Search

Multilevel relational database systems store information at different security classifications. An inference problem exists if it is possible for a user with a low-level clearance to draw conclusions about information at higher classifications. The authors are developing DISSECT, a tool for analyzing multilevel relational database schemas to assist in the detection and elimination of inference problems. A translation is defined from schemas to an equivalent graph representation, which can be presented graphically in DISSECT. The initial focus is on detection of inference problems that depend only on information all of which is stored in the database. In particular, potential inference problems are identified as different sequences of foreign key relationships that connect the same entities. Inferences can be blocked by upgrading the security classification of some of foreign key relationships. A global optimization approach to upgrading is suggested to block a set of inference problems that allows upgrade costs to be considered, and supports security categories as well as levels. >

An inference channel exists if it is possible for a low-clearance user to infer high-classification data from low-classification data. Inference channels can be blocked by upgrading the security classification of some of the low-level data. The task of eliminating inference channels is formulated for solution by the Davis-Putnam theorem-proving procedure. The procedure is augmented to search for solutions with minimum total upgrade cost. >

A serious problem in computer database and knowledge base security is detecting and eliminating so-called inference channels. The existence of such channels enables a user with access to information classified at a low level to infer information classified at a high level, and through the transformation of low level data to high level data may provide an unacceptable information flow. In order to estimate the presence of inference channels, determine the degree of risk which they present, and find ways to eliminate them, one needs a formal model to describe them. The authors introduce abductive reasoning. Abduction provides both the basis for a formal model for the inference problem and a computational mechanism for detecting inference channels. Abduction additionally provides a framework for reasoning with approximate and uncertain information, which enables them to extend the model for inference channels by taking into account the likelihood that a person might believe some statement of interest. >