ACHIEVING k-ANONYMITY PRIVACY PROTECTION USING GENERALIZATION AND SUPPRESSION

TLDR

Data holders must share personal records while preventing identity disclosure, and k‑anonymity guarantees that each released record is indistinguishable among at least k individuals. This paper formally presents a method that combines generalization and suppression to achieve k‑anonymity. The authors introduce the Preferred Minimal Generalization Algorithm (MinGen), which merges generalization and suppression to provide k‑anonymity with minimal distortion, and compare it to the real‑world tools Datafly and μ‑Argus. The study shows that Datafly often over‑distorts data and that μ‑Argus can fail to provide adequate protection.

Abstract

Often a data holder, such as a hospital or bank, needs to share person-specific records in such a way that the identities of the individuals who are the subjects of the data cannot be determined. One way to achieve this is to have the released records adhere to k-anonymity, which means each released record has at least (k-1) other records in the release whose values are indistinct over those fields that appear in external data. So, k-anonymity provides privacy protection by guaranteeing that each released record will relate to at least k individuals even if the records are directly linked to external information. This paper provides a formal presentation of combining generalization and suppression to achieve k-anonymity. Generalization involves replacing (or recoding) a value with a less specific but semantically consistent value. Suppression involves not releasing a value at all. The Preferred Minimal Generalization Algorithm (MinGen), which is a theoretical algorithm presented herein, combines these techniques to provide k-anonymity protection with minimal distortion. The real-world algorithms Datafly and μ-Argus are compared to MinGen. Both Datafly and μ-Argus use heuristics to make approximations, and so, they do not always yield optimal results. It is shown that Datafly can over distort data and μ-Argus can additionally fail to provide adequate protection.