Databases Reference
In-Depth Information
B. Thuraisingham
Therefore
e cannot be a semi-cylinder function for
PP
[Public]. If x
=y,
then x and y satisfy the condition R2 of step 2 of the program. Then for some
stage m
H(e), e will be attacked and Pe will be deleted via step 3a of the
program. This is a contradiction as Pe is fixed and assigned at stage H(e).
≥
Hence the condition x = y holds. Therefore
e cannot be a semi-cylinder
function for
PP
[Public]. This proves lemma 3 and hence Theorem 2(iii).
2.4 A Note on Multilevel Privacy Functions
In the previous section we assumed that all privacy functions as well as the
privacy constraints were at system-low. That is, the functions and constraints
were visible at the Public level. Note that if all inference rules are at system-
low then all users could use the same strategies to make inferences and deduce
information say at the private level. In reality it may be possible for certain
users to use some additional inference strategies in order to make inferences.
We assume that those who can view private information may possess some
additional strategies. In order to model these additional strategies, we need
to introduce the notion of a multilevel privacy function.
A multilevel privacy function is a privacy function, which has different
views at different privacy levels. That is, the result of a multilevel privacy
function applied to some data will give different values at different levels.
Figure 5 illustrates a multilevel privacy function, Inference that can be made
at the Public level is shown by unbold lines. At the private level it is possible to
make all the inferences that can be made at the public level. Some additional
inferences can be made at the private level. These inferences are shown by the
bold line.
(u,v+2)
(0,u+v+2)
(u,v+1)
(0,u+v+1)
(u,v)
(0,u+v)
(0,u+1)
(0,2)
(u,2)
(0,1)
(u,1)
Highly-Private point
(u,0)
(0,0)
Fig. 5.
Multilevel privacy function
