On security of statistical databases

Abstract

A statistical database (SDB) is a database that is used to provide statistical information (such as average, sums etc.), derived from the records, to user queries for statistical data analysis. Sometimes, by correlating enough statistics, protected data about an individual can be inferred. The security problem is to limit the use of the SDB such that only statistical information is available and no protected individual data can be obtained from the available queries. When users are able to infer protected information in the SDB from responses to queries, the SDB is said to be compromised. The goal is to maximize the number of available queries without compromise. One of the natural restrictions for the prevention of database compromise is to allow only SUM queries, that is, only certain sums of individual records are available for the users. In this paper we discuss security problems for databases where only SUM queries with certain constraints are allowed. Assume there are n numeric records {z <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> ,..., z <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sub> } stored in a database. The problem is to find the largest number of subset sums of {z <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sub> ,..., z <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">n</sub> } (maybe with some other constraints) that can be disclosed such that none of numbers z <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">i</sub> (or even sums of small subsets) can be determined from these sums. Some tight bounds for this number (under certain constraints on size and dimension of query subsets) are presented