Transcription

1 ProtectingPrivacywhenDisclosingInformation:k-Anonymity anditsenforcementthroughgeneralizationandsuppression ComputerScienceLaboratory MenloPark,CA94025,USA PierangelaSamaratiy SRIInternational MassachusettsInstituteofTechnology LaboratoryforComputerScience Cambridge,MA02139,USA LatanyaSweeney Today'sgloballynetworkedsocietyplacesgreatdemandonthedisseminationandsharingofperson-specic data.situationswhereaggregatestatisticalinformationwasoncethereportingnormnowrelyheavilyonthe transferofmicroscopicallydetailedtransactionandencounterinformation.thishappensatatimewhen Abstract asangerprint,evenwhenthesourcesoftheinformationcontainsnoexplicitidentiers,suchasname together,theyprovideanelectronicshadowofapersonororganizationthatisasidentifyingandpersonal moreandmorehistoricallypublicinformationisalsoelectronicallyavailable.whenthesedataarelinked otherdistinctivedata,whichwetermquasi-identiers,oftencombineuniquelyandcanbelinkedtopublicly andphonenumber.inordertoprotecttheanonymityofindividualstowhomreleaseddatarefer,data holdersoftenremoveorencryptexplicitidentierssuchasnames,addressesandphonenumbers.however, availableinformationtore-identifyindividuals. usinggeneralizationandsuppressiontechniques.weintroducetheconceptofminimalgeneralization,which ambiguouslymaptheinformationtoatleastkentities.weillustratehowk-anonymitycanbeprovidedby theanonymityoftheindividualstowhomthedatarefer.theapproachisbasedonthedenitionofkanonymity.atableprovidesk-anonymityifattemptstolinkexplicitlyidentifyinginformationtoitscontents Inthispaperweaddresstheproblemofreleasingperson-specicdatawhile,atthesametime,safeguarding capturesthepropertyofthereleaseprocessnottodistortthedatamorethanneededtoachievek-anonymity. releasesofrealmedicalinformation.wealsoreportonthequalityofthereleaseddatabymeasuringthe Weillustratepossiblepreferencepoliciestochooseamongdierentminimalgeneralizations.Finally,we presentanalgorithmandexperimentalresultswhenanimplementationofthealgorithmwasusedtoproduce precisionandcompletenessoftheresultsfordierentvaluesofk. bymedicalinformaticstraininggrantit15lm07092fromthenationallibraryofmedicine. andbythenationalsciencefoundationundergrantecs theworkoflatanyasweeneywassupported TheworkofPierangelaSamaratiwassupportedinpartDARPA/RomeLaboratoryundergrantF C-0337 yonleavefromuniversitadimilano. 1

2 forinformation,allkindsofinformationformanynewandoftenexcitinguses.mostactionsindailylife 1IntheageoftheInternetandinexpensivecomputingpower,societyhasdevelopedaninsatiableappetite arerecordedonsomecomputersomewhere.thatinformationinturnisoftenshared,exchanged,andsold. Introduction Manypeoplemaynotcarethatthelocalgrocerkeepstrackofwhichitemstheypurchase,butshared informationcanbequitesensitiveordamagingtoindividualsandorganizations.improperdisclosureof medicalinformation,nancialinformationormattersofnationalsecuritycanhavealarmingramications, andmanyabuseshavebeencited[2,23].theobjectiveistoreleaseinformationfreelybuttodosoinaway thattheidentityofanyindividualcontainedinthedatacannotberecognized.inthisway,informationcan besharedfreelyandusedformanynewpurposes. andphonenumber,fromdatasothatotherinformationinthedatacanbeshared,incorrectlybelieving thattheidentitiesofindividualscannotbedetermined.onthecontrary,de-identifyingdataprovidesno Dataholders,includinggovernmentagencies,oftenremoveallexplicitidentiers,suchasname,address, guaranteeofanonymity[18].releasedinformationoftencontainsotherdata,suchasbirthdate,gender, Shockingly,thereremainsacommonincorrectbeliefthatifthedatalooksanonymous,itisanonymous. andzipcode,thatincombinationcanbelinkedtopubliclyavailableinformationtore-identifyindividuals. Mostmunicipalitiessellpopulationregistersthatincludetheidentitiesofindividualsalongwithbasicdemographics;examplesincludelocalcensusdata,voterlists,citydirectories,andinformationfrommotorvehicle uniquebirthdates,29%wereuniquewithrespecttobirthdateandgender,69%withrespecttobirthdate anda5-digitzipcode,and,97%wereidentiablewithjustthefullpostalcodeandbirthdate[18].these agencies,taxassessors,andrealestateagencies.forexample,anelectronicversionofacity'svoterlistwas namesandaddresses,thevoterlistincludedthebirthdatesandgendersof54,805voters.ofthese,12%had ofbirth,ethnicity,genderandmartialstatus,canbe. resultsrevealhowuniquelyidentifyingcombinationsofbasicdemographicattributes,suchaszipcode,date purchasedfortwentydollarsandusedtoshowtheeaseofre-identifyingmedicalrecords[18].inadditionto MaritalStatusgcanalsoappearinsomeexternaltablejointlywiththeindividualidentity,andcanthereforeallowittobetracked.AsillustratedinFigure1,ZIP,DateOfBirth,andSexcanbelinkedtothingnamesandSocialSecurityNumbers(SSNs)soasnottodisclosetheidentitiesofindividualstowhom thedatarefer.however,valuesofotherreleasedattributes,suchasfzip,dateofbirth,ethnicity,sex, Toillustratethisproblem,Figure1exempliesatableofreleasedmedicaldatade-identiedbysuppress- tootherpubliclyavailablepopulationregisters.inthemedicaldatatableoffigure1,thereisonlyone VoterListtorevealtheName,Address,andCity.Likewise,EthnicityandMaritalStatuscanbelinked female,bornon9/15/61andlivinginthe02142area.fromtheuniquenessresultsmentionedpreviously regardinganactualvoterlist,morethan69%ofthe54,805voterscouldbeuniquelyidentiedusingjust theseattributes.thiscombinationuniquelyidentiesthecorrespondingbulletedtupleinthereleaseddata determinewhichmedicaldataamongthosereleasedarehers.)whilethisexampledemonstratedanexact individuals,andthedesiredprotectionistoreleasethemedicalinformationsuchthattheidentitiesofthe individualscannotbedetermined.however,theofthereleasedcharacteristicsforsuej.carlsonleadsto shortnessofbreath.(noticethemedicalinformationisnotassumedtobepubliclyassociatedwiththe aspertainingto\suej.carlson,1459mainstreet,cambridge"andthereforerevealsshehasreported match,insomecases,releasedinformationcanbelinkedtoarestrictivesetofindividualstowhomthe releasedinformationcouldrefer. blingandswappingvaluesandaddingnoisetothedatainsuchawayastomaintainanoverallstatistical propertyoftheresult[1,21].however,manynewusesofdata,includingdatamining,costanalysisand systemshavebeenreleasedwhichusesuppressionandgeneralizationastechniquestoprovidedisclosurecon- retrospectiveresearch,oftenneedaccurateinformationwithinthetupleitself.twoindependentlydeveloped Severalprotectiontechniqueshavebeendevelopedwithrespecttostatisticaldatabases,suchasscram- 2

