Data Anonymization Introduction and kanonymity Li Xiong CS

Data Anonymization – Introduction and k-anonymity Li Xiong CS 573 Data Privacy and Security

Outline n Problem definition n K-Anonymity Property n Disclosure Control Methods n Complexity n Attacks against k-Anonymity

Defining Privacy in DB Publishing n Traditional information security: protecting information and information systems from unauthorized access and use. n Privacy preserving data publishing: protecting private data while publishing useful information NO FOUL PLAY Modify Data 3

Problem: Disclosure Control n Disclosure Control is the discipline concerned with the modification of data, containing confidential information about individual entities such as persons, households, businesses, etc. in order to prevent third parties working with these data to recognize individuals in the data n Privacy preserving data publishing, anonymization, deidentification Types of disclosure n Identity disclosure - identification of an entity (person, institution) n Attribute disclosure - the intruder finds something new about the target person n Disclosure – identity, attribute disclosure or both.

Microdata and External Information n Microdata represents a series of records, each record containing information on an individual unit such as a person, a firm, an institution, etc n In contrast to computed tables n Masked Microdata names and other identifying information are removed or modified from microdata n External Information any known information by an presumptive intruder related to some individuals from initial microdata

Disclosure Risk and Information Loss n Disclosure risk - the risk that a given form of disclosure will arise if a masked microdata is released n Information loss - the quantity of information which exist in the initial microdata and because of disclosure control methods does not occur in masked microdata

Disclosure Control Problem Individuals Submit Collect Data Owner Masking Process Release Receive Masked Data Researcher Intruder

Disclosure Control Problem Individuals Submit Collect Data Owner Release Receive Researcher Intruder Data Masking Process Masked Data Confidentiality of Individuals Preserve Data Utility Disclosure Risk / Anonymity Properties Information Loss

Disclosure Control Problem Individuals Submit Collect Data Owner Release Receive Data Masking Process Masked Data Researcher Intruder External Data Confidentiality of Individuals Preserve Data Utility Disclosure Risk / Anonymity Properties Information Loss Use Masked Data for Statistical Analysis Use Masked Data and External Data to disclose confidential information

Types of Disclosure Initial Microdata Masked Microdata Name SSN Age Zip Diagnosis Income Alice 123456789 44 48202 AIDS 17, 000 Bob 32323 44 48202 AIDS 68, 000 Charley 232345656 44 48201 Asthma 80, 000 Dave 33333 55 48310 Asthma 55, 000 Eva 66666 55 48310 Diabetes 23, 000 Data Owner

Types of Disclosure Initial Microdata Masked Microdata Name SSN Age Zip Diagnosis Income Alice 123456789 44 48202 AIDS 17, 000 Bob 32323 44 48202 AIDS 68, 000 Charley 232345656 44 48201 Asthma 80, 000 Dave 33333 55 48310 Asthma 55, 000 Eva 66666 55 48310 Diabetes 23, 000 Data Owner External Information Name SSN Age Zip Alice 123456789 44 48202 Charley 232345656 44 48201 Dave 33333 55 48310 Intruder

Types of Disclosure Initial Microdata Masked Microdata Name SSN Age Zip Diagnosis Income Alice 123456789 44 48202 AIDS 17, 000 Bob 32323 44 48202 AIDS 68, 000 Charley 232345656 44 48201 Asthma 80, 000 Dave 33333 55 48310 Asthma 55, 000 Eva 66666 55 48310 Diabetes 23, 000 Data Owner Identity Disclosure: External Information Name SSN Age Zip Alice 123456789 44 48202 Attribute Disclosure: Charley 232345656 44 48201 Alice has AIDS Dave 33333 55 48310 Charlie is the third record Intruder

