L-Diversity Privacy Beyond K-Anonymityl-多样性超越K-匿名隐私.ppt

Multiple Sensitive Attributes Previous discussions only addressed single sensitive attributes. Suppose S and V are two sensitive attributes, and consider the q*- block with the following tuples: {(q ,s1,v1),(q ,s1,v2),(q ,s2,v3),(q ,s3,v3)}. This q*-block is 3-diverse (actually recursive (2,3)-diverse) with respect to S (ignoring V) and 3-diverse with respect to V (ignoring S). However, if we know that Bob is in this block and his value for S is not s1 then his value for attribute V cannot be v1 or v2, and therefore must be v3. To address this problem we can add the additional sensitive attributes to the quasi-identifier. CS 295 Data privacy and confidentiality Implementing Privacy Preserving Data Publishing Domain generalization is used to define a generalization lattice. For discussion, all non-sensitive attributes are combined into a multi-dimensional attribute (Q) where the bottom element on the lattice is the domain of Q and the top of the lattice is the domain where each dimension of Q is generalized to a single value. CS 295 Data privacy and confidentiality Implementing Privacy Data Publishing (cont.) The algorithm for publishing should find the point on the lattice where the table T* preserves privacy and is useful as possible. The usefulness (utility) of table T* is diminished as the data becomes more generalized, so the most utility is at the bottom of the lattice. CS 295 Data privacy and confidentiality Monotonicity Property Monotonicity property is described as a stopping point in the lattice search where the privacy is protected and further generalization does not increase privacy. An example is if zip 13065 can be generalized to 1306* and it preserves privacy, generalizing it to 130** also preserves privacy. However, the additional generalization reduces utility. CS 295 Data privacy and confid