Course CS4440 Reading Summaries
Paper #: 8.11
Title: Protecting Privacy when Disclosing Information: k-Anonymity
and its Enforcement Through Generalization and Specialization
Problem
This paper discusses a sub-problem of the high-level privacy issue.
It is often the case that a privacy-preserving database contains too
many quasi-identifiers. A dataset containing too many such quasi-
identifiers can be crossed with another quasi-identifying dataset
to make very strong inferences about personally-identifiable
information. One method of ensuring that the data cannot be used
to identify a person is to ensure that there are multiple records
that are similar enough that they cannot be used to identify the
individual. This is called k-anonymity, where the value k is the
number of similar records that should be in the dataset.
New Idea and Strengths
In this paper, Generalization and a complete form of generalization,
called Supression, are used in order to reduce the strength of
quasi-identifiers and to massage the data into k-anonymity form.
Generalization is a way to mask data so that it is less precise than
before. For example, the area code "90210" can be generalized to
"9021*", "902**", or "90***". way, This a location can be
approximated. Suppression masks the data completely, leaving only a
trace of the form of the data. To use the zip code example again, a
suppressed value would be "*****".
This concept can be applied to numbers, ages, or even a person's race.
Once the personally identifiable information has been masked
adequately, the data will be in k-anonymity form, which can then be
used by external data mining processes without sacrificing privacy.
Weaknesses & Extensions
Two systems are analyzed: the author's own generaliztion system
called Datafly and a system from the Netherlands, the mu-Argus System.
DataFly is fairly simple and straightforward; however, the masks
it performs, or "distortions&q...