Preservation of proximity privacy in publishing numerical sensitive data

Abstract

We identify proximity breach as a privacy threat specific to numerical sensitive attributes in anonymized data publication. Such breach occurs when an adversary concludes with high confidence that the sensitive value of a victim individual must fall in a short interval -even though the adversary may have low confidence about the victim's actual value.None of the existing anonymization principles (e.g., kanonymity, l-diversity, etc.) can effectively prevent proximity breach. We remedy the problem by introducing a novel principle called (ε, m)-anonymity. Intuitively, the principle demands that, given a QI-group G, for every sensitive value x in G, at most 1/m of the tuples in G can have sensitive values "similar" to x, where the similarity is controlled by ε. We provide a careful analytical study of the theoretical characteristics of (ε, m)-anonymity, and the corresponding generalization algorithm. Our findings are verified by experiments with real data.

Generalizing PIR for Practical Private Retrieval of Public Data

“…In some contexts, the basic principle of k-Anonymity is not sufficient to protect data privacy, for example in a group of data with little diversity or high similarity. Therefore, a number of proposals designed new privacy principles to enhance the privacy of k-Anonymity [12,13,5,6,7]. However, they are not easy to apply in the private retrieval of public data applications.…”

“…As pointed out in [5,6,7], there should be enough difference between the data items in an anonymized range (in a bounding box in the case of bbPIR) under a privacy breach probability P brh , which we call neighborhood difference, otherwise the private data can be determined in a narrow range with probability P brh . Instead of using the non-numeric Adult data set, we generated a synthetic data set with 10 6 numeric data keys and values, which follow a Zipf distribution and are in the range of [0.0, 1.0].…”

“…However, a potential security threat with k-Anonymity is that both the client query and the server answer, although anonymized for protecting the client's privacy, are in plain text that can be seen by a third party. The privacy of k-Anonymity for numeric data has also been questioned by a number of proposals [5,6,7] for potential proximity breach: the real private data and the blurred data could be so close that the server can conclude with probability 1/k that the private data is in a narrow range. Computational Private Information Retrieval (cPIR) [8] retrieves a bit from a public bit string on a server without revealing to the server the position of the desired bit under some intractability assumption.…”

XColor: Protecting general proximity privacy

“…In the setting of central publication, a publisher intends to release an anonymized version T * of the microdata table T , such that no malicious user, called an attacker, can infer the sensitive information regarding any individual from T * , whereas the statistical utility of T is still preserved in T * . Towards this end, a bulk of work has been done on anonymized data publication [1], [3], [7], [9], [10], [11], [12], [13], [14], [15], [16]. One of the major aims is to address association attack: the attacker possesses the exact non-sensitive (quasi-identifier (QI)) values of the victim, and attempts to discover his/her sensitive (SA) value from the published table T * .…”

“…Existing privacy principles and definitions (e.g., [9], [10], [11], [12], [13], [15], [16]), however, are incapable of capturing this general form of breach because of their assumptions regarding the underlying data models. Recently, ( , δ) kdissimilarity [14], a data-model-independent privacy principle, has been proposed as an effective countermeasure against general proximity breach.…”