Privacy Inference Attacking and Prevention on Multiple Relative K-Anonymized Microdata Sets

Abstract

In k-anonymity modeling process, it is widely assumed that a relational table of microdata is published with a single sensitive attribute. This assumption is too simple and unreasonable. We observe that multiple sensitive attributes in one or more tables may incur privacy inference violations that are not visible under the single sensitive attribute assumption. In this paper, a new (k, ℓ)-anonymity model is introduced beyond the existed ℓ-diversity mechanism, which is an improved microdata publication model that can effectively prevent these multiple-attributed privacy violations. The (k, ℓ)-anonymity process consists of two phases: k-anonymization on identifying attributes and ℓ-diversity on sensitive attributes. The related (k, ℓ)-anonymity algorithms are proposed and the data generalization metric is provided for minimizing the anonymization cost. A running example illustrates this technique in detail, which also convinces its effectiveness.