如何隐藏数据库表的外键关系或创建匿名条目？

Question

Is it possible to store associated data in a database without explicitly revealing its relationship or owner? This page talks about using a hash of user info combined with a password to identify a user that a transaction belongs to. A few searches have revealed nothing in terms of implementation details for this security feature.

Say that I have users which have private data tied to their account, how can I make it so that someone with access to a dump of the database cannot tell which data belongs to which user?

Answer 1

It's not a security feature, it's a design pattern (or, arguably, anti-pattern). The page you linked describes how they implemented it: sensitive information is stored with an identifier that cannot be traced back to any given user without cross-referencing information external to the database. In their example, it's the password, which when combined with other account information and hashed generates a consistent id for that user's transactions. In order to correctly associate a user with their transactions, you need the original password to rebuild the hash. No password = no association.

So that does the job; it sacrifices referential integrity, which is why I'd call it an anti-pattern, but then that's the whole idea. The bigger problem is that it's at likely the most sensitive possible point, since the hash must be updated for all of a user's transactions whenever the information used to generate it changes. The lack of a foreign key constraint also allows bogus transactions without any user. It would be somewhat safer, structurally speaking, to have an anonymized table of transaction owners with a proper foreign key relationship to the transaction table and a hash as described linking the owner entity to the actual user. This way, the sensitive relationship is one-to-one instead of one-to-many and the impact of an integrity failure is restricted.

Both of these approaches, of course, are vulnerable to simple patience and analysis -- if someone has a database dump and is sufficiently motivated, the transactions themselves can be enough to get an idea of who made them as long as they're tied to a consistent user-hash or owner. One pizza delivery charge could be anything; several put you within a few miles of someone's house. The more information you can correlate with an anonymous record, the less anonymous it really is.