3 SSNNameEthnicityDateOfBirthSex asian MedicalDataReleasedasAnonymous 09/27/64 09/30/64 04/18/64 04/15/64 03/13/63 female02139divorced ZIP 02139married MaritalStatusProblem chestpain black 03/18/63 09/13/64 09/07/64 05/14/61 05/08/61 female02141married 02138married 02138single hypertension chestpain Name white Address09/15/61CityVoterList female02142widow ZIP DOB Sex Party obesity shortnessofbreath SueJ.Carlson1459MainSt.Cambridge021429/15/61femaledemocrat Figure1:Re-identifyinganonymousdatabylinkingtoexternaldata trolwhilemaintainingtheintegrityofthevalueswithineachtuple-namelydatayintheunitedstates[17] andmu-argus[11]ineurope.however,noformalfoundationsorabstractionhavebeenprovidedforthe techniquesemployedbyboth.furtherapproximationsmadebythesystemscansuerfromdrawbacks,such asgeneralizingdatamorethanisneeded,like[17],ornotprovidingadequateprotection,like[11]. applicationofgeneralizationandsuppressiontowardsitssolution.weintroducethedenitionofquasiidentiersasattributesthatcanbeexploitedforlinking,andofk-anonymityascharacterizingthedegree Inthispaperweprovideaformalfoundationfortheanonymityproblemagainstlinkingandforthe ininformationreleasesbygeneralizingand/orsuppressingpartofthedatatobedisclosed.withinthis ofprotectionofdatawithrespecttoinferencebylinking.weshowhowk-anonymitycanbeensured presentanalgorithmtocomputeapreferredminimalgeneralizationofagiventable.finally,wediscuss framework,weintroducetheconceptsofgeneralizedtableandofminimalgeneralization.intuitively,a thedenitionofpreferredgeneralizationallowstheusertoselect,amongpossibleminimalgeneralizations, someexperimentalresultsderivedfromtheapplicationofourapproachtoamedicaldatabasecontaining thosethatsatisfyparticularconditions,suchasfavoringcertainattributesinthegeneralizationprocess.we generalizationisminimalifdataarenotgeneralizedmorethannecessarytoprovidek-anonymity.also, informationon265patients. 4,8,9,12,22]problems.Accesscontrolsystemsaddresstheproblemofcontrollingspecicaccesstodata withrespecttorulesstatingwhetherapieceofdatacanorcannotbereleased.inourworkitisnotthe ratherthefactthatthedatareferstoaparticularentity.statisticaldatabasetechniquesaddresstheproblem disclosureofthespecicpieceofdatatobeprotected(i.e.,onwhichanaccessdecisioncanbetaken),but Theproblemweconsiderdiersfromthetraditionalaccesscontrol[3]andfromstatisticaldatabase[1, insuchaframeworkbyensuringthatitisnotpossibleforuserstoinferoriginalindividualdatafromthe ofproducingtabulardatarepresentingasummaryoftheinformationtobequeried.protectionisenforced producedsummary.inourapproach,instead,weallowthereleaseofgeneralizedperson-specicdataon whichuserscanproducesummariesaccordingtotheirneeds.theadvantagewithrespecttoprecomputed andavailabilityhasasadrawback,fromtheend-userstandpoint,acoarsegranularitylevelofthedata. release-specicstatisticsisanincreasedexibilityandavailabilityofinformationfortheusers.thisexibility Thisnewtypeofdeclassicationandreleaseofinformationseemstoberequiredmoreandmoreintoday's emergingapplications[18]. Theremainderofthispaperisorganizedasfollows.InSection2weintroducebasicassumptionsand 3

4 denitions.insection3wediscussgeneralizationtoprovideanonymity,andinsection4wecontinuethe discussiontoincludesuppression.insection5basicpreferencepoliciesforchoosingamongdierentminimal generalizationsareillustrated.insection6wediscussanalgorithmicimplementationofourapproach. Section7reportssomeexperimentalresults.Section8concludesthepaper. Weconsiderthedataholder'stabletobeaprivatetablePTwhereeachtuplereferstoadierententity 2(individual,organization,andsoon).FromtheprivatetablePT,thedataholderconstructsatablewhichis tobeananonymousreleaseofpt.forthesakeofsimplicity,wewillsubsequentlyrefertotheprivacyandreidenticationofindividualsincasesequallyapplicabletootherentities.weassumethatallexplicitidentiers (e.g.,names,ssns,andaddresses)areeitherencryptedorsuppressed,andwethereforeignoretheminthe remainderofthispaper.borrowingtheterminologyfrom[6],wecallthecombinationofcharacteristicson whichlinkingcanbeenforcedquasi-identiers.quasi-identiersmustthereforebeprotected.theyare denedasfollows. Denition2.1(Quasi-identier)LetT(A1;:::;An)beatable.Aquasi-identierofTisasetofattributesfAi;:::;AjgfA1;:::;Angwhosereleasemustbecontrolled. maintainingduplicatetuples,ofattributesai;:::;ajint.also,qitdenotesthesetofquasi-identiers t[ai;:::;aj]denotesthesequenceofthevaluesofai;:::;ajint,t(ai;:::;aj)denotestheprojection, associatedwitht,andjtjdenotescardinality,thatis,thenumberoftuplesint. GivenatableT(A1;:::;An),asubsetofattributesfAi;:::;AjgfA1;:::;Ang,andatuplet2T, Assumptionsandpreliminarydenitions Theanonymityconstraintrequiresreleasedinformationtoindistinctlyrelatetoatleastagivennumberkof individuals,wherekistypicallysetbythedataholder,asstatedbythefollowingrequirement. Denition2.2(k-anonymityrequirement)Eachreleaseofdatamustbesuchthateverycombination Ourgoalistoallowthereleaseofinformationinthetablewhileensuringtheanonymityoftheindividuals. obviouslyanimpossibletaskforthedataholder.althoughwecanassumethatthedataholderknows matches.thiscanbedonebyexplicitlylinkingthereleaseddatawithexternallyavailabledata.thisis ofvaluesofquasi-identierscanbeindistinctlymatchedtoatleastkindividuals. valuesofdatainexternalknowledgecannotbeassumed.thekeytosatisfyingthek-anonymityrequirement, whichattributesmayappearinexternaltables,andthereforewhatconstitutesquasi-identiers,thespecic Adherencetotheanonymityrequirementnecessitatesknowinghowmanyindividualseachreleasedtuple therefore,istotranslatetherequirementintermsofthereleaseddatathemselves.inordertodothat,we Assumption2.1AllattributesintablePTwhicharetobereleasedandwhichareexternallyavailablein requirethefollowingassumptiontohold. combination(i.e.,appearingtogetherinanexternaltableorinpossiblejoinsbetweenexternaltables)1toa datarecipientaredenedinaquasi-dentierassociatedwithpt. attributesmightbeusedtolinkwithoutsideknowledge;thisofcourseformsthebasisforaquasi-identier. Whiletheexpectationofthisknowledgeissomewhatreasonableforpubliclyavailabledata,werecognizethat therearefartoomanysourcesofsemipublicandprivateinformationsuchaspharmacyrecords,longitudinal Althoughthisisnotatrivialassumptionitsenforcementispossible.Thedataholderestimateswhich 1Auniversalrelationcombiningexternaltablescanbeimagined[20]. 4

