Selective partial access to a database

A system to support a multi-function, shared-access database requires the capability of defining for each user an arbitrary subset of the fields of a logical record to which access is allowed. The feasibility of such a capability has already been demonstrated by several operational systems. This paper is concerned with the possibility of granting something less than complete access to a specified field of a record. The purpose would be to allow a user to perform various summary and statistical tasks over controlled fields without allowing identification of the exact value of a field in a particular record. Three different strategies are examined: 1. An arbitrary partition of values is defined for each restricted field. A user granted this type of access can determine only which class of the partition contains the field value. 2. The actual field value is distorted by a random perturbation. 3. Access to actual field values is allowed—but values are dissociated from the actual record in which they occur. The third strategy—dissociation—appears to be the most interesting, potentially useful, but potentially vulnerable. In each case, the utility of incomplete access is examined and various implementation alternatives are explored. The degree of protection against persistent assault is determined.