Systems and Methods For Anonymity Protection

• US 20110178943A1
• Filed: 12/17/2010
• Published: 07/21/2011
• Est. Priority Date: 12/17/2009
• Status: Abandoned Application

• Current Assignee: New Jersey Institute of Technology
• Original Assignee: New Jersey Institute of Technology
• Inventors: Ziavras, Sotirios, Motahari, Sara Gatmir
• Application Number:
  US12/972,045
• Publication Number:
  US 20110178943A1
• Time in Patent Office: Days
• US Class Current: 705/325
• CPC Class Codes: G06F 21/6254 by anonymising data, e.g. decorrelating personal data from the owner's identification
• CPC Class Codes: G06Q 50/265 Personal security, identity or safety
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00

Abstract

In any situation where an individual'"'"'s personal attributes are at risk to be revealed or otherwise inferred by a third, there is a chance that such attributes may be linked back to the individual. Examples, of such situations include publishing user profile micro-data or information about social ties, sharing profile information on social networking sites or revealing personal information in computer-mediated communication. Measuring user anonymity is the first step to ensure that a users identity cannot be inferred. The systems and methods of the present disclosure, embrace an information-entropy-based estimation of the user anonymity level which may be used to predict identity inference risk. One important aspect of the present disclosure is complexity reduction with respect to the anonymity calculations.

Claims

1. A method for protecting anonymity over a network, the method comprising:

ascertaining a set Q of one or more linkable attributes for a user;

determining a level of anonymity for the user by calculating a conditional entropy H(Φ

|Q) for user identity Φ

, given the set Q of linkable attributes;

initiating a responsive action based on the estimated level of anonymity.

2. The method of claim 1, wherein the conditional entropy H(Φ

|Q) is calculated according to the equation

3. The method of claim 1, wherein the set Q includes a probabilistic attribute characterized by a probability distribution of possible values for the attribute.

4. The method of claim 1, wherein the set Q includes an attribute revealed in one or more computer mediated communications by the user.

5. The method of claim 1, wherein the set Q includes an attribute which is inferable from one or more computer mediated communications based on an estimated background knowledge for an intended recipient or group of recipients.

6. The method of claim 1, further comprising comparing the level of anonymity to an anonymity threshold calculated based on a desired degree of obscurity.

7. The method of claim 6, wherein the responsive action is initiated if the level of anonymity is less than the anonymity threshold.

8. The method of claim 6, wherein the set Q is determined to be an identity-leaking set if the level of anonymity is less than the anonymity threshold.

9. The method of claim 1, wherein the set Q accounts for an estimated background knowledge of an inferrer over a network.

10. The method of claim 9, wherein the background knowledge is estimated based on an assumption that a determined set of attributes would be relevant to the inferrer for the purposes of distinguishing a user'"'"'s identity.

11. The method of claim 9, wherein the background knowledge is estimated based on a network context.

12. The method of claim 9, wherein the background knowledge is estimated using relevant user studies over the network.

13. The method of claim 9, wherein the background knowledge is estimated by dynamically monitoring the inferrer user over the network.

14. The method of claim 1, further comprising monitoring communications between the user and an inferrer to identify user attributes revealed by the user or inferable by the inferrer.

15. The method of claim 14, further comprising determining whether an identified user attribute is a linkable user attribute, wherein a non-linkable user attribute is disregarded.

16. The method of claim 14, wherein the set Q and the level of anonymity for the user are dynamically determined based on the monitoring of the communications.

17. The method of claim 1, further comprising determining whether the set Q includes an identifying attribute, wherein the level of anonymity is determined only where the set Q does not include an identifying attribute and wherein, if an identifying attribute is detected, the responsive action is immediately initiated.

18. The method of claim 1, further comprising determining a degree of obscurity for the user, given the set Q, and comparing the degree of obscurity relative to a sufficiency threshold, wherein the level of anonymity is determined only where the degree of obscurity does not exceed the sufficiency threshold.

19. The method of claim 1, further comprising determining a degree of obscurity for the user, given the set Q, and comparing the degree of obscurity relative to a desired degree of obscurity, wherein the level of anonymity is determined only where the degree of obscurity is greater than the desired degree of obscurity and wherein, if the degree of obscurity is less than the desired degree of obscurity, the responsive action is immediately initiated.

20. The method of claim 1, wherein the responsive action includes at least one of:

(i) blocking a communication containing a linkable attribute, (ii) warning the user that his/her anonymity is being compromised, (iii) taking a proactive action strengthen anonymity, and (iv) introducing false information of increase anonymity.

21. A system for protecting anonymity over a network the system, comprising:

a non-transitory computer readable medium storing computer executable instructions for;

ascertaining a set Q of one or more linkable attributes for a user; and

determining a level of anonymity for the user by calculating a conditional entropy H(Φ

|Q) for user identity Φ

, given the set Q of linkable attributes.

22. The system of claim 21, further comprising a processor for executing the computer executable instructions.