restriction, data perturbation, and output perturbation. The authors discuss the main conceptual models due to Chin, O¨zsoyog?lu, Denning, and Schlorer. Different ways to restrict queries are surveyed and compared. The query set size may be restricted, and may overlap between successive queries. The methodology can depend on the data storage technique. The query-set-size control releases a statistic only if certain restrictions are made to the size of the query set. The paper mentions work in this area by Denning, Schlorer, Schwartz, Hoffman, Miller, Jonge, and Traub and notes the problems caused by the application of fast trackers. The work by Dobkin and others on query-set overlap restrictions shows the difficulties that arise in making this solution practical. Auditing involves keeping track of all queries made by a user over time and checking for possible compromise whenever a new query is issued. This paper discusses methods proposed by Chin, O¨zsoyog?lu, and McLeish. Data partitioning clusters individual entities of the population into a number of mutually exclusive subsets. Security control methods that use this technique, which are due to Yu, Chin, Schlorer, and O¨zsoyog?lu, are mentioned. (McLeish's more general results on dynamic partitioned models are not mentioned.) Sande and Cox's work on the use of cell suppression methods for the Canadian census indicates that this method is computationally complex. Data and output perturbation methods provide a very different solution to the security problem—none of the reported answers will be exact. The bias problem (Matloff), data swapping (Reiss), probability-distribution methods (Liew et al.), an analytical method (Lefons et al.), and fixed-data perturbation methods (Traub and Warner) are all reviewed. Output perturbation methods involve using random-sample queries (Denning), and a method due to Beck introduces a varying perturbation to the data. The paper presents a variety of rounding techniques: systematic rounding, random rounding, and controlled rounding. The effectiveness of all these methods depends, of course, on the strictness of the security required. Sometimes an exact compromise (determining the exact value of a protected attribute) is the only situation in which disclosure is of concern; at other times,<__?__Pub Caret> revealing a close estimate of the value (statistical disclosure) is dangerous. The authors discuss the approaches to security control mentioned in the previous paragraph in light of the different measures of disclosure. A comparative analysis of the methods contrasts random-sample queries with Beck's varying-output-perturbation and some fixed-data-perturbation methods. Precision and security criteria for COUNT and SUM queries are presented along with consistency, cost, and robustness criteria. The paper brings some newer threats to the attention of SDB researchers. Logical inference is a new problem arising from logic programming environments. Earlier work concentrated on sum and count queries, but regression analyses present a whole new set of confidentiality problems. The last section makes the point that no single method is adequate for security control. The authors make suggestions for future work to try to overcome the major practical problems of many of the current methods. The paper presents and synthesizes a great deal of published material in this surprisingly large research area. Particular methods are discussed in some detail. The bibliography is not as extensive as in some survey papers.