Personalized Privacy Preservation Research Articles

Adaptive personalized privacy-preserving data collection scheme with local differential privacy

Local differential privacy (LDP) is a state-of-the-art privacy notion that enables terminal participants to share their private data safely while controlling the privacy disclosure at the source. In most recent works, it is assumed that the privacy parameter is determined solely by collectors and then dispatched to all participants. However, it is inelegant and unpromising for all participants to accept the same level of privacy preservation due to their personalized preferences. Here, an adaptive data collection scheme is proposed to realize personalized privacy preservation while achieving higher data utility, in which two different LDP perturbation methods are adaptively chosen by data participants according to their personalized privacy preferences. The adaptive boundary based on the minimum mean square error (MSE) is theoretically and accurately derived to allow participants to adaptively choose the best perturbation method. Then, a weighted combination method is demonstrated to do effective data aggregation from multiple privacy groups. Moreover, an expanded data strategy (EDS) with multiple privacy perturbations is presented to equivalently increase the sample size without harming others privacy, thereby further improving the accuracy of statistics. Finally, the experiments show that the proposed scheme performs better than the previous proposal in terms of MSE and average error rate (AER), especially using the EDS method.

APLDP: Adaptive personalized local differential privacy data collection in mobile crowdsensing

Local differential privacy (LDP) enables terminal participants to share their private data safely while controlling the privacy disclosure at the source. In the majority of current works, they assumed that the privacy preservation parameter is totally determined by the data collector and then dispatched to all participants in mobile crowdsensing. However, in the real world, due to different privacy preferences of participants, it is inelegant and unpromising for all participants to accept the same privacy preservation level during data collection. To address such issue, an adaptive personalized local differential privacy (APLDP) data collection scheme is proposed to realize personalized privacy preservation while achieving higher data utility, in which two different LDP perturbation methods (basic RAPPOR and k-RR) are adaptively chosen by the participants according to their different privacy preferences, as well as the best perturbation probability is adaptively adopted by the participants to perturb their private data. In such case, the adaptive boundary based on the minimum mean square error (MSE) is theoretically derived to allow the participant to adaptively choose the best perturbation method, and meanwhile, it allows the participant to adaptively choose the best perturbation probability. Then, two estimation mergence methods named the direct combination (DC) and the weighted combination (WC) are demonstrated to do efficient data aggregation. Experiments on both synthetic and real data sets show that the proposed APLDP scheme performs better than previous non-personalized proposals in terms of the MSE and the average error rate (AER), especially using WC estimation method.

Trajectory personalization privacy preservation method based on multi-sensitivity attribute generalization and local suppression

Fast-developing mobile location-aware services generate an enormous volume of trajectory data while adding value to people’s lives. However, trajectory data contains not only location information, but also sensitive personal information. If the original trajectory data is published directly, it could result in serious privacy leaks. Most of the existing privacy-preserving trajectory publishing methods only protect the location information or set the same privacy preservation levels for all moving objects. To meet the users’ personalized privacy requirements and ensure the utility of trajectory location and sensitive information, we propose a trajectory personalized privacy preservation method based on multi-sensitivity attribute generalization and local suppression. First, we set different security levels for each trajectory by calculating the correlation between sensitive attributes to establish a sensitive attribute classification tree. Second, we generalized sensitive attributes based on privacy preservation levels for each trajectory, the trajectory data still at risk of privacy leakage after generalization was locally suppressed. Finally, an anonymized trajectory dataset was generated. Experimental results on real datasets demonstrated that our method could improve data availability while preserving privacy.

Personalized Privacy Preservation in Consumer Mobile Trajectories

The use of mobile technologies to collect and analyze consumer location data has created a multi-billion-dollar ecosystem with various stakeholders. However, this ecosystem also presents privacy risks to consumers. To address this issue, data aggregators can implement a privacy preserving framework that balances privacy risks to consumers with data utilities for advertisers. The proposed framework is personalized and flexible, allowing for quantification of personalized privacy risks and data obfuscation to reduce these risks. It can accommodate a variety of risks, utilities, and trade-offs between the two. The framework was validated on one million consumer location trajectories, revealing potential privacy risks in the absence of data obfuscation. Machine learning methods are used to demonstrate the effectiveness of the proposed framework which outperformed ten baselines from the latest literature, significantly reducing each consumer’s privacy risk while preserving advertiser utility. As the use of location big data continues to grow, this research offers a necessary framework to balance privacy risks and data utilities, sustain a secure and self-governing ecosystem, and ensure the protection of consumers’ personal data.

