Privacy Enhancing Technologies

Question 1

Which requirement categories of a system may contradict privacy?

Answer 1

Functionality, efficiency, accountability

Question 2

What are key attributes vs quasi-identifiers?

Answer 2

Key attributes: uniquely identifying information

Quasi-identifiers: Combination of attributes that can be used to identify users in many / most / some cases

Question 3

What is K-anonymity?

Answer 3

Each person represented in the table is in an anonymity set of at least k people.
Or: A table is k-anonymous if any quasi-identifier present in the released table appears in at least k records.

Question 4

Name two techniques to reach k-anonymity

Answer 4

• Generalization: replace quasi-identifiers with less specific values
• Suppression: blunt the data (extreme case of generalization)

Question 5

Describe two attacks on k-anonymity

Answer 5

• Homogeneity Attack: use lack of diversity in equivalence class
• Background Knowledge Attack: use background knowledge -> may be problematic even if records are diverse

Question 6

What is L-diversity?

Answer 6

A table is L-diverse if every equivalence class in the table has at least L different values of the sensitive attribute.

Question 7

Name three other types of L-diversity

Answer 7

Probabilistic L-diversity, Entropy L-diversity, Recursive (c,L)-diversity

Question 8

Name two attacks on L-diversity

Answer 8

• Skewness Attack: statistical anomalies in blocks may be telling
• Similarity Attack: values may be semantically correlated

Question 9

What is t-Closeness?

Answer 9

T-Closeness is described by the distance between two distributions:
- Q: distribution of the sensitive attribute value in the whole table
- P: distribution of the sensitive attribute value in one block
A table has t-closeness if for every block the distance between P and Q is below a threshold t

Question 10

What is the idea behind Differential Privacy?

Answer 10

Differential privacy aims to provide means to maximize the accuracy of queries from statistical databases while minimizing the chances of identifying its records. -> plausible deniability

Question 11

How is access to data monitored in an inverse transparency system?

Answer 11

• Direct access: blocked
• API access: Monitored API wrapper
• Analytical tool access: Monitored plug-ins

Question 12

What path does data take through the monitored API wrapper?

Answer 12

Request: Request authenticator -> allowance module -> request translator -> data source
Response: data source -> Risk computation -> allowance module, access logger -> response generator

Question 13

What are two benefits of monitored plug-ins vs apis?

Answer 13

• Raw data never leaves the plug-in (?)

- additional benefit of rich access semantics