Advanced COMP7370 Computer and Network Security
Generalizing Data to Provide Anonymity when Disclosing Information (2)
Comments on homework 2.
Topics:
1. Problem description
a. How to define a term formally?
Review: Problem Description
Motivation:
o Protect individual-specific (private) data
- e.g., name, address, phone number, SSN
o Limitation: (see slide09b, p2)
- Re-identifying anonymous data
- Link to outside data (public data)
- e.g., voting list - use DOB (12%); DOB+gender (29%); DOB+Zip (69%)
DB:
Private data
Other data
Remove
Private Data
DB_release:
Private data
Other data
Re-identify: Linking
Quasi-identifier
DB_outside:
Private-data
Other-data
Private-data+
Other data
-
PT (or Private Table) = DB_release
QI_PT = (u1, , u_m) in PT (released DB)
Goal: how to control QI_PT? or what info should be released to public?
e.g.: QI_PT1= (DOB, gender, zip, marital status, problem) or
QI_PT2= (gender, zip, marital status, problem) or
QI_PT3= (DOB, marital status, problem)
To at match least k individuals
1
o Anonymity constraint: (see Lec11a, p4)
DB_release + DB_outside -> at least k individual
Each Quasi-identifier
Question: Why only consider one quasi-identifier? (see Lec11a.ppt, p5)
Answer: If each quasi-identifier in the released data satisfy k-anonymity, then the combination
of released data to external sources cannot match lower than k individuals
Topic 2: Generalization of PT (private table, DB_release)
Related K-anonymity ideas:
o change unusual information to typical values, e.g. 4/1/1969 -> 1/1/1969
o insert complementary records
o swapping entries
o scrambling records
New idea: re-coding values -> make more general
o e.g.: zip code 02139 -> 02130 (last digit is replaced by 0, less informative)
Domain:
o e.g.: zip code domain, number domain, string domain.
Every attribute is in the ground domain
Key: Less informative
domain generalization hierarchy
2
value generalization hierarchy
Question: give Eo, can you provide E1?
3