. S. Verykios 2 and P A. Karakasidis 1 , V . Christen 3 1 Department - - PowerPoint PPT Presentation

▶
s verykios 2 and p a karakasidis 1 v
SMART_READER_LITE
LIVE PREVIEW

. S. Verykios 2 and P A. Karakasidis 1 , V . Christen 3 1 Department - - PowerPoint PPT Presentation

Oct 07, 2022 253 likes •657 views

DPM 2011 - Leuven, Belgium 15-16 September 2011 . S. Verykios 2 and P A. Karakasidis 1 , V . Christen 3 1 Department of Computer and Communication Engineering University of Thessaly Volos, Greece akarakasidis@inf.uth.gr 2 School of Science and T

slide-1
SLIDE 1

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

1

  • A. Karakasidis1, V

. S. Verykios2 and P . Christen3

1 Department of Computer and Communication Engineering

University of Thessaly Volos, Greece akarakasidis@inf.uth.gr

2 School of Science and T

echnology Hellenic Open University Patras, Greece verykios@eap.gr

3 ANU College of Engineering and Computer Science

The Australian National University Canberra, Australia peter .christen@anu.edu.au

slide-2
SLIDE 2

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

2

Approximate matching without common

unique identifiers

Integration without compromising privacy Examples:

Merging medical data Locating tax evaders

slide-3
SLIDE 3

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

3

Let µ be a privacy metric for PPRL. A plain text database Dpt and its ciphered

equivalent Dc.

µ represents the ability to infer data from Dpt

using data from Dc

Higher values of µ

  • higher inference ability.
slide-4
SLIDE 4

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

4

A PPRL method is considered to offer

sufficient privacy guaranties, if the value of its privacy metric µ does not exceed a predetermined privacy threshold δ.

slide-5
SLIDE 5

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

5

Considering data sources A, B, we wish to

perform record matching between datasets RA and RB in a way that at the end of the process the privacy metric for source A, µΑ will not exceed δA.

More flexible definition

slide-6
SLIDE 6

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

6

Three ways for providing privacy

Suppression Perturbation Generalization

slide-7
SLIDE 7

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

7

Inherent Generalization Characteristics Retain the first letter of the name and drop all other

  • ccurrences of a, e, h, i, o, u, w, y.

Replace consonants with digits as follows (after the

first letter):

b, f, p, v => 1 c, g, j, k, q, s, x, z => 2 d, t => 3 l => 4 m, n => 5 r => 6 T

wo adjacent letters with the same number are coded as a single number .

Continue until you have one letter and three numbers.

If you run out of letters, fill in 0s until there are three numbers.

slide-8
SLIDE 8

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

8

Based on Soundex inherent privacy Using a trusted third party Fake codes to enhance privacy

slide-9
SLIDE 9

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

9

A B C

ID Sndx Surname 1 F632 2 J525 Johnson 3 K364 Miller 4 M460 ID Sndx Surname 1 A100 2 F632 Fortson 3 J525 Johnsen 4 M346

slide-10
SLIDE 10

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

10

Sources send data to the third party

A B C

ID Sndx Surname 1 F632 2 J525 Johnson 3 K364 Miller 4 M460 ID Sndx Surname 1 A100 2 F632 Fortson 3 J525 Johnsen 4 M346

slide-11
SLIDE 11

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

11

A B C The third party joins the Soundex codes

JOIN JOIN

ID Sndx Surname 1 F632 2 J525 Johnson 3 K364 Miller 4 M460 ID Sndx Surname 1 A100 2 F632 Fortson 3 J525 Johnsen 4 M346

slide-12
SLIDE 12

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

12

A B C The third party returns the matching identifiers

A[1,2] B[2,3]

ID Sndx Surname 1 F632 2 J525 Johnson 3 K364 Miller 4 M460 ID Sndx Surname 1 A100 2 F632 Fortson 3 J525 Johnsen 4 M346

slide-13
SLIDE 13

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

13

A B C Sources determine identifiers

ID Sndx Surname 1 F632 2 J525 Johnson 3 K364 Miller 4 M460 ID Sndx Surname 1 A100 2 F632 Fortson 3 J525 Johnsen 4 M346

slide-14
SLIDE 14

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

14

A B C Sources ask directly data from each other

A requests: J525 B requests: J525, F632

ID Sndx Surname 1 F632 2 J525 Johnson 3 K364 Miller 4 M460 ID Sndx Surname 1 A100 2 F632 Fortson 3 J525 Johnsen 4 M346

