Data anonymization is a relevant and important field within data privacy, which tries to find a good balance between utility and privacy in data. The field is especially relevant since the GDPR came into force, because the GDPR does not regulate anonymous data. This thesis focuses on anonymization of directory-structured data, which means data structured into a tree of directories. In the thesis, four of the most common models for anonymization of tabular data, k-anonymity, ℓ-diversity, t-closeness and differential privacy, are adapted for anonymization of directory-structured data. This adaptation is done by creating three different approaches for anonymizing directory-structured data: SingleTable, DirectoryWise and RecursiveDirectoryWise. These models and approaches are compared and evaluated using five metrics and three attack scenarios. The results show that there is always a trade-off between utility and privacy when anonymizing data. Especially it was concluded that the differential privacy model when using the RecursiveDirectoryWise approach gives the highest privacy, but also the highest information loss. On the contrary, the k-anonymity model when using the SingleTable approach or the t-closeness model when using the DirectoryWise approach gives the lowest information loss, but also the lowest privacy. The differential privacy model and the RecursiveDirectoryWise approach were also shown to give best protection against the chosen attacks. Finally, it was concluded that the differential privacy model when using the RecursiveDirectoryWise approach, was the most suitable combination to use when trying to follow the GDPR when anonymizing directory-structured data.

Testing an integrated information system that relies on data from multiple sources can be a challenge, particularly when the data is confidential. This thesis describes a novel test data extraction approach, called semantic-based test data extraction for integrated systems (iSTDE) that solves many of the problems associated with creating realistic test data for integrated information systems containing confidential data. iSTDE reads a consistent cross-section of data from the production databases, manipulates that data to obscure individual identities while still preserving overall semantic data characteristics that are critical to thorough system testing, and then moves that test data to an external test environment. This thesis also presents a theoretical study that compares test-data extraction with a competing technique, named test-data generation. Specifically, this thesis a) describes a comparison method that includes a comprehensive list of characteristics essential for testing the database applications organized into seven different areas, b) presents an analysis of the relative strengths and weaknesses of the different test-data creation techniques, and c) reports a number of specific conclusions that will help testers make appropriate choices.

Mémoire numérisé par la Division de la gestion de documents et des archives de l'Université de Montréal

This master’s thesis is focused on anonymization of ultrasound data in DICOM format. Haar wavelet belonging to Daubechies wavelet family is used to detect text areas in the image. Extraction of the text from the image is done using a free tool - tesseract OCR Engine. Finally, detected text is compared to sensitive data from DICOM metadata using Levenshtein - edit distance algorithm.

Es soll ein mathematisches Modell zur Berechnung von Abweichungen verschiedener Datentypen auf relationalen Datenbanksystemen eingeführt und getestet werden. Basis dieses Modells sind Ähnlichkeitsmessungen für verschiedene Datentypen. Hierbei führen wir zunächst eine Betrachtung der relevanten Datentypen für die Arbeit durch. Danach definieren wir für die für diese Arbeit relevanten Datentypen eine Algebra, welche die Grundlage zur Berechnung des Anonymisierungsgrades θ ist. Das Modell soll zur Messung des Grades der Anonymisierung, vor allem personenbezogener Daten, zwischen Test- und Produktionsdaten angewendet werden. Diese Messung ist im Zuge der Einführung der EU-DSGVO im Mai 2018 sinnvoll, und soll helfen personenbezogene Daten mit einem hohen Ähnlichkeitsgrad zu identifizieren.

L’anonymisation des données personnelles requiert l’utilisation d’algorithmes complexes permettant de minimiser le risque de ré-identification tout en préservant l’utilité des données. Dans cette thèse, nous décrivons une approche fondée sur les modèles qui guide le propriétaire des données dans son processus d’anonymisation. Le guidage peut être informatif ou suggestif. Il permet de choisir l’algorithme le plus pertinent en fonction des caractéristiques des données mais aussi de l’usage ultérieur des données anonymisées. Le guidage a aussi pour but de définir les bons paramètres à appliquer à l’algorithme retenu. Dans cette thèse, nous nous focalisons sur les algorithmes de généralisation de micro-données. Les connaissances liées à l’anonymisation tant théoriques qu’expérimentales sont stockées dans une ontologie. / Personal data anonymization requires complex algorithms aiming at avoiding disclosure risk without losing data utility. In this thesis, we describe a model-driven approach guiding the data owner during the anonymization process. The guidance may be informative or suggestive. It helps the data owner in choosing the most relevant algorithm given the data characteristics and the future usage of anonymized data. The guidance process also helps in defining the best input values for the algorithms. In this thesis, we focus on generalization algorithms for micro-data. The knowledge about anonymization is composed of both theoretical aspects and experimental results. It is managed thanks to an ontology.

