Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here.

One approach to ensure privacy is the small result rejection, in which the system rejects (returns no result from) any query, the result of which is derived from a small number, for example, five, of records. Show how to obtain sensitive data by using only queries derived from six records.

1 Excerpt copied from Security in computing By Charles P. Pfleeger, Shari Lawrence Pfleeger

If someone can help me with the answer, I would appreciate it.

share|improve this question
add comment

2 Answers

I think what the book is saying is that if you can come up with such a specific query that there are only a few results, you can identify one particular target in the database.

For example, if a car dealer had a database of customers, and they "anonymized" the database to include only zip code, make, model, year, color, and salary, you could find your neighbor's salary if you know they bought a car from that dealer.

For example, you could run a query that selects the salary of all people who own a Green 2012 Chevy Volt in your zip code. If you got only a handful of records showing salaries of 20K 30K 40K and 300K and you know your neighbor is a successful attorney, you can guess that he has the 300K salary.

But if the system refused to show less than 100 results, it's harder to find the target such a result set.

share|improve this answer
    
OK, so this is the why part, and I've shown ways to cover the how part. I'm gonna +1 this as it's an appropriate example use-case. It also makes a strong case for why this question should be on IT security, rather than on, say, StackOverflow. Thanks for posting! –  TildalWave Apr 12 '13 at 5:21
add comment

Selecting it through a SQL query only, you could check suggestion to this question. Both answers there are more or less equal (JOIN, when it's type is not specified, defaults to INNER JOIN in most RDBMS anyway).

This is however highly inefficient way of producing results with a minimum number of records. A lot easier, but also faster, would be to check for the required number of records before displaying results in your front-end generating code, and then deciding whether to list matched records, or display a non-disclosing error message.

This is easier because you don't have to change your existing SQL queries to accommodate for this new requirement, faster because there's no internal linking to aggregate result sets, and also more convenient since you'd be required to handle both cases in your front-end generating code anyway.

Basically, all you'd have to do is to display same (or similar) message when query returns less than n records, as before with empty result sets.

Language-agnostic example:

query.run;
if (query.recordcount >= 6) {
  display_results(query);
} else {
  error(minimum_not_reached);
}

that replaces:

query.run;
if (query.recordcount > 0) {
  display_results(query);
} else {
  error(no_results);
}

Returned error message of course shouldn't disclose the minimum required records, and is probably best to keep minimum_not_reached equal to no_results. Which just so happens is also a lot more convenient, if you're modifying an existing code, as it barely requires any change (query.recordcount > 0 to query.recordcount > 5).

Depending on RDBMS in use, this could be also achieved with stored procedures ;)

share|improve this answer
1  
I don't think you answered the question he asked, he asked "Show how to obtain sensitive data by using only queries derived from six records", not how to prevent showing sensitive data for small result sets. –  Johnny Apr 12 '13 at 5:04
    
@Johnny - That's covered in the link I provided. The other way of obtaining this data would be by using DataBase stored procedures (mentioned at the end) that would look pretty much the same as the code in between. The exercise from the book however is rather ambiguous, so I thought it's best to cover all angles. Use as it applies ;) –  TildalWave Apr 12 '13 at 5:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.