5 studies,nancialrecords,surveyresponses,occupationallists,andmembershiplists,toaccountapriorifor alllinkingpossibilities[18].supposethechoiceofattributesforaquasi-identierisincorrect;thatis,the dataholdermisjudgeswhichattributesaresensitiveforlinking.inthiscase,thereleaseddatamaybeless anonymousthanwhatwasrequired,andasaresult,individualsmaybemoreeasilyidentied.sweeney[18] examinesthisriskandshowsthatitcannotbeperfectlyresolvedbythedataholdersincethedataholder andcontracts.intheremainderofthiswork,weassumethatproperquasi-identiershavebeenrecognized. cannotalwaysknowwhateachrecipientofthedataknows.[18]posessolutionsthatresideinpolicies,laws, Denition2.3(k-anonymity)LetT(A1;:::;An)beatableandQITbethequasi-identiersassociated withit.tissaidtosatisfyk-anonymityiforeachquasi-identierqi2qiteachsequenceofvaluesin T[QI]appearsatleastwithkoccurrencesinT[QI]. Weintroducethedenitionofk-anonymityforatableasfollows. tupleforeachidentitytobeprotected(i.e.,towhomaquasi-identierrefers),k-anonymityofareleased atablesatisfyingdenition2.3foragiven,ksatisesthek-anonymityrequirementforsuchak.consider tablerepresentsasucientconditionforthesatisfactionofthek-anonymityrequirement.inotherwords, aquasi-identierqi;ifdenition2.3issatised,eachtupleinpt[qi]hasatleastkoccurrences.since UnderAssumption2.1,andunderthehypothesisthattheprivatelystoredtablecontainsatmostone thepopulationoftheprivatetableisasubsetofthepopulationoftheoutsideworld,therewillbeatleast kindividualsintheoutsideworldmatchingthesevalues.also,sinceallattributesavailableoutsidein suchaset.(notealsothatanysubsetoftheattributesinqiwillrefertok0>kindividuals.)toillustrate, considerthesituationexempliedinfigure1butassumethatthereleaseddatacontainedtwooccurrences combinationareincludedinqi,noadditionalattributescanbejointtoqitoreducethecardinalityof ofthesequencewhite,09/15/64,female,02142,widow.thenatleasttwoindividualsmatchingsuch occurrenceswillexistinthevoterlist(orinthetablecombiningthevoterlistwithallotherexternaltables), providedintherelease,eachmedicalrecordcouldindistinctlybelongtoatleasttwoindividuals. withthesevaluesofthequasi-identierbelongtowhichofthetwoindividuals.sincek-anonymityof2was anditwillnotbepossibleforthedatarecipienttodeterminewhichofthetwomedicalrecordsassociated 3theproblemofproducingaversionofPTwhichsatisesk-anonymity. Giventheassumptionanddenitionsabove,andgivenaprivatetablePTtobereleased,wefocuson Ourrstapproachtoprovidingk-anonymityisbasedonthedenitionanduseofgeneralizationrelationships betweendomainsandbetweenvaluesthatattributescanassume. Generalizingdata Inaclassicalrelationaldatabasesystem,domainsareusedtodescribethesetofvaluesthatattributes 3.1Generalizationrelationships assume.forexample,theremightbeazipcodedomain,anumberdomain,andastringdomain.we extendthisnotionofadomaintomakeiteasiertodescribehowtogeneralizethevaluesofanattribute.in theoriginaldatabase,whereeveryvalueisasspecicaspossible,everyattributeisinthegrounddomain. usedtodescribezipcodes,z1,inwhichthelastdigithasbeenreplacedbya0.thereisalsoamappingfrom Forexample,02139isinthegroundZIPcodedomain,Z0.Toachievek-anonymity,wecanmaketheZIP codelessinformative.wedothisbysayingthatthereisamoregeneral,lessspecic,domainthatcanbe Z0toZ1,suchas02139!02130.Thismappingbetweendomainsisstatedbymeansofageneralization relationship,whichrepresentsapartialorderdonthesetdomofdomains,andwhichisrequiredto satisfythefollowingconditions:(1)eachdomaindihasatmostonedirectgeneralizeddomain,and(2)all 5

6 Z2=f02100g Z1=f02130;02140g Z0=f02138;20239;02141;02142g 6DGHZ * 02139HYHH E0=fasian;black;caucasiang E1=fpersong 6DGHE0 asian * VGHE0 person black HY6HH M2=fnotreleasedg caucasian H M1=foncemarried;nevermarriedg M0=fmarried;divorced;widow;singleg 6DGHM0 oncemarriednotreleased marrieddivorcedwidow 36Q * QkQ HYHH VGHM0nevermarried Hsingle 6 E1=fnotreleasedg E0=fmale;femaleg 6DGHG0 notreleased Figure2:Examplesofdomainandvaluegeneralizationhierarchies female generalizedvaluescanbeusedinplaceofmorespecicones,itisimportantthatalldomainsinahierarchy maximalelementsofdomaresingleton.2thedenitionofthisgeneralizationimpliestheexistence,foreach domaind2dom,ofahierarchy,whichwetermthedomaingeneralizationhierarchydghd.since becompatible.compatibilitycanbeensuredbyusingthesamestoragerepresentationformforalldomains inageneralizationhierarchy.avaluegeneralizationrelationship,partialorderv,isalsodenedwhich associateswitheachvalueviinadomaindiauniquevalueindomaindjdirectgeneralizationofdi.such Example3.1Figure2illustratesanexampleofdomainandvaluegeneralizationhierarchiesfordomain arelationshipimpliestheexistence,foreachdomaind,ofavaluegeneralizationhierarchyvghd. Z0representingzip-codesoftheCambridge,MA,area,E0representingethnicities,M0representingmarital impliedgeneralizationrelationshipsdonotappearasarcsinthegraph).wewillusethetermhierarchy status,andg0representinggender. ofthegraphrepresentingallandonlythedirectgeneralizationrelationshipsbetweentheelementsinit(i.e., generalizationrelationshipsbetweenitselements.wewillexplicitlyrefertotheorderedsetortothegraph interchangeablytodenoteeitherapartiallyorderedsetorthegraphrepresentingthesetandallthedirect Intheremainderofthispaperwewilloftenrefertoadomainorvaluegeneralizationhierarchyinterms andhierarchiesintermsoftuplescomposedofelementsofdomoroftheirvalues.givenatupledt= whenitisnototherwiseclearfromcontext. hd1;:::;dnisuchthatdi2dom;i=1;:::;n,wedenethedomaingeneralizationhierarchyofdtas DGHDT=DGHD1:::DGHDn,assumingthattheCartesianproductisorderedbyimposingcoordinatewiseorder[7].DGHDTdenesalatticewhoseminimalelementisDT.Thegeneralizationhierarchyof Also,sincewewillbedealingwithsetsofattributes,itisusefultovisualizethegeneralizationrelationship fromdttotheuniquemaximalelementofdghdtinthegraphdescribingdghdtdenesapossible alternativepaththatcanbefollowedinthegeneralizationprocess.werefertothesetofnodesineachof adomaintupledtdenesthedierentwaysinwhichdtcanbegeneralized.inparticular,eachpath suchpathstogetherwiththegeneralizationrelationshipsbetweenthemasageneralizationstrategyfor singlevalue. DGHDT.Figure3illustratesthedomaingeneralizationhierarchyDGHE0;Z0wherethedomaingeneralization hierarchiesofe0andz0areasillustratedinfigure2. 2Themotivationbehindcondition2istoensurethatallvaluesineachdomaincanbeeventuallygeneralizedtoa 6

7 he1;z1i he0;z2i he0;z0i he0;z1i 6 he1;z2i he1;z1i he1;z2i DGH DT he1;z0i he0;z0i 6GS1 he1;z1i he1;z2i he0;z1i he0;z0i GS2 6 he0;z2i he0;z1i he0;z0i GS3 6 Eth:E0ZIP:Z0 Figure3:DomaingeneralizationhierarchyDGHDTandstrategiesforDT=hE0;Z0i asian Eth:E1ZIP:Z0 black whitept Eth:E1ZIP:Z1 person02138 person02139 person02141 person02142 Eth:E0ZIP:Z2 GT[1;0] person02130 asian person02140 Eth:E0ZIP:Z1 GT[1;1] white black GT[0;2] asian black Figure4:ExamplesofgeneralizedtablesforPT white GT[0;1] generalizedvalues.sincemultiplevaluescanmaptoasinglegeneralizedvalue,generalizationmaydecrease inthetable.intuitively,attributevaluesstoredintheprivatetablecanbesubstituted,uponrelease,with GivenaprivatetablePT,ourrstapproachtoprovidek-anonymityconsistsofgeneralizingthevaluesstored 3.2Generalizedtableandminimalgeneralization thenumberofdistincttuples,therebypossiblyincreasingthesizeoftheclusterscontainingtupleswiththe AiintableT.Di=dom(Ai;PT)denotesthedomainassociatedwithattributeAiintheprivatetablePT. itsvalueswithcorrespondingvaluesfromamoregeneraldomain.generalizationattheattributelevel process,thedomainofanattributecanchange.inthefollowing,dom(ai;t)denotesthedomainofattribute ensuresthatallvaluesofanattributebelongtothesamedomain.however,asaresultofthegeneralization samevalues.weperformgeneralizationattheattributelevel.generalizinganattributemeanssubstituting Denition3.1(GeneralizedTable)LetTi(A1;:::;An)andTj(A1;:::;An)betwotablesdenedonthe samesetofattributes.tjissaidtobeageneralizationofti,writtentitj,i 1.jTij=jTjj 2.8z=1;:::;n:dom(Az;Ti)Ddom(Az;Tj) i(1)tiandtjhavethesamenumberoftuples,(2)thedomainofeachattributeintjisequaltoora 3.ItispossibletodeneabijectivemappingbetweenTiandTjthatassociateseachtuplestiandtjsuch Denition3.1statesthatatableTjisageneralizationofatableTi,denedonthesameattributes, thatti[az]vtj[az]. 7

