Cell suppression to limit content-based disclosure

Duncan, George T.; Krishnan, Ramayya; Padman, Rema; Reuther, Phyllis; Roehrig, Stephen F.

doi:10.1109/hicss.1997.661699

Cited by 5 publications

(4 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For example, a particular contingency table cell may be too sensitive to be released if the number of respondents is smaller than a threshold. In such a case, we should protect privacy by combined use of the TM 2 method and other disclosure limitation techniques, including cell suppression, rounding, sampling, data swapping, and other sampling and simulation techniques (for more details see Duncan et al, 2001; Oganian and Domingo-Ferrer, 2003; Domingo-Ferrer and Saygin, 2008; Fienberg and Slavkovic, 2008; and Slavkovic, 2010). The TM 2 method makes sure that the data collectors do not see the raw patient data ( Z 1 and Z 2 ) but they can still derive the correct contingency table ( a , b , c and d ).…”

Section: Properties Of Matrix Masked Datamentioning

confidence: 99%

A New Data Collection Technique for Preserving Privacy

Wu¹,

Chen²,

Burr³

et al. 2018

JPC

View full text Add to dashboard Cite

Abstract.A major obstacle that hinders medical and social research is the lack of reliable data due to people's reluctance to reveal private information to strangers. Fortunately, statistical inference always targets a well-defined population rather than a particular individual subject and, in many current applications, data can be collected using a web-based system or other mobile devices. These two characteristics enable us to develop a data collection method, called triple matrix-masking (TM 2 ), which offers strong privacy protection with an immediate matrix transformation so that even the researchers cannot see the data, and then further uses matrix transformations to guarantee that the data will still be analyzable by standard statistical methods. The entities involved in the proposed process are a masking service provider who receives the initially masked data and then applies another mask, and the data collectors who partially decrypt the now doubly masked data and then apply a third mask before releasing the data to the public. A critical feature of the method is that the keys to generate the matrices are held separately. This ensures that nobody sees the actual data, but because of the specially designed transformations, statistical inference on parameters of interest can be conducted with the same results as if the original data were used. Hence the TM 2 method hides sensitive data with no efficiency loss for statistical inference of binary and normal data, which improves over Warner's randomized response technique. In addition, we add several features to the proposed procedure: an error checking mechanism is built into the data collection process in order to make sure that the masked data used for analysis are an appropriate transformation of the original data; and a partial masking technique is introduced to grant data users access to non-sensitive personal information while sensitive information remains hidden.

show abstract

Section: Properties Of Matrix Masked Datamentioning

confidence: 99%

A New Data Collection Technique for Preserving Privacy

Wu¹,

Chen²,

Burr³

et al. 2018

JPC

View full text Add to dashboard Cite

show abstract

“…Inference control methods proposed in statistical databases are usually classified into two main categories: restriction based techniques and perturbation based techniques. Restriction based techniques [25] include restricting the size of a query set (that is, the values aggregated by a single query), overlap control [21] in query sets, auditing all queries in order to determine when inferences are possible [13,10,29,33,6], suppressing sensitive data in released statistical tables [14,22], partitioning data into blocks and treating each block as a single value in answering queries [11,12,34]. Perturbation based technique includes adding noise to source data [39], outputs [5], database structure [36], or size of query sets (that is, answering queries using sampled data) [16].…”

Section: Related Workmentioning

confidence: 99%

“…Some variations of the inference problem have been studied lately, such as the inference caused by arithmetic constraints [8,7], the inference of approximate values instead of exact values [32] and the inference of small intervals enclosing exact values [30]. Finally, techniques similar to suppression and partitioning are being developed to protect the sensitive information in released census data [37,43,14,22,42,34].…”

Section: Related Workmentioning

confidence: 99%

Cardinality-based inference control in data cubes*

Wang

Wijesekera

Jajodia

2004

JCS

View full text Add to dashboard Cite

This paper addresses the inference problem in on-line analytical processing (OLAP) systems. The inference problem occurs when the exact values of sensitive attributes can be determined through answers to OLAP queries. Most existing inference control methods are computationally expensive for OLAP systems, because they ignore the special structures of OLAP queries. By exploiting such structures, we derive cardinality-based sufficient conditions for safe OLAP data cubes. Specifically, data cubes are safe from inferences if their core cuboids are dense enough, in the sense that the number of known values is under a tight bound. We then apply the sufficient conditions on the basis of a three-tier inference control model. The model introduces an aggregation tier between data and queries. The aggregation tier represents a collection of safe data cubes that are pre-computed over a partition of the data using the proposed sufficient conditions. The aggregation tier is then used to provide users with inference-free queries. Our approach mitigates the performance penalty of inference control, because partitioning the data yields smaller input to inference control algorithms, pre-computing the aggregation tier reduces on-line delay, and using cardinality-based conditions guarantees linear-time complexity.

show abstract

“…This approach is called randomization. Another possibility is to decrease precision of the transmitted data by rounding, suppressing certain values, replacing values with intervals, or replacing categorical values by more general categories up the taxonomic hierarchy, see [19,31,40,41].…”

Section: Privacy-preserving Data Miningmentioning

confidence: 99%

The Architecture of the Cornell Knowledge Broker

Demers

Gehrke

Riedewald

2004

Intelligence and Security Informatics

View full text Add to dashboard Cite

Abstract.Intelligence applications have to process massive amounts of data in order to extract relevant information. This includes archived historical data as well as continuously arriving new data. We propose a novel architecture that addresses this problem -the Cornell Knowledge Broker. It will not only support knowledge discovery, but also security, privacy, information exchange, and collaboration.

show abstract

Cell suppression to limit content-based disclosure

Cited by 5 publications

References 15 publications

A New Data Collection Technique for Preserving Privacy

A New Data Collection Technique for Preserving Privacy

Cardinality-based inference control in data cubes*

The Architecture of the Cornell Knowledge Broker

Contact Info

Product

Resources

About