FIWARE OpenSpecification Security Optional_Security_Enablers DBAnonymizer

19.4Overview

However, two different problems may arise: first to decide if a piece of data has to be considered private or not, and second, to assess whether the exposure of non-private data could be used by correlation algorithms to infer hidden private data. The second task is particularly challenging, and cannot be handled manually for large datasets, where the potential number of combinations of different fields is extremely large. In fact, disclosure policies are typically described by human users (security experts and others) that are not able to predict all the possible combinations of the data that could ease the guess of private data contained in the dataset. In some other cases, policy authors are not necessarily security experts and could expose sensitive data without being aware of the impact of such exposure.

DB Anonymizer is a database re-identification risk evaluation and anonymization service; it can be used as a support tool in case of dataset disclosure operations. DB Anonymizer deals with the estimation of the re-identification risk associated to information disclosures, which is the risk that an attacker can reconstruct exactly a dataset's content. This estimation is then used for providing DB Anonymizer users with a number of functionalities connected to dataset anonymization. For instance, the service exposes a function that calculates a value, that represents the likelihood (from 0 - impossibility to 1 - certainty) that an attacker can reconstruct exactly a dataset's content that is anonymized using a certain obfuscation policy.

Albeit privacy risk estimators have already been developed in some specific contexts (statistical databases), they have had limited impact, since they are often too specific for a given context, and do not provide the user with the necessary feedback to mitigate the risk. In addition, they can be computationally expensive on large datasets. DB Anonymizer is specifically designed to address all these issues, exposing a simple RESTful API that can be easily integrated in any application.

DB Anonymizer uses a special algorithm to estimate the re-identification risk. Details on this algorithm can be found in the following article:

• 
  Trabelsi, S.; Salzgeber, V.; Bezzi, M.; Montagnon, G.; , "Data disclosure risk evaluation," 2009 Fourth International Conference on Risks and Security of Internet and Systems (CRiSIS), pp.35-72, 19-22 Oct. 2009. DOI: 10.1109/CRISIS.2009.5411979
  

The service can be used by information owners or responsible persons to evaluate the re-identification risk associated to an information disclosure operation of their data; by suggesting the safest configurations according to a specified upper-bound and finally to perform the dataset anonymization operation according to a disclosure policy. More precisely, through the methods of its API, the service provides the user with an estimation of the re-identification risk when disclosing certain information, and proposes safe combinations in order to minimize the risk that an attacker can reconstruct the original dataset. For instance, the service can estimate the re-identification risk associated to all attributes of a dataset (i.e., its columns); this functionality helps the users in defining the anonymization policies that better suit their business needs and that minimize the re-identification risk.

DB Anonymizer at this stage supports DB dumps in basic SQL syntax. It is however recommended to use MySQL SQL instructions.