8 he1;z1i he0;z2i he0;z0i he0;z1i 6 [1,1][1,2][0,2] he0;z0i intj(andviceversa)suchthatthevalueforeachattributeintjisequaltoorageneralizationofthevalue generalizationofthedomainoftheattributeinti,and(3)eachtupletiintihasacorrespondingtupletj Figure5:HierarchyDGHhE0;Z0iandcorrespondinglatticeondistancevectors chiesfore0andz0illustratedinfigure2.theremainingfourtablesinfigure4areallpossiblegeneralized Example3.2ConsiderthetablePTillustratedinFigure4andthedomainandvaluegeneralizationhierar- ofthecorrespondingattributeinti. k-anonymityfork=1;2;gt[1;0]satisesk-anonymityfork=1;2;3;gt[0;2]satisesk-anonymityfor tablesforpt,butthetopmostonegeneralizeseachtupletohperson;02100i.fortheclarityoftheexample, eachtablereportsthedomainforeachattributeinthetable.withrespecttok-anonymity,gt[0;1]satises equallysatisfactory.forinstance,thetrivialgeneralizationbringingeachattributetothehighestpossible k=1;:::;4,andgt[1;1]satisesk-anonymityfork=1;:::;6: levelofgeneralization,thuscollapsingalltuplesinttothesamelistofvalues,providesk-anonymityat thepriceofastronggeneralizationofthedata.suchextremegeneralizationisnotneededifamorespecic table(i.e.,containingmorespecicvalues)existswhichsatisesk-anonymity.thisconceptiscapturedby Givenatable,dierentpossiblegeneralizationsexist.Notallgeneralizations,however,canbeconsidered thedenitionofk-minimalgeneralization.tointroduceitwerstintroducethenotionofdistancevector. Example3.3ConsidertablePTanditsgeneralizedtablesillustratedinFigure4.Thedistancevectors ThedistancevectorofTjfromTiisthevectorDVi;j=[d1;:::;dn]whereeachdzisthelengthoftheunique pathbetweend=dom(az;ti)anddom(az;tj)inthedomaingeneralizationhierarchydghd. Denition3.2(Distancevector)LetTi(A1;:::;An)andTj(A1;:::;An)betwotablessuchthatTiTj. betweenptanditsdierentgeneralizationsarethevectorsappearingasasubscriptofeachtable. 1;:::;n;DV<DV0iDVDV0andDV6=DV0.Ageneralizationhierarchyforadomaintuplecanbeseen representingtherelationshipbetweenthedistancevectorscorrespondingtothepossiblegeneralizationof asahierarchy(lattice)onthecorrespondingdistancevectors.forinstance,figure5illustratesthelattice he0;z0i. GiventwodistancevectorsDV=[d1;:::;dn]andDV0=[d01;:::;d0n],DVDV0idid0iforalli= beak-minimalgeneralizationoftii Denition3.3(k-minimalgeneralization)LetTiandTjbetwotablessuchthatTiTj.Tjissaidto Wecannowintroducethedenitionofk-minimalgeneralization. 1.Tjsatisesk-anonymity 8

9 EthnDOB asian09/27/64female02139divorced asian09/30/64female02139divorced asian04/18/64male asian04/15/64male black03/13/63male black03/18/63male Sex ZIP 02139married 02138married Status black09/13/64female02141married black09/07/64female02141married white05/14/61male white05/08/61male white09/15/61female02142widow EthnDOBSexPT ZIP02138single asian64 black63 Status EthnDOB black64 white61 Sex ZIP Status GT[0;2;1;2;2] [60-65]female02130been notrel02100notrel [60-65]male 02130been Figure6:AnexampleoftablePTanditsminimalgeneralizations pers [60-65]female02140been GT[1;3;0;1;1] 02130never anonymitywhichisdominatedbytjinthedomaingeneralizationhierarchyofhd1;:::;dni(or,equivalently, inthecorrespondinglatticeofdistancevectors).ifthiswerethecasetjwoulditselfbeageneralizationfor 2.69Tz:TiTz;Tzsatisesk-anonymity,andDVi;z<DVi;j. Tz.Notealsothatatablecanbeaminimalgeneralizationofitselfifthetablealreadyachievedk-anonymity. Intuitively,ageneralizationTjisminimalitheredoesnotexistanothergeneralizationTzsatisfyingk- Example3.4ConsidertablePTanditsgeneralizedtablesillustratedinFigure4.AssumeQI=(Eth;ZIP) tobeaquasi-identier.itiseasytoseethatfork=2thereexisttwok-minimalgeneralizations,whichare GT[1;0]andGT[0;1].TableGT[0;2],whichsatisestheanonymityrequirements,isnotminimalsinceitisa generalizationofgt[0;1].analogouslygt[1;1]cannotbeminimal,beingageneralizationofbothgt[1;0]and GT[0;1].Therearealsoonlytwok-minimalgeneralizedtablesfork=3,whichareGT[1;0]andGT[0;2]. quasi-identiers,foreveryminimalgeneralizationtj,dvi;j[dz]=0forallattributesazwhichdonotbelong toanyquasi-identier. Notethatsincek-anonymityrequirestheexistenceofk-occurrencesforeachsequenceofvaluesonlyfor 4InSection3wediscussedhow,givenaprivatetablePT,ageneralizedtablecanbeproducedwhichreleases theadvantageofallowingreleaseofallthesingletuplesinthetable,althoughinamoregeneralform.here, amoregeneralversionofthedatainptandwhichsatisesak-anonymityconstraint.generalizationhas Suppressingdata Suppressionisusedto\moderate"thegeneralizationprocesswhenalimitednumberofoutliers(thatis, new[5,21].weapplysuppressionatthetuplelevel,thatis,atuplecanbesuppressedonlyinitsentirety. weillustrateacomplementaryapproachtoprovidingk-anonymity,whichissuppression.suppressingmeans toremovedatafromthetablesothattheyarenotreleasedandasadisclosurecontroltechniqueisnot 9

10 EthnDOB asian09/27/64female02139divorced asian09/30/64female02139divorced asian04/18/64male asian04/15/64male black03/13/63male black03/18/63male Sex ZIP 02139married 02138married Status EthnDOBSex black09/13/64female02141married black09/07/64female02141married ZIP Status white05/14/61male white05/08/61male female02139divorced 02138single asian64 black63 black64 female02141married 02138married 02139married Figure7:AnexampleoftablePTanditsminimalgeneralization white61gt[0;2;0;0;0] 02138single Eth:E0ZIP:Z0 white02138 black02138 black02141 black02142 asian PT Eth:E1ZIP:Z0 person02141 Eth:E0ZIP:Z1 GT[1;0] black02130 asian Eth:E0ZIP:Z2 white02130 GT[0;1] black asian Eth:E1ZIP:Z1 white02100 GT[0;2] Figure8:ExamplesofgeneralizedtablesforPT person02140 person02130 GT[1;1] tupleswithlessthatkoccurrences)wouldforceagreatamountofgeneralization.toclarify,considerthe andsupposek-anonymitywithk=2istobeprovided.attributedateofbirthhasadomaindatewith tableillustratedinfigure1,whoseprojectionontheconsideredquasi-identierisillustratedinfigure6 onmaritalstatus,andeitheronefurthersteponsex,zipcode,andmaritalstatus,or,alternatively, stepsofgeneralizationondateofbirth,onestepofgeneralizationonzipcode,onestepofgeneralization thefollowinggeneralizations:fromthespecicdate(mm/dd/yy)tothemonth(mm/yy)totheyear(yy)toa 5-yearinterval(e.g.,[60-64])toa10-yearinterval(e.g.,[60,69])toa25-yearintervalandsoon.3Itiseasy toseethatthepresenceofthelasttupleinthetablenecessitates,forthisrequirementtobesatised,two generalizationonattributedateofbirth,asillustratedinfigure7.suppressingthetuplewouldinthis time,thathadthislasttuplenotbeenpresentk-anonymitycouldhavebeensimplyachievedbytwostepsof casepermitenforcementoflessgeneralization. onethnicityanddateofbirth.thetwopossibleminimalgeneralizationsareasillustratedinfigure6. Inpractice,inbothcasesalmostalltheattributesmustbegeneralized.Itcanbeeasilyseen,atthesame Denition4.1(GeneralizedTable-withsuppression)LetTi(A1;:::;An)andTj(A1;:::;An)betwo statingthedenitionofgeneralizedtableasfollows. tablesdenedonthesamesetofattributes.tjissaidtobeageneralizationofti,writtentitj,i Inillustratinghowsuppressioninterplayswithgeneralizationtoprovidek-anonymity,webeginbyre- 1.jTjjjTij 2.8z=1;:::;n:dom(Az;Ti)Ddom(Az;Tj) usingthesamerepresentationform.forinstance,themonthcanberepresentedalwaysasaspecicday.thisis 3Notethatalthoughgeneralizationmayseemtochangetheformatofthedata,compatibilitycanbeassuredby 3.ItispossibletodeneaninjectivemappingbetweenTiandTjthatassociatestuplesti2Tiandtj2Tj actuallythetrickthatweusedinourapplicationofgeneralization. suchthatti[az]vtj[az]. 10

