Secure and efficient anonymization of distributed confidential databases

Abstract

Let us consider the following situation: $t$ entities (e.g., hospitals) hold different databases containing different records for the same type of confidential (e.g., medical) data. They want to deliver a protected version of this data to third parties (e.g., pharmaceutical researchers), preserving in some way both the utility and the privacy of the original data. This can be done by applying a statistical disclosure control (SDC) method. One possibility is that each entity protects its own database individually, but this strategy provides less utility and privacy than a collective strategy where the entities cooperate, by means of a distributed protocol, to produce a global protected dataset. In this paper, we investigate the problem of distributed protocols for SDC protection methods. We propose a simple, efficient and secure distributed protocol for the specific SDC method of rank shuffling. We run some experiments to evaluate the quality of this protocol and to compare the individual and collective strategies for solving the problem of protecting a distributed database. With respect to other distributed versions of SDC methods, the new protocol provides either more security or more efficiency, as we discuss through the paper.

Appendix: Distributed versions of rank swapping cannot be secure

Let us recall the argument given in [21] to show that any distributed privacy-preserving (or multiparty) version of any SDC method in the swapping family can never offer the desired level of privacy, in our scenario where confidential attributes are not modified.

Remember that swapping methods work attribute by attribute. For simplicity we consider the case where $X$ is partitioned between $t=2$ entities, $P_1$ and $P_2$. Therefore, $P_1$ knows all the attributes of some original records, whereas $P_2$ knows all the attributes of the rest of records. Assume now that $P_1$ and $P_2$ jointly apply a distributed protocol which results in $X' = \rho (X)$, where $\rho$ is a perturbation method which swaps pairs of values of the same attribute.

$P_1$ knows which records in $X'$ correspond to his original records, because the confidential attributes have not been modified. Let $i$ be the index of one of $P_2$’s original records. If the protection method is secure, then $P_1$ should not have a high probability to obtain information on the confidential attributes of the record $i$, even after having obtained the original non-confidential attributes of this record. But, for each of these original non-confidential attributes $x_{ij}$ of the record $i$, entity $P_1$ can look for it in $X'$. With reasonably high probability, $x_{ij}$ is now placed in a record $i' \ne i$ of $X'$ that corresponds to $P_1$. If this is the case, $P_1$ can look for his value $x_{i'j}$ in $X'$, which for sure will be in the record $i$, because the applied method is a swapping one.

Once $P_1$ has found the protected record $i$ where $x_{i'j}$ lies, he has re-identified the non-confidential attributes of some record belonging to $P_2$ with the corresponding confidential attributes, breaking in this way the privacy of the system.

A simple example of this kind of attacks is illustrated in Fig. 5. Original records in boldface correspond to records of entity $P_1$, whereas the rest of original records correspond to entity $P_2$. Once the distributed swapping method is applied, the protected dataset $X'$ is publicly available. $P_1$ realizes that only one record (his first one, with 1 as the value for $at_1$ and 4 as the value for $at_2$) had ’high’ as the value of attribute $at_3$. In $X'$, this records has 5 as the value for $at_1$ and 6 as the value for $at_2$, which do not correspond to any record of $P_1$. This means that values 1 and 5 for $at_1$ and values 4 and 6 for $at_2$ have been swapped. As a consequence, $P_1$ knows that the record (owned by $P_2$) with $at_1=5$ has confidential attribute $at_3=$ ‘very high’, and the record (owned by $P_2$) with $at_2=6$ also has $at_3=$ ‘very high’. Other combinations (with $P_2$ as the attacker, as well) can be easily found.

Fig. 5

Example: insecurity of distributed rank swapping

Of course, if the values of an attribute for different records have many repetitions, this method is less effective. On the other hand, running this attack for different attributes, the success probability for the attacker $P_1$ increases. The conclusion is that perturbation methods in the swapping family are not suitable for the scenario where the original database is distributed among several entities.