Privacy in Data Management Sharad Mehrotra 1 Privacy

Privacy in Data Management Sharad Mehrotra 1

Privacy - definitions Generic - Privacy is the interest that individuals have in sustaining a 'personal space', free from interference by other people and organizations. Information Privacy - - The degree to which an individual can determine which personal information is to be shared with whom and for what purpose. The evolving relationship between technology and the legal right to, or public expectation of privacy in the collection and sharing of data Identity privacy (anonymity) - Anonymity of an element (belonging to a set) refers to the property of that element of not being identifiable within the set, i. e. , being indistinguishable from the other elements of the set 2

Means of achieving privacy Information Security is the process of protecting data from unauthorized access, use, disclosure, destruction, modification, or disruption. Enforcing security in information processing applications: 1. 2. 3. 4. Law Access control Data encryption Data transformation – statistical disclosure control Techniques used depend on - Application semantics/functionality requirements Nature of data Privacy requirement/metrics Privacy is contextual 3

Overview Study the nature of privacy in context of datacentric applications 1. 2. 3. 4. Privacy-preserving data publishing for data mining applications Secure outsourcing of data: “Database as A Service (DAS)” Privacy-preserving implementation of pervasive spaces Secure data exchange and sharing between multiple parties 4

Privacy-Preserving / Anonymmized Data Publishing 5

Why Anonymize? o For Data Sharing n n o Give real(istic) data to others to study without compromising privacy of individuals in the data Allows third-parties to try new analysis and mining techniques not thought of by the data owner For Data Retention and Usage n n n Various requirements prevent companies from retaining customer information indefinitely E. g. Google progressively anonymizes IP addresses in search logs Internal sharing across departments (e. g. billing marketing) 6

Why Privacy? o o Data subjects have inherent right and expectation of privacy “Privacy” is a complex concept (beyond the scope of this tutorial) n What exactly does “privacy” mean? When does it apply? n Could there exist societies without a concept of privacy? Concretely: at collection “small print” outlines privacy rules n Most companies have adopted a privacy policy n E. g. AT&T privacy policy att. com/gen/privacy-policy? pid=2506 Significant legal framework relating to privacy n UN Declaration of Human Rights, US Constitution n HIPAA, Video Privacy Protection, Data Protection Acts 7

Case Study: US Census o o o Raw data: information about every US household n Who, where; age, gender, racial, income and educational data Why released: determine representation, planning How anonymized: aggregated to geographic areas (Zip code) n Broken down by various combinations of dimensions n Released in full after 72 years Attacks: no reports of successful deanonymization n Recent attempts by FBI to access raw data rebuffed Consequences: greater understanding of US population n Affects representation, funding of civil projects n Rich source of data for future historians and genealogists 8

Case Study: Netflix Prize o o o Raw data: 100 M dated ratings from 480 K users to 18 K movies Why released: improve predicting ratings of unlabeled examples How anonymized: exact details not described by Netflix n All direct customer information removed n Only subset of full data; dates modified; some ratings deleted, n Movie title and year published in full Attacks: dataset is claimed vulnerable [Narayanan Shmatikov 08] n Attack links data to IMDB where same users also rated movies n Find matches based on similar ratings or dates in both Consequences: rich source of user data for researchers n unclear if attacks are a threat—no lawsuits or apologies yet 9

Case Study: AOL Search Data o o o Raw data: 20 M search queries for 650 K users from 2006 Why released: allow researchers to understand search patterns How anonymized: user identifiers removed n All searches from same user linked by an arbitrary identifier Attacks: many successful attacks identified individual users n Ego-surfers: people typed in their own names n Zip codes and town names identify an area n NY Times identified 4417749 as 62 yr old GA widow [Barbaro Zeller 06] Consequences: CTO resigned, two researchers fired n Well-intentioned effort failed due to inadequate anonymization 10

Three Abstract Examples o “Census” data recording incomes and demographics n n o “Video” data recording movies viewed n n o Schema: (Uid, DOB, Sex, ZIP), (Vid, title, genre), (Uid, Vid) Graph data—graph properties should be retained “Search” data recording web searches n n o Schema: (SSN, DOB, Sex, ZIP, Salary) Tabular data—best represented as a table Schema: (Uid, Kw 1, Kw 2, …) Set data—each user has different set of keywords Each example has different anonymization needs 11

