Database inference attack control device and method thereof

Abstract

The present invention relates to a database (DB) inference attack control device and method. [Solution] The present invention provides a database inference attack control device and method that receives result data output from multiple database management systems (DBMS) that manage one or more databases, detects inference attacks that are difficult to detect using access control and query control methods based on pre-set inference knowledge, analyzes the inference attacks at multiple levels of risk, and restricts one or more data attributes corresponding to inference attack elements related to the inference attack before providing them to the queryer, thereby preventing sensitive information from being inferred and leaked.

Description

[Technical Field]

[0001] The present invention relates to a database (DB) inference attack control device and method thereof, and more particularly, to a database inference attack control device and method thereof that can infer personal information by inputting result data output from a plurality of database management systems (DBMS) that manage one or more DBs, detects inference attacks that are difficult to detect using access control and query control methods based on pre-set inference knowledge, analyzes the inference attacks at multiple risk levels, and restricts one or more data attributes corresponding to inference attack elements related to the inference attack before providing them to an inquirer, thereby preventing sensitive personal information from being inferred and leaked. [Background technology]

[0002] In recent years, information and communication technology has rapidly developed, and web-based services have become widely used. To provide all of these services, each service provider (SP) must manage a large amount of customer information in a database. Based on this information, they distribute various knowledge-based content in areas such as finance, shopping, education, and medicine.

[0003] As customer information is increasingly stored in online databases, the number of hackers attempting to steal customer information stored in these databases is increasing, and there have been frequent cases of large amounts of customer information being extracted from the databases of large service providers.

[0004] In order to prevent information from leaking from a database, a service provider typically applies an access control technology to a service providing system that allows or blocks access to the database information based on access control rules.

[0005] Furthermore, a query control method for controlling queries (questions) is also commonly used to protect DB information. That is, the query control method is a method for protecting key information in a database by setting and controlling permissions for queries according to various conditions, such as by DB user or group, and prohibiting the execution of queries that are deemed important from a security standpoint.

[0006] However, existing access control and query control technologies have a problem in that they are fundamentally unable to detect inference attacks, which are attacks that use publicly available or obtainable data to infer sensitive personal information or other information that should be kept private and protected (hereinafter referred to as "sensitive information").

[0007] To prevent such inference attacks, various techniques are being used, such as not disclosing information that could be used in an inference attack, applying de-identification techniques, or encrypting information stored in a database.

[0008] However, if all information in the database that could be used in an inference attack is kept secret, or if de-identification technology is applied, or if the information is encrypted, there is a problem in that the information cannot be used.

[0009] Furthermore, such techniques have limitations in fundamentally preventing inference attacks, and fundamentally defending against inference attacks based on inferable knowledge data. Here, inferable knowledge data refers to data that is determined to be obtainable from other information sources, through social engineering, or other methods.

[0010] Furthermore, there are problems in that it is not possible to analyze the multi-level risk of inference attacks, so it is not possible to prevent information leakage due to race-condition inference attacks, and it is not possible to prevent information leakage due to inference attacks on multiple DBs. Summary of the Invention [Problem to be solved by the invention]

[0011] Therefore, an object of the present invention is to provide a database inference attack control device and method that receives result data output from a database management system (DBMS) that manages a diverse number of DBs, detects inference attacks that cannot be detected by access control methods based on inference knowledge, analyzes the inference attacks at multiple risk levels, and restricts one or more data attributes related to the inference attack before providing them to the interrogator, thereby preventing sensitive information from being inferred. [Means for solving the problem]

[0012] To achieve the above-mentioned objectives, the database inference attack control device according to the present invention includes an input / output unit that receives and outputs queries from a plurality of interrogator terminal units, and receives result data that is a response to the input queries and provides it to the interrogator terminal unit; one or more DBMSs that have at least one or more databases (DBs) containing a plurality of data attributes, at least one of which contains sensitive data attributes set to sensitive information to be protected, and that search the DBs for queries input from the input / output unit, generate and output result data that is the search result; and an inference control unit that sets inference knowledge that includes inference attack elements corresponding to data attributes that can infer the sensitive information and inference logic composed of logical operations, refers to the inference logic, detects inference attacks that can infer the sensitive information from the result data input from the DBMS, and restricts data attribute information corresponding to at least one or more inference attack elements that can infer the sensitive information from among the inference attack elements included in the result data in which an inference attack is detected, and transmits the restricted data to the interrogator terminal unit via the input / output unit.

[0013] The inference control unit includes an inference knowledge storage unit that stores inference knowledge including inference attack elements corresponding to inference logic and data attributes provided to the questioner terminal unit; an inference setting unit that receives one or more data attributes from the security administrator via the security administrator terminal unit, which can infer the sensitive information configured in the DB, generates inference logic including the one or more data attributes, stores the inference logic as inference knowledge, sets the data attributes included in the inference logic as inference attack elements, and outputs inference attack element information including the set inference attack elements; and an inference setting unit that receives inference attack element information from the inference setting unit, extracts inference attack elements corresponding to the inference attack element information from result data input from the DBMS, and generates and outputs inference attack transactions consisting of the extracted inference attack elements. The system is characterized by including an attack element extraction unit, an inference attack detection unit that receives the inference attack transaction, detects an inference attack by checking whether the inference attack elements included in the inference attack transaction and the inference attack elements already provided to the interrogator terminal unit and stored in the inference knowledge storage unit satisfy any one of the inference logics of the inference knowledge storage unit, and outputs restriction processing request information for any one of the inference attack elements of the inference attack transaction when an inference attack is detected, and an inference attack control unit that, when restriction processing request information is input from the inference attack detection unit, restricts data attributes corresponding to the inference attack elements of the input restriction processing request information from among data attributes included in result data corresponding to the inference attack transaction in which an inference attack was detected, and provides the data attributes to the interrogator terminal unit via the input / output unit.

[0014] The inference control unit further includes an inference attack ordering configuration unit that serially orders and outputs a plurality of inference attack transactions input from the inference attack element extraction unit, and the inference attack detection unit detects an inference attack using the serially ordered inference attack transactions.

[0015] The inference setting unit is characterized by including: an inference logic generation unit that receives one or more data attributes that can infer the sensitive information configured in the DB from the security administrator via the security administrator terminal, generates inference logic including the one or more data attributes, and stores it as inference knowledge in the inference knowledge storage unit; and an inference attack element generation unit that sets the data attributes included in the inference logic as inference attack elements and outputs them.

[0016] The inference logic generation unit includes an inference attack logic generation unit that receives input of one or more data attributes that can be directly related to the sensitive information configured in the DB from the security administrator via the security administrator terminal and can infer the sensitive information, generates inference attack logic including the one or more data attributes as one of the inference logics, and stores the inference attack logic in the inference knowledge storage unit; and an inferenceable logic generation unit that receives input of one or more data attributes that can increase the accuracy of inference attacks on the sensitive information, generates inferenceable logic including the one or more data attributes, combines the inferenceable logic with the inference attack logic to generate extended inference attack logic, and stores the extended inference knowledge in the inference knowledge storage unit.

[0017] The inference setting unit further includes a multi-stage risk setting unit that, when a multi-stage risk setting request is made by the security administrator via the security administrator terminal unit, selects one or more of the inference attack elements so as not to overlap to generate an inference attack subset, and provides it to the security administrator, and receives a risk level for each inference attack subset from the security administrator, sets a risk level for each inference attack subset, and stores it in the inference knowledge storage unit as inference knowledge.

[0018] The inference setting unit is characterized in that, when a threshold setting request is received from the security administrator terminal unit, an inference attack element threshold, which is the number of inference attack elements that are to be restricted among the inference attack elements that constitute the inference attack subset, is input, and the inference attack element threshold is stored and set in the knowledge storage unit.

[0019] The threshold setting unit is characterized in that, when a threshold setting request is made from the security manager terminal unit, a danger level threshold, which is a danger level for restricting the inference attack subset, is further input and set.

[0020] The threshold setting unit is characterized in that, when the threshold setting request is generated, it further sets an inferable logic threshold, which is the number of inferential attack elements to be limited among the inferential attack elements included in the inferable logic.

