Identity Disclosure Attack Research Articles

Privacy risks of whole-slide image sharing in digital pathology

Access to large volumes of so-called whole-slide images—high-resolution scans of complete pathological slides—has become a cornerstone of the development of novel artificial intelligence methods in pathology for diagnostic use, education/training of pathologists, and research. Nevertheless, a methodology based on risk analysis for evaluating the privacy risks associated with sharing such imaging data and applying the principle “as open as possible and as closed as necessary” is still lacking. In this article, we develop a model for privacy risk analysis for whole-slide images which focuses primarily on identity disclosure attacks, as these are the most important from a regulatory perspective. We introduce a taxonomy of whole-slide images with respect to privacy risks and mathematical model for risk assessment and design . Based on this risk assessment model and the taxonomy, we conduct a series of experiments to demonstrate the risks using real-world imaging data. Finally, we develop guidelines for risk assessment and recommendations for low-risk sharing of whole-slide image data.

An anonymization-based privacy-preserving data collection protocol for digital health data.

Digital health data collection is vital for healthcare and medical research. But it contains sensitive information about patients, which makes it challenging. To collect health data without privacy breaches, it must be secured between the data owner and the collector. Existing data collection research studies have too stringent assumptions such as using a third-party anonymizer or a private channel amid the data owner and the collector. These studies are more susceptible to privacy attacks due to third-party involvement, which makes them less applicable for privacy-preserving healthcare data collection. This article proposes a novel privacy-preserving data collection protocol that anonymizes healthcare data without using a third-party anonymizer or a private channel for data transmission. A clustering-based k-anonymity model was adopted to efficiently prevent identity disclosure attacks, and the communication between the data owner and the collector is restricted to some elected representatives of each equivalent group of data owners. We also identified a privacy attack, known as "leader collusion", in which the elected representatives may collaborate to violate an individual's privacy. We propose solutions for such collisions and sensitive attribute protection. A greedy heuristic method is devised to efficiently handle the data owners who join or depart the anonymization process dynamically. Furthermore, we present the potential privacy attacks on the proposed protocol and theoretical analysis. Extensive experiments are conducted in real-world datasets, and the results suggest that our solution outperforms the state-of-the-art techniques in terms of privacy protection and computational complexity.

Utility-Based SK-Clustering Algorithm for Privacy Preservation of Anonymized Data in Healthcare

Background: The increasing need for various data publishers to release or share the healthcare datasets has imparted a threat for the privacy and confidentiality of the Electronic Medical Records. However, the main goal is to share useful information thereby maximizing utility as well as ensuring that sensitive information is not disclosed. There always exist utility-privacy tradeoff which needs to be handled properly for the researchers to learn statistical properties of the datasets. Objective: The objective of the research article is to introduce a novel SK-Clustering algorithm that overcomes identity disclosure, attribute disclosure and similarity attacks. The algorithm is evaluated using metrics such as discernability measure and relative error so as to show its performance compared with other clustering algorithms. Methodology: The SK-Clustering algorithm flexibly adjusts the level of protection for high utility. Also the size of the clusters is minimized dynamically based on the requirements of the protection required and we add extra tuples accordingly. This will drastically reduce information loss thereby increasing utilization. Results: For a k-value of 50 the discernabilty measure of SK algorithm is 65000 whereas the Mondrian algorithm exhibits 70000 discernability measure and the Anatomy algorithm has a discernability measure of 150000. Similarly, the relative error of our algorithm is less than 10% for a tuple count of 35000 when compared to other k-anonymity algorithms. Conclusion: The proposed algorithm executes more competently in terms of minimal discernability measure as well as relative error, thereby proving higher data utility compared with traditionally available algorithms.

An improved Chang-Lee’s smart card-based authentication scheme

It is useful to verify a legal user from a remote terminal through the Internet with the user authentication schemes based on the smart card. Usually, the remote user has to use his/her identification accompanying the password to access the system. This action is an important scheme to protect the user’s privacy and confidentiality. To achieve the robustness and the efficiency, Chang and Lee proposed a scheme that employs a smart card-based user authentication with the characters of implementation practically and easily. Also, Chang and Lee claim that the scheme could resist the replay attacks, the impersonation attacks, the identity disclosure attacks, and the perfect forward secrecy. However, this work shows that the scheme is in the risk with an on-line guessing identity and password attacks and denial of service attack. Hence, in this paper, it proposes an improved user authentication scheme that holds the capacity to withstand the vulnerability as that in Chang-Lee’s smart card-based scheme.

