Privacy-aware Management of Relational Data

该提案研究了使用星型模式对关系数据进行具有隐私意识的高效管理。特别是，我们考虑包含个人数据的非正规化、非聚合数据库。此外，我们假设一个数据库模型，其中许多维度表通过代理键与一个大型事实表相链接。通常，这样的数据库非常频繁地处理读取操作，必须时不时地执行插入和删除操作，但不频繁地处理对现有元组的更新操作。我们关注这一场景有三个原因：首先，星型模式是一种经典的数据库模型，许多最近的应用程序使用该模型存储个人数据，例如用于数据仓库和挖掘，用于管理ERP系统中客户的交易历史，或者使用社交软件方法(如大众分类)来注释数字对象。其次，现在特别重要的是为具有星型模式的关系数据库开发隐私方法，因为有一种强烈的趋势是通过使用云计算或数据库即服务等技术将此类数据库转移到第三方的监管之下。第三，不清楚如何保护这些数据库所涉个人的隐私。存在用于统计数据库、地理空间轨迹、集值数据库或图形数据库的隐私方法，例如，诸如差分隐私之类的匿名化方法或诸如希波克拉底数据库之类的体系结构。然而，对于具有星型模式的关系数据库，这种方法并不容易部署。我们的目标是为具有星型模式(RDSS)的关系数据开发一个隐私感知的数据库管理系统，该系统能够有效地处理查询、插入和删除操作。因此，每个用户都应该能够知道并确定谁能够访问与该用户相关的哪些个人价值。为此，我们希望为RDSS创建隐私方法，以(1)隐藏数据与相关个人的关系，或(2)限制对敏感数据的访问。在此背景下，我们希望设计系统架构、算法、数据库模型和攻击者模型。因此，我们努力寻求一种全面的方法，考虑到在RDSS中存储、传输和处理个人数据的许多方面可能会产生隐私挑战。

This proposal investigates privacy-aware, efficient management of relational data with a star schema. In particular, we consider denormalized, non-aggregated databases containing personal data. Further, we assume a database model where many dimension tables are linked with a large fact table via surrogate keys. Typically, such databases process read operations very frequently, insert- and delete operations must be executed from time to time, but update operations on existing tuples are infrequently processed. We focus on this scenario for three reasons: Firstly, the star schema is a classical database model that is used by numerous recent applications storing personal data, e.g., for data warehousing and mining, to manage transaction histories of customers in an ERP system, or to annotate digital objects with social software approaches like Folksonomies. Secondly, it is particularly important to develop privacy approaches for relational databases with a star schema now, because there is a strong tendency to move such databases into the custody of third parties by using techniques like cloud computing or database-as-a-service. Thirdly, it is unclear how to protect the privacy of the individuals concerned by such databases. There exist privacy approaches for statistical databases, geospatial trajectories, set-valued databases or graph databases, e.g., anonymization approaches like Differential Privacy or architectures like Hippocratic Databases. Nevertheless, such approaches cannot be deployed readily for relational databases with a star schema. Our objective is to develop a privacy-aware database management system for relational data with a star schema (RDSS) that handles queries, insert- and delete operations efficiently. Thus, every user should be able to know and to determine who is able to access which personal values relating to the user. For this purpose, we want to create privacy methods for RDSS that (1) conceal the relation of the data to the individual concerned, or (2) restrict the access to sensitive data. In this context, we want to design system architectures, algorithms, database models and attacker models. Thus, we strive for a holistic approach that takes into account that privacy challenges might arise from many aspects of storing, transferring and processing personal data in RDSS.