Models of Anonymization o o o Interactive Model (akin to statistical databases) n Data owner acts as “gatekeeper” to data n Researchers pose queries in some agreed language n Gatekeeper gives an (anonymized) answer, or refuses to answer “Send me your code” model n Data owner executes code on their system and reports result n Cannot be sure that the code is not malicious Offline, aka “publish and be damned” model n Data owner somehow anonymizes data set n Publishes the results to the world, and retires n Our focus in this tutorial – seems to model most real releases 12

Objectives for Anonymization o o o Prevent (high confidence) inference of associations n Prevent inference of salary for an individual in “census” n Prevent inference of individual’s viewing history in “video” n Prevent inference of individual’s search history in “search” n All aim to prevent linking sensitive information to an individual Prevent inference of presence of an individual in the data set n Satisfying “presence” also satisfies “association” (not vice-versa) n Presence in a data set can violate privacy (eg STD clinic patients) Have to model what knowledge might be known to attacker n Background knowledge: facts about the data set (X has salary Y) n Domain knowledge: broad properties of data (illness Z rare in men) 13

Utility o Anonymization is meaningless if utility of data not considered n n o The empty data set has perfect privacy, but no utility The original data has full utility, but no privacy What is “utility”? Depends what the application is… n n n For fixed query set, can look at max, average distortion Problem for publishing: want to support unknown applications! Need some way to quantify utility of alternate anonymizations 14

Measures of Utility o o Define a surrogate measure and try to optimize n Often based on the “information loss” of the anonymization n Simple example: number of rows suppressed in a table Give a guarantee for all queries in some fixed class n Hope the class is representative, so other uses have low distortion n Costly: some methods enumerate all queries, or all anonymizations Empirical Evaluation n Perform experiments with a reasonable workload on the result n Compare to results on original data (e. g. Netflix prize problems) Combinations of multiple methods n Optimize for some surrogate, but also evaluate on real queries 15

Definitions of Technical Terms o o o Identifiers–uniquely identify, e. g. Social Security Number (SSN) n Step 0: remove all identifiers n Was not enough for AOL search data Quasi-Identifiers (QI)—such as DOB, Sex, ZIP Code n Enough to partially identify an individual in a dataset n DOB+Sex+ZIP unique for 87% of US Residents [Sweeney 02] Sensitive attributes (SA)—the associations we want to hide n Salary in the “census” example is considered sensitive n Not always well-defined: only some “search” queries sensitive n In “video”, association between user and video is sensitive n SA can be identifying: bonus may identify salary… 16

Summary of Anonymization Motivation o o o Anonymization needed for safe data sharing and retention n Many legal requirements apply Various privacy definitions possible n Primarily, prevent inference of sensitive information n Under some assumptions of background knowledge Utility of the anonymized data needs to be carefully studied n Different data types imply different classes of query 17

Privacy issues in data outsourcing (DAS) and cloud computing applications 18

Motivation 19

20

21

22

Example: DAS - Secure outsourcing of data management DB Data owner/Client Issues: Server Service Provider n Confidential information in data needs to be protected n Features – support queries on data: SQL, keyword based search-queries, XPath queries etc. n Performance - Bulk of work to be done on server, reduce communication overhead, client-side storage and postprocessing of solutions. 23

Security model for DAS applications Adversaries (A): o o Inside attackers: authorized users with malicious intent Outside attackers: hackers, snoopers Attack models: o Passive attacks: A wants to learn confidential information o Active attacks: A wants to learn confidential information + actively modifies data and/or queries Trust on server: o Untrusted: normal hardware, data & computation visible o Semi-trusted: trusted co-processors + limited storage o Trusted: All hardware is trusted & tamper-proof 24

Secure data storage & querying in DAS DB Service Provider Server Data owner/Client R ssn name credit rating salary age 780 John bad 34 K 32 876 Mary good 29 K 40 : : Security concern: “ssn” “salary” & “credit rating” is confidential How to execute queries on encrypted data? Encrypt the sensitive column values e. g. Select * from R where salary [25 K, 35 K] Trivial solution: retrieve all rows to client, decrypt them and check for predicate We can do better Use secure indices for query evaluation on server 25