Anonymizing datasets with demographics and diagnosis codes in the presence of utility constraints

Publishing data about patients that contain both demographics and diagnosis codes is essential to perform large-scale, low-cost medical studies. However, preserving the privacy and utility of such data is challenging, because it requires: (i) guarding against identity disclosure (re-identification) attacks based on both demographics and diagnosis codes, (ii) ensuring that the anonymized data remain useful in intended analysis tasks, and (iii) minimizing the information loss, incurred by anonymization, to preserve the utility of general analysis tasks that are difficult to determine before data publishing. Existing anonymization approaches are not suitable for being used in this setting, because they cannot satisfy all three requirements. Therefore, in this work, we propose a new approach to deal with this problem. We enforce the requirement (i) by applying (k,km)-anonymity, a privacy principle that prevents re-identification from attackers who know the demographics of a patient and up to m of their diagnosis codes, where k and m are tunable parameters. To capture the requirement (ii), we propose the concept of utility constraint for both demographics and diagnosis codes. Utility constraints limit the amount of generalization and are specified by data owners (e.g., the healthcare institution that performs anonymization). We also capture requirement (iii), by employing well-established information loss measures for demographics and for diagnosis codes. To realize our approach, we develop an algorithm that enforces (k,km)-anonymity on a dataset containing both demographics and diagnosis codes, in a way that satisfies the specified utility constraints and with minimal information loss, according to the measures. Our experiments with a large dataset containing more than 200,000 electronic health records show the effectiveness and efficiency of our algorithm.

Privacy-preserved data publishing of evolving online social networks

ABSTRACTThe increasing growth of online social networks provides an unprecedented opportunity to study the complex interactions among human beings. Privacy-preserved network-data publishing is becoming increasingly popular in both industry and academia. This articles focuses on evolving social subscription networks (ESSN), which indicate social actors’ participation in certain media channels, such as Hollywood stars’ Twitter pages, during a series of time intervals. The discussion first introduces a new identity disclosure attack by exploring the subscribed channel sizes of a social actor and the actor’s frequency of joining/leaving the channels. For privacy protection, K-anonymity should be ensured for the whole evolving graph. However, unlike the conventional topology information, such as node degree, the ESSN data points are much more sparse. Moreover, during the construction of anonymous groups, the unpopular channel-related information is likely to be discarded. How to maximally preserve ESSN data ut...

Managing dimensionality in data privacy anonymization

The curse of dimensionality has remained a challenge for a wide variety of algorithms in data mining, clustering, classification, and privacy. Recently, it was shown that an increasing dimensionality makes the data resistant to effective privacy. The theoretical results seem to suggest that the dimensionality curse is a fundamental barrier to privacy preservation. However, in practice, we show that some of the common properties of real data can be leveraged in order to greatly ameliorate the negative effects of the curse of dimensionality. In real data sets, many dimensions contain high levels of inter-attribute correlations. Such correlations enable the use of a process known as vertical fragmentation in order to decompose the data into vertical subsets of smaller dimensionality. An information-theoretic criterion of mutual information is used in the vertical decomposition process. This allows the use of an anonymization process, which is based on combining results from multiple independent fragments. We present a general approach, which can be applied to the k-anonymity, $$\ell $$l-diversity, and t-closeness models. In the presence of inter-attribute correlations, such an approach continues to be much more robust in higher dimensionality, without losing accuracy. We present experimental results illustrating the effectiveness of the approach. This approach is resilient enough to prevent identity, attribute, and membership disclosure attack.

