COLLABORATIVE RESEARCH: Privacy-aware Information Release Control

随着计算机和网络技术的快速发展，一个组织可以快速有效地收集、存储和检索大量的各种数据。数据对许多组织具有战略和运营重要性。同时，由于这些大型信息系统包含了大量的个人详细信息，对个人隐私构成了潜在的威胁。处理不当的个人数据隐私不仅侵犯了个人的基本权利和相关的联邦和州法律，而且对企业的可信度和最终的底线也是一种责任。因此，迫切需要一种技术，可以被组织和企业采用，在不阻碍实现其战略和运营目标所必需的信息流的情况下保护个人隐私。尽管这种迫切需求反映在最近隐私领域研究活动的增加上，但仍存在一些问题，特别是与隐私感知数据发布系统相关的问题尚未得到解决。关键问题包括：当一段数据被发布时，个人隐私在多大程度上被泄露？如果损失过大，我们如何修改要发布的数据，以允许最大程度的信息流动，同时保护隐私？这个项目的出发点是意识到隐私问题对于不同的数据集有不同的形式。为了保护个人隐私，必须将隐私问题形式化。当数据被发布时，无论是用于保护隐私的数据挖掘，还是仅仅向第三方或公众发布，都需要满足这些隐私规则。这被称为隐私感知信息发布控制。一般采用两种方法：查询匿名化和在线数据检查。查询匿名化意味着要对所有查询进行评估，以了解通过查询泄露了多少隐私。如果查询披露了太多信息，将进行一些更改，以保持隐私级别。在这里，技术上的挑战是如何确保系统将释放最大的信息，但没有任何隐私侵犯。在线数据检查是指在数据发布时，对即将发布的数据进行隐私规则检查，发现是否存在侵犯隐私的情况。在线检查的技术挑战在于它的效率。这两种方法是相辅相成的，有时可以在实际系统中一起使用。上述技术基于了解数据请求者被允许拥有的隐私级别。一旦数据发布，根据输出中包含的私有数据的级别，可能会附加一些义务。本项目还处理与管理这些义务有关的问题。

With rapid advancements in computer and network technology, it has become possible for an organization to collect, store, and retrieve vast amounts of data of all kinds quickly and efficiently. Data is of strategic and operational importance to many organizations. At the same time, these large information systems represent a potential threat to individual privacy since they contain a great amount of detailed information about individuals. Privacy of individual data handled poorly not only violates the fundamental rights of individuals and relevant federal and state laws, it is also a liability to businesses in terms of their trustworthiness and eventually their bottom line. Therefore, there is an urgent need of technology that can be adopted by organizations and businesses to protect the privacy of individuals without impeding the flow of information that is necessary to achieve their strategic and operation goals. Although this urgent need is reflected in the recent increase of research activities in the privacy area, there are several problems, especially related to a privacy-aware data release system, that are yet to be addressed. The essential questions include: when a piece of data is released, to what extent privacy of individuals is lost? If the loss is excessive, how do we modify the data to be released in a way that permits maximum flow of information while preserving privacy at the same time? The starting point of this project is the realization that privacy concerns take different forms for different data sets. In order to preserve the privacy of individuals, the privacy concerns must be formalized. When data is released, whether used in privacy-preserving data mining or simply published to the third party or the general public, these privacy rules need to be satisfied. This is termed privacy-aware information release control. Two general approaches are adopted: query anonymization and online data checking. Query anonymization means that all queries are to be evaluated to see how much privacy is disclosed through the query. If the query discloses too much, some changes will be made so that the privacy level will be maintained. Here, the technical challenge is how to ensure that the system will release the maximum information but without any privacy violation. Online data checking means that when data is released, privacy rules will be checked on the to-be-released data to find any privacy violation. The technical challenge of online checking is its efficiency. These two methods are complementary to each other and can sometimes be used together in a practical system. The above techniques are based on knowing the privacy level that the data requester is allowed to have. Once data is released, depending on the level of private data contained in the output, some obligations may be attached. This project also tackles the problems related to management of such obligations.