US 2010/0162402 A1 · DATA ANONYMIZATION BASED ON GUESSING ANONYMITY

Abstract

Privacy is defined in the context of a guessing game based on the so-called guessing inequality. The privacy of a sanitized record, i.e., guessing anonymity, is defined by the number of guesses an attacker needs to correctly guess an original record used to generate a sanitized record. Using this definition, optimization problems are formulated that optimize a second anonymization parameter (privacy or data distortion) given constraints on a first anonymization parameter (data distortion or privacy, respectively). Optimization is performed across a spectrum of possible values for at least one noise parameter within a noise model. Noise is then generated based on the noise parameter value(s) and applied to the data, which may comprise real and/or categorical data. Prior to anonymization, the data may have identifiers suppressed, whereas outlier data values in the noise perturbed data may be likewise modified to further ensure privacy.

Claims41

Dependent claims

A method, implemented by a processing device, to perform anonymization of data through application of noise to the data, the anonymization assessed according to a first anonymization parameter and a second anonymization parameter, the method comprising:

determining a desired level for the first anonymization parameter;
determining a value for a noise parameter of a noise model based on optimization of the second anonymization parameter subject to the desired level for the first anonymization parameter;
and
applying noise, generated by the noise model based on the value, to the data to provide noise perturbed data,
wherein the noise, when applied to the data, ensures anonymization performance according to the first anonymization parameter no worse than the desired level.

2 more elements

An apparatus for anonymizing data through application of noise to the data, the anonymization assessed according to a first anonymization parameter and a second anonymization parameter, the apparatus comprising:

a noise generation component configured to provide noise based on a noise model and a parameter value for a parameter of the noise model determined according to optimization of the second anonymization parameter subject to a desired level for the first anonymization parameter, wherein the noise, when applied to the data, ensures anonymization performance according to the first anonymization parameter no worse than the desired level;
and
an anonymizing component, in communication with the noise generation component, operative to apply the noise to the data to provide noise perturbed data.

at least one processor;
at least one storage device, in communication with the at least one processor, having stored thereon executable instructions that, when executed, cause the at least one processor to:
determine a desired level for the first anonymization parameter;
determine a value for a noise parameter of a noise model based on optimization of the second anonymization parameter subject to the desired level for the first anonymization parameter;
and
apply noise, generated by the noise model based on the value, to the data to provide noise perturbed data,
wherein the noise, when applied to the data, ensures anonymization performance according to the first anonymization parameter no worse than the desired level.

4 more elements

Dependencies are inferred from the claim text.

Data anonymization based on guessing anonymity

Life of this patent

Data anonymization based on guessing anonymity

Life of this patent

Abstract

Claims41