Anonymization is a broad term. Meaning that personal data, or rather data that identifies a person, is redacted or obscured. In the context of video and image data, the most palpable information is the face. Faces barely change compared to other aspect of a person, such as cloths, and we as people already have a strong sense of recognizing faces. Computers are also adroit at recognizing faces, with facial recognition models being exceptionally powerful at identifying and comparing faces. Therefore it is generally considered important to obscure the faces in video and image when aiming for keeping it anonymized. Traditionally this is simply done through blurring or masking. But this de- stroys useful information such as eye gaze, pose, expression and the fact that it is a face. This is an especial issue, as today our society is data-driven in many aspects. One obvious such aspect is autonomous driving and driver monitoring, where necessary algorithms such as object-detectors rely on deep learning to function. Due to the data hunger of deep learning in conjunction with society’s call for privacy and integrity through regulations such as the General Data Protection Regularization (GDPR), anonymization that preserve useful information becomes important. This Thesis investigates the potential and possible limitation of anonymizing faces without destroying the aforementioned useful information. The base approach to achieve this is through face swapping and face manipulation, where the current research focus on changing the face (or identity) while keeping the original attribute information. All while being incorporated and consistent in an image and/or video. Specifically, will this Thesis demonstrate how target-oriented and subject-agnostic face swapping methodologies can be utilized for realistic anonymization that preserves attributes. Thru this, this Thesis points out several approaches that is: 1) controllable, meaning the proposed models do not naively changes the identity. Meaning that what kind of change of identity and magnitude is adjustable, thus also tunable to guarantee anonymization. 2) subject-agnostic, meaning that the models can handle any identity. 3) fast, meaning that the models is able to run efficiently. Thus having the potential of running in real-time. The end product consist of an anonymizer that achieved state-of-the-art performance on identity transfer, pose retention and expression retention while providing a realism. Apart of identity manipulation, the Thesis demonstrate potential security issues. Specifically reconstruction attacks, where a bad-actor model learns convolutional traces/patterns in the anonymized images in such a way that it is able to completely reconstruct the original identity. The bad-actor networks is able to do this with simple black-box access of the anonymization model by constructing a pair-wise dataset of unanonymized and anonymized faces. To alleviate this issue, different defense measures that disrupts the traces in the anonymized image was investigated. The main take away from this, is that naively using what qualitatively looks convincing of hiding an identity is not necessary the case at all. Making robust quantitative evaluations important.

"Mémoire présenté à la faculté des études supérieures en vue de l'obtention du grade de maître en droit (LL.M.)" / Les bouleversements engendrés par les nouveaux moyens de communication des données publiques de même que les multiples possibilités offertes par le réseau Internet, telles que le stockage des informations, la mémoire sans faille et l'utilisation des moteurs de recherche, présentent des enjeux majeurs liés à la protection de la vie privée. La diffusion des données publiques en support numérique suscite un changement d'échelle dans le temps et dans l'espace et elle modifie le concept classique de publicité qui existait dans l'univers papier. Nous étudierons les moyens de respecter le droit à la vie privée et les conditions d'accès et d'utilisation des données personnelles, parfois à caractère sensible, contenues dans les documents publics diffusés sur Internet. Le cas particulier des données accessibles dans les banques de données judiciaires exige des solutions particulières : il s'agit de trouver l'équilibre nécessaire entre le principe de transparence judiciaire et le droit à la vie privée. / The upheavals generated by the new means of disseminating public data, together with the multiple possibilities offered by the Internet, such as information storage, comprehensive memory tools and the use of search engines, give rise to major issues related to privacy protection. The dissemination of public data in digital format causes a shift in our scales of time and space, and changes the traditional concept ofpublic nature previously associated with the "paper" universe. We will study the means of protecting privacy, and the conditions for accessing and using the personal information, sometimes of a "sensitive" nature, which is contained in the public documents posted on the Internet. The characteristics of the information available through judicial data banks require special protection solutions, so that the necessary balance can be found between the principle of judicial transparency and the right to privacy.