Types of Disclosure Initial Microdata Masked Microdata Name SSN Age Zip Diagnosis Income Alice 123456789 44 48202 AIDS 17, 000 44 482 AIDS 17, 000 Bob 32323 44 48202 AIDS 68, 000 44 482 AIDS 68, 000 Charley 232345656 44 48201 Asthma 80, 000 44 482 Asthma 80, 000 Dave 33333 55 48310 Asthma 55, 000 55 483 Asthma 55, 000 Eva 66666 55 48310 Diabetes 23, 000 55 483 Diabetes 23, 000 Data Owner Identity Disclosure: External Information Name SSN Age Zip Alice 123456789 44 48202 Attribute Disclosure: Charley 232345656 44 48201 Alice has AIDS Dave 33333 55 48310 Charlie is the third record Intruder

Disclosure Control for Tables vs. Microdata n Precomputed statistics tables

Disclosure Control For Microdata

Disclosure Control for Tables

Outline n Problem definition n K-Anonymity Property n Disclosure Control Methods n Complexity and algorithms n Attacks against k-Anonymity

History n The term was introduced in 1998 by Samarati and Sweeney. n Important papers: n n n Sweeney L. (2002), K-Anonymity: A Model for Protecting Privacy, International Journal on Uncertainty, Fuzziness and Knowledgebased Systems, Vol. 10, No. 5, 557 -570 Sweeney L. (2002), Achieving K-Anonymity Privacy Protection using Generalization and Suppression, International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, Vol. 10, No. 5, 571 -588 Samarati P. (2001), Protecting Respondents Identities in Microdata Release, IEEE Transactions on Knowledge and Data Engineering, Vol. 13, No. 6, 1010 -1027

More recently n Many new research papers in the last 4 -5 years n n n Theoretical results Many algorithms achieving k-anonymity Many improved principles and algorithms

Terminology (Sweeney) n Data or Microdata - a person-specific information n n that is conceptually organized as a table of rows and columns. Tuple, Row, or Record – a row from the microdata. Attribute or Field – a column from the microdata Inference – Belief on a new fact based on some other information Disclosure – Explicit and inferable information about a person

Attribute Classification n I 1, I 2, . . . , Im - identifier attributes n Ex: Name and SSN n Found in IM only n Information that leads to a specific entity. n K 1, K 2, . …, Kp - key attributes (quasi-identifiers) n Ex: Zip Code and Age n Found in IM and MM. n May be known by an intruder. n S 1, S 2, . …, Sq - confidential attributes n Ex: Principal Diagnosis and Annual Income n Found in IM and MM. n Assumed to be unknown to an intruder.

Attribute Types n Identifier, Key (Quasi-Identifiers) and Confidential Attributes Rec. ID Name SSN Age State Diagnosis Income Billing 1 John Wayne 123456789 44 MI AIDS 45, 500 1, 200 2 Mary Gore 32323 44 MI Asthma 37, 900 2, 500 3 John Banks 232345656 55 MI AIDS 67, 000 3, 000 4 Jesse Casey 33333 44 MI Asthma 21, 000 5 Jack Stone 44444 55 MI Asthma 90, 000 900 6 Mike Kopi 66666 45 MI Diabetes 48, 000 750 7 Angela Simms 77777 25 IN Diabetes 49, 000 1, 200 8 Nike Wood 88888 35 MI AIDS 66, 000 2, 200 9 Mikhail Aaron 99999 55 MI AIDS 69, 000 4, 200 10 Sam Pall 10000 45 MI Tuberculosis 34, 000 3, 100

Motivating Example Non-Sensitive Data Modify Data 24 # Zip 1 Sensitive Data Age Nationality Name Condition 13053 28 Brazilian Ronaldo Heart Disease 2 13067 29 US Bob Heart Disease 3 13053 37 Indian Kumar Cancer 4 13067 36 Japanese Umeko Cancer

