Privacy preserving linkage using multiple dynamic match keys

Randall, Sean; Brown, Adrian; Ferrante, Anna; Boyd, James H.

doi:10.23889/ijpds.v4i1.1094

Cited by 11 publications

(35 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…As a result, further modifications to Bloom filter encodings have been suggested [ 16 , 17 ]. Work in this area is ongoing, although it should be noted that these modifications have an effect on linkage quality, with record-level Bloom filters unable to achieve as high linkage quality as found with field/key-level Bloom filters [ 7 ].…”

Section: Discussionmentioning

confidence: 99%

“…The data was encoded for privacy preserving linkage using field-based Bloom filters; each identifier was encoded into a separate Bloom filter, with a standard probabilistic record linkage method used on these encoded identifiers. This approach has been described previously in the literature [ 3 ]; previous studies suggest it provides higher linkage quality than other privacy preserving methods [ 7 ].…”

Section: Methodsmentioning

confidence: 99%

See 1 more Smart Citation

A blinded evaluation of privacy preserving record linkage with Bloom filters

Randall

Wichmann

Brown

et al. 2022

BMC Med Res Methodol

Self Cite

View full text Add to dashboard Cite

Background Privacy preserving record linkage (PPRL) methods using Bloom filters have shown promise for use in operational linkage settings. However real-world evaluations are required to confirm their suitability in practice. Methods An extract of records from the Western Australian (WA) Hospital Morbidity Data Collection 2011–2015 and WA Death Registrations 2011–2015 were encoded to Bloom filters, and then linked using privacy-preserving methods. Results were compared to a traditional, un-encoded linkage of the same datasets using the same blocking criteria to enable direct investigation of the comparison step. The encoded linkage was carried out in a blinded setting, where there was no access to un-encoded data or a ‘truth set’. Results The PPRL method using Bloom filters provided similar linkage quality to the traditional un-encoded linkage, with 99.3% of ‘groupings’ identical between privacy preserving and clear-text linkage. Conclusion The Bloom filter method appears suitable for use in situations where clear-text identifiers cannot be provided for linkage.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Methodsmentioning

confidence: 99%

A blinded evaluation of privacy preserving record linkage with Bloom filters

Randall

Wichmann

Brown

et al. 2022

BMC Med Res Methodol

Self Cite

View full text Add to dashboard Cite

show abstract

“…The use of combinations of QID values (called linkage keys) is commonly used for deterministic linkage [6]. A single attribute combination (such as SLK-581 [23]) or multiple attribute combinations (such as p-signatures [34]), which can improve the likelihood of identifying matches [29], can be used to generate linkage keys to identify matches. However, linkage keys cannot tolerate differences in QID values, nor can they handle missing values or use additional information such as relationships between records [23,29,34].…”

Section: Related Workmentioning

confidence: 99%

Large Scale Record Linkage in the Presence of Missing Data

Ranbaduge,

Christen,

Schnell

2021

Preprint

View full text Add to dashboard Cite

Record linkage is aimed at the accurate and efficient identification of records that represent the same entity within or across disparate databases. It is a fundamental task in data integration and increasingly required for accurate decision making in application domains ranging from health analytics to national security. Traditional record linkage techniques calculate string similarities between quasi-identifying (QID) values, such as the names and addresses of people. Errors, variations, and missing QID values can however lead to low linkage quality because the similarities between records cannot be calculated accurately. To overcome this challenge, we propose a novel technique that can accurately link records even when QID values contain errors or variations, or are missing. We first generate attribute signatures (concatenated QID values) using an Apriori based selection of suitable QID attributes, and then relational signatures that encapsulate relationship information between records. Combined, these signatures can uniquely identify individual records and facilitate fast and high quality linking of very large databases through accurate similarity calculations between records. We evaluate the linkage quality and scalability of our approach using large real-world databases, showing that it can achieve high linkage quality even when the databases being linked contain substantial amounts of missing values and errors.

show abstract

“…We now briefly describe the main steps of multiple dynamic match-key encoding as proposed by Randall et al [5]. Common notations used throughout the paper are shown in Table 1.…”

Section: Multiple Dynamic Match-key Approachmentioning

confidence: 99%

“…The multiple dynamic match-key approach [5] is a recently proposed method for PPRL which aims to provide privacy protection against frequency attacks, while achieving high linkage quality. As we describe next, the main idea of this approach is to generate distinct hash-codes (called match-key values) using attribute value combinations (called match-keys) and compare these match-key values across databases to identify matching pairs of records.…”

Section: Introductionmentioning

confidence: 99%

Privacy Attack on Multiple Dynamic Match-key based Privacy-Preserving Record Linkage

Vidanage

Ranbaduge

Christen

et al. 2020

IJPDS

Self Cite

View full text Add to dashboard Cite

Introduction Over the last decade, the demand for linking records about people across databases has increased in various domains. Privacy challenges associated with linking sensitive information led to the development of privacy-preserving record linkage techniques. The multiple dynamic match-key encoding approach recently proposed by Randall et al. (IJPDS, 2019) is such a technique aimed at providing sufficient privacy for linkage applications while obtaining high linkage quality. However, the use of this encoding in large databases can reveal frequency information that can allow the re-identification of encoded values. Objectives We propose a frequency-based attack to evaluate the privacy guarantees of multiple dynamic match-key encoding. We then present two improvements to this match-key encoding approach to prevent such a privacy attack. Methods The proposed attack analyses the frequency distributions of individual match-keys in order to identify the attributes used for each match-key, where we assume the adversary has access to a plain-text database with similar characteristics as the encoded database. We employ a set of statistical correlation tests to compare the frequency distributions of match-key values between the encoded and plain-text databases. Once the attribute combinations used for match-keys are discovered, we then re-identify encoded sensitive values by utilising a frequency alignment method. Next, we propose two modifications to the match-key encoding; one to alter the original frequency distributions and another to make the frequency distributions uniform. Both will help to prevent frequency-based attacks. Results We evaluate our privacy attack using two large real-world databases. The results show that in certain situations the attack can successfully re-identify a set of sensitive values encoded using the multiple dynamic match-key encoding approach. On the databases used in our experiments, the attack is able to re-identify plain-text values with a precision and recall of both up to 98%. Furthermore, we show that our proposed improvements are able to make this attack harder to perform with only a small reduction in linkage quality. Conclusions Our proposed privacy attack demonstrates the weaknesses of multiple match-key encoding that should be taken into consideration when linking databases that contain sensitive personal information. Our proposed modifications ensure that the multiple dynamic match-key encoding approach can be used securely while retaining high linkage quality.

show abstract

Privacy preserving linkage using multiple dynamic match keys

Cited by 11 publications

References 26 publications

A blinded evaluation of privacy preserving record linkage with Bloom filters

A blinded evaluation of privacy preserving record linkage with Bloom filters

Large Scale Record Linkage in the Presence of Missing Data

Privacy Attack on Multiple Dynamic Match-key based Privacy-Preserving Record Linkage

Contact Info

Product

Resources

About