Citation Context

...t is the subject of this paper is not so much whether the recipient can get access or not to the information as much as what values will constitute the information the recipient will receive. A general doctrine of the work presented herein is to release all the information but to do so such that the identities of the people who are the subjects of the data (or other sensitive properties found in the data) are protected. Therefore, the goal of the work presented in this paper lies outside of traditional work on access control and authentication. 2.4. Multiple queries can leak inference Denning [17] and others [18, 19] were among the first to explore inferences realized from multiple queries to a database. For example, consider a table containing only (physician, patient, medication). A query listing the patients seen by each physician, i.e., a relation R(physician, patient), may not be sensitive. Likewise, a query itemizing medications prescribed by each physician may also not be sensitive. But the query associating patients with their prescribed medications may be sensitive because medications typically correlate with diseases. One common solution, called query restriction, prohibits q...

Citation Context

...on of data cells of small size (e.g. [Cox80]), and clustering entities into mutually exclusive atomic populations (e.g. [YC77]). The perturbation family includes swapping values between records (e.g. =-=[Den82]-=-), replacing the original database by a sample from the same distribution (e.g. [LST83] [LCL85] [Rei84]), adding noise to the values in the database (e.g. [TYW84] [War65]), adding noise to the results...

Citation Context

...n flow control systems provide the ability to declassify data because strict information flow control is too restrictive to write real applications. More complex mechanisms such as inference controls =-=[Den82]-=- often are used to decide when declassification is appropriate. In previous systems, declassification is performed by a trusted subject: code having the authority of a highly trusted principal. One ke...

Citation Context

...nst a “curious” user. For example, there are methods that enable a user to ask queries to a statistical database in a way that prevents him from reconstructing the value of particular entities (e.g., =-=[2, 9, 13, 14, 26]-=- and [27, Section 10.5]). It may seem surprising at first glance that there are no methods to protect the privacy of the user. For example, an investor that queries the stock-market database for the v...

Citation Context

...of protecting against the ability of data recipients to determine sensitive information from other information released to them has been considerably studied in the framework of statistical databases =-=[1, 6]-=-. However, most attention has been devoted to the protection of inference in aggregate statistics and tabular data in contrast to microdata. As a consequence, while a good set of methodologies exist f...

Citation Context

...nown n be distinguished from a valid public key e? Assume that p and q are chosen to be of the form 2p 0 + 1 and 2q 0 + 1, where p 0 and q 0 are primes, a choice that is recommended for other reasons =-=[9]-=-. Then an overwhelming majority of the odd integers (mod n) will be relatively prime to (p \Gamma 1)(q \Gamma 1) = 4p 0 q 0 , and hence will be valid candidate public keys e. Consequently, a dictionar...