[0021] The inference attack detection unit is characterized in that, when determining the inference attack elements to be restricted, the inference attack detection unit refers to the inference knowledge to determine the inference attack elements to be restricted so as not to be provided to the questioner terminal unit.

[0022] The inference attack control unit is characterized in that it performs a masking process, an anonymization process, or a removal process to remove data attribute information from the result data that corresponds to the inference attack element to be restricted, thereby restricting the data attribute information.

[0023] To achieve the above-mentioned object, the database inference attack control method according to the present invention includes a DB search process in which one or more DBMSs that store information including multiple data attributes and manage one or more DBs, at least one of which contains sensitive information to be protected, perform a search for queries input from the DBs, generate and output result data, and an inference control process in which an inference control unit sets inference knowledge including inference attack elements corresponding to data attributes that can infer the sensitive information and inference logic composed of logical operations, refers to the inference logic, detects inference attacks that can infer the sensitive information from result data input from the DBMS, and restricts data attributes corresponding to at least one inference attack element among the inference attack elements included in the result data in which the inference attack is detected, and transmits the result data to the interrogator terminal unit via an input / output unit.

[0024] The inference control process includes an inference setting step in which the inference control unit receives one or more data attributes from the security administrator via the inference setting unit, which can infer the sensitive information configured in the DB, generates an inference logic including the one or more data attributes, stores the generated inference logic in an inference knowledge storage unit as inference knowledge, sets the data attributes included in the inference logic as inference attack elements, and outputs inference attack element information including the set inference attack elements; an inference attack element extraction step in which the inference control unit receives inference attack element information from the inference setting unit and sets it, extracts inference attack elements corresponding to the inference attack element information from result data input from the DBMS, and generates and outputs inference attack transactions consisting of the extracted inference attack elements; and an inference attack detection step in which the inference control unit receives an inference attack transaction via the inference attack detection unit and extracts the inference attack transaction from the inference attack element information. an inference attack detection step of detecting an inference attack by checking whether an inference attack element included in a transaction and an inference attack element stored in an inference knowledge storage unit as having already been provided to the interrogator terminal unit satisfy any one of the inference attack logic, inferable logic, and inference attack subset of the inference knowledge storage unit, and outputting restriction processing request information for any one of the inference attack elements of the inference attack transaction when an inference attack is detected; and an inference attack control step of restricting data attributes corresponding to the inference attack elements of the input restriction processing request information among data attributes included in result data corresponding to the inference attack transaction in which an inference attack has been detected, and providing the data to the interrogator terminal unit via the input / output unit when the inference control unit receives restriction processing request information from the inference attack detection unit.

[0025] The inference control process further includes an inference attack ordering configuration step in which the inference control unit serially orders and outputs a plurality of inference attack transactions input from the inference attack element extraction unit via the inference attack ordering configuration unit, and in the inference attack control step, when restriction processing request information is input from the inference attack detection unit, the inference attack control unit restricts data attributes of the result data corresponding to the inference attack elements of the input restriction processing request information from among the data attributes of the result data corresponding to the inference attack transaction in which the inference attack was detected, and provides the data attributes to the questioner terminal unit via the input / output unit.

[0026] The inference setting step is characterized by including an inference logic generation step in which the inference setting unit receives one or more data attributes that can infer the sensitive information configured in the DB from the security administrator via an inference logic generation unit, generates inference logic including the one or more data attributes, and stores the inference logic in the inference knowledge storage unit as inference knowledge, and an inference attack element generation step in which the inference setting unit sets the data attributes included in the inference logic as inference attack elements via an inference attack element generation unit and outputs the inference attack elements.

[0027] The inference logic generating step includes a step of generating an inference attack logic in which the inference logic generating unit receives one or more data attributes that are directly related to the sensitive information configured in the DB from the security administrator via an inference attack logic generating unit and can infer the sensitive information, and generates an inference attack logic including the one or more data attributes as one of the inference logics and stores it in the inference knowledge storage unit; and a step of generating an inference attack logic in which the inference logic generating unit receives one or more data attributes that can increase the accuracy of an inference attack on the sensitive information via an inferable logic generating unit, generates an inferable logic including the one or more data attributes, combines the inferable logic and the inference attack logic to generate an extended inference attack logic, and stores it in the inference knowledge storage unit as inference knowledge.

[0028] The inference setting step further includes a multi-stage risk setting step in which, when a multi-stage risk setting request is received from the security administrator via the security administrator terminal unit through the multi-stage risk setting unit, the inference setting unit generates an inference attack subset by selecting one or more of the inference attack elements so as not to overlap and provides the generated inference attack subset to the security administrator, and the security administrator inputs a risk level for each inference attack subset, sets a risk for each inference attack subset, and stores the risk level in the inference knowledge storage unit as inference knowledge.

[0029] The inference setting step is characterized in that it further includes a threshold setting step in which, when a threshold setting request is received from the security administrator terminal unit via the threshold setting unit, the inference setting unit inputs and sets an inference attack element threshold, which is the number of inference attack elements to be restricted among the inference attack elements that constitute the inference attack subset.

[0030] In the threshold setting step, when a threshold setting request is received from the security administrator terminal unit via the threshold setting unit, the inference setting unit further inputs and sets a danger level threshold, which is a danger level at which restriction processing is performed on the inference attack subset.

[0031] In the threshold setting step, the inference setting unit further sets an inferenceable logic threshold, which is the number of inference attack elements to be restricted among the inference attack elements of the inferenceable logic, when the threshold setting request occurs via the threshold setting unit.

[0032] In the inference attack detection step, when determining the inference attack elements to be restricted, the inference attack control unit refers to the inference knowledge to determine the inference attack elements to be restricted so that they are not provided to the questioner terminal unit.

[0033] In the inference attack control step, the inference attack control unit performs a masking process, an anonymization process, or a removal process to remove the data attribute information from the result data, for the data attributes corresponding to the inference attack elements to be restricted, thereby restricting the data attribute information. [Effects of the Invention]

[0034] The present invention sets inference attack elements and inference logic that can constitute an inference attack, detects whether an inference attack will occur from the result data that is the search result for a query in a DB, and restricts data attributes that correspond to the inference attack elements that can constitute an inference attack in the result data, thereby having the effect of fundamentally blocking information leakage due to inference attacks.

[0035] Furthermore, the present invention prevents inference attacks by setting attributes of inferable knowledge data that are determined to be obtainable from other information sources, through social engineering, or other methods as inference attack elements, and detecting result data that can be included in inference logic to form an inference attack, thereby having the effect of preventing the inference of sensitive information using inferable knowledge data.

[0036] Furthermore, the present invention detects inference attack elements by serializing simultaneous or parallel inference attacks, and therefore has the effect of detecting race condition inference attacks and blocking information leakage.

[0037] Furthermore, the present invention detects inference attacks on result data for queries output from multiple DBMSs, thereby providing an effect of detecting and defending against inference attacks on multiple DBs. [Brief explanation of the drawings]

[0038] [Figure 1] 1 is a diagram showing the configuration of a DB inference attack control device according to the present invention. [Figure 2] 2 is a diagram showing the configuration of an inference control unit in a DB inference attack control device according to the present invention. FIG. [Figure 3] FIG. 2 is a diagram showing the configuration of an inference setting unit in the inference control unit according to the present invention. [Figure 4] FIG. 2 is a diagram illustrating an example of a DB configuration according to an embodiment of the present invention. [Figure 5] 1 is a diagram illustrating a method for configuring inference logic according to an embodiment of the present invention. [Figure 6]FIG. 2 illustrates an inference attack element according to one embodiment of the present invention. [Figure 7] 10 illustrates a multi-level risk table for each inference attack subset according to an embodiment of the present invention. [Figure 8] 10 is a diagram illustrating a method for constructing a serial ordering for an inference attack by concurrent processing of two pieces of result data according to an embodiment of the present invention. FIG. [Figure 9] FIG. 10 is a diagram illustrating a method for constructing a serial ordering for an inference attack by parallel processing of two pieces of result data according to an embodiment of the present invention. [Figure 10] 1 is a flowchart illustrating a DB inference attack control method according to the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0039] Hereinafter, the configuration and operation of a DB inference attack control device according to the present invention will be described in detail with reference to the accompanying drawings, and a DB inference attack control method in the device will be described.