Les bouleversements engendrés par les nouveaux moyens de communication des données publiques de même que les multiples possibilités offertes par le réseau Internet, telles que le stockage des informations, la mémoire sans faille et l'utilisation des moteurs de recherche, présentent des enjeux majeurs liés à la protection de la vie privée. La diffusion des données publiques en support numérique suscite un changement d'échelle dans le temps et dans l'espace et elle modifie le concept classique de publicité qui existait dans l'univers papier. Nous étudierons les moyens de respecter le droit à la vie privée et les conditions d'accès et d'utilisation des données personnelles, parfois à caractère sensible, contenues dans les documents publics diffusés sur Internet. Le cas particulier des données accessibles dans les banques de données judiciaires exige des solutions particulières : il s'agit de trouver l'équilibre nécessaire entre le principe de transparence judiciaire et le droit à la vie privée. / The upheavals generated by the new means of disseminating public data, together with the multiple possibilities offered by the Internet, such as information storage, comprehensive memory tools and the use of search engines, give rise to major issues related to privacy protection. The dissemination of public data in digital format causes a shift in our scales of time and space, and changes the traditional concept ofpublic nature previously associated with the "paper" universe. We will study the means of protecting privacy, and the conditions for accessing and using the personal information, sometimes of a "sensitive" nature, which is contained in the public documents posted on the Internet. The characteristics of the information available through judicial data banks require special protection solutions, so that the necessary balance can be found between the principle of judicial transparency and the right to privacy. / "Mémoire présenté à la faculté des études supérieures en vue de l'obtention du grade de maître en droit (LL.M.)"

This work has the goal to make an implementation of an anonymization service on Software-Defined Networks (SDN) with the goal to reduce the number of attacks. With an anonymization service is possible to hide the IP address from the network’s hosts, ensuring more protection against security attacks, which allows a more time availability. One of the biggest challenge on SDN architecture is the security issue. The separation of control and data planes allows o generated challenges on security, due to the network’s permissiveness to attacks such as “ Man in the Middle ”, Denial of Service and Saturation. The service developed in this work, named as BomIP, uses the micro-data anonymization technique of randomization of IP address of the hosts. The BomIP was added in the SDN controller RunOS, which was the responsible to make the management of the real and anonymized IP address. To validate this service it was developed two Case Studies with an environment simulating a Denial of Service attack. The first Case Study made a comparison between Crypto-Pan and BomIP. While the second Case Study made a comparison between a traditional network IP and a SDN one using BomIP, both under Denial of Service attack. The analysis of results showed that the service developed has an running time 65% more efficient than Crypto-Pan. The assintotic analysis shows that BomIP is an algorith with running time of quadratic order. The results also showed that the anonymized packets can be tracked and a mitigation of 80% from the attacks trials, ensuring that the services provided by the network remain available. / Este trabalho tem como objetivo implementar um servi¸co de anonimiza¸c˜ao em Redes Definidas por Software (SDN) com o objetivo de realizar a mitiga¸c˜ao de tentativas de ataque sofridas por uma rede. Atrav´es de um servi¸co de anonimiza¸c˜ao ´e poss´ıvel realizar a oculta¸c˜ao dos endere¸cos IP dos hosts da rede, garantindo maior prote¸c˜ao contra ataques `a seguran¸ca, permitindo um aumento de sua disponibilidade. Um dos maiores desafios da arquitetura SDN ´e a seguran¸ca. A separa¸c˜ao do controle e do plano de dados permite que desafios para garantir a seguran¸ca sejam gerados, devido `a permissividade da rede a ataques como “Homem no Meio”, Nega¸c˜ao de Servi¸co e Satura¸c˜ao. O servi¸co aqui desenvolvido, denominado de BomIP, utiliza a t´ecnica de anonimiza¸c˜ao de micro-dados atrav´es da randomiza¸c˜ao dos endere¸cos IP dos hosts. O servi¸co BomIP foi adicionado ao controlador RunOS, que ficou respons´avel por realizar o gerenciamento dos endere¸cos IP reais e anonimizados. Para validar este servi¸co foram realizados dois Estudos de Caso em um ambiente simulando um ataque de Nega¸c˜ao de Servi¸co. O primeiro Estudo de Caso realizou a compara¸c˜ao do funcionamento do servi¸co de anonimiza¸c˜ao Crypto-Pan com o BomIP. Enquanto que o segundo Estudo de Caso realizou a compara¸c˜ao de uma rede IP tradicional sob ataque de Nega¸c˜ao de Servi¸co e uma SDN utilizando o BomIP. A an´alise dos resultados mostrou que o servi¸co desenvolvido tem um tempo de execu¸c˜ao 65% mais eficiente que o Crypto-Pan. A an´alise de complexidade do algoritmo do BomIP demonstrou que ´e de ordem quadr´atica. Os resultados tamb´em demonstraram que os pacotes anonimizados permitem a rastreabilidade e a mitiga¸c˜ao de 80% das tentativas de ataque, dando garantias que os servi¸cos providos pela rede continuem dispon´ıveis.