Privacy Attacks Based on Correlation of Dataset Identifiers: Assessing the Risk

Data de-identification refers to any process of removing data-identifying attributes and dependencies from a data set. Currently practiced techniques of de-identification of personal and confidential information either insufficiently consider or plainly ignore data dependencies, and, therefore, carry serious risks of re-identification of confidential data. This paper describes four privacy attack models which correlate data identifiers from the existing internal data set with those data identifiers which are available from external sources. The attacks described herein allow a hacker to perform de-clustering of a public data set by either disclosing values of identifiers, or by adding new values into the original dataset which will increase the probability of re-identification. These attribute disclosure attacks carry direct risks to generally accepted privacy models, such as 1-diversity, k-anonymity, and t-closeness. We develop probabilistic risk metrics for re-identification and sensitive data disclosure, and use them to calculate the risks associated with each of the attribute disclosure attacks. The attribute disclosure attacks demonstrably increase the overall re-identification and disclosure risk by an average of up to 3.3 times the original risk.