[0040] The present invention is not limited thereto.

[0041] FIG. 1 is a diagram showing the configuration of a DB inference attack control device according to the present invention.

[0042] Referring to FIG. 1, the DB inference attack control device of the present invention includes an input / output unit 10, an inference control unit 20, and at least one DBMS 30.

[0043] The input / output unit 10 is connected directly to the questioner terminal units of a plurality of questioners or is connected via a data communication network 1 .

[0044] The questioner terminal unit can transmit questions to the inference control unit 20 using various DB client programs such as access via the web using HTTP / HTTPS to the input / output unit 10, a DBMS client program, and a proprietary client program.

[0045] The input / output unit 10 receives a question from the questioner terminal unit and provides it to the inference control unit 20, and receives data as a result of responding to the question from the inference control unit 20 and provides it to the questioner terminal unit.

[0046] The questioner is, for example, an administrator or any user, and therefore the questioner terminal unit is, for example, an administrator terminal unit or a user terminal unit.

[0047] The questioner terminal unit is, for example, a computer terminal such as a desktop computer, a personal computer, or a notebook computer, or a mobile terminal such as a smartphone or a smart pad.

[0048] The data communication network 1 is a data communication network including, for example, a mobile communication network including 3rd Generation (3G), 4G, 5G, etc., a wired and wireless Internet network including a local area network (LAN), a wide area network (WAN), and a WiFi network, an intranet network, an extranet network, etc.

[0049] The questioner terminal unit, input / output unit 10, inference control unit 20, DBMS 30, and DB 40 can be directly connected via wired or wireless communication depending on various configuration environments, or can be connected via the data communication network 1 using wired or wireless communication.

[0050] The DBMS 30 includes at least one DB 40, searches the DB 40 for an input query, generates result data for the query, and then transmits the result data to the inference control unit 20. The DBMS 30 may be configured to exist in the same server as the inference control unit 20, or in the same physical space via the above-mentioned data communication network 1, or may be configured as physically separate systems such as a data center or a cloud environment, or may be configured in a combination of these. The data configured in the DB 40 may be configured in the form of a single table, or multiple tables, or the multiple tables may be configured in different DBs 40.

[0051] The result data (r (u、p、q) ) is defined as in the following Equation 1.

[0052]

number

[0053] where r (u、p、q) is the DBMS for the questioner (u)'s question. p means the qth result data of data d x It is shown that the set of x is the DBMS for the queryer (u) p The qth result data r (u、p、q) , which means data ordered by query order, location order, time order, etc. For example, y <zであれば、データd y is the data z D takes precedence over the others in terms of query order, location order, or time order. u means the result dataset for the questioner (u), and r (u、p、q) Dset means the result dataset for all questioners, and D u It consists of a set of

[0054] The inference control unit 20 provides the input query to the corresponding DBMS 30, and receives result data (r( u、p、q) ) is entered.

[0055] The inference control unit 20 extracts inference attack elements, which are elements that can constitute an inference attack, from the data attributes included in the input result data, determines whether the extracted inference attack elements constitute a preset inference attack logic, and if it is determined that they constitute a preset inference attack logic, restricts the data attribute information corresponding to the inference attack elements in the result data so that the preset sensitive information cannot be inferred, and then provides the result data to the questioner terminal unit of the questioner via the input / output unit 10. The restriction process is, for example, a masking process or anonymization process so that the data attribute information corresponding to the inference attack elements cannot be identified, or a removal process that removes the data attribute information from the result data.

[0056] FIG. 2 is a diagram showing the configuration of an inference control unit in a DB inference attack control device according to the present invention. FIG. 3 is a diagram showing the configuration of an inference setting unit in the inference control unit according to the present invention. FIG. 4 is a diagram showing an example of a DB configuration according to one embodiment of the present invention. FIG. 5 is a diagram explaining a method of configuring inference logic according to one embodiment of the present invention. FIG. 6 is a diagram showing inference attack elements according to one embodiment of the present invention. FIG. 7 is a diagram showing a multi-level risk table for each inference attack subset according to one embodiment of the present invention. FIG. 8 is a diagram explaining a method of configuring a serial ordering of an inference attack by concurrent processing of two result data according to one embodiment of the present invention. FIG. 9 is a diagram explaining a method of configuring a serial ordering of an inference attack by parallel processing of two result data according to one embodiment of the present invention. The following description will be made with reference to FIGS. 2 to 9, taking the DB 40 configured as shown in FIG. 4 as an example.

[0057] First, the configuration of a table configured in the DB 40 according to an embodiment of the present invention will be described.

[0058] The data in DB40 can be organized as one table 401 containing multiple records each having a data attribute. Figure 4 shows a table containing 12 records each having seven data attributes. The data in DB40 has seven attributes, but can also be divided into multiple tables.

[0059] In the case of Figure 4, table 401 consists of 12 records with seven data attributes defined for each data attribute (patient name, age, address, zip code, treatment, surgery, and cancer).

[0060] In the example of Figure 4, cancer data attribute information is set as sensitive information to be protected. It is assumed that a query that directly accesses the cancer data attribute or a query result that includes the content of the cancer data attribute is blocked and cannot be obtained by normal protection methods such as query word restriction, access control, etc. Therefore, a queryer cannot directly obtain information about the data attribute cancer from the DB 40.

[0061] The inference control unit 20 includes an inference setting unit 110, multiple inference attack element extraction units 120 to which result data is input from each of multiple DBMSs 30, an inference attack sequencing configuration unit 130, an inference attack detection unit 140, an inference knowledge storage unit 150, an inference attack control unit 160, and an inference attack log storage unit 170.

[0062] The inference setting unit 110 includes an inference logic setting interface unit 210 , an inference logic generation unit 220 , an inference attack element generation unit 230 , a multi-stage danger setting unit 240 , and a threshold setting unit 250 .

[0063] The inference logic setting interface unit 210 is connected to the security administrator terminal unit directly or via the input / output unit 10 .

[0064] The inference logic setting interface unit 210 provides an inference logic setting means to the connected security administrator terminal unit, and enables the data attributes of the table configured in the DB 40 via the DBMS 30 and the data attributes corresponding to sensitive information to be checked using the inference logic setting means. It also provides a setting means for each inference logic setting element for each inference logic setting element, enabling settings to be made for the corresponding inference logic setting element.

[0065] The inference logic setting elements include, for example, inference attack logic, inference-enabled logic, multi-level risk levels, and thresholds.

[0066] The inference logic generation unit 220 includes an inference attack logic generation unit 221 and an inferable logic generation unit 222, and generates inference logic, and then stores the logic in the inference knowledge storage unit 150 via the inference attack detection unit 140 or directly in the inference knowledge storage unit 150.

[0067] The inference attack logic generation unit 221 generates inference attack logic by inputting logical operations and data attributes from which sensitive information can be directly inferred, among data attributes excluding data attributes corresponding to sensitive information configured in the DB 40, according to a setting means for the inference attack logic setting elements provided to the security administrator terminal unit via the inference logic setting interface unit 210. The logical operations may be input by the security administrator or may be preset. The logical operations include, for example, and, or, not, >, =, <, etc., and the set logical operation expression may be composed of a single logical operation (e.g., A and B) or may be applied in a composite manner (e.g., not(A and B)).

[0068] The inference attack logic can be defined as the following Equation 2, and a configuration example will be described with reference to 501 in FIG.

[0069]

number

[0070] where α x is the inference attack logic, and A is the inference attack logic (α x ) is a set of

[0071] Inference attack logic (α x ) consists of one or more data attributes.

[0072] 501 in Figure 5 is the inference attack logic (α x ) and indicates an inference attack logic consisting of the patient name (patient), treatment, and surgery, which are data attributes that can directly infer the name of the patient with cancer, assuming that the name of the patient with cancer is sensitive information. That is, in the case of 501 in Figure 5, the inference attack logic (α w , α x ) can be expressed as in the following Equation 3.