Extended K-Anonymity Model for Privacy Preserving on Micro Data

Today, information collectors, particularly statistical organizations, are faced with two conflicting issues. On one hand, according to their natural responsibilities and the increasing demand for the collected data, they are committed to propagate the information more extensively and with higher quality and on the other hand, due to the public concern about the privacy of personal information and the legal responsibility of these organizations in protecting the private information of their users, they should guarantee that while providing all the information to the population, the privacy is reasonably preserved. This issue becomes more crucial when the datasets published by data mining methods are at risk of attribute and identity disclosure attacks. In order to overcome this problem, several approaches, called p-sensitive k-anonymity, p+-sensitive k-anonymity, and (p, α)-sensitive k-anonymity, were proposed. The drawbacks of these methods include the inability to protect micro datasets against attribute disclosure and the high value of the distortion ratio. In order to eliminate these drawbacks, this paper proposes an algorithm that fully protects the propagated micro data against identity and attribute disclosure and significantly reduces the distortion ratio during the anonymity process. Index Terms—Privacy preservation, data mining, k- anonymity, micro data.

WEAKNESSES AND IMPROVEMENT OF HSU-CHUANG'S USER IDENTIFICATION SCHEME

In 2004, Yang et al. proposed an efficient user identification scheme with key distribution. The scheme provides user anonymity, so it is possible for the user to anonymously login the remote server. Unfortunately, Mangipudi and Katti found that Yang et al.’s scheme suffers from a Denial-of-Service (DoS) attack and then proposed an improvement of Yang et al.’s scheme. However, Hsu and Chuang demonstrated that Mangipudi-Katti’s scheme is vulnerable to an identity disclosure attack, and further proposed a novel user identification scheme with key distribution preserving user anonymity for distributed computer networks. They claimed that their scheme can achieve the following advantages: (1) user anonymity, (2) key distribution, (3) mutual authentication, and (4) key confirm. In this study, the author shows that Hsu-Chuang’s scheme is vulnerable to three impersonation attacks. Then, the improvement of Hsu-Chuang’s scheme is proposed.

A Review of Privacy Preservation Technique

Privacy-preserving is one of the most important challenges in a computer world, because of the huge amount of sensitive information on the internet. The paper contains several privacy preservation techniques for data publishing in the real world. There are several privacy attacks are associate but among of them mainly two attacks are record linkage and attribute linkage. Many scientists have proposed methods to preserve the privacy of data publishing such as K-anonymity, l-diversity, t-closeness. K-anonymity can prevent the record linkage but unable to protect attribute linkage. l-diversity technique overcomes the drawback of k-anonymity technique but it fail to protect from membership discloser attack. Tcloseness technique prevents to attribute discloser attack but it fail in identity disclosure attack. Its computational complexity is large. In this paper we present the novel technique call slicing which to be implemented with various data set through prevent the privacy preservation for data publishing. The goals of this paper is re-analysis a number of privacy preservation of data mining technique clearly and then study the advantages and disadvantages of this technique.

Anonymizied Approach to Preserve Privacy of Published Data Through Record Elimination

Data mining is the process of analyzing data. Data Privacy is collection of data and dissemination of data. Privacy issues arise in different area such as health care, intellectual property, biological data, financial transaction etc. It is very difficult to protect the data when there is transfer of data. Sensitive information must be protected. There are two kinds of major attacks against privacy namely record linkage and attribute linkage attacks. Research have proposed some methods namely k-anonymity, l-diversity, t-closeness for data privacy. K-anonymity method preserves the privacy against record linkage attack alone. It is unable to prevent address attribute linkage attack. l-diversity method overcomes the drawback of k-anonymity method. But it fails to prevent identity disclosure attack and attribute disclosure attack. t-closeness method preserves the privacy against attribute linkage attack but not identity disclosure attack. A proposed method used to preserve the privacy of individuals' sensitive data from record and attribute linkage attacks. In the proposed method, privacy preservation is achieved through generalization by setting range values and through record elimination. A proposed method overcomes the drawback of both record linkage attack and attribute linkage attack

A New Method for Preserving Privacy in Data Publishing Against Attribute and Identity Disclosure Risk

Sharing, transferring, mining and publishing data are fundamental operations in day to day life. Preserving the privacy of individuals is essential one. Sensitive personal information must be protected when data are published. There are two kinds of risks namely attribute disclosure and identity disclosure that affects privacy of individuals whose data are published. Early Researchers have contributed new methods namely k-anonymity, l-diversity, t-closeness to preserve privacy. K-anonymity method preserves privacy of individuals against identity disclosure attack alone. But Attribute disclosure attack makes compromise this method. Limitation of k-anonymity is fulfilled through l-diversity method. but it does not satisfies the privacy against identity disclosure attack and attribute disclosure attack in some scenarios. The efficiency of t-closeness method is better than k-anonymity and l-diversity. But the complexity of Computation is more than other proposed methods. In this paper, the authors contributes a new method for preserving the privacy of individuals’ sensitive information from attribute and identity disclosure attacks. In the proposed method, privacy preservation is full filled through generalization of quasi identifiers by setting range values.

