An extended access control mechanism exploiting data dependencies

Abstract

In general, access control mechanisms in DBMSs ensure that users access only those portions of data for which they have authorizations, according to a predefined set of access control policies. However, it has been shown that access control mechanisms might be not enough. A clear example is the inference problem due to functional dependencies, which might allow a user to discover unauthorized data by exploiting authorized data. In this paper, we wish to investigate data dependencies (e.g., functional dependencies, foreign key constraints, and knowledge-based implications) from a different perspective. In particular, the aim was to investigate data dependencies as a mean for increasing the DBMS utility, that is, the number of queries that can be safely answered, rather than as channels for releasing sensitive data. We believe that, under given circumstances, this unauthorized release may give more benefits than issues. As such, we present a query rewriting technique capable of extending defined access control policies by exploiting data dependencies, in order to authorize unauthorized but inferable data.

Appendix: Security proofs

Correctness

Proof

We prove Theorem 1 by showing that if $\exists t^{\star } \in Rs(q^{rw})$ such that $\exists a \in \mathtt{schema(}Rs(q^{rw})\mathtt{)}$, for which neither P.1 nor P.2 hold, then a contradiction arises.

If P.1 does not hold, it means that there is no policy authorizing $t^{\star }$, thus $a^{\star }$ is not contained into $authorizedAttributes_{q}$, but it is still in $requestedAttributes_{q}$ computed in Line 4 of Algorithm 5.1. The algorithm then checks each table specified in F $_{q}$. When the one, say $T^{\star }$, to which $t^{\star }$ belongs is considered, the if condition in Line 7 is satisfied. After the execution of Line 8, $unauthorizedAttributes_{q}$ contains $a^{\star }$. When $a^{\star }$ is considered in for cycle in Line 10, since P.2 does not hold, we might have two cases: (i) There exists no data dependency that implies attribute $a^{\star }$; (ii) there exists no data dependency that implies attribute $a^{\star }$ such that the dependency determinant is explicitly authorized for u.

Let us consider the first case (i), that is, that no data dependency in DD implies attribute $a^{\star }$. As such, the dependenciesForAttribute set computed at Line 10 is empty. Therefore, the conditional statement at Line 11 is not verified and the computation goes at Line 28, where the algorithm stops and returns a message to inform that the query is not authorized. Thus, a contradiction arises.

In the second case (ii), there exists at least one data dependency $dd^{\star }$ with $a^{\star }$ $\in$ $dd^{\star }.Dep$, but there is no access control policy authorizing u to access $dd^{\star }.Det$. In this case, the condition in Line 11 is satisfied (i.e., dependenciesForAttribute $\ne$ $\emptyset$), but the $PoliciesForDeterminant$ set is empty. This brings the algorithm to remove $dd^{\star }$ from dependenciesForAttribute, thus making the if condition in Line 16 false. As such, algorithm jumps to line 26, stops, and returns an unauthorized message. Thus, a contradiction arises. $\square$

Completeness

Proof

Similarly to Theorem 1, we prove Theorem 2 by contradiction. In particular, we show that if there exists a tuple $t^{\star }\in Rs(q)$ such that there exists an attribute $a^{\star }\in \mathtt{schema(}Rs(q)\mathtt{)}$ to which properties P.1 and P.2 do not apply and $t^{\star }\in Rs(q^{rw})$, then a contradiction arises.

If P.1 does not hold for $a^{\star }$, it implies that there is no policy authorizing $t^{\star }$. Thus, similarly to the proof of Theorem 1, the if condition in Line 7 is satisfied. However, since P.2 does not apply, it means that: (i) there exists no data dependency that implies attribute $a^{\star }$; (ii) there exists no data dependency that implies attribute $a^{\star }$ such that the dependency determinant is explicitly authorized for u.

Let us consider the first case (i). Since no data dependency is available, the if condition in Line 11 is not satisfied, thus Algorithm jumps to Line 28, stops, and returns an unauthorized message. As such, a contradiction arises, since the assumption that $t^{\star }\in Rs(q^{rw})$ implies that a rewritten query is returned.

In the second case (ii), we have that there exists at least one data dependency $dd^{\star }$ with $a^{\star }$ $\in$ $dd^{\star }.Dep$, but there is no access control policy authorizing u to access $dd^{\star }.Det$. In this case, the if condition in Line 11 is satisfied (i.e., dependenciesForAttribute $\ne$ $\emptyset$), but the PoliciesForDeterminant set is empty. This brings the algorithm to remove $dd^{\star }$ from dependenciesForAttribute, thus making the if condition in Line 16 false. As such, algorithm jumps to line 26, stops, and returns an unauthorized message. Thus, a contradiction arises, since the assumption that $t^{\star }\in Rs(q^{rw})$ implies that a rewritten query is returned. $\square$