[0073]

number

[0074] where α w is the previous inference attack logic, and α x is α w is the following inference attack logic, where ∧ means the logical operator and.

[0075] To further explain, the inference attack logic α of the above formula 3 w means that this is an inference attack that can infer that a patient (Z) who has received immunotherapy (X) and undergone tumor removal surgery (Y) is a patient with cancer.

[0076] The inference attack logic generation unit 221 generates the inference attack logic α w is generated and stored in the inference knowledge storage unit 150 as one of the inference knowledge.

[0077] Here, it is assumed that a control is added so that information about the patient of the data attribute, which is identification information, cannot be obtained. Therefore, the inference attack logic α of Equation 3, which does not include the controlled data attribute of patient, x can be generated and stored as one of the inference knowledge in the inference knowledge storage unit 150. In this way, since the patient of the data attribute is controlled, the inference attack logic α w and α x Since the valid inference attack elements included in include the two identical data attributes of treatment and surgery, in the following explanation, we will use the inference attack logic α x The explanation will be based on the above.

[0078] Since the interrogator cannot directly obtain information about the patient and cancer data attributes in Figure 4, the inference attack logic α x This makes it impossible to accurately infer whether a particular patient has cancer. In other words, it is not possible to determine whether a particular person has cancer based solely on immunotherapy (X) and tumor removal (Y).

[0079] Taking Figure 4 as an example, records 1, 5, 8, 9, and 12 in table 401 correspond to cases where a patient received immunotherapy and then underwent tumor removal surgery. However, since information about the data attributes patient and cancer cannot be obtained, the fact that a patient has cancer can be inferred, but the identity of the patient who has cancer cannot be determined.

[0080] Therefore, in order to identify and accurately infer patients with cancer, the inference attack logic (α x Therefore, the inferable logic generator 222 receives one or more data attributes that are determined to be usable for increasing the accuracy of an inference attack on sensitive information in the DB 40 from the security administrator terminal via the inferential logic setting interface 210, and generates the inferable logic (c xThe inferable logic can be defined as in Equation 4 below, and a configuration example will be described with reference to 502 in FIG.

[0081]

number

[0082] where c x is an inferable logic that is determined to be usable to increase the accuracy of an inference attack on sensitive information, and C denotes a set of inferable logics.

[0083] 502 in Fig. 5 is the inferable logic (c x ) and shows the inferable logic consisting of age (age) and address (addr), which are data attributes that can be used to infer the name of the patient who has cancer, assuming that the name of the patient who has cancer is sensitive information. That is, in the case of 502 in Figure 5, x ) can be expressed as in the following Equation 5.

[0084]

number

[0085] Here, A means information about age, and B means information about address.

[0086] More specifically, as mentioned above, immunotherapy and tumor removal information alone does not tell us who is a cancer patient.

[0087] Furthermore, it is not possible to determine whether a patient has cancer based on age and address information alone.

[0088] Furthermore, age, address, and immunotherapy information alone do not determine whether a patient has cancer. For example, in Figure 4, James (No. 1) and Oliver (No. 10), both 26 years old and living in Seattle, both received immunotherapy, but Oliver is not a cancer patient.

[0089] Furthermore, age, address, and tumor removal information alone do not determine whether a patient has cancer. For example, in Figure 4, John (No. 5) and Rebecca (No. 7), both 35 years old and living in San Francisco, have both undergone tumor removal surgery, but Rebecca is not a cancer patient.

[0090] However, if all of the age, address, immunotherapy, and tumor removal information is obtained, it can be determined whether a particular person is a cancer patient. That is, the patient's name associated with the age and address information can be determined (for example, people who live in the patient's area will know the patient's name and age information, and the patient's name and age information can be indirectly determined through people who live in the patient's area, or through a combination of information obtained from other sources). Then, by associating the age and address information thus obtained with the immunotherapy and tumor removal information, it can be inferred that the patient with the patient's name is a cancer patient.

[0091] Therefore, when the inferable logic is generated, the inferable logic generating unit 222 generates the inferable logic (c x ) into the inference attack logic α w and α x 503 in Figure 5 and the (extended) inference attack logic α w and α x is generated and stored in the inference knowledge storage unit 150.

[0092]

number

[0093] The inference attack element generation unit 230 receives the inference attack logic generated by the inference logic generation unit 220 and one or more of the inferable logic and the extended inference attack logic, and sets a data attribute composed of the inference attack logic, the inferable logic and the extended inference attack logic as the inference attack element, as shown in Figure 6.

[0094] The inference attack element generation unit 230 provides inference attack element information (or "inference attack element set", (E)) which is information on the set inference attack elements to the inference attack element extraction unit 120. Depending on the embodiment, the inference attack element information (E) may be provided to the security administrator terminal unit via the inference logic setting interface unit 210, or may be provided to the multi-stage risk setting unit 240. The inference attack element information (E) can be expressed as in Equation 7 below.

[0095]

number

[0096] where e i is an inference attack element, and E denotes a set of inference attack elements.

[0097] For example, in Figure 6, e1=patient, e2=age, e3=addr, e i =treatment, e j =surgery.

[0098] When a multi-stage risk setting request is made by the security manager via the security manager terminal unit, the multi-stage risk setting unit 240 receives the inference attack elements from the inference attack element generation unit 230 and generates an inference attack subset (s x ) to generate the inference attack subset (s x ) is one or more inference attack elements (e i) and there is no order imposed on the inference attack elements included in the inference attack subset.

[0099] 7, the multi-level risk setting unit 240 provides a multi-level risk table including the inference attack subset to the security administrator terminal unit via the inference logic setting interface unit 210. At this time, the risk level field is, for example, a null value.

[0100] The multi-level risk setting unit 240 sets a risk level value for each inference attack subset of the multi-level risk table input by the security administrator through the security administrator terminal, and stores the multi-level risk table with the set risk level values ​​in the inference knowledge storage unit 150. The risk levels can be divided into low<medium<high<critical as shown in Figure 7. The multi-level risk table of Figure 7 can be expressed as follows:

[0101]

number

[0102] where s x is the inference attack subset, v x is the risk level, and V means a multi-level risk table.

[0103] Taking Figures 6 and 7 as an example, when a multi-stage risk level is set to (s3, v3) = ({e2, e3}, medium), since (s3, v3) = ({age(A)), add(B)}, medium), if an inference attack subset is detected that includes an inference attack element that can obtain information about the patient's age (A) and address (B), the risk level is medium.

[0104] Another example is (s5, v5) = ({e1, e j}, high), (s5, v5) is ({patient(Z), surgery(Y)}, high), so if an inference attack subset containing an inference attack element that can obtain the patient's name (Z) and information about tumor removal (i.e., Y=tumor removal) is detected, the risk level is high.

[0105] Another example is (s6, v6) = ({e i , e j}, critical), (s6, v6) is ({treatment(X), surgery(Y)}, critical), so if an inference attack subset is detected that includes an inference attack element that can obtain information about the patient's immunotherapy and tumor removal (i.e., X=immunotherapy, Y=tumor removal), the risk level is very high (critical).

[0106] The threshold setting unit 250 receives thresholds for inference attack elements to be restricted from among the inference attack elements extracted from the result data input from the DBMS 30 from the security administrator, and stores and sets them in the inference knowledge storage unit 150. The thresholds are divided into three types: inference attack element threshold (ρ), danger level threshold (σ), and inferable logic threshold (τ), and one or more thresholds can be applied.

[0107] The inference attack element threshold (ρ) is the threshold value of the extracted inference attack elements, i.e., the inference attack subset (s x ) is the number of inference attack elements that are limited by the following Equation 9.

[0108]

number

[0109] len() is the inference attack subset (s x) is a function that returns the number of elements in the inference attack subset (s x ) or is set to a small positive integer value.

[0110] That is, the inference attack component threshold (ρ) is the inference attack subset (s x ) occurs, the inference attack subset (s x This is used to prevent inference attacks from succeeding by restricting the disclosure of information about the number of inference attack elements that make up the inference attack elements corresponding to the threshold.