A Personalized Privacy Preserving Mechanism for Crowdsourced Federated Learning

In this paper, we focus on the privacy preserving mechanism design for crowdsourced Federated Learning (FL), where a requester can outsource its model training task to some workers via an FL platform. A potential way to preserve the privacy of workers' local data is to leverage Differential Privacy (DP) mechanisms on local models. However, most of these studies cannot allow workers to dominate their own privacy protection levels by themselves. Thus, we propose a Personalized Privacy Preserving Mechanism, called P3M, to satisfy the heterogeneous privacy needs of workers, which consists of two parts. The first part includes a personalized privacy budget determination problem. We model it as a two-stage Stackelberg game, derive the personalized privacy budget for each worker and the optimal payment for the requester, and prove that they form a unique Stackelberg equilibrium. Second, we design a dynamic perturbation scheme to perturb model parameters. Through the theoretical analysis, we prove that P3M satisfies the desired DP property, and derive the bounds of the variance of average perturbed parameters and the convergence upper bound. This demonstrates that the global model accuracy can be controllable and P3M is endowed with the satisfactory convergence performance. In addition, we extend our problem to the scenario where the total privacy budget of all workers is limited, so as to prevent some workers from setting exorbitant privacy budgets. Under the privacy constraint, we re-determine the personalized privacy budget for each worker. Finally, exhaustive simulations of P3M are conducted based on real-world datasets, and the experimental results corroborate its effectiveness and practicability.

Local generalization and bucketization technique for personalized privacy preservation

Anonymization technique has been extensively studied and widely applied for privacy-preserving data publishing. In most previous approaches, a microdata table consists of three categories of attributes, namely explicit-identifier, quasi-identifier (QI), and sensitive attribute. In general, individuals may have different views on the sensitivity of different attributes. Therefore, there is another type of attribute that contains both QI values and sensitive values, termed semi-sensitive attribute. In this paper, we propose a new anonymization technique, called Local Generalization and Bucketization, to prevent identity disclosure and protect the sensitive values on each semi-sensitive attribute and sensitive attribute. The rationale is to use local generalization and local bucketization to divide the tuples into local equivalence groups and partition the sensitive values into local buckets, respectively. The protections of local generalization and local bucketization are independent, so that they can be implemented by appropriate algorithms without weakening other protection. Besides, the protection of local bucketization for each semi-sensitive attribute and sensitive attribute is also independent. Consequently, local bucketization can comply with various principles in different attributes according to the actual requirements of anonymization. We conducted extensive experiments to illustrate the effectiveness of the proposed approach.

Enhanced Privacy Preserving for Social Networks Relational Data Based on Personalized Differential Privacy

With the popularization and development of social software, more and more people join the social network, which produces a lot of valuable information, but also contains plenty of sensitive privacy information. To achieve the personalized privacy protection of massive social network relational data, a privacy enhancement method for social networks relational data based on personalized differential privacy is proposed. And a dimensionality reduction segmentation sampling (DRS-S) algorithm is proposed to implement this method. First, in order to solve the problem of inefficiency caused by the excessive amount of data in social networks, dimension reduction and segmentation are carried out to divide the data into groups. According to the privacy protection requirements of different users, we adopt sampling method to protect users with different privacy requirements at different levels, so as to realize personalized different privacy. After that, the noise is added to the protected data to satisfy the privacy budget. Then publish the social network data. Finally, the proposed algorithm is compared with the traditional personalized differential privacy (PDP) algorithm and privacy preserving approach based on clustering and noise (PBCN) in real data set, the experimental results demonstrate that the quality of privacy protection and data availability of DRS-S are better than that of PDP algorithm and PBCN algorithm.