Data storage • Encrypt the rows Client side meta-data • Partition salary values into buckets • Index the etuples by their bucket-labels buckets B 0 0 B 1 20 B 2 30 B 3 40 50 Server side data RS : Server side Table (encrypted + indexed) R: Original Table (plain text) ssn name sex credit rating sal age 345 Tom Male Bad 34 k 32 876 Mary Female Good 29 k 40 234 Jerry Male Good 45 k 34 780 John Male Bad 39 k 33 Encrypt etuple bucket (^#&*%T%&4&7 ERGTty^Q!%^&* B 2 &^$^G@UG^g&@^&&#G@@#(GW B 1 &*#($T%#$@$R@@$#@^FG$%& B 3 &*#($T%#$@$R@@$#@^FG$%& B 2 26

Querying encrypted data Select * from R where sal [25 K, 35 K] Client side data Client-side query B 0 0 Server-side query B 1 20 B 2 30 Select etuple from RS where bucket = B 1 ∨ B 2 B 3 40 50 False positive Server side Table (encrypted + indexed) Client side Table (plain text) RS R ssn name sex credit rating sal age 345 Tom Male Bad 34 k 32 876 Mary Female Good 29 k 40 234 Jerry Male Good 45 k 34 780 John Male Bad 39 k 33 etuple bucket (^#&*%T%&4&7 ERGTty^Q!%^&* B 2 &^$^G@UG^g&@^&&#G@@#(GW B 1 &*#($T%#$@$R@@$#@^FG$%& B 3 &*#($T%#$@$R@@$#@^FG$%& B 2 27

Problems to address o o o Security analysis n Goal: To hide away the confidential information in data from server-side adversaries (DB admins etc. ) n Quantitative measures of disclosure-risk Quality of partitioning (bucketization) n Data partitioning schemes n Cost measures Tradeoff n Balancing the two competing goals of security & performance Continued later … 28

Privacy in Cloud Computing o What is cloud computing? n n n Many definition exist Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e. g. , networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. [NIST] Clouds are a large pool of easily usable and accessible virtualized resources (such as hardware, development platforms and/or services). These resources can be dynamically re-configured to adjust to a variable load (scale), allowing also for an optimum resource utilization. This pool of resources is typically exploited by a pay-per-use model in which guarantees are offered by the Infrastructure Provider by means of customized service-level agreements. [Luis M. Vaquero et al. , Madrid Spain] 29

Privacy in Cloud Computing o Actors n Service Providers o n Service Users o n Personal, business, government Infrastructure Providers o o Provide software services (Ex: Google, Yahoo, Microsoft, IBM, etc…) Provide the computing infrastructure required to host services Three cloud services n Cloud Software as a Service (Saa. S) o n Cloud Platform as a Service (Paa. S) o n Use provider’s applications over a network Deploy customer-created applications to a cloud Cloud Infrastructure as a Service (Iaa. S) o Rent processing, storage, network capacity, and other fundamental computing resources 30

Privacy in Cloud Computing o Examples of cloud computing services n n n Web-based email Photo storing Spreadsheet applications File transfer Online medical record storage Social network applications 31

Privacy in Cloud Computing o Privacy issues in cloud computing n n Cloud increases security and privacy risks Data o o n Create enormous risks for data privacy o o n Creation, storage, communication – exponential rate Data replicated across large geographic distances Data contain personal identifiable information Data stored at untrusted hosts lost of control of sensitive data Risk of sharing sensitive data with marketing Other problem: technology ahead of law o o Does the user or the hosting company own the data? Can the host deny a user access to their own data? If the host company goes out of business, what happens to the users' data it holds? How does the host protect the user's data? 32

Privacy in Cloud Computing o Solutions n n n o Effort n n o The cloud does not offer any privacy Awareness Some effort ACM Cloud Computing Security Workshop, November, 2009 ACM Symposium on Cloud Computing, June, 2010 Privacy in cloud computing at UCI n n Recently lunched a project on privacy-preservation in cloud computing General approach: personal privacy middleware 33

Privacy preservation in Pervasive Spaces 34

Privacy in data sharing and exchange 40

Extra material 41

Example: Detecting a pre-specified set of events o o No ordinary coffee room, one that is monitored ! There are rules that apply Just like a coffee room !! If rule is violated, penalties may be imposed But all is not unfair: individuals have right to privacy ! ”Till an individual has not had more than his quota of coffee, his identity will not be revealed” 42