[0111] For example, suppose the inference attack component threshold (ρ) is set to 1, and the inference attack subset is s x ={e i , e j}={treatment(X), surgery(Y)}, then len(s x ) = 2, the two elements that make up the inference attack subset, the inference attack elements, e i , e j The information corresponding to one of the above is restricted from being disclosed, thereby preventing inference attacks from succeeding.

[0112] The inference attack elements corresponding to the inference attack element threshold (ρ) are restricted by selecting them from the earliest order based on the input time, or from the latest order, or by random selection.

[0113] The danger level threshold (σ) is defined as in the following Equation 10.

[0114]

number

[0115] where v x indicates the danger level.

[0116] Therefore, the danger level threshold (σ) can be set to any one of the danger levels (low, medium, high, or critical), and the level value can be set using any one of numbers, letters, or symbols that indicate the magnitude and severity of the level.

[0117] For example, when the danger level threshold (σ) is set to high, the inference attack subset {e1, e2, e3} having a danger level equal to or higher than the danger level threshold (σ)=high (i.e., high, critical) is selected. i}, {e1, e j}, {e i , e j When a} is detected, all inference attack elements of the inference attack subset are restricted from being disclosed. In this way, when all inference attack elements included in the inference attack subset are restricted from being disclosed, the usability of the data is reduced.

[0118] In another embodiment, when a risk level threshold and an inference attack element threshold are applied in combination, if an inference attack subset with a risk level corresponding to or higher than the set risk level threshold is detected, a number of inference attack elements included in the inference attack subset that corresponds to the inference attack element threshold ρ are restricted from being disclosed. Therefore, rather than restricting all inference attack elements from being disclosed, a number of inference attack elements that corresponds to the inference attack element threshold (ρ) are restricted from being disclosed. Therefore, rather than restricting all inference attack elements from being disclosed, by restricting only the number of inference attack elements that corresponds to the inference attack element threshold (ρ), the purpose of inference control can be achieved and the effect of improving data usability can be achieved.

[0119] The inferable logic threshold (τ) is defined as in the following Equation 11.

[0120]

number

[0121] where c x means inferable logic, and len() means a function that returns the number of elements of the inferable logic.

[0122] As shown in Equation 11, the inferable logic threshold (τ) is calculated by dividing the inferable logic subset (c x ) is set to an integer value greater than or equal to 0 and less than the number of elements in

[0123] The inferable logic threshold (τ) is used to restrict disclosure of information about inference attack elements corresponding to the inferable logic threshold (τ) among inference attack elements constituting the inferable logic when it is determined that an inference attack corresponding to the inferable logic has occurred. The inference attack elements corresponding to the inferable logic threshold (τ) are restricted by selecting them from the earliest order based on the input time, or from the latest order, or by randomly selecting them.

[0124] As described above, the inference attack element threshold (ρ), the danger level threshold (σ), and the inferenceable logic threshold (τ) may be set singly or in combination of two or more. Therefore, by appropriately setting the three thresholds in combination and applying the restriction process, it is possible to prevent sensitive information from being leaked by an inference attack while improving the usability of data.

[0125] The security administrator can connect to the inference logic setting interface unit 210 via the security administrator terminal unit, and can add, delete, and change the above-mentioned inference attack logic and inference-enabled logic, add, delete, and change the risk levels in the multi-stage risk table, and add, delete, and change the thresholds. Furthermore, the security administrator can change the values ​​of each threshold.

[0126] The inference attack element extraction unit 120 is set with inference attack element information input from the inference setting unit 110, and result data (r (u、p、q) ), which is search result data for an arbitrary questioner's question from the DBMS 30, is input. After extracting data attribute information corresponding to the inference attack elements of the inference attack element information from the input result data, an inference attack transaction (t (u、p、q) ) including the inference attack elements corresponding to the extracted data attributes is generated and output to the inference attack serialization configuration unit 130. The inference attack transaction is defined as in the following mathematical formula 12.

[0127]

Equation

[0128] Here, t (u、p、q) means the q-th inference attack transaction by an arbitrary questioner (u) on the DBMS p and is composed of a set of inference attack elements φ x . φ x is included in the inference attack element information (E) as an inference attack element included in the q-th inference attack transaction (t p ) by an arbitrary questioner (u) on the DBMS (u、p、q) . And the inference attack elements (φ x ) are inference attack elements ordered by query order, position order, or time order, etc. That is, if y < z for times y and z, the inference attack element φ y has priority over the inference attack element φ z . Tset means the set of inference attack transactions attempted by all questioners and is composed of a set of all T u . T u means the set of inference attack transactions by an arbitrary questioner (u) and is composed of a set of t (u、p、q) .

[0129] The inference attack transaction in which the extracted inference attack elements are serialized can be defined as in the following mathematical formula 13.

[0130]

Number

[0131] Here, JPEG2026506480000015.jpg86 means the serialized inference attack transaction and is included in the q-th inference attack transaction set (T p ={t u}) of the DBMS by any querier (u). And (u、p、q) JPEG2026506480000016.jpg77 means the inference attack transaction set serialized as a set of JPEG2026506480000017.jpg87. Therefore, if y < z for times y and z, the inference attack transaction JPEG2026506480000018.jpg88 has priority over the inference attack transaction JPEG2026506480000019.jpg78.

[0132] Figure 8 shows the case where the inference attack elements of the first result data (r p1 )) and the second result data (r (a、p1、q1 )) for queriers a and b input to the inference attack element extraction unit 120 from the same DBMS (b、p1、q2) occur concurrently, and Figure 9 shows the case where they occur in parallel and are input.

[0133] More specifically, referring to Figures 8 and 9, the inference attack elements e j and e i of querier a and the inference attack elements e i and e j of the result data for querier b occur mutually and simultaneously or in parallel in terms of time and are input to the inference attack element extraction unit 120.

[0134] At this time, the inference attack element extraction unit 120 has e with time priority for the result data of querier aj and e i Inference attack transaction t (a、p1、q1) ={φ1=e j , φ2=e i}={φ1=surgery(Y), φ2=treatment(X)} is output to the inference attack ordering construction unit 130.

[0135] In addition, the inference attack element extraction unit 120 selects the result data of the questioner b, which has a time priority. i and e j Inference attack transaction t (b、p1、q2) ={φ1=e i , φ2=e j}={φ1=treatment(X), φ2=surgery(Y)} to the inference attack ordering construction unit 130.

[0136] The inference attack ordering component 130 is (a、p1、q1) and t (b、p1、q2) and the result data r (a、p1、q1) and r (b、p1、q2) When the input time information is input, as shown in Figures 8 and 9, the result data r is generated regardless of the input time of the inference attack element. (a、p1、q1) and r (b、p1、q2) Depending on the input time order, JPEG2026506480000020.jpg96=t (b、p1、q2) and JPEG2026506480000021.jpg97=t (a、p1、q1) The transactions are serially ordered in the order of JPEG2026506480000022.jpg97=t (b、p1、q2) However, inference attack transactions JPEG2026506480000023.jpg86=t (a、p1、q1) This means that it has priority in terms of time compared to the other.

[0137] In this method, all inference attack transactions output from the inference attack element extraction unit 120 are serially ordered and output to the inference attack detection unit 140 .

[0138] When the serially ordered inference attack transactions are input from the inference attack ordering configuration unit 130, the inference attack detection unit 140 detects inferenceable logic (c x ) and determines the inference attack elements to be restricted by the set inference threshold (τ). In addition, the inference attack detection unit 140 detects the inference attack transactions containing the inference attack subset (s x ) is detected, and depending on the embodiment, the risk level is analyzed by referring to the multi-level risk table in the inference knowledge storage unit 150, and whether the inference attack subset corresponds to a risk level above the set threshold is determined, and the inference attack elements to be restricted are determined.

[0139] When the inference attack elements to be restricted are determined, the inference attack detection unit 140 generates restriction processing request information including the inference attack elements to be restricted, and outputs the restriction processing request information to the inference attack control unit 160.