Neural Network-based Game Theory Approach for Personalized Privacy Preservation in Data Publishing

Neural Network-based Game Theory Approach for Personalized Privacy Preservation in Data Publishing

Privacy Recommendation Based on Bhattacharyya Coefficient

In the era of big data, how to achieve the trade-off between recommendation accuracy and privacy protection has become a hot topic in the field of recommendation. In this work, a recommendation scheme with personal privacy preservation is designed. Besides, it does not depend on co-ratings. In order to solve the problem of excessive sensitivity when the Laplace noise is introduced directly, the Bhattacharyya coefficient that is used as the similarity metric is normalized. Moreover, a personalized privacy protection scheme that considering the difference of users is used for the recommendation system. Experimental results show that, compared with the traditional differential privacy collaborative filtering scheme, the RMSE and MAE of the proposed scheme are significantly improved. The proposed scheme not only ensures the accuracy of the prediction results but also effectively guarantees the privacy protection of user data. It also provides an insight into the design of recommendation services considering privacy protection.

Light-Weight Selective Image Encryption for Privacy Preservation

To protect personal privacy and confidential preservation, access control is used to authorize legal users for safe browsing the authorized contents on photos. The access control generates an authorization rule according to each permission assignment. However, the general access control is inappropriate to apply in some social services (e.g., photos posted on Flickr and Instagram, personal image management in mobile phone) because of the increasing popularity of digital images being stored and managed. With low maintenance loads, this paper integrates the data hiding technique to propose an access control mechanism for privacy preservation. The proposed scheme changes the partial regions of a given image as random pads (called selective image encryption) and only allows the authorized people to remedy the random pads back to meaningful ones which are with similar visual qualities of original ones.

Mobile Semantic-Aware Trajectory for Personalized Location Privacy Preservation

Synthesizing a fake trajectory with consistent lifestyle and meaningful mobility as the actual one is the most popular way to protect the location privacy in trajectory sharing. Recent location privacy preservation shows a strong personalized requirement from the mobile semantics between users and locations. However, the existing techniques cannot fully satisfy such personalized requirements, resulting in either overprotection or underprotection. It remains open to characterize and quantify the personalized requirement for location privacy preservation. In this article, we propose a mobile semantic-aware privacy model, named MSP. Specifically, we first characterize a new kind of user-related mobile semantic on-location set by constructing a hierarchical semantic tree, according to the user’s roles at locations. Then, a dedicated approach is proposed to evaluate the location’s privacy sensitivity and integrate it into the user-related mobile semantic. Finally, an adaptive privacy-preserving mechanism, MSP, is developed, fully considering the personalized requirement from both the user and the location. With this model in place, mobile semantic-aware synthetic trajectories are constructed adaptively. Extensive experiments with a real-world data set demonstrate that our MSP model can achieve an effective and flexible balance between the personalized privacy preservation and the data availability of synthetic trajectories.

Green Personalized Privacy Preservation of E-Health Data through Multi-Objective Weighted Clustering and Optimal Item Set Mining

Green Personalized Privacy Preservation of E-Health Data through Multi-Objective Weighted Clustering and Optimal Item Set Mining

Motion Detection to Preserve Personal Privacy from Surveillance Data using Contrary Motion

Internet of Things network today naturally is one of the huge quantities of devices from sensors linked through the communication framework to give value added service to the society and mankind. That allows equipment to be connected at anytime with anything rather using network and service. By 2020 there will be 50 to 100 billion devices connected to Internet and will generate heavy data that is to be analyzed for knowledge mining is a forecast. The data collected from individual devices of IoT is not going to give sufficient information to perform any type of analysis like disaster management, sentiment analysis, and smart cities and on surveillance. Privacy and Security related research increasing from last few years. IoT generated data is very huge, and the existing mechanisms like k- anonymity, l-diversity and differential privacy were not able to address these personal privacy issues because the Internet of Things Era is more vulnerable than the Internet Era [10][20]. To solve the personal privacy related problems researchers and IT professionals have to pay more attention to derive policies and to address the key issues of personal privacy preservation, so the utility and trade off will be increased to the Internet of Things applications. Personal Privacy Preserving Data Publication (PPPDP) is the area where the problems are identified and fixed in this IoT Era to ensure better personal privacy.

