Aggregation and inference: facts and fallacies

The author examines inference and aggregation problems that can arise in multilevel relational database systems and points out some fallacies in current thinking about these problems that may hinder real progress from being made toward their solution. She distinguishes several different types of aggregation and inference problems and shows that the different types of problems are best addressed by different approaches. In particular, it is shown that sensitive associations among entities of different types are best treated by representing the sensitive association separately and classifying the individual entities low and the relationship high. Sensitive associations among the various properties of an entity are best treated by determining those properties that contribute most to the inference and by storing those separately at a higher classification. Sensitive associations among entities of the same type are best treated by storing the individual data items comprising the aggregate at the aggregate-high classification; they must be sanitized for release to lower-level users. The suggested approaches allow the mandatory reference monitor to protect the sensitive associations, with no additional trusted mechanism needed