[0140] The inference attack element threshold (ρ) is set to 1, the danger level threshold (σ) is set to very high (critical), and the inferenceable logic threshold (τ) is set to 1. The inference attack logic, age(A) ∧ addr(B)) ∧ treatment(X) ∧ surgery(Y), is applied to the serially ordered inference attack transactions. JPEG2026506480000024.jpg96=[age(A), addr(B)] is input first, followed by a serially ordered inference attack transaction JPEG2026506480000025.jpg95 and An example will be described in which JPEG2026506480000026.jpg87 is input.

[0141] The inference attack detection unit 140 detects the serially ordered inference attack transactions that have been input previously. JPEG2026506480000027.jpg88 has inferable logic (c x) = age(A) ∧ addr(B) occurs, so one of age(A) and addr(B) is selected and restricted according to the set inference-enabled logic threshold (τ=1). One of the addr(B)s with the latest order in JPEG2026506480000028.jpg88=[age(A), addr(B)] is subjected to restriction processing, and the remaining age(A) is determined to be provided to the questioner, and the content of this determination is stored as inference knowledge in the inference knowledge storage unit 150.

[0142] The inference attack detection unit 140 then detects the serially ordered input inference attack transactions. JPEG2026506480000029.jpg86 and JPEG2026506480000030.jpg87 is entered first JPEG2026506480000031.jpg77=t (b、p1、q2) =[φ1=e i , φ2=e j ]=[φ1=treatment(X), φ2=surgery(Y)] is determined to match the inference attack subset with a critical threshold (σ). JPEG2026506480000032.jpg86 is the inference attack subset s6={e i , e j}, the inference attack detection unit 140 selects one of treatment(X) and surgery(Y) according to the set inference attack element threshold (ρ=1) and performs restriction processing. The surgery(Y) which is the last in the JPEG2026506480000033.jpg85=[treatment(X), surgery(Y)] is subjected to restriction processing, and the remaining treatments(X) are determined to be provided to the questioner, and the content of this determination is stored as inference knowledge in the inference knowledge storage unit 150.

[0143] Then, the inference attack elements age(A) and addr(B) that have already occurred The inference attack elements φ1=treatment(X) and φ2=surgery(Y) of JPEG2026506480000034.jpg86 are the inference attack logic (α x ), the inference attack detection unit 140 notifies the security administrator terminal unit that an inference attack has occurred, and provides reporting information regarding the details of the attack.

[0144] In this way, the inference attack detection unit 140 detects the inference attack logic (c x ) and the inference attack subset (s x ) is configured, the inference attack control unit 160 determines which inference attack elements to restrict based on a threshold value, generates restriction processing request information including information about the determined inference attack elements, and provides it to the inference attack control unit 160.

[0145] As a result, the inference attack detection unit 140 detects the inference attack transaction Input after JPEG2026506480000035.jpg86 JPEG2026506480000036.jpg87 is also an inference attack subset s6={e i , e j}, so it is an inference attack transaction One of the two inference attack elements of JPEG2026506480000037.jpg76 must be restricted. The inference attack detection unit 140 refers to the inference knowledge stored in the inference knowledge storage unit 150 and performs the following: The restriction processing request information requesting restriction processing of the same inference attack element as the inference attack element restricted in JPEG2026506480000038.jpg86 is generated and provided to the inference attack control unit 160.

[0146] Here, different DBMSs p1 and DBMS p2Inference attack generated from transaction t (a、p1、q1) and t (b、p2、q2) and the result data r (a、p1、q1) and r (b、p2、q2) In this case, it is clear that inference control is performed as described above. p1 and DBMS p2 Inference attack generated from transaction t (a、p1、q1) and t (a、p2、q2) and the result data r (a、p1、q1) and r (a、p2、q2) It is clear that inference control is also performed in the case of

[0147] In the above description, the case where the thresholds are applied in a complex manner has been described. However, if only the critical level threshold is set, the inference attack detection unit 140 will not be able to detect the inference attack logic s x The inference attack control unit 160 generates restriction processing request information requesting that restriction processing be performed on all of the above.

[0148] As another example, it is assumed that the inference attack element threshold is set to 1, the inferable logic threshold is set to 0, and the danger level threshold (σ) is set to very high (critical).

[0149] In this case, the inference attack detection unit 140 detects the serially ordered inference attack transaction that was input earlier. For JPEG2026506480000039.jpg88, it is determined that both age(A) and addr(B) can be provided to the inquirer according to the inference logic threshold (τ=0), and this is stored as inference knowledge in the inference knowledge storage unit 150. Then, the inference attack detection unit 140 detects the previously input inference attack transaction JPEG2026506480000040.jpg98 is the inference attack subset s6={e i , e j} is determined to be matched.

[0150] Therefore, the inference attack detection unit 140 determines whether the inference attack element threshold (ρ=1) is set. One of the inference attack elements, treatment(X) and surgery(Y), of JPEG2026506480000041.jpg88 is selected and restricted. In this embodiment, surgery(Y), which is the latest in the order, is determined as the inference attack element to be restricted, and the inference attack element determined to be restricted and the inference attack element provided are stored as inference knowledge in the inference knowledge storage unit 150, and an inference attack transaction is created. The restriction processing request information for JPEG2026506480000042.jpg88 is generated and provided to the inference attack control unit 160. Then, the inference attack element {age(X), addr(Y)} and the inference attack transaction that have already occurred are generated. The inference attack elements treatment(X) and surgery(Y) of JPEG2026506480000043.jpg88 are the inference attack logic (α x ), the inference attack detection unit 140 notifies the security administrator terminal unit that an inference attack has occurred, and provides reporting information regarding the content of the inference attack.

[0151] Then, the inference attack detection unit 140 detects the inference attack transaction Input after JPEG2026506480000044.jpg87 The restriction process for JPEG2026506480000045.jpg76 is also determined in the same manner as in the previous example, and the determined content is stored as inference knowledge in the inference knowledge storage unit 150. Inference attack log information is generated and stored in the inference attack log storage unit 170. Restriction processing request information for JPEG2026506480000046.jpg76 is generated and provided to the inference attack control unit 160.

[0152] Furthermore, the inference attack detection unit 140 outputs restriction processing request information to the inference attack control unit 160, which requests that result data that does not constitute an inference attack logic be output without being subjected to restriction processing.

[0153] The inference attack control unit 160 receives result data from the DBMS 30, receives restriction processing request information for each result data, and if there are no inference attack elements that are requested to be restricted according to the input restriction processing request information, it either provides the result data as is to the questioner terminal unit via the input / output unit 10, or performs restriction processing on the data attributes corresponding to the inference attack elements that are requested to be restricted in the restriction processing request information, and then provides the result data to the questioner terminal unit.

[0154] The restriction process can be performed by masking or anonymizing the data attribute information of the result data, or by removing the data attribute information from the result data.

[0155] FIG. 10 is a flowchart showing a DB inference attack control method according to the present invention.

[0156] 10, the inference control unit 20 sets the inference logic by providing an inference logic setting interface means to the security administrator terminal unit via the inference setting unit 110, and stores the set inference logic as inference knowledge in the inference knowledge storage unit 150 (S111). The inference logic setting is composed of settings for inference attack logic, inferable logic, extended inference attack logic, inference attack element threshold (ρ), multi-stage danger level threshold (σ), and inferable logic threshold (τ).

[0157] Once the inference logic is set, the inference control unit 20 generates inference attack elements using the inference attack logic, inferable logic, and extended inference attack logic generated through the inference attack element generation unit 230 of the inference setting unit 110, and generates inference attack element information (E) for the inference attack elements and provides it to the inference attack element extraction unit 120 (S113).

[0158] Once the inference logic and the inference attack elements are set, the inference control unit 20 monitors whether result data is input from the DBMS 30 via the inference attack element extraction unit 120 (S115).

[0159] When the result data is input, the inference control unit 20 checks whether each inference attack element of the inference attack element information set in advance is included in the result data through the inference attack element extraction unit 120, and if included, extracts the inference attack element, and generates an inference attack transaction (t (u、p、q) ), and then outputs it to the inference attack ordering construction unit 130 (S117).

