A framework for efficient data anonymization under privacy and accuracy constraints

Abstract

Recent research studied the problem of publishing microdata without revealing sensitive information, leading to the privacy-preserving paradigms of k-anonymity and -diversity. k-anonymity protects against the identification of an individual's record. -diversity, in addition, safeguards against the association of an individual with specific sensitive information. However, existing approaches suffer from at least one of the following drawbacks: (i) -diversification is solved by techniques developed for the simpler k-anonymization problem, causing unnecessary information loss.(ii) The anonymization process is inefficient in terms of computational and I/O cost. (iii) Previous research focused exclusively on the privacy-constrained problem and ignored the equally important accuracy-constrained (or dual) anonymization problem.In this article, we propose a framework for efficient anonymization of microdata that addresses these deficiencies. First, we focus on one-dimensional (i.e., single-attribute) quasi-identifiers, and study the properties of optimal solutions under the k-anonymity and -diversity models for the privacy-constrained (i.e., direct) and the accuracy-constrained (i.e., dual) anonymization problems. Guided by these properties, we develop efficient heuristics to solve the one-dimensional problems in linear time. Finally, we generalize our solutions to multidimensional quasi-identifiers using space-mapping techniques. Extensive experimental evaluation shows that our techniques clearly outperform the existing approaches in terms of execution time and information loss.

No free lunch in data privacy

“…In some cases utility is so important that some exact statistics about the data must be released. After this initial data release, additional queries can be answered, with degraded accuracy, as long as they do not introduce an additional privacy breach (note that this is a special case of the dual privacy problem where the goal is to provide as much privacy subject to utility constraints [15]). For example:…”

Limiting Attribute Disclosure in Randomization Based Microdata Release

“…Finally, we are interested in comparing our randomization approaches to most recently developed generalization approaches (e.g., the accuracy-constrained l-diversification method in [14]). We are also interested in combining the derived optimal randomization schemes with the small domain randomization [38] to further improve utility preservation.…”

“…The method generalizes the values of quasiidentifier attributes to less-specific ones, so that each individual cannot be distinguished from at least k − 1 other individuals based on quasi-identifier information. There has been much study in designing efficient algorithms for k-anonymity using generalization and suppression techniques [2,3,5,13,14].…”

“…The proposed randomization model is compared to traditional l-diversity [2] and anatomy [5] models. Recently, Ghinita et al [14] proposed a framework to solve the privacy-constrained and accuracy constrained data anonymization problems under the k-anonymity and l-diversity models. They developed efficient heuristics to solve the one-dimensional problems in linear time and generalized solutions to multi-dimensional attributes using space-mapping techniques.…”

Computing Covariance and Correlation in Optimally Privacy-Protected Statistical Databases: Feasible Algorithms

“…On the other hand, if they are too narrow, e.g., if some box contains only one record, then the privacy of this record is not well-protected. To properly protect privacy, we need to make sure for some sufficiently large integer K, each box b contains at least K records (this is called K-anonymity; see, e.g., [8]), and that for each variable x i , there are at least ℓ different values of this variable coming from records within this box (this is called ℓ-diversity); see, e.g., [1]. Boxes do not have to come from thresholds.…”