A Secure Anonymous Identity-based Key Agreement Protocol for Distributed Computer Networks

Recently, Hsu and Chuang proposed an efficient user identification scheme with key preserving user anonymity for distributed computer networks. Their protocol addressed an identity disclosure attack on the Yang et al. and Mangipudi-Katti schemes. Unfortunately, Hsu and Chuang’s new scheme posed vulnerability that the service provider could compute the private key of the user and imitate the user to send the service request to other service provider. In this paper, we analyzed Hsu-Chuang scheme and presented the vulnerability. We further secured their protocol by proposing a novel protocol that overcomes the above limitation while achieving the same security features. Besides, we made a demonstration of the correctness of our new scheme and analyzed the security properties. After compared Hsu-Chuang scheme and the new scheme, we also illustrated an example to illustrate the application of our improved protocol.

On Ultralightweight RFID Authentication Protocols

A recent research trend, motivated by the massive deployment of RFID technology, looks at cryptographic protocols for securing communication between entities in which some of the parties have very limited computing capabilities. In this paper, we focus our attention on SASI, a new RFID authentication protocol, designed for providing Strong Authentication and Strong Integrity. SASI is a good representative of a family of RFID authentication protocols, referred to as Ultralightweight RFID authentication protocols. These protocols, suitable for passive Tags with limited computational power and storage, involve simple bitwise operations such as and, or, exclusive or, modular addition, and cyclic shift operations. They are efficient, fit the hardware constraints, and can be seen as an example of the above research trend. However, the main concern is the real security of these protocols, which are often supported only by apparently reasonable and intuitive arguments. The contribution we provide with this work is the following: we start by showing some weaknesses in the SASI protocol, and then, we describe how such weaknesses, through a sequence of simple steps, can be used to compute in an efficient way all secret data used for the authentication process. Specifically, we describe three attacks: 1) a desynchronization attack, through which an adversary can break the synchronization between the RFID Reader and the Tag; 2) an identity disclosure attack, through which an adversary can compute the identity of the Tag; and 3) a full disclosure attack, which enables an adversary to retrieve all secret data stored in the Tag. Then, we present some experimental results, obtained by running several tests on an implementation of the protocol, in order to evaluate the performance of the proposed attacks, which confirm that the attacks are effective and efficient. It comes out that an active adversary by interacting with a Tag more or less three hundred times, makes the authentication protocol completely useless. Finally, we close the paper with some observations. The cryptoanalysis of SASI gets some new light on the ultralightweight approach, and can also serve as a warning to researchers working on the field and tempted to apply these techniques. Indeed, the results of this work, rise serious questions regarding the limits of the ultralightweight family of protocols, and on the benefits of these ad hoc protocol design strategies and informal security analysis.

A novel user identification scheme with key distribution preserving user anonymity for distributed computer networks

Recently, Yang et al. proposed an efficient user identification scheme with key distribution, in which it is possible for the user to anonymously log into a system and establish a secret key shared with the system. Mangipudi and Katti later demonstrated a Deniable-of-Service (DoS) attack on the Yang et al. scheme and then proposed an improvement to withstand such an attack. However, this paper demonstrates an identity disclosure attack to show that neither schemes’ claimed user anonymity requirement can be achieved. We further propose a novel user identification scheme with key distribution preserving user anonymity for distributed computer networks. The proposed scheme not only withstands the attacks mentioned above, but also achieves the following: (i) user anonymity, (ii) key distribution, (iii) mutual authentication, and (iv) key confirmation. The performance of our scheme is of greater efficiency than that of previously proposed schemes in terms of communication costs and computational complexities.