11 Eth:E0ZIP:Z0 black asian Eth:E1ZIP:Z0 whitept Eth:E0ZIP:Z1 person02142 person GT[1;0] black asian Eth:E0ZIP:Z2 GT[0;1] black asian Eth:E1ZIP:Z1 GT[0;2] Figure9:ExamplesofgeneralizedtablesforPT person02140 person02130 GT[1;1] correspondinggeneralizedtupleintj.intuitively,tuplesintinothavinganycorrespondentintjaretuples whichhavebeensuppressed. ThedenitionabovediersfromDenition3.1sinceitallowstuplesappearinginTinottohaveany Thisiscapturedbythefollowingdenition. intablesthatsuppressmoretuplesthannecessarytoachievek-anonymityatagivenlevelofgeneralization. Denition4.2(Minimalrequiredsuppression)LetTibeatableandTjageneralizationofTisatisfyingk-anonymity.Tjissaidtoenforceminimalrequiredsuppressioni69TzsuchthatTiTz;DVi;z= DVi;j;jTjj<jTzjandTzsatisesk-anonymity. boldfaceandmarkedwithdoublelinesineachtablearethetuplesthatmustbesuppressedtoachievek- anysupersetwouldbeunnecessary(notsatisfyingminimalrequiredsuppression). anonymityof2.suppressionofasubsetofthemwouldnotreachtherequiredanonymity.suppressionof Denition4.1allowsanyamountofsuppressioninageneralizedtable.Obviously,wearenotinterested Example4.1ConsiderthetablePTanditsgeneralizationsillustratedinFigure8.Thetupleswrittenin occurrences. straintbyenforcingminimalsuppressionisunique.thistableisobtainedbyrstapplyingthegeneralization describedbythedistancevectorandthenremovingallandonlythetuplesthatappearwithfewerthank prove,however,thatforeachpossibledistancevector,thegeneralizedtablesatisfyingak-anonymitycon- Allowingtuplestobesuppressedtypicallyaordsmoretablesperlevelofgeneralization.Itistrivialto generalizationsthatweconsiderenforceminimalrequiredsuppression.hence,inthefollowing,withinthe contextofak-anonymityconstraint,whenreferringtothegeneralizationatagivendistancevectorwewill intendtheuniquegeneralizationforthatdistancevectorwhichsatisesthek-anonymityconstraintenforcing minimalrequiredsuppression.toillustrate,considerthetableptinfigure8;withrespecttok-anonymity IntheremainderofthispaperweassumetheconditionstatedinDenition4.2tobesatised,thatis,all applied.forinstance,wehavealreadynoticedhow,withrespecttothetableinfigure1,generalization haveleftanemptyrowtocorrespondtoeachremovedtuple.) whichsatisesk-anonymity.itistrivialtonotethatthetwoapproachesproducethebestresultswhenjointly withk=2,wewouldrefertoitsgeneralizationsasillustratedinfigure9.(notethatforsakeofclarity,we tuplesinthetable.jointapplicationofthetwotechniquesallows,instead,thereleaseofatablelikethe aloneisunsatisfactory(seefigure6).suppressionalone,ontheotherside,wouldrequiresuppressionofall Generalizationandsuppressionaretwodierentapproachestoobtaining,fromagiventable,atable oneinfigure7.thequestionisthereforewhetheritisbettertogeneralize,atthecostoflessprecision acceptablethreshold,suppressionisconsideredpreferabletogeneralization(inotherwords,itisbetterto inthedata,ortosuppress,atthecostofcompleteness.fromobservationsofreal-lifeapplicationsand requirements[16],weassumethefollowing.weconsideranacceptablesuppressionthresholdmaxsup,as specied,statingthemaximumnumberofsuppressedtuplesthatisconsideredacceptable.withinthis 11

12 suppressmoretuplesthantoenforcemoregeneralization).thereasonforthisisthatsuppressionaects inthetable.tableswhichenforcesuppressionbeyondmaxsupareconsideredunacceptable. singletupleswhereasgeneralizationmodiesallvaluesassociatedwithanattribute,thusaectingalltuples Denition4.3(k-minimalgeneralization-withsuppression)LetTiandTjbetwotablessuchthat intoconsideration. TiTjandletMaxSupbethespeciedthresholdofacceptablesuppression.Tjissaidtobeak-minimal Giventheseassumptions,wecannowrestatethedenitionofk-minimalgeneralizationtakingsuppression generalizationofatabletii 1.Tjsatisesk-anonymity 2.jTij?jTjjMaxSup thanitisallowed,andtheredoesnotexistanothergeneralizationsatisfyingtheseconditionswithadistance vectorsmallerthanthatoftj,nordoesthereexistanothertablewiththesamelevelofgeneralization 3.69Tz:TiTz;Tzsatisesconditions1and2,andDVi;z<DVi;j. satisfyingtheseconditionswithlesssuppression. Intuitively,generalizationTjisk-minimaliitsatisesk-anonymity,itdoesnotenforcemoresuppression Example4.2ConsidertheprivatetablePTillustratedinFigure9andsupposek-anonymitywithk=2 illustratedinfigure9.dependingontheacceptablesuppressionthreshold,thefollowinggeneralizationsare isrequired.thepossiblegeneralizations(butthetopmostonecollapsingeverytupletohperson;02100i)are consideredminimal: MaxSup2:GT[1;0]andGT[0;1] becauseofgt[1;0]andgt[1;2]isnotminimalbecauseofgt[1;0]andgt[0;2]); MaxSup=1:GT[1;0]andGT[0;2](GT[0;1]suppressesmoretuplethanitisallowed,GT[1;1]isnotminimal MaxSup=0:GT[1;1] minimalbecauseofgt[1;1]); (GT[1;0];GT[0;1],orGT[0;2]suppressmoretuplethanitisallowed,GT[1;2]isnot 5minimalbecauseofGT[1;0]andGT[0;1]). Preferences (GT[0;2]isnotminimalbecauseofGT[0;1],GT[1;1]andGT[1;2]arenot solutionsistobepreferreddependsonsubjectivemeasuresandpreferencesofthedatarecipient.forinstance,dependingontheuseofthereleaseddata,itmaybepreferabletogeneralizesomeattributesinsteaanonymityisenforced.however,multiplesolutionsmayexistwhichsatisfythiscondition.whichofthe onlycapturestheconceptthattheleastamountofgeneralizationandsuppressionnecessarytoachieveksionthresholdandk-anonymityconstraint.thisiscompletelylegitimatesincethedenitionof\minimal" ItisclearfromSection4thattheremaybemorethanoneminimalgeneralizationforagiventable,suppres- andrelativedistance.letti(a1;:::;an)beatableandtj(a1;:::;an)beoneofitsgeneralizationswith imalgeneralization.todothat,werstintroducetwodistancemeasuresdenedbetweentables:absolute ofothers.weoutlineheresomesimplepreferencepoliciesthatcanbeappliedinchoosingapreferredmin- wherehzistheheightofthedomaingeneralizationhierarchyofdom(az;ti). distancevectordvi;j=[d1;:::;dn].theabsolutedistanceoftjfromti,writtenabsdisti;j,isthesumof thedistancesforeachattribute.formally,absdisti;j=pni=1di.therelativedistanceoftjfromti,written isobtainedbydividingthedistanceoverthetotalheightofthehierarchy.formally,reldisti;j=pnz=1dz Reldisti;j,isthesumofthe\relative"distanceforeachattribute,wheretherelativedistanceofeachattribute Giventhosedistancemeasureswecanoutlinethefollowingbasicpreferencepolicies: hz, 12

