题名

行動支付之個人資料去識別化方法

并列篇名

Personal data de-identification techniques for mobile payment

作者

祝亞琪(Ya-Chi Chu)；魏銪志(Yu-Chih Wei)

关键词

可識別個人資訊 ； 去識別化 ； 重新識別攻擊

期刊名称

電腦稽核

卷期/出版年月

34期（2016 / 08 / 20）

页次

18 - 27

内容语文

繁體中文
中文摘要

隨著資訊科技的進步，組織在個人資料的蒐集、處理、利用的範圍越來越廣，舉凡在公共事務、商業行為，都可能涉及個人資料的應用，透過蒐集客戶或使用者的個人資訊或是使用行為，使其在業務經營或是趨勢分析的研究上有更大的發現，並增進組織的利潤，然而隨著使用者對於個人隱私的重視，在保護個人資料及取得最大利益間如何取的平衡，成為組織需克服的難題，因此去識別化的機制漸漸成為組織在保護個人資料時所採取強化的方式，在本文，會說明目前國內對於去識別化驗證要求之標準CNS 29191，及國外對於去識別化機制重視程度的狀況及NISTIR 8053中對去識別化的概念，同時也會介紹標準 ISO/IEC 20889中所提到的去識別化分類，組織可透過其底層技術及所可降低之重新識別攻擊風險程度的不同，選擇適當的方式進行個人資料的保護。
英文摘要

Increasingly, organizations want to collect and share their data to get more benefits. But it is an important issue that how to balance between protect personally identifiable information (PII) and make more revenue. In order to enhance the level of protection PII, organizations implement the de-identification techniques for Personal data. In this paper, we introduce the concept of de-identification mentioned by CNS 29191 and NISTIR 8053. We also briefly introduce the de-identification architectures and techniques in the ISO/IEC 20889 draft. In addition, there still dress on the importance of the de-identification process and provide their own mechanism described in national regulation. Organizations can choose the most suitable de-identification technique when they try to reduce the risk of PII leakage.
主题分类 基礎與應用科學 > 資訊科學
参考文献
  1. (2015).National Institute of Standards and Technology Draft Interagency ReportNational Institute of Standards and Technology Draft Interagency Report,未出版
  2. 「資訊技術－安全技術－部分匿名及部分去連結鑑別之要求事項」, In:CNS 29191（Jun. 2015）.
  3. “Information technology - Security techniques - Privacy enhancing data de-identification techniques”. In: ISO/IEC WD 20889 (Dec. 2015)..
  4. “Combined Regulation Text of All Rules,” U.S. Department of Health and Human Services, Office for Civil Rights, Health Information Privacy. url:http://www.hhs.gov/ocr/privacy/hipaa/administrative/combined/index.html
  5. (2011).ISO/IEC 29100, Information technology - Security techniques - Privacy framework.
  6. ISO/TS 25237:2008, Health informatics - Pseud-onymization..
  7. Dear Colleague Letter about Family Educational Rights and Privacy Act (FERPA) Final Regulations, U.S. Department of Education, December 17, 2008. url: http://www2.ed.gov/policy/gen/guid/fpco/hottopics/ht12-17-08.html
  8. Dankar, F.,El Emam, K.(2010).A method for evaluating marketer re-identification risk.Proceedings of the 2010 EDBT/ICDT workshops,New York:
  9. Dondi, R.,Mauri, G.,Zoppis, I.(2011).On the complexity of the l-diversity problem.Proceedings of the 36th international conference on Mathematical foundations of computer science, August 22-26, 2011, Warsaw, Poland
  10. El Emam, K.,Dankar, F.(2008).Protecting privacy using k-anonymity.J. Amer. Med. Info. Assoc.,15(5),627-637.
print cancel