[0160] The inference attack transaction (t (u、p、q) ) is input, the inference control unit 20 calculates the inference attack transactions (t (u、p、q) ) are serially ordered in descending order of the input time of the result data and output to the inference attack detection unit 140 (S119).

[0161] The inference control unit 20 checks whether the inference attack elements of the serially ordered inference attack transactions input from the inference attack ordering configuration unit 130 through the inference attack detection unit 140 match the inference attack subset and the inference attack element (S121). If the inference attack elements of the input inference attack transaction do not match the inference attack subset and the inference attack element (S122), the inference attack detection unit 140 transmits restriction processing request information to the inference attack control unit requesting that result data be output without restriction processing, and the inference attack control unit 160 provides the result data to the questioner terminal unit without restriction processing (S123).

[0162] When an inference attack transaction matching the inferenceable logic and the inference attack subset is detected, the inference control unit 20 determines, through the inference attack detection unit 140, an inference attack element corresponding to a threshold value among the inference attack elements included in the inference attack transaction as an inference attack element to be restricted (S125). At this time, the inference attack detection unit 140 refers to the inference attack elements that have been previously restricted stored in the inference knowledge storage unit 150, determines whether there is an inference attack element that has been previously restricted among the inference attack elements that correspond to the threshold value, and if there is an inference attack element that has been previously restricted, determines the inference attack element that has been previously restricted as an inference attack element to be restricted using result data corresponding to the current inference attack transaction.

[0163] Once the inference attack elements to be restricted are determined, the inference control unit 20 determines whether there are any inference knowledge update elements via the inference attack detection unit 140 (S127). That is, the inference attack detection unit 140 determines whether there are any new inference attack elements to be restricted or newly provided to the questioner.

[0164] If a new restriction process is performed or a new inference attack element is provided, the inference attack detection unit 140 stores the inference attack element as inference knowledge in the inference knowledge storage unit 150 and updates the inference knowledge (S129).

[0165] The inference attack detection unit 140 determines whether the inference attack elements that have already occurred and the inference attack elements of the input inference attack transaction constitute an inference attack logic (S131), and if the determination result detects the configuration of an inference attack logic, it notifies the security administrator terminal unit that an inference attack has occurred and provides reporting information regarding the content (S133).

[0166] The inference control unit 20 restricts data attribute information corresponding to the inference attack element determined to be restricted among a plurality of data attributes constituting the result data via the inference attack control unit 160 (S135).

[0167] The inference control unit 20 provides the result data that has been subjected to the restriction process via the inference attack control unit 160 to the questioner terminal unit via the input / output unit 10 (S137).

[0168] The inference attack control unit 160 generates an inference attack log including the detection and restriction process results of the inference attack, and stores the generated inference attack log in the inference attack log storage unit 170 (S139).

[0169] In the above embodiment, as shown in FIG. 4, an example of one table including multiple records with seven data attributes is described. However, as another example, when a questioner approaches a view and asks a question, it is obvious that the inference attack control method according to the present invention can be applied to result data including the results of querying the view.

[0170] In addition, when a questioner asks a question using a query that changes a data attribute name (e.g., ALTER, RENAME, SELECT AS, etc.), when the query is input via the input / output unit 10, the inference control unit 20 transmits change information including the original data attribute name and the changed data attribute name corresponding to the original data attribute name to the inference setting unit 110, and preferably changes the inference attack logic, inferable logic, and extended inference attack logic to correspond to the changed data attribute name.

[0171] Specifically, the inference control unit 20 adds or updates the changed data attribute name corresponding to the original data attribute name (S111), further generates or updates inference attack elements, further sets or updates inference attack element information (E) and a multi-level risk table for each inference attack subset to include the further generated or updated inference attack elements (S111), and provides the further generated or updated inference attack elements to the inference attack element extraction unit 120 (S113). Accordingly, the inference control unit 20 extracts inference attack elements corresponding to the original data attribute name and the changed data attribute name from among the data attributes included in the result data, and detects and controls inference attacks as described above in the above embodiment. Furthermore, when a questioner asks a question via a stored procedure or trigger including a query that changes a data attribute name, the inference attack is detected and controlled based on the inference attack elements corresponding to the original data attribute name and the changed data attribute name in the same manner as described above in the above embodiment. Therefore, it is clear that the inference attack control method according to the present invention can be similarly applied to queries in which aliases are set for names of database-related objects such as tables, views, and procedures using synonyms (or similar methods). [Explanation of symbols]

[0172] 10 Input / output section 20 Inference control section 30 Database Management System (DBMS) 40 Database (DB) 110 Inference setting section 120 Inference attack element extraction unit 130 Inference attack sequencing component 140 Inference Attack Detection Unit 150 Inference knowledge storage unit 160 Inference attack control unit 170 Inference attack log storage 210 Inference logic setting interface section 220 Inference logic generation unit 221 Inference attack logic setting part 222 Inferable Logic Generation Unit 230 Inference attack element generation unit 240 Multi-stage risk setting section 250 Threshold setting unit

Claims

1. an input / output unit that receives and outputs questions from a plurality of questioner terminal units, and receives and provides result data that is a response to the input questions to the questioner terminal units; one or more DBMSs including at least one database (DB) including a plurality of data attributes, at least one of which includes sensitive data attributes set for sensitive information to be protected, searching the DBs for queries input from the input / output unit, generating and outputting result data as search results; A DB inference attack control device characterized by including: an inference control unit that sets inference knowledge including inference attack elements corresponding to data attributes that can infer the sensitive information and inference logic composed of logical operations, detects inference attacks that can infer the sensitive information from result data input from the DBMS by referring to the inference logic, restricts data attribute information corresponding to at least one inference attack element among the inference attack elements included in the result data in which the inference attack is detected, and transmits the restricted data attribute information to the interrogator terminal unit via the input / output unit.

2. The inference control unit an inference knowledge storage unit for storing inference knowledge including inference logic and inference attack elements corresponding to data attributes provided to the questioner terminal unit; an inference setting unit that receives one or more data attributes from which the sensitive information configured in the DB can be inferred from a security administrator via a security administrator terminal unit, generates an inference logic including the one or more data attributes, stores the generated inference logic as inference knowledge in the inference knowledge storage unit, sets the data attributes included in the inference logic as inference attack elements, and outputs inference attack element information including the set inference attack elements; an inference attack element extraction unit that receives and sets inference attack element information from the inference setting unit, extracts inference attack elements corresponding to the inference attack element information from result data received from the DBMS, and generates and outputs inference attack transactions composed of the extracted inference attack elements; an inference attack detection unit that receives the inference attack transaction, checks whether the inference attack elements included in the inference attack transaction and the inference attack elements already provided to the interrogator terminal unit and stored in the inference knowledge storage unit satisfy any one of the inference logics of the inference knowledge storage unit, and detects an inference attack, and outputs restriction processing request information to any one of the inference attack elements of the inference attack transaction when the inference attack is detected; The DB inference attack control device according to claim 1, further comprising an inference attack control unit that, when input of restriction processing request information from the inference attack detection unit, restricts data attributes included in the result data corresponding to the inference attack transaction in which the inference attack was detected, and provides the data attributes corresponding to the inference attack elements of the input restriction processing request information to the interrogator terminal unit via the input / output unit.

3. The inference control unit further comprising an inference attack ordering configuration unit that serially orders and outputs the plurality of inference attack transactions input from the inference attack element extraction unit; The inference attack detection unit 3. The DB inference attack control device according to claim 2, wherein an inference attack is detected by the serially ordered inference attack transactions.

4. The inference setting unit an inference logic generating unit that receives one or more data attributes from which the sensitive information configured in the DB can be inferred from a security administrator via a security administrator terminal, generates inference logic including the one or more data attributes, and stores the generated inference logic in the inference knowledge storage unit as inference knowledge; The DB inference attack control device according to claim 2, further comprising an inference attack element generating unit that sets data attributes included in the inference logic as inference attack elements and outputs the inference attack elements.