Enhanced anonymous models for microdata release based on sensitive levels partition

Depending on the inherent characteristic of sensitive attributes, even those existing enhanced anonymous models still permit the private information to be disclosed or have other limitations so far, such as skewness attacks or sensitive attacks. Based on this, three novel enhanced anonymous models, i.e., (p,αisg)-sensitive k-anonymity model, (p+,αisg)-sensitive k-anonymity model and (pi+,αisg)-sensitive k-anonymity model, are proposed to improve the privacy preservation by fully considering the sensitivity of different sensitive values on the sensitive attribute so as to realize better personalized privacy preservation. Different from the traditional methods, which basically quantify the sensitive level of the specific sensitive value focusing on user-defined classification approaches, the sensitivity of different sensitive values based on self-information is fully considered to obtain sensitive levels partition (SLP) so as to achieve better privacy by designing SLP from qualitative status towards quantitative status in our models. The conception of identical sensitive group (ISG), which is generated from the idea of hierarchical clustering method by using SLP algorithm, is introduced to design the anonymous models for better defending against sensitive attacks. In this case, the sensitive values with the most similar sensitivity are most likely clustered in the same ISG. Moreover, the frequency of each ISG is confined to no more than the specific personalized threshold αisg in any equivalence class without ending up with “one size for all” restrictions. Here, higher sensitive of ISG should be assigned a lower frequency constraint for resisting sensitive attacks so as to achieve better privacy. Then, two clustering algorithms are devised by using the idea of bottom-up greedy methods. Experiment results based on two real-world datasets show that our three anonymous models can effectively protect data privacy and enhance data security and practicality with certain information loss.

Multiple Sensitive Values-Oriented Personalized Privacy Preservation Based on Randomized Response

In the case where the private data is not equally important, personalized local privacy preservation based on randomized response (RR) is studied in the collection of sensitive data. So far, the existing RR mechanisms for multiple discrete private sources, which are termed as conventional randomized response (CRR) mechanisms, focus on a universal approach that exerts the same amount of privacy preservation for all sensitive values, without catering for their concrete privacy requirements. An immediate consequence is that they may be offering insufficient protection to a subset of data contributors with relatively higher privacy requirements, while applying excessive privacy control to another subset with relatively lower privacy requirements. Motivated by this, a novel perturbation framework, which is termed as personalized randomized response (PRR) mechanism, is proposed to achieve personalized privacy preservation (Personalized-PP) by designing the statistical privatization mechanism for multiple sensitive values. The proposed PRR technique introduces the weights for different sensitive values according to their sensitivity, and then introduces the weights into the decision of PRR by considering the concrete requirements for privacy, and thus, attains a higher data utility with respect to the quality of statistics while guaranteeing Personalized-PP. The estimate error of the private distribution is used to measure the quality of statistics for the two RR mechanisms. Theoretical study shows that the estimate error of PRR mechanism is smaller than that of the CRR mechanism for a certain same subjective privacy leakage degree. In particular, simulation results reveal the circumstances where CRR mechanism fails to provide Personalized-PP, and then establish the superiority of PRR mechanism.

A generalization model for multi-record privacy preservation

Privacy preservation becomes a more and more serious problem in data publication, which has drawn dramatic attention in research and development. Recently, several privacy preservation models and algorithms have been proposed for publishing data. However, most of the previous methods suffer from more than one drawback as follows: (i) Could not be used on multi-record datasets. (ii) Only guarantee one-way generalization. (iii) User privacy preferences are ignored. In order to satisfy higher privacy requirements and make it suitable for multi-record publishing datasets, a bidirectional personalized generalization (BP-generalization) model is proposed as a new solution in this paper. The rational is to focus anonymous objects on both relational and set-valued information. First, we merge tuples with the same attribute values in multi-record datasets to ensure the validity of quasi-identifier anonymity. Second, by enforcing l-diversity on equivalence groups and k-anonymity on fingerprint buckets respectively, privacy preservation model may resist bi-directional chain attack. Finally, a new hierarchical generalization strategy is also proposed for personal privacy preservation of sensitive attributes, then different generalization rules can be adopted for different levels of sensitive values. Extensive experimental results on two datasets show that the performance of our method is better than state-of-art techniques in terms of efficiency and information loss.