Issues to be addressed o o o Modeling pervasive spaces: How to capture events of interest n E. g. , “Tom had his 4 th cup of coffee for the day” Privacy goal: Guarantee anonymity to individuals n What are the necessary and sufficient conditions? Solution n Design should satisfy the necessary and sufficient conditions n Practical/scalable 43

Basic events, Composite events & Rules o Model of pervasive space: Pervasive Space with sensors o o o Composite event: one or more sequence of basic events Rule: (Composite event, Action) Rules apply to groups of individuals, e. g. : n Coffee room rules apply to everyone n Server room rule applies to everyone except administrators etc. Stream of basic events A stream of basic events : : ek: <Bill, coffee-room, coffee-maker, exit> : : e 2: <Tom, coffee-room, coffee-cup, dispense> e 1: <Tom, coffee-room, *, enter> 44

Composite-events & automaton templates Composite-event templates o “A student drinks more than 3 cups of coffee” e 1 ≡ <u ∈ STUDENT, coffee_room, coffee_cup, dispense> o “A student tries to access the IBM machine in the server room” e 1 ≡ <u ∈ STUDENT, server_room, *, entry> e 2 ≡ <ū, server_room, *, exit> e 3 ≡ <ū, server_room, IBM-mc, loginattempt> 45

System architecture & adversary Secure Sensor node (SSN) Server Rules DB : : Secure Sensor node (SSN) Basic Assumptions about SSNs o o o State Information Thin trusted middleware to obfuscate origin of events Trusted hardware (Sensors are tamper-proof) Secure data capture & generation of basic events by SSN Limited computation + storage capacity: can carry out encryption/decryption with secret key common to all SSNs, automaton transition 46

Privacy goal & Adversary’s knowledge Ensure k-anonymity for each individual (k-anonymity is achieved when each individual is indistinguishable from at least k-1 other individuals associated with the space ) Passive adversary (A): Server-side snooper who wants to deduce the identity of the individual associated with a basic-event o o o A knows all rules of the space & automaton structures A can observe all server-side activities A has unlimited computation power Minimum requirement to ensure anonymity: State information (automatons) are always kept encrypted on server 47

Basic protocol SERVER Return automatons that (possibly) match e (encrypted match) Store updated automatons SECURE SENSOR NODE Generate basic event e Encrypted query for automatons that make transition on e Decrypt automatons, advance the state of automatons if necessary associate encrypted label with new state. Write-back encrypted automatons Question: Does encryption ensure anonymity? NO! pattern of automaton access may reveal identity 48

Example R 1 R 2 R 3 U enters kitchen U takes coffee U enters kitchen U opens fridge Applies to Tom enters Kitchen 3 firings U enters kitchen U opens microwave Applies to Bill enters Kitchen 2 firings R 1 R 2 U enters kitchen U takes coffee U enters kitchen U opens fridge On an event, the # rows retrieved from state table can disclose the identity of the individual 49

Characteristic access patterns of automatons The set of rules applicable to an individual maybe unique potentially identify the individual x Tom enters kitchen Tom takes coffee Rules applicable to TOM Characteristic patterns of x P 1: {x, y, z} {x y} y z Tom enters kitchen s take m o T e coffe Tom ope fridg ns e Tom opens fridge Tom leaves coffee pot empty Tom leaves fridge open Characteristic patterns of y P 2: {x, y, z} {x, y} {y} P 3: {x, y, z} {y} Characteristic patterns of z P 4: {x, y, z} {y z} The characteristic access patterns of rows can potentially reveal the identity of the automaton in spite of encryption 50

Solution scheme o Formalized the notion of indistinguishability of automatons in terms of their access patterns o Identified “event clustering” as a mechanism for inducing indistinguishability for achieving k-anonymity n n Proved the difficulty of checking for k-anonymity Characterized the class of event-clustering schemes that achieve kanonymity o Proposed an efficient clustering algorithm to minimize average execution overhead for protocol o Implemented a prototype system o Challenges: n Designing a truly secure sensing-infrastructure is challenging n Key management issues n Are there other interesting notions of privacy in pervasive space? 51