The Optimization Problem Motivating Example (continued) Published Data: Alice publishes data without the Name Non-Sensitive Data Modify Data # Zip 1 Sensitive Data Age Nationality Condition 13053 28 Brazilian Heart Disease 2 13067 29 US Heart Disease 3 13053 37 Indian Cancer 4 13067 36 Japanese Cancer Attacker’s Knowledge: Voter registration list # 25 Name Zip Age Nationality 1 John 13067 45 US 2 Paul 13067 22 US 3 Bob 13067 29 US 4 Chris 13067 23 US

The Optimization Problem Motivating Example (continued) Published Data: Alice publishes data without the Name Non-Sensitive Data Modify Data # Zip 1 Sensitive Data Age Nationality Condition 13053 28 Brazilian Heart Disease 2 13067 29 US Heart Disease 3 13053 37 Indian Cancer 4 13067 36 Japanese Cancer Attacker’s Knowledge: Voter registration list # 26 Name Zip Age Nationality 1 John 13067 45 US 2 Paul 13067 22 US 3 Bob 13067 29 US 4 Chris 13067 23 US Data Leak !

Data Re-identification Disease Birthdate Zip Sex Name 87% of the population in the USA can be uniquely identified using Birthdate, Sex, and Zipcode

Source of the Problem Even if we do not publish the individuals: • There are some fields that may uniquely identify some individual Non-Sensitive Data # Zip Age Nationality Condition … … … Quasi Identifier • The attacker can use them to join with other sources and identify the individuals 28

K-Anonymity Definition n The k-anonymity property for a masked microdata (MM) is satisfied if with respect to Quasi-identifier set (QID) if every count in the frequency set of MM with respect to QID is greater or equal to k

K-Anonymity Example Rec. ID Age Zip Sex Illness 1 50 41076 Male AIDS 2 30 41076 Female Asthma 3 30 41076 Female AIDS 4 20 41076 Male Asthma 5 20 41076 Male Asthma 6 50 41076 Male Diabetes n QID = { Age, Zip, Sex } n SELECT COUNT(*) FROM Patient GROUP BY Sex, Zip, Age; n If the results include groups with count less than k, the relation Patient does not have k-anonymity property with respect to QID.

Outline n Problem definition n K-Anonymity Property n Disclosure Control Methods n Attacks against k-Anonymity

Disclosure Control Techniques n Remove Identifiers n Generalization n Suppression n Sampling n Microaggregation n Perturbation / randomization n Rounding n Data Swapping n Etc.

Disclosure Control Techniques n Different disclosure control techniques are applied to the following initial microdata: Rec. ID Name SSN Age State Diagnosis Income Billing 1 John Wayne 123456789 44 MI AIDS 45, 500 1, 200 2 Mary Gore 32323 44 MI Asthma 37, 900 2, 500 3 John Banks 232345656 55 MI AIDS 67, 000 3, 000 4 Jesse Casey 33333 44 MI Asthma 21, 000 5 Jack Stone 44444 55 MI Asthma 90, 000 900 6 Mike Kopi 66666 45 MI Diabetes 48, 000 750 7 Angela Simms 77777 25 IN Diabetes 49, 000 1, 200 8 Nike Wood 88888 35 MI AIDS 66, 000 2, 200 9 Mikhail Aaron 99999 55 MI AIDS 69, 000 4, 200 10 Sam Pall 10000 45 MI Tuberculosis 34, 000 3, 100

Remove Identifiers n Identifiers such as Names, SSN etc. are removed Rec. ID Age State Diagnosis Income Billing 1 44 MI AIDS 45, 500 1, 200 2 44 MI Asthma 37, 900 2, 500 3 55 MI AIDS 67, 000 3, 000 4 44 MI Asthma 21, 000 5 55 MI Asthma 90, 000 900 6 45 MI Diabetes 48, 000 750 7 25 IN Diabetes 49, 000 1, 200 8 35 MI AIDS 66, 000 2, 200 9 55 MI AIDS 69, 000 4, 200 10 45 MI Tuberculosis 34, 000 3, 100