slide-15
SLIDE 15

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

15

A B C

A delivers data B delivers data

Sources deliver data

ID Sndx Surname 1 F632 2 J525 Johnson 3 K364 Miller 4 M460 ID Sndx Surname 1 A100 2 F632 Fortson 3 J525 Johnsen 4 M346

slide-16
SLIDE 16

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

16

Need for a Privacy Metric Use of Information Theory

Calculation of Entropy Calculation of Information Gain Calculation of Relative Information Gain

slide-17
SLIDE 17

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

17

The amount of information in a message. Entropy provides a degree of a set’s

predictability

Low entropy of X means low uncertainty and as a

result, high predictability of X’s values.

slide-18
SLIDE 18

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

18

Quantification of the amount of uncertainty

in predicting the value of the discrete random variable Y given X.

slide-19
SLIDE 19

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

19

The difficulty of inferring the original text

(Y), knowing its enciphered version (X)

How the knowledge of X’s value can reduce

the uncertainty of inferring Y .

Lower Information Gain means that it is

difficult to infer the original text from the cipher.

slide-20
SLIDE 20

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

20

Information Gain depends on the size of the

measured dataset.

Relative Information Gain on the other hand,

provides a normalized scale.

slide-21
SLIDE 21

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

21

Uniform Ciphertext / Uniform Plaintext Uniform Ciphertexts by Swapping Plaintexts k-anonymous Ciphertexts

slide-22
SLIDE 22

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

22

Intuitive approach To reduce RIG, plaintexts and ciphertexts

appear equal number of times

Inject fake records so that all ciphers map to

an equal number of surnames

slide-23
SLIDE 23

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

23

Calculate the average number of plaintext

  • ccurrences ⌈ K⌉ for each Soundex code

For Soundex codes with more than ⌈K⌉ occurrences,

remove the plaintexts redundant occurrences

Add an equal number of fake occurrences for

Soundex codes with less than ⌈K⌉ appearances,

Each Soundex code appears exactly ⌈K⌉ times.

slide-24
SLIDE 24

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

24

For:

Avoid oversized datasets

Against:

Removed plaintexts will have to be separately

matched.

slide-25
SLIDE 25

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

25

Same intuition with Sweeney’s k-anonymity Create datasets so that each Soundex code

reflects to at least k Surnames.

Parametric approach with k as its tuning

parameter.

For each Soundex code with less than k

Surnames we inject fake surnames.

T

unable by means of the k parameter.

slide-26
SLIDE 26

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

26

Four datasets with different distributions Real world and synthetic data Study on a single (Surname) field

slide-27
SLIDE 27

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

27

Assess the amount of information hidden by

Soundex

Calculate

Entropy H(Surname) and Conditional Entropy H(Surname|Soundex)

slide-28
SLIDE 28

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

28

slide-29
SLIDE 29

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

29

Drop in RIG represents how much privacy we

gain.

Quantitatively measure the inherent

reduction in RIG that the Soundex algorithm provides

slide-30
SLIDE 30

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

30

slide-31
SLIDE 31

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

31

Use fake records in order to further reduce

RIG

Results for

UCUP UCSP kaC

slide-32
SLIDE 32

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

32

Determine privacy gain by each fake

injection strategy

Measure results for all four distributions

slide-33
SLIDE 33

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

33

slide-34
SLIDE 34

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

34

Determine impact on data quality Estimate the number of additional records

required by each strategy

Gather results for all four distributions

slide-35
SLIDE 35

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

35

slide-36
SLIDE 36

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

36

Private record matching using differential

privacy, Inan et al (2010)

Privacy-preserving record linkage using

Bloom filters, Schnell et al (2009)

Privacy preserving schema and data

matching, Scannapieco et al (2007)

slide-37
SLIDE 37

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

37

Privacy without complicated encryption schemes Use more fields Probabilistic alternative of Soundex Experiment with more phonetic algorithms And many more…

slide-38
SLIDE 38

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

38

This research is partially supported by the

FP7 ICT/FET Project MODAP (Mobility, Data Mining, and Privacy) funded by the European

Visit us here: www.modap.org.

slide-39
SLIDE 39

DPM 2011 - Leuven, Belgium 15-16 September 2011

  • A. Karakasidis - University of Thessaly

39

For your attention