13 Minimumabsolutedistanceprefersthegeneralization(s)thathasasmallerabsolutedistance,thatis, Minimumrelativedistanceprefersthegeneralization(s)thathasasmallerrelativedistance,thatis, withasmallertotalnumberofgeneralizationsteps(regardlessofthehierarchiesonwhichtheyhave thatminimizesthetotalnumberofrelativesteps,thatis,consideredwithrespecttotheheightofthe beentaken). Maximumdistributionprefersthegeneralization(s)thatcontainsthegreatestnumberofdistincttuples. Minimumsuppressionprefersthegeneralization(s)thatsuppressesless,thatis,thatcontainsthegreater hierarchyonwhichtheyaretaken. Underminimumabsolutedistance,GT[1;0]ispreferred.Underminimumrelativedistance,maximumdistribution,andminimumsuppressionpolicies,thetwogeneralizationsareequallypreferable.SupposeMaxSup=2. numberoftuples. Example5.1ConsiderExample4.2.SupposeMaxSup=1.MinimalgeneralizationsareGT[1;0]andGT[0;2]. eralizationsareequallypreferable.undertheminimumsuppressionpolicy,gt[1;0]ispreferred.underthe minimumrelativedistanceandthemaximumdistributionpolicies,gt[0;1]ispreferred. MinimalgeneralizationsareGT[1;0]andGT[0;1].Undertheminimumabsolutedistancepolicy,thetwogen- applied;thebestonetouse,ofcourse,dependsonthespecicuseforthereleaseddata.examinationofan exhaustivesetofpossiblepoliciesisoutsidethescopeofthispaper.thechoiceofaspecicpreferencepolicy isdonebytherequesteratthetimeofaccess[18].dierentpreferencepoliciescanbeappliedtodierent quasi-identiersinthesamereleaseddata. Thelistaboveisobviouslynotcompleteandthereremainadditionalpreferencepoliciesthatcouldbe someobservationsclarifyingtheproblemofndingaminimalgeneralizationanditscomplexity.weusethe Here,weillustrateanapproachtocomputingsuchageneralization.Beforediscussingthealgorithmwemake Wehavedenedtheconceptofpreferredk-minimalgeneralizationcorrespondingtoagivenprivatetable. 6 Computingapreferredgeneralization consideringthewholetablepttobegeneralized,weconsideritsprojectionpt[qi],keepingduplicates,on weconsiderthegeneralizationofeachspecicquasi-identierwithintableptindependently.insteadof theattributesofaquasi-identierqi.thegeneralizedtableptisobtainedbyenforcinggeneralizationfor termoutliertorefertoatuplewithfewerthankoccurrences,wherekistheanonymityconstraintrequired. eachquasi-identierqi2qipt.thecorrectnessofthecombinationofthegeneralizationsindependently Firstofall,giventhatthek-anonymitypropertyisrequiredonlyforattributesinquasi-identiers, correspondenceofvaluesacrosswholetuplesandbythefactthatthequasi-identiersofatablearedisjoint.4 producedforeachquasi-identierisensuredbythefactthatthedenitionofageneralizedtablerequires picturesallthepossiblegeneralizationsandtheirrelationships.eachpath(strategy)initdenesadierent Givenaquasi-identierQI=(A1;:::;An),thecorrespondingdomainhierarchyonDT=hD1;:::;Dni wayinwhichgeneralizationcanbeapplied.withrespecttoastrategy,wecoulddenetheconceptof localminimalgeneralizationasthegeneralizationthatisminimalwithrespecttothesetofgeneralizations InSection3weillustratedtheconceptsofageneralizationhierarchyandstrategiesforadomaintuple. inthestrategy(intuitivelytherstfoundinthepathfromthebottomelementdttothetopelement). serially. Eachk-minimalgeneralizationislocallyminimalwithrespecttosomestrategy,asstatedbythefollowing theorem. 4Thislastconstraintcanberemovedprovidedthatgeneralizationofnon-disjointquasi-identiersbeexecuted 13

14 Theorem6.1LetT(A1;:::;An)=PT[QI]bethetabletobegeneralizedandletDT=hD1;:::;Dnibethe tuplewheredz=dom(az;t),z=1;:::;n,beatabletobegeneralized.everyk-minimalgeneralizationof TiisalocalminimalgeneralizationforsomestrategyofDGHDT. Proof.(sketch)Bycontradiction.SupposeTjisk-minimalbutisnotlocallyminimalwithrespectto anystrategy.then,thereexistsastrategycontainingtjsuchthatthereexistsanothergeneralizationtz dominatedbytjinthisstrategywhichsatisesk-anonymitybysuppressingnomoretuplesthanwhatis allowed.hence,tzsatisesconditions1and2ofdenition4.3.moreover,sincetzisdominatedbytj, DVi;z<DVi;j.Hence,Tjcannotbeminimal,whichcontradictstheassumption. 2 Sincestrategiesarenotdisjoint,theconverseisnotnecessarilytrue,thatis,alocalminimalgeneralization withrespecttoastrategymaynotcorrespondtoak-minimalgeneralization. FromTheorem6.1,followingeachgeneralizationstrategyfromthedomaintupletothemaximalelement ofthehierarchywouldthenrevealallthelocalminimalgeneralizationsfromwhichthek-minimalgeneralizationscanbeselectedandaneventualpreferredgeneralizationchosen.(theconsiderationofpreferences impliesthatwecannotstopthesearchattherstgeneralizationfoundthatisknowntobek-minimal.) However,thisprocessismuchtoocostlybecauseofthehighnumberofstrategieswhichshouldbefollowed. ItcanbeprovedthatthenumberofdierentstrategiesforadomaintupleDT=hD1;:::;Dniis(h1+:::+hn)! h1!:::hn!, whereeachhiisthelengthofthepathfromditothetopdomainindghdi. Intheimplementationofourapproachwehaverealizedanalgorithmthatcomputesapreferredgeneralizationwithoutneedingtofollowallthestrategiesandcomputingthegeneralizations.Thealgorithm makesuseoftheconceptofdistancevectorbetweentuples.lettbeatableandx;y2ttwotuplessuch thatx=hv01;:::;v0niandy=hv00 1;:::;v00 niwhereeachv0i;v00 iisavalueindomaindi.thedistancevector betweenxandyisthevectorvx;y=[d1;:::;dn]wherediisthelengthofthepathsfromv0iandv00 itotheir closestcommonancestorinthevaluegeneralizationhierarchyvghdi.forinstance,withreferencetothe PTillustratedinFigure4,thedistancebetweenhasian,02139iandhblack,02139iis[1,0].Intuitively,the distancebetweentwotuplesxandyintabletiisthedistancevectorbetweentiandthetabletj,with TiTjwherethedomainsoftheattributeinTjarethemostspecicdomainsforwhichxandygeneralize tothesametuplet. Thefollowingtheoremstatestherelationshipbetweendistancevectorsbetweentuplesinatableanda minimalgeneralizationforthetable. Theorem6.2LetTi(A1;:::;An)=PT[QI]andTjbetwotablessuchthatTiTj.IfTjisk-minimalthen DVi;j=Vx;yforsometuplesx;yinTisuchthateitherxoryhasanumberofoccurrencessmallerthank. Proof.(sketch)Bycontradiction.Supposethatak-minimalgeneralizationTjexistssuchthatDVi;j doesnotsatisfytheconditionabove.letdvi;j=[d1;:::;dn].considerastrategycontainingageneralization withthatdistancevector(therewillbemorethanoneofsuchstrategies,andwhichoneisconsideredisnot important).considerthedierentgeneralizationstepsexecutedaccordingtothestrategy,fromthebottom goingup,arrivingatthegeneralizationcorrespondingtotj.sincenooutlierisatexactdistance[d1;:::;dn] fromanytuple,nooutlierismergedwithanytupleatthelaststepofgeneralizationconsidered.thenthe generalizationdirectlybelowtjinthestrategysatisesthesamek-anonymityconstraintastiwiththesame amountofsuppression.also,bydenitionofstrategy,dvi;z<dvi;j.then,bydenition4.3,tjcannotbe minimal,whichcontradictstheassumption. 2 AccordingtoTheorem6.2thedistancevectorofaminimalgeneralizationfallswithinthesetofthe vectorsbetweentheoutliersandothertuplesinthetable.thispropertyisexploitedbythegeneralization algorithmtoreducethenumberofgeneralizationstobeconsidered. Thealgorithmworksasfollows.LetPT[QI]betheprojectionofPToverquasi-identierQI.First,all distincttuplesinpt[qi]aredeterminedtogetherwiththenumberoftheiroccurrences.then,thedistance 14

