Section:
New Results
Privacy-Preserving Data Publishing
Participants :
Tristan Allard, Benjamin Nguyen, Philippe Pucheral.
While most PPDP works make the assumption of a trusted central publisher,
this study advocates a decentralized way of publishing anonymized
datasets. More precisely, our work concerns the proof of feasibility
of adapting traditional PPDP schemes, such as -anonymity, -diversity
or differential privacy to encompass the use of secure portable devices.
In the applications we consider, each secure device is a data provider
with weak computing capacities and weak connectivity (frequency and
duration of connections are unpredictable)(E.g., in the e-health context, patients may have their medical folder
embedded in a secure device and connect it sporadically when they
visit their physician or when they want to consult it at home.). Weak connectivity precludes any P2P solution to the problem. A server
allowing asynchronous communications between the devices becomes necessary
to implement a distributed PPDP mechanism but this server does not
benefit from the same trustworthiness as the participating devices.
Our work aims to provide a generic method to adapt an important subclass
of PPDP algorithms to this context, using both the limited secure
computation capacities of each device (but taking advantage of their
number) and the powerful computation abilities of an untrusted server
available 24/7. Our proposal is based on a meta algorithm divided
in three phases: (1) a collection phase where encrypted data is collected by the
untrusted server, (2) a construction phase where the untrusted server performs a
sound computation of a given privacy mechanism to generate sanitization
rules and (3) a sanitization phase where the encrypted data is decrypted
then sanitized by the devices to produce a final clear-text result.
The last phase can be distributed using many different
devices for better efficiency. In [15] , [17] , we showed
how it is possible to transform existing anonymity mechanisms into
decentralized ones using secure devices, while maintaining equivalent
security guarantees against honest-but-curious and weakly malicious
adversaries. In [16] , we studied the (unlikely) event that
some secure devices might be compromised, and can collude with the
untrusted server. We provided schemes to detect the compromised devices
with a probability that can be fixed as close to 1 as desired (the
trade-off being the latency of the protocol).
Previous | 
Home