CAREER: Securing history: privacy and accountability in database systems

University Of Massachusetts Amherst, Amherst MA

Investigators

Abstract

Accountability in computer systems is typically provided by preserving a history of activities and data. This allows past events to be analyzed to detect breaches, maintain data quality, and to audit compliance with security policies. In some settings, however, retaining a history of past data or operations poses a serious threat to privacy. Privacy and accountability are both important goals, and system designers need to carefully manage the balance between them. This CAREER research is building a database system capable of securely managing history, thus balancing the needs for privacy and accountability. In settings that require it, the system is configurable as ``memoryless'', protecting privacy by resisting unauthorized attempts to trace activities or recover deleted data. This is achieved by removing data safely when it is deleted, providing an accurate view of the data that is retained, and by offering bounds on the lifetime of sensitive data items stored in the system. In other settings, the system supports accountability by retaining desired history, permitting its efficient analysis, and protecting it from unwanted disclosure. The broader impact of this project includes a publicly-available prototype database system embodying the goals above, along with curriculum extensions that bring privacy and system accountability themes into undergraduate education. In addition to enriching existing programs at UMass Amherst for training undergraduates in Information Assurance, this project will foster collaboration among the campuses of the Five College consortium of Western Massachusetts. The project results including the prototype source code and documentation and the project publications will be made available via the project website (http://dbgroup.cs.umass.edu/securing-history).