Sampling n Sampling is the disclosure control method in which only a subset of records is released n If n is the number of elements in initial microdata and t the released number of elements we call sf = t / n the sampling factor n Simple random sampling is more frequently used. In this technique, each individual is chosen entirely by chance and each member of the population has an equal chance of being included in the sample Rec. ID Age State Diagnosis Income Billing 5 55 MI Asthma 90, 000 900 4 44 MI Asthma 21, 000 8 35 MI AIDS 66, 000 2, 200 9 55 MI AIDS 69, 000 4, 200 7 25 IN Diabetes 49, 000 1, 200

Microaggregation n Order records from the initial microdata by an attribute, create groups of consecutive values, replace those values by the group average n Microaggregation for attribute Income and minimum size 3 n The total sum for all Income values remains the same. Rec. ID Age State Diagnosis Income Billing 2 44 MI Asthma 30, 967 2, 500 4 44 MI Asthma 30, 967 1, 000 10 45 MI Tuberculosis 30, 967 3, 100 1 44 MI AIDS 47, 500 1, 200 6 45 MI Diabetes 47, 500 750 7 25 IN Diabetes 47, 500 1, 200 3 55 MI AIDS 73, 000 5 55 MI Asthma 73, 000 900 8 35 MI AIDS 73, 000 2, 200 9 55 MI AIDS 73, 000 4, 200

Data Swapping n In this disclosure method a sequence of so-called elementary swaps is applied to a microdata n An elementary swap consists of two actions: n n A random selection of two records i and j from the microdata A swap (interchange) of the values of the attribute being swapped for records i and j Rec. ID Age State Diagnosis Income Billing 1 44 MI AIDS 48, 000 1, 200 2 44 MI Asthma 37, 900 2, 500 3 55 MI AIDS 67, 000 3, 000 4 44 MI Asthma 21, 000 5 55 MI Asthma 90, 000 900 6 45 MI Diabetes 45, 500 750 7 25 IN Diabetes 49, 000 1, 200 8 35 MI AIDS 66, 000 2, 200 9 55 MI AIDS 69, 000 4, 200 10 45 MI Tuberculosis 34, 000 3, 100

Generalization and Suppression n • Generalization n n Suppression Replace the value with a less specific but semantically consistent value # Zip Age Nationality n Do not release a value at all Condition 1 41076 < 40 * Heart Disease 2 48202 < 40 * Heart Disease 3 41076 < 40 * Cancer 4 48202 < 40 * Cancer

Domain and Value Generalization Hierarchies Z 2 = {410**} 410** Z 1 = {4107*. 4109*} Z 0 = {41075, 41076, 41095, 41099} 4107* 41075 4109* 41076 Person S 1 = {Person} S 0 = {Male, Female} 41095 Male Female 41099

Generalization Lattice <S 1, Z 2> S 1 = {Person} S 0 = {Male, Female} <S 1, Z 1> <S 0, Z 2> <S 1, Z 0> [1, 2] <S 0, Z 1> Z 2 = {410**} <S 0, Z 0> Z 1 = {4107*, 4109*} Z 0 = {41075, 41076, 41095, 41099} [1, 1] [0, 2] [1, 0] [0, 1] Generalization Lattice [0, 0] Distance Vector Generalization Lattice

Generalization Tables

Outline n Problem definition n K-Anonymity Property n Disclosure Control Methods n Attacks and problems with k-Anonymity

Attacks against k-Anonymity n Unsorted Matching Attack n Complementary Release Attack n Temporal Attack n Homogeneity Attack for Attribute Disclosure

Unsorted Matching Attack Solution - Random shuffling of rows

Complementary Release Attack

Temporal Attack black 9/7/65 11/4/65 male 02139 headache rash PTt 1 GTt 1 black 1965 male 02139 headache rash

Homogeneity Attack k-Anonymity can create groups that leak information due to lack of diversity in sensitive attribute.

Coming up n Algorithms on k-anonymity n Improved principles on k-anonymity