Click to edit Master text styles
Second level
Third level
Fourth level
Fifth level
‹date/time›
=
‹fo=
oter›
=
‹#&=
#8250;
=
------=_NextPart_01C4F197.49C61310
content-location: file:///C:/2AA2647F/3A-03-Bhargava__files/master04.xml
content-transfer-encoding: quoted-printable
content-type: text/xml;
charset="utf-8"
Click to edit Master title style=
Click to edit Master subtitle st=
yle
‹=
;date/time›
‹footer›
‹#›&=
#13;
------=_NextPart_01C4F197.49C61310
content-location: file:///C:/2AA2647F/3A-03-Bhargava__files/master05.xml
content-transfer-encoding: quoted-printable
content-type: text/xml;
charset="utf-8"
‹header›
‹date/time›
‹footer›
‹#›
------=_NextPart_01C4F197.49C61310
content-location: file:///C:/2AA2647F/3A-03-Bhargava__files/pres.xml
content-transfer-encoding: quoted-printable
content-type: text/xml;
charset="utf-8"
![](3D"master05_image001.gif")
Using Entropy to Trade <=
/span>Privacy
for Trust
Yuhui Zhong
<=
/span>
Bharat Bhargava&#=
13;
{zhon=
g,
bb}@cs.purdue.edu
Department of Com=
puter
Sciences
Purdue University=
This work is supported by NSF grant IIS-0209059
![](3D"master04_image002.gif")
![](3D"master04_image003.gif")
![](3D"master04_image004.gif")
![](3D"master04_image005.gif")
Prob=
lem
motivation
nPrivacy
and trust form an adversarial relationship
<=
/div>
nInternet users worry about revealing personal <=
span
style=3D'position:absolute;top:48.0%;left:14.04%;width:92.69%;height:6.5%=
'>data.
This fear held back $15 billion in online revenue in 2001
nUsers
have to provide digital credentials that contain private informat=
ion
in order to build trust in open environments like Internet.
<=
/span>
nResearch
is needed to quantify the tradeoff between privacy and trust.<=
/span>
Sub problems
nHow much privac=
y is
lost by disclosing a piece of credential?
nHow =
much does
a user benefit from having a higher level of trust?
=
nHow =
much
privacy a user is willing to sacrifice for a certain amount of t=
rust gain?
<=
span
style=3D'visibility:hidden'>n
nFormulate the privacy-trust tradeoff problem
=
nDesign metrics and algorithms to evaluate the privacy loss. We consider:
nInformation receiver
nInformation usage
nInformation disclosed in the past
nEstimate trust gain due to disclosing a set of credentials
nDevelop mechanisms empowering users to trade trust for privacy.
nDesign prototype and conduct experimental =
study
Prop=
osed
approach
nPrivacy Metrics
nAnonymity set without accounting for probability distribution =
[Reiter and Rubin, ’99]
<=
/div>
nDifferential entropy to measure how well an attac=
ker
estimates an attr=
ibute
value [Agrawal and Aggarwal ’01]
nAutomated trust negotiation (ATN) [Yu, Winslett, =
and Seamons, ’03]
nTradeoff between the length of the negotiation, t=
he
amount of information disc=
losed,
and the computation effort
nTrust-based decision making [Wegella et al.
’03]
nTrust lifecycle management, with considerations o=
f both
trust and risk assessments=
nTrading privacy for trust [Seigneur and Jensen,
’04]
nPrivacy as the linkability of pieces of evidence =
to a
pseudonym; measured by usin=
g nymity
[Goldberg, thesis, ’00]
Relat=
ed work
nSet
of private attributes that user wants to
conceal
nSet
of credentials
nR(i): subset of credentials revealed to receive=
r i
nU(i): credentials unrevealed to receiver i&#=
13;
nCredential
set with minimal privacy loss
nA subset of credentials NC from U (i)=
3;
nNC
satisfies the requirements for trust building
nPrivacyLoss(NC∪R(i))
– PrivacyLoss(R(i))) is minimized
Form=
ulation
of tradeoff problem
nDecision
problem:
nDecide
whether trade trust for privacy or not
nDetermine
minimal privacy damage
nMinimal privacy damage is a function of minimal p=
rivacy
loss, information usag=
e and
trustworthiness of information receiver.
nCompute
trust gain
nTrade
privacy for trust if trust gain > minimal privacy damage
nSelection
problem:
nChoose
credential set with minimal privacy loss
Formulation
tradeoff problem (con=
t. 1)
nCollusion
among information receivers
nUse
a global version R<=
i>g instead of <=
i>R(i)
nMinimal
privacy loss for multiple private attributes
nnc<=
i>1<=
span
style=3D'mso-spacerun:yes'> better
for attr<=
i>1 but=
worse
for attr<=
i>2 tha=
n nc2
nWeight vector {w1,
w2, …, w<=
i>m} corresponds to the sensitivity of attributes
nSalary
is more sensitive than favorite TV show
nPrivacy
loss can be evaluated using:
nThe
weighted sum of privacy loss for all attributes
nThe
privacy loss for the attribute with the highest weight
Form=
ulation
tradeoff problem (con=
t. 2)
nQuery-independent
privacy loss
nUser determines her private attributes
nQuery-independent loss characterizes how helpful
provided credentials for an adversarial to determine the probab=
ility
density or probability mass function of a private
attribute.
Two =
types
of privacy loss
nQuery-dependent
privacy loss
nUser determines a set of potential queries Q
that she is reluctant to answer
nProvided
credentials reveal information of attribute set A. Q is a
function of A.
nQuery-dependent loss characterizes how helpful
provided credentials for an adversarial to determine the probab=
ility
density or probability mass function of Q.