15 vectorsbetweeneachoutlierandeverytupleinthetableiscomputed.then,adagwith,asnodes,all distancevectorsfoundisconstructed.thereisanarcfromeachvectortoallthesmallestvectordominating itintheset.intuitively,thedagcorrespondstoa\summary"ofthestrategiestobeconsidered(not allstrategiesmayberepresented,andnotallgeneralizationsofastrategymaybepresent).eachpathin thedagisthenfollowedfromthebottomupuntilaminimallocalgeneralizationisfound.thealgorithm determinesifageneralizationislocallyminimalsimplybycontrollinghowtheoccurrencesofthetupleswould combine(onthebasisofthedistancetableconstructedatthebeginning),withoutactuallyperformingthe thealgorithmkeepstrackofgeneralizationsthathavebeenconsideredsoastostoponapathwhenitruns generalization.whenalocalgeneralizationisfound,anotherpathisfollowed.aspathsmaybenotdisjoint, intoanotherpathonwhichalocalminimumhasalreadybeenfound.onceallpossiblepathshavebeen examined,theevaluationofthedistancevectorsallowsthedeterminationofthegeneralizations,amongthose thebasisofthedistancevectorsandofhowtheoccurrencesoftupleswouldcombine. found,whicharek-minimal.amongthem,apreferredgeneralizationtobecomputedisthendeterminedon distancevectorsbetweentuplesgreatlyreducesthenumberofgeneralizationstobeconsidered;(2)generalizationsarenotactuallycomputedbutforeseenbylookingathowtheoccurrencesofthetupleswould combine;(3)thefactthatthealgorithmkeepstrackofevaluatedgeneralizationsallowsittostopevaluation Thecharacteristicsthatreducethecomputationcostarethereforethat(1)thecomputationofthe onapathwheneveritcrossesapathalreadyevaluated. tablebeatleastk,andonlyinthiscase,therefore,isthealgorithmapplied.thisisstatedbythefollowing theorem. ThecorrectnessofthealgorithmdescendsdirectlyfromTheorems6.1and6.2. Theorem6.3LetTbeatable,MaxSupjTjbetheacceptablesuppressionthreshold,andkbeanatural ThenecessaryandsucientconditionforatableTtosatisfyk-anonymityisthatthecardinalityofthe value.hence,thegeneralizationwillcontainjtjoccurrencesofthesametuple.sincejtjk,itsatises number.ifjtjk,thenthereexistsatleastak-minimalgeneralizationfort.ifjtj<kthereareno possibledomain.sincemaximalelementsofdomaresingleton,allvaluesofanattributecollapsetothesame non-emptyk-minimalgeneralizationsfort. suppressingallthetuplesint. k-anonymity.supposejtj<k,nogeneralizationcansatisfyk-anonymity,whichcanbereachedonlyby Proof.(sketch)SupposejTjk.Considerthegeneralizationgeneralizingeachtupletothetopmost 7 Applicationoftheapproach:someexperimentalresults 2 whichinturnaccessedamedicaldatabase.ourgoalwastomodelanactualreleaseandtomeasurethequality thresholdsofsuppression.theprogramwaswritteninc++,usingodbctointerfacewithansqlserver, ofthereleaseddata.moststateshavelegislativemandatestocollectmedicaldatafromhospitals,sowe Weconstructedacomputerprogramthatproducestablesadheringtok-minimalgeneralizationsgivenspecic Figure10itemizestheattributesused;thetableisconsideredde-identiedbecauseitcontainsnoexplicit tuplerepresentsonepatient,andeachpatientisunique.thedatacontainedmedicalrecordsfor265patients. identifyinginformationsuchasnameoraddress.asdiscussedearlier,zipcode,dateofbirth,andgendercan thenationalassociationofhealthdataorganizationsrecommendsthatstateagenciescollect[14].each collapsedtheoriginalmedicaldatabaseintoasingletableconsistentwiththeformatandprimaryattributes belinkedtopopulationregistersthatarepubliclyavailableinordertore-identifypatients[18].therefore, foundtobeunique. thequasi-identierqifzip,birthdate,gender,ethnicitygwasconsidered.eachtuplewithinqiwas generalizationofthattablegivenathresholdofsuppression.thezipeldhasbeengeneralizedtothe ThetoptableinFigure10isasampleoftheoriginaldata,andthelowertableillustratesak-minimal 15

16 Attribute ZIP Birthyear Gender #distinctvaluesminfrequencymaxfrequencymedianfrequencycomments Ethnicity Table1:Distributionofvaluesinthetableconsideredintheexperiment yrrange rst3digits,anddateofbirthtotheyear.thetuplewiththeunusualzipcodeof hasbeen suppressed.(note:thedefaultvalueformonthisjanuaryandfordayisthe1stwhendatesaregeneralized. suppressed.therecipientofthedataisinformedofthelevelsofgeneralizationsandhowmanytupleswere Thisisdoneforpracticalconsiderationsthatpreservethedatatypeoriginallyassignedtotheattribute(see weregeneralizedrsttothemonth,then1-year,5-year,10-year,20-year,and100-yearperiods.atwo-level full9-digitform,withageneralizationhierarchyreplacingrightmostdigitswith0,of10levels.birthdates Section3).) hierarchywasconsideredforgenderandethnicity(seefigure2).theproductofthenumberofpossible domainsforeachattributegivesthetotalnumberofpossiblegeneralizations,whichis280. Table1itemizesthebasicdistributionofvalueswithintheattributes.ZIPcodeswerestoredinthe vectorsbetweenadjacenttuples.readingthesevectorsfromtheclique,theprogramgeneratedasetof generalizationstoconsider.therewere141generalizationsreadfromtheclique,discarding139or50%.for ourtests,weusedvaluesofktobe3,6,9,...,30andamaximumsuppressionthresholdof10%or27tuples. Theprogramconstructedacliquewhereeachnodewasatupleandtheedgeswereweightedbydistance andrealisticapplication.wemeasurethelossofdataqualityduetosuppressionastheratioofthenumberof tuplessuppresseddividedbythetotalnumberoftuplesintheoriginaldata.wedenetheinversemeasure suppression.generalizationalsoreducesthequalityofthedatasincegeneralizedvaluesarelessprecise.we of\completeness",todeterminehowmuchofthedataremains,computedasoneminusthelossdueto Figure11showstherelationshipbetweensuppressionandgeneralizationwithintheprograminapractical measurethelossduetogeneralizationastheratioofthelevelofgeneralizationdividedbythetotalheight computedasoneminusthelossduetogeneralization. ofthegeneralizationhierarchy.weterm\precision"astheamountofspecicityremaininginthedata, increases.lossesarereportedforbothgeneralizationandsuppressionforeachattributeasifitweresolely natureofvaluesfoundintheseattributes.giventhedistributionofmales(96)andfemales(169)inthedata, responsibleforachievingthek-anonymityrequirement.bydoingso,wecharacterizethedistributionand thegenderattributeitselfcanachievethesevaluesofksoweseenolossduetogeneralizationorsuppression. InCharts(A)and(B)ofFigure11wecomparethedataqualitylossasthek-anonymityrequirement generalizationsfound.basically,generalizationsthatsatisfysmallervaluesofkappearfurthertotheright Theatlinesonthesecurvesindicatevaluesbeingsomewhatclustered mostdiscriminatingvalues,soitisnotsurprisingthattheymustbegeneralizedmorethanotherattributes. Ontheotherhand,therewere258of265distinctbirthdates.Clearly,dateofbirthandZIPcodearethe inchart(c),andthosegeneralizationsthatachievelargervaluesofkareleftmost.thisresultsfromthe observationthatthelargerthevaluefork,themoregeneralizationmayberequired,resulting,ofcourse,in alossofprecision.itisalsonotsurprisingthatcompletenessremainsabove0.90becauseoursuppression Charts(C)and(D)ofFigure11reportcompletenessandprecisionmeasurementsforthe44minimal thresholdduringthesetestswas10%.thoughnotshowninthecharts,itcaneasilybeunderstoodthat raisingthesuppressionthresholdtypicallyimprovesprecisionsincemorevaluescanbesuppressedtoachieve k.clearly,generalizationisexpensivetothequalityofthedatasinceitisperformedacrosstheentire attribute;everytupleisaected.ontheotherhand,itremainssemanticallymoreusefultohaveavalue 16

