# Privacy Preservation and Analytical Utility of E-Learning Data Mashups in the Web of Data
## 4 Privacy-Preserving Vertical Data Mashup Protocol
### Anonymization and Integration Protocol  
This protocol vertically integrates the data partitions identified in the setup protocol and \(k\)-anonymizes the aggregate quasi-identifier, built by vertically joining the quasi-identifier attributes of each partition. The collection and integration of the vertical partitions of the dataset are carried out by the mashup coordinator and the set of providers participating in the protocol without revealing the individuals' identities in the data. This privacy-preserving data collection and integration is achieved by segregating the quasi-identifier collection from the confidential data collection and by using what we call _privacy-preserving connectors_. **Definition 2** (Privacy-Preserving Connector). : _A privacy-preserving connector for a record \(i\) of a vertically partitioned dataset, denoted by \(ppc_{i}\), is a pseudonym of the identifier attribute shared by all the vertical partitions, which is computed as a collision-resistant hash function of the value that the identifier attribute holds in the record \(i\), \(ID_{i}\), and a nonce common to all records._  
\[ppc_{i}=H(ID_{i},nonce),\qquad 1\leq i\leq n \tag{1}\]  
where \(n\) is the number of records in the dataset. The nonce--one-time arbitrary number--is used to prevent reusing the \(ppc\) and strengthen the \(ppc\) against dictionary attacks. The anonymization and integration protocol is detailed below. Figure 1 shows the data transfer among the parties participating in the protocol, and Table 2 lists the symbols and mathematical notations used in the definition of the protocol. Without loss of generality and for the sake of simplicity, we depict the protocol for two data providers, \(P_{a}\) and \(P_{b}\), each holding a vertical data partition of the final dataset. Each partition contains different quasi-identifier attribute sets--\(Q^{a}\) and \(Q^{b}\)--and different confidential attribute sets--\(C^{a}\) and \(C^{b}\). The leading provider selected in the setup protocol (\(P_{a}\) in Figure 1) initiates the anonymization and integration protocol, generating the nonces used to build the privacy-preserving connectors. Two connectors \(ppc\) are used in the protocol: one to integrate the data partitions received in the quasi-identifier collection, named \(Qppc\), and another to integrate the data partitions received in the confidential data collection, named \(Cppc\). This segregated collection contributes to anonymizing data because it allows confidential attributes to be disassociated from quasi-identifiers and, thus, prevents the mashup coordinator from linking the original values of the quasi-identifiers with sensitive information. Therefore, the leading provider must generate two nonces: one for each \(ppc\) (step 1 in Figure 1). These nonces, named \(Qnonce\) and \(Cnonce\), are shared in step 2 with the other data providers participating in the process (\(P_{b}\) in Figure 1) through a secure channel that provides authentication, privacy, and data integrity between communicating parties, such as TLS (Transport Layer Security). In the quasi-identifier collection, the data providers send their quasi-identifier attributes, \(Q_{i}\), along with the connector \(Qppc\) of each record, \(Qppc_{i}\), ordered by \(Qppc_{i}\), to the mashup coordinator through a secure channel. These data partitions are sent in step 4 of the protocol, the partition of the provider \(P_{a}\) being represented by \((Qppc_{i},Q^{a}_{i})_{i=1}^{n}\), similarly,for \(P_{b}\). Previously, as specified in step 3, \(Qppc_{i}\) is derived from \(Qnonce\) and \(1D_{i}\) using Equation (1). The mashup coordinator vertically integrates the data partitions received in the quasi-identifier collection through the connector \(Qppc\), thus building the aggregate quasi-identifier, \(Q_{join}=(Qppc_{i},Q_{i}^{a},Q_{i}^{b})_{i=1}^{n}\), as shown in step 5. Then, the mashup coordinator initiates the anonymization process of \(Q_{join}\) in step 6.