Two =
types
of privacy loss (cont1)
Obser=
vation
1
nHigh
query-independent loss does not necessarily imply high
query-dependent loss
nAn abstract example
![](3D"slide0045_image007.jpg")
nPrivacy loss is affected by the order of <=
/span>disclosure
nExample:
nPrivate attribute
nage
nPotential queries:
n(Q1) Is Alice an elementary sc=
hool
student?
n(Q2) Is Alice older than 50 to=
join a
silver insurance plan?
nCredentials
n(C1) Driver license
n(C2) Purdue undergraduate stud=
ent ID
Obse=
rvation
2
Exam=
ple
![](3D"slide0009_image009.jpg")
nC1 à C=
2
n=
Disclosing C1
nlow query-independent loss (wide range for age)&#=
13;
n100% loss for Query 1 (elem. school student)
=
nlow loss for Query 2 (silver plan)
n=
Disclosing C2
nhigh query-independent loss (narrow range for age=
)
nzero loss for Query 1 (because privacy was lost by
disclosing license)
nhigh loss for Query 2 (“not sure” &agrav=
e; “no - high probability”
nC2 à C=
1
n=
Disclosing C2
nlow query-independent loss (wide range for age)&#=
13;
n100% loss for Query 1 (elem. school student)
=
nhigh loss for Query 2 (silver plan)
n=
Disclosing C1
nhigh query-independent loss (narrow range of age)=
nzero loss for Query 1 (because privacy was lost by
disclosing ID)
nzero loss for Query 2
Exam=
ple
(cont.)
Entr=
opy-based
privacy loss
nEntropy measures the randomness, or uncertainty, in private data.
<=
/div>
nWhen an adversarial gains more information, entropy decreases
nThe difference shows how much information =
has been leaked
nConditional probability is needed for entropy evaluation
nBayesian networks, kernel density estimation or <=
/span>subjective estimation can be adopted
Estimation of query-independent
privacy loss
nSingle attribute
nDomain of attribute a : {v1=
,
v2,
…, vk}
nPi and P*i are
probability mass function before and after disclosing NC giv=
en
revealed credential set R.
nMultiple attributes
nAttribute set {a1, a2=
…,an} =
with =
sensitivity
vector {w1, w2, …, wn=
}
Estimation of query-dependent
privacy loss
nSingle query Q
nQ is the function f of attribute set A
nDomain of f (A) : {qv1=
,
qv2,
…, qvk}
nMultiple queries
nQuery set {q1, q2=
…,qn} with sensitivi=
ty
vector {w1, w2, …, wn}
nPri is the probability that qi is asked
Esti=
mate
privacy damage
nAssum=
e user
provides one damage function d<=
i>usage(PrivacyLoss) for
each information usage
nPriva=
cyDamage(PrivacyLoss,
Usage, Receiver) =3D Dmax(P=
rivacyLoss)×(1-Trustreceiver) + dusage(PrivacyLoss) ×=
;Trustreceiver
nTrustreceiver is
a number Є [0,1] representing the =
trustworthy of
information receiver
nDm=
ax(PrivacyLoss) =3D Max(d<=
i>usage(PrivacyLoss) for
all usage)
nIncreasing trust
level
nAdopt research on trust
establishment and management
nBenefit function <=
i>TB(trust_level)
nProvided by service provider=
or
derived from user’s utility function
<=
/div>
nTrust gain
nTB(trust_levelnew) - TB(tust_level<=
span
style=3D'font-size:67%;color:#333399;mso-color-index:3;position:relative;
top:.37em;mso-text-raise:-25%'>prev)
Esti=
mate
trust gain
(1)
[2a]
(3) [2b] [2d]
[2c1]
[2c2]
(2)
(4)
TERA =3D Trust-Enhanced Role Assignment
(&=
lt;nr>) – unconditional path=
3;
[<nr>]– conditional path
PRETTY:
Prototype for Expe=
rimental
Studies
1)User application sends query to server applicatio=
n.
2)Server application sends user information to TERA=
server
for trust evaluation and r=
ole
assignment.
a)If a higher trust level is required for query, TE=
RA
server sends the request for more user’s
credentials to privacy negotiator.
b)Based on server’s privacy policies and the
credential requirements, privacy negotiator interacts with user’s privacy negotiator to=
build
a higher level of trust.
c)Trust gain and privacy loss evaluator selects
credentials that will increase trust to the required level with the least privacy loss. Calcu=
lation
considers credential requ=
irements
and credentials disclosed in previous interactions.
d)According to privacy policies and calculated priv=
acy
loss, user’s privacy negotiator decides whether or not to supply credentials to t=
he
server.
3)Once trust level meets the minimum requirements,
appropriate roles are assig=
ned to
user for execution of his query.
4)Based on query results, user’s trust level =
and
privacy polices, data disseminator determines:
(i) whether to distort data and if so to what degree, and (ii) what privacy enforcement metadata should be associated=
with
it.
Info=
rmation
flow for PRETTY
Conc=
lusion
nThis research
addresses the tradeoff issues between privacy and trust.=
3;
=
nTrad=
eoff
problems are formally defined.
nAn
entropy-based approach is proposed to estimate privacy loss.&=
#13;nA pr=
ototype
is under development for experimental study.
' + ENDSHOW_MESG + '
![](3D"notes_flag.gif")
N=
otes![](3D"buttons.gif")
![](3D"slide0045_image006.png"){kind=link}
![](3D"slide0009_image008.png"){kind=link}
![](3D"slide0049_image011.gif"){kind=link}
![](3D"slide0049_image013.gif"){kind=link}
![](3D"slide0050_image015.gif"){kind=link}
![](3D"slide0050_image017.gif"){kind=link}
![](3D"slide0034_image018.png"){kind=link}
![](3D"slide0034_image019.jpg"){kind=link}