# Privacy Preservation and Analytical Utility of E-Learning Data Mashups in the Web of Data
## 5 Evaluation
### Analytical Evaluation of the \(k\)-Unlinkability Property  
We evaluate whether our protocol satisfies the \(k\)-unlinkability property. The evaluation is conducted in the worst-case scenario when the passive adversary participates in the anonymization and integration protocol.  
When the passive adversary is a data provider participating in the protocol:  
1. Because the data partitions are sent encrypted to the mashup coordinator through a secure transport protocol, no data provider will be able to view other providers' quasi-identifier and confidential attributes, even if the provider carried out a network traffic analysis.  
Based on (i), we conclude that a malicious provider cannot associate the confidential data of a particular individual with their original quasi-identifiers because those data are unknown to the provider.  
When the passive adversary is the mashup coordinator participating in the protocol:  
1. Because the mashup coordinator handles quasi-identifiers and confidential attributes during the execution of the protocol, the coordinator may learn additional information about the subjects of those data by linking the data obtained in the different steps of  
Figure 1: Anonymization and integration protocol in a scenario with two data providers, \(P_{a}\) and \(P_{b}\), and a mashup coordinator, \(M\). The provider \(P_{a}\) acts as a leading provider.  
the protocol. After analyzing the data handled by the mashup coordinator, compiled in Table 3, it follows that the mashup coordinator can only make ambiguous links between confidential attributes and original quasi-identifiers. In particular, the mashup coordinator can only perform the following reverse linking of the information:  
\[(C_{i}^{a},C_{i}^{b})\longrightarrow(Q_{i}^{a*},Q_{i}^{b*})\longrightarrow( Qppc_{i})_{i=1}^{k}\longrightarrow(Q_{i}^{a},Q_{i}^{b})_{i=1}^{k}\]  
That is, in step 10 of the protocol, the mashup coordinator can link the confidential attributes \((C_{i}^{a},C_{i}^{b})\) with the masked quasi-identifier attributes \((Q_{i}^{a*},Q_{i}^{b*})\). In turn, \((Q_{i}^{a*},Q_{i}^{b*})\) can be linked with \(k\) or more connectors \(Qppc\) by using the \(k\)-anonymized data from step 6. Note that the masked quasi-identifiers of a given individual can never be linked with less than \(k\) connectors since, after \(k\)-anonymization, the number of privacy-preserving connectors that have associated the same values in the masked quasi-identifier attributes is always greater than or equal to \(k\). Finally, from the data received in step 4, the mashup coordinator can link the \(k\) (or more) connectors \(Qppc\) with their respective original quasi-identifiers. Because the connectors used in step 10, \(Cppc\), are different from those received in step 4, \(Qppc\), the mashup coordinator will never be able to link a given \(Cppc_{i}\) with its corresponding \(Qppc_{i}\), and thus, it will not be able to uniquely associate the confidential attributes from a given individual with their original quasi-identifiers.  
Based on (ii), we conclude that a malicious mashup coordinator can at most associate the confidential data of a particular individual with the set of original quasi-identifiers of the \(k\)-anonymous group to which the individual belongs. Therefore, the probability that the mashup coordinator correctly correlates the confidential attributes to the original quasi-identifiers is at most \(1/k\). The higher the value of \(k\), the greater the uncertainty of the mashup coordinator.  
Therefore, the proposed anonymization and integration protocol satisfies the \(k\)-unlinkability property, whether the passive adversary is a data provider or the mashup coordinator.