Fine-grained Image Authorization Mechanism for Image Management Systems

To protect personal privacy and confidential preservation, access control is used to authorize legal users for safe browsing the authorized contents on photos. The access control generates an authorization rule according to each permission assignment. With low maintenance loads, this paper integrates the PM-tree compression and access control technique to propose a fine-grained access control model for digital image systems. The proposed scheme enables users to have different views of an image after they login to the system. The authorization unit for the image can be parts of the image, such as a pixel, a block, several blocks or the whole image. The experiments implement this model on the Blueprint Collaboration System (BCS) provided the positive data to confirm its feasibility.

A Novel Approach for Personalized Privacy Preserving Data Publishing with Multiple Sensitive Attributes

The Personalized Privacy has drawn a lot of attention from diverse magnitudes of the public and various functional units like bureau of statistics, and hospitals. A large number of data publishing models and methods have been proposed and most of them focused on single sensitive attribute. A few research papers marked the need for preserving privacy of data consisting of multiple sensitive attributes. Applying the existing methods such as k-anonymity, l-diversity directly for publishing multiple sensitive attributes would minimize the utility of the data. Moreover, personalization has not been studied in this dimension. In this paper, we present a publishing model that manages personalization for publishing data with multiple sensitive attributes. The model uses slicing technique supported by deterministic anonymization for quasi identifiers; generalization for categorical sensitive attributes; and fuzzy approach for numerical sensitive attributes based on diversity. We cap the belief of an adversary inferring a sensitive value in a published data set to as high as that of an inference based on public knowledge. The experiments were carried out on census dataset and synthetic datasets. The results ensure that the privacy is being safeguarded without any compromise on the utility of the data.

Personalized Privacy Preserving Approaches for Multiple Sensitive Attributes in Data Publishing

n recent years, more and more research for multiple sensitive attributes of personal privacy preserving technology, and put forward a variety of methods, but most of the multiple sensitive attributes privacy protection method have not achieved autonomy of personal privacy, personalized privacy preserving. This paper proposed a personalized privacy preserving model for multiple sensitive attributes based on multi-sensitive bucketization, the model with personalized (, l) - anonymity model of multi dimension bucket grouping technology to realize personalized preserving. The general multi-sensitive personal-(,l)(GMSP) and the maximum selectivity personal first (MSPF) are proposed, which is based on the as the parameter. Through a lot of experiments on real data sets, the results show that the model can reduce the leakage of sensitive data and enhance the data publishing.

Personalized extended (α, k)‐anonymity model for privacy‐preserving data publishing

SummaryGeneral (α, k)‐anonymity model is a widely used method in privacy‐preserving data publishing, but it cannot provide personalized anonymity. At present, two main schemes for personalized anonymity are the individual‐oriented anonymity and the sensitive value‐oriented anonymity. Unfortunately, the existing personalized anonymity models, designed for any of the aforementioned schemes for privacy‐preserving data publishing, are not effective enough to meet the personalized privacy preservation requirement. In this paper, we propose a novel personalized extended scheme to provide the personalized services in general (α, k)‐anonymity model. The sensitive value‐oriented anonymity is combined with the individual‐oriented anonymity in the new personalized extended (α, k)‐anonymity model by the following two steps: (1) The sensitive attribute values are divided into several groups according to their sensitivities, and each group is assigned with its own frequency constraint threshold. (2) A guarding node is set for each individual to replace his/her sensitive value if necessary. We implement the personalized extended (α, k)‐anonymity model with a clustering algorithm. The performance evaluation finally shows that our model can provide stronger privacy preservation efficiently as well as achieving the personalized service. Copyright © 2016 John Wiley & Sons, Ltd.