5. The inference logic generation unit an inference attack logic generation unit that receives one or more data attributes that are directly related to the sensitive information configured in the DB and can infer the sensitive information from the security administrator via a security administrator terminal, generates an inference attack logic including the one or more data attributes as one of the inference logics, and stores the generated inference attack logic in the inference knowledge storage unit; The DB inference attack control device of claim 4, further comprising an inferable logic generation unit that receives input of one or more data attributes that can increase the accuracy of inference attacks on the sensitive information, generates inferable logic including the one or more data attributes, combines the inferable logic with the inference attack logic to generate extended inference attack logic, and stores the extended inference attack logic in the inference knowledge storage unit as inference knowledge.

6. The inference setting unit The DB inference attack control device of claim 5 further comprises a multi-stage risk setting unit that, when a multi-stage risk setting request is made by a security administrator via a security administrator terminal unit, selects one or more of the inference attack elements so as not to overlap, generates an inference attack subset, and provides it to the security administrator, and when a risk level for each inference attack subset is input by the security administrator, sets a risk level for each inference attack subset and stores it in an inference knowledge storage unit as inference knowledge.

7. The inference setting unit The DB inference attack control device described in claim 6 further includes a threshold setting unit that, when a threshold setting request is made from a security administrator terminal unit, inputs an inference attack element threshold, which is the number of inference attack elements that are to be restricted among the inference attack elements that constitute the inference attack subset, and stores and sets it in a knowledge storage unit.

8. The threshold setting unit The DB inference attack control device according to claim 7, characterized in that when a threshold setting request is made from the security administrator terminal, a danger level threshold, which is a danger level for restricting processing for the inference attack subset, is further input and set.

9. The threshold setting unit A DB inference attack control device as described in claim 7 or 8, characterized in that when the threshold setting request occurs, an inferenceable logic threshold, which is the number of inference attack elements to be limited among the inference attack elements included in the inferenceable logic, is further set.

10. The inference attack detection unit A DB inference attack control device as described in claim 2, characterized in that when determining the inference attack elements to be restricted, the inference attack elements to be restricted are determined by referring to the inference knowledge so that they are not provided to the questioner terminal unit.

11. The inference attack control unit: The DB inference attack control device described in claim 2, characterized in that data attribute information corresponding to the inference attack elements to be restricted from the result data is masked, anonymized, or removed from the result data, thereby restricting the data attribute information.

12. a DB search process in which one or more DBMSs managing one or more DBs storing information including a plurality of data attributes, at least one of which contains sensitive information to be protected, perform a search for queries input from the DBs, generate and output result data; a DB inference attack control method characterized by including an inference control process in which an inference control unit sets inference knowledge including inference attack elements corresponding to data attributes that can infer the sensitive information and inference logic composed of logical operations, detects inference attacks that can infer the sensitive information from result data input from the DBMS by referring to the inference logic, and restricts data attributes corresponding to at least one inference attack element among the inference attack elements included in the result data in which the inference attack is detected, and transmits the restricted data to the interrogator terminal unit via the input / output unit.

13. The inference control process an inference setting step in which the inference control unit receives one or more data attributes from which the sensitive information configured in the DB can be inferred from the security administrator via the inference setting unit, generates inference logic including the one or more data attributes, stores the generated inference logic in the inference knowledge storage unit as inference knowledge, sets the data attributes included in the inference logic as inference attack elements, and outputs inference attack element information including the set inference attack elements; an inference attack element extraction step in which the inference control unit receives inference attack element information from the inference setting unit and sets it, extracts inference attack elements corresponding to the inference attack element information from result data received from the DBMS, and generates and outputs inference attack transactions composed of the extracted inference attack elements; an inference attack detection step in which the inference control unit receives the inference attack transaction via the inference attack detection unit, checks whether the inference attack elements included in the inference attack transaction and the inference attack elements stored in the inference knowledge storage unit as those already provided to the interrogator terminal unit satisfy any one of the inference attack logic, inferable logic, and inference attack subset of the inference knowledge storage unit, and outputs restriction processing request information for any one of the inference attack elements of the inference attack transaction when the inference attack is detected; The DB inference attack control method according to claim 12, further comprising an inference attack control step in which, when restriction processing request information is input from the inference attack detection unit via the inference attack control unit, the inference control unit restricts data attributes included in the result data corresponding to the inference attack elements of the input restriction processing request information, and provides the data attributes to the questioner terminal unit via the input / output unit.

14. The inference control process the inference control unit includes an inference attack ordering configuration step of serially ordering and outputting a plurality of inference attack transactions input from the inference attack element extraction unit via the inference attack ordering configuration unit; The DB inference attack control method described in claim 13, characterized in that, when restriction processing request information is input from the inference attack detection unit in the inference attack control step, the inference attack control unit restricts data attributes of the result data corresponding to the inference attack elements of the input restriction processing request information from among the data attributes of the result data corresponding to the inference attack transaction in which the inference attack was detected, and provides them to the questioner terminal unit via the input / output unit.

15. The inference setting step includes: an inference logic generating step in which the inference setting unit receives one or more data attributes capable of inferring the sensitive information configured in the DB from a security administrator via an inference logic generating unit, generates inference logic including the one or more data attributes, and stores the generated inference logic in the inference knowledge storage unit as inference knowledge; The DB inference attack control method according to claim 13, further comprising an inference attack element generation step in which the inference setting unit sets the data attributes included in the inference logic as an inference attack element via the inference attack element generation unit and outputs it.

16. The inference logic generating step includes: an inference attack logic generation step in which the inference logic generation unit receives one or more data attributes that can infer the sensitive information configured in the DB from the security administrator via the inference attack logic generation unit, generates an inference attack logic including the one or more data attributes as one of the inference logics, and stores the inference attack logic in the inference knowledge storage unit; The DB inference attack control method of claim 15, further comprising an inference logic generation step in which the inference logic generation unit receives one or more data attributes that can increase the accuracy of inference attacks on the sensitive information through an inferenceable logic generation unit, generates inferenceable logic including the one or more data attributes, combines the inferenceable logic with the inference attack logic to generate extended inference attack logic, and stores the extended inference attack logic in the inference knowledge storage unit as inference knowledge.

17. The inference setting step includes: The DB inference attack control method of claim 16, further comprising a multi-stage risk setting step in which, when a multi-stage risk setting request is received from a security administrator via a security administrator terminal unit through a multi-stage risk setting unit, the inference setting unit generates an inference attack subset by selecting one or more of the inference attack elements so as not to overlap and provides the generated inference attack subset to the security administrator, and the security administrator inputs a risk level for each inference attack subset, sets a risk level for each inference attack subset, and stores the risk level in an inference knowledge storage unit as inference knowledge.

18. The inference setting step includes: The DB inference attack control method described in claim 17, characterized in that the inference setting unit further includes a threshold setting step in which, when a threshold setting request is received from a security administrator terminal unit via a threshold setting unit, an inference attack element threshold, which is the number of inference attack elements that are to be restricted among the inference attack elements that constitute the inference attack subset, is input and set.

19. The DB inference attack control method described in claim 18, characterized in that in the threshold setting step, when a threshold setting request is received from the security administrator terminal unit via the threshold setting unit, a danger level threshold, which is a danger level at which restriction processing is performed on the inference attack subset, is further input and set.

20. A DB inference attack control method as described in claim 18 or 19, characterized in that in the threshold setting step, the inference setting unit further sets an inferenceable logic threshold, which is the number of inference attack elements of the inferenceable logic to be restricted when the threshold setting request occurs via the threshold setting unit.

21. The DB inference attack control method described in claim 13, characterized in that in the inference attack detection step, when determining the inference attack elements to be restricted, the inference attack control unit refers to the inference knowledge to determine the inference attack elements to be restricted so that they are not provided to the questioner terminal unit.

22. The DB inference attack control method described in claim 13, characterized in that in the inference attack control step, the inference attack control unit performs a masking process, an anonymization process, or a removal process to remove data attribute information from the result data that corresponds to the inference attack element to be restricted, thereby restricting the data attribute information.

Images