# Privacy Preservation and Analytical Utility of E-Learning Data Mashups in the Web of Data
## 4 Privacy-Preserving Vertical Data Mashup Protocol
### Anonymization and Integration Protocol
Any PPDP method that satisfies \(k\)-anonymity, such as those based on aggregation or generalization mentioned in Section 1, can be used to anonymize the quasi-identifier attributes. The result of the de-identification process is represented by \(Q_{join}^{*}=(Qppc_{i},Q_{i}^{a*},Q_{i}^{b*})_{i=1}^{n}\), \(Q_{i}^{a*}\) and \(Q_{i}^{b*}\) being the masked values of the quasi-identifier attributes of the record \(i\). In step 7, the mashup coordinator sends the anonymized aggregate quasi-identifier set \(Q_{join}^{*}\) to each data provider. Because the anonymization of the quasi-identifiers has been delegated to the mashup coordinator, the data providers must make sure before reporting confidential information that the result satisfies the requirements of \(k\)-anonymity. Each provider must check that the \(k\)-anonymous groups in \(Q_{join}^{*}\) comprise \(k\) or more records. Once \(Q_{join}^{*}\) is received, each data provider integrates \(Q_{join}^{*}\) with the confidential data of its data partition to form the confidential data partition (step 8). This integration is achieved through the connector \(Qppc\). Then, in step 9, each data provider sends its confidential data partition along with the connectors \(Cppc_{i}\), ordered by \(Cppc_{i}\), to the mashup coordinator through a secure channel--e.g., the data set sent by the provider \(P_{a}\) is \((Cppc_{i},Q_{i}^{a*},Q_{i}^{b*},C_{i}^{a*})_{i=1}^{n}\), similarly for \(P_{b}\). Note that the connector \(Cppc_{i}\) of each record is derived from \(Cnonce\) and \(1D_{i}\) in step 3. Finally, as shown in step 10, the mashup coordinator vertically joins the received confidential data partitions through the connector \(Cppc_{i}\) to yield the de-identified dataset provided to the data consumer. This dataset, \((Q_{i}^{a*},Q_{i}^{b*},C_{i}^{a},C_{i}^{b})_{i=1}^{n}\), satisfies \(k\)-anonymity because at least \(k\) records share the same values in the aggregate quasi-identifier. \begin{table}
\begin{tabular}{l l} \hline \(P_{a}\) & data provider \(a\), similarly for the data provider \(b\) \\ \(ppc\) & Privacy-Preserving Connector \\ \(Qppc\) & \(ppc\) used to integrate the data partitions received in the quasi-identifier collection \\ \(Cppc\) & \(ppc\) used to integrate the data partitions received in the confidential data collection \\ \(Qnonce\) & nonce used in the calculation of \(Qppc\) \\ \(Cnonce\) & nonce used in the calculation of \(Cppc\) \\ \(Qppc_{i}\) & \(Qppc\) corresponding to the record \(i\), similarly for \(Cppc_{i}\) \\ \(H(.)\) & hash function \\ \((.)_{i=1}^{n}\) & set of \(n\) records \\ \(ID_{i}\) & identifier attribute of the record \(i\) (held by both \(P_{a}\) and \(P_{b}\)) \\ \(Q_{i}^{a}\) & (non-masked) quasi-identifier attributes of the record \(i\) held by \(P_{a}\), similarly for \(Q_{i}^{b*}\) \\ \(Q_{i}^{a*}\) & masked quasi-identifier attributes of the record \(i\) held by \(P_{a}\), similarly for \(Q_{i}^{b*}\) \\ \(C_{i}^{a}\) & confidential attributes of the record \(i\) held by \(P_{a}\), similarly for \(C_{i}^{b}\) \\ \(Q_{i}^{a}\) & (non-masked) quasi-identifier attributes of the \(n\) records held by \(P_{a}\), similarly for \(Q^{b}\) \\ \(Q_{join}^{b}\) & (non-masked) aggregate quasi-identifiers of the \(n\) records \\ \(Q_{join}^{b}\) & masked aggregate quasi-identifiers of the \(n\) records \\ \hline \end{tabular}
\end{table} 
Table 2: List of symbols and mathematical notations used in the anonymization and integration protocol.