安全数据库隐私保护和访问控制集成研究

Integrating secure database access control and privacy protection

数据库数据的合法使用和隐私保护是现代安全数据库系统面临的新挑战。针对目前单方面考虑隐私保护或访问控制技术难以同时满足数据库信息安全和处理性能需求的不足,提出一种集成访问控制和隐私保护技术的安全数据库模型,通过建立查询审计隐私保护模型中的查询可疑性与授权视图访问控制模型中查询有效性之间的关系,形成统一的查询判断方法,并给出多项式时间复杂度的审计算法和集成的安全检查框架,以同时实现数据库系统隐私保护和访问控制的安全功能。

The development of modern information technology and digitalization of the daily lives brings security database new challenges. It is necessary for a security database to provide access control and privacy protection mechanism to ensure the legal use of data and to prevent privacy breach. This paper introduced an integrated security model which could provide the functions of privacy protection and access control simultaneously by building the connection between the validity of query in parameterized authorization view model and the suspiciousness of a conjunctive select-project-join query in online query audit model, it also designed a polynomial time detecting algorithm and two incorporating frameworks for the integrated model to provide higher performance and fine-grained access control in modern database systems.