17 Figure10:Exampleofcurrentreleasepracticeandminimallygeneralizedequivalent Figure11:Experimentalresultsbasedon265medicalrecords 17

18 present,evenifitisalesspreciseone,thannothavinganyvalueatall,asistheresultofsuppression. practicalapplications.ofcourse,protectingagainstlinkinginvolvesalossofdataqualityintheattributes thatcomprisethequasi-identier,thoughwehaveshownthatthelossisnotsevere.thesetechniquesare identierthatcanbeusedforlinking.inthesamplemedicaldatashownearlier,researchers,computer clearlymosteectivewhentheprimaryattributesrequiredbytherecipientarenotthesameasthequasi- Fromtheseexperimentsitisclearthatthetechniquesofgeneralizationandsuppressioncanbeusedin scientists,healtheconomistsandothersvaluetheinformationthatisnotincludedinthequasi-identierin ordertodevelopdiagnostictools,performretrospectiveresearch,andassesshospitalcosts[18]. 8Wehavepresentedanapproachtodisclosingentity-specicinformationsuchthatthereleasedtablecannot bereliablylinkedtoexternaltables.theanonymityrequirementisexpressedbyspecifyingaquasi-identier andaminimumnumberkofduplicatesofeachreleasedtuplewithrespecttotheattributesofthequasiidentier.theanonymityrequirementisachievedbygeneralizing,andpossiblysuppressing,informatiotionisnotgeneralizedmorethanitisneededtoachievetheanonymityrequirement.wehavediscussed uponrelease.wehavegiventhenotionofminimalgeneralizationcapturingthepropertythatinforma- possiblepreferencepoliciestochoosebetweendierentminimalgeneralizationsandanalgorithmtocom- theapplicationofourapproachtothereleaseofamedicaldatabasecontaininginformationregarding265 puteapreferredminimalgeneralization.finally,wehaveillustratedtheresultsofsomeexperimentsfrom patients. disclosurecontrol.manyproblemsarestillopen.fromamodelingpointofview,thedenitionofquasiidentiersandofanappropriatesizeofkmustbeaddressed.thequalityofgeneralizeddataisbestwhen theattributesmostimportanttotherecipientdonotbelongtoanyquasi-identier.forpublic-uselesthis maybeacceptable,butdeterminingthequalityandusefulnessinothersettingsmustbefurtherresearched. Thisworkrepresentsonlyarststeptowardthedenitionofacompleteframeworkforinformation Conclusions andofdataupdating,whichmayallowinferenceattacks[10,13]. toenforcetheproposedtechniquesandtheconsiderationofspecicqueries,ofmultiplereleasesovertime, Fromthetechnicalpointofview,futureworkshouldincludetheinvestigationofanecientalgorithm[15] Acknowledgments WethankSteveDawson,atSRI,fordiscussionsandsupport;RemaPadmanatCMUfordiscussionson metrics;and,dr.leemannofinovahealthsystems,lexicaltechnology,inc.,anddr.fredchufor makingmedicaldataavailabletovalidateourapproaches.wealsothanksylviabarrettandhenryleitner ofharvarduniversityfortheirsupport. References [1]N.R.AdamandJ.C.Wortman.Security-controlmethodsforstatisticaldatabases:Acomparative [2]RossAnderson.Asecuritypolicymodelforclinicalinformationsystems.InProc.ofthe1996IEEE [3]SilvanaCastano,MariaGraziaFugini,GiancarloMartella,andPierangelaSamarati.DatabaseSecurity. study.acmcomputingsurveys,21:515{556,1989. AddisonWesley,1995. SymposiumonSecurityandPrivacy,pages30{43,Oakland,CA,May

19 [4]P.C.Chu.Cellsuppressionmethodology:Theimportanceofsuppressingmarginaltotals.IEEETrans. [6]ToreDalenius.Findinganeedleinahaystack-oridentifyinganonymouscensusrecord.Journalof [5]L.H.Cox.Suppressionmethodologyinstatisticaldisclosureanalysis.InASAProceedingsofSocial StatisticsSection,pages750{755,199. onknowledgedatasystems,4(9):513{523,july/august1997. [7]B.A.DaveyandH.A.Priestley.IntroductiontoLatticesandOrder.CambridgeUniversityPress,1990. [8]DorothyE.Denning.CryptographyandDataSecurity.Addison-Wesley,1982. OcialStatistics,2(3):329{336,1986. [10]J.HaleandS.Shenoi.Catalyticinferenceanalysis:Detectinginferencethreatsduetoknowledge [9]DanGuseld.Alittleknowledgegoesalongway:Fasterdetectionofcompromiseddatain2-Dtables. discovery.inproc.ofthe1997ieeesymposiumonsecurityandprivacy,pages188{199,oakland, InProc.oftheIEEESymposiumonSecurityandPrivacy,pages86{94,Oakland,CA,May1990. [11]A.HundepoolandL.Willenborg.-and-Argus:Softwareforstatisticaldisclosurecontrol.InThird [12]RamKumar.Ensuringdatasecurityininterrelatedtabulardata.InProc.oftheIEEESymposiumon CA,May1997. [13]TeresaLunt.Aggregationandinference:Factsandfallacies.InProc.oftheIEEESymposiumon InternationalSeminaronStatisticalCondentiality,Bled,1996. [14]NationalAssociationofHealthDataOrganizations,FallsChurch.AGuidetoState-LevelAmbulatory SecurityandPrivacy,pages96{105,Oakland,CA,May1994. [15]P.SamaratiandL.Sweeney.Generalizingdatatoprovideanonymitywhendislosinginformation.In SecurityandPrivacy,pages102{109,Oakland,CA,May1989. Proc.oftheACMSIGACT-SIGMOD-SIGART1998SymposiumonPrinciplesofDatabaseSystems CareDataCollectionActivities,October1996. [17]LatanyaSweeney.Guaranteeinganonymitywhensharingmedicaldata,theDataysystem.InProc. [16]LatanyaSweeney.Computationaldisclosurecontrolformedicalmicrodata.InRecordLinkageWorkshop (PODS98),Seattle,USA,June1998. BureauoftheCensus,Washington,DC,1997. [18]LatanyaSweeney.Weavingtechnologyandpolicytogethertomaintaincondentiality.JournalofLaw, JournaloftheAmericanMedicalInformaticsAssociation,Washington,DC:Hanley&Belfus,Inc., [19]ReinTurn.Informationprivacyissuesforthe1990s.InProc.oftheIEEESymposiumonSecurityand Medicine,&Ethics,25(2{3):98{110, [20]JereyD.Ullman.PrinciplesofDatabasesandKnowledge-BaseSystems,volumeI.ComputerScience Privacy,pages394{400,Oakland,CA,May1990. [22]L.WillenborgandT.DeWaal.StatisticalDisclosureControlinPractice.Springer-Verlag,1996. [21]L.WillenborgandT.DeWaal.Statisticaldisclosurecontrolinpractice.NewYork:Springer-Verlag, Press,1989. [23]BeverlyWoodward.Thecomputer-basedpatientrecordcondentiality.TheNewEnglandJournalof Medicine,333(21):1419{1422,