# SMARTEN--A Sample-Based Approach towards Privacy-Friendly Data Refinement
## 4 Smarten
### Elicitation of Non-Disclosure Requirements  
For the configuration of SMARTEN, i.e., the specification of privacy thresholds and privacy techniques that have to be applied, we adopt a two-stage approach in order to address the two separate phases of the data refinement process. For this purpose, we rely on digital signatures that can be inseparably attached to the data. These signatures specify the non-disclosure requirements of the data producers. Such an approach ensures that an attacker cannot alter the requirements retrospectively in order to gain deeper insights into the data of the data producer [90]. Digital signatures are used to prove the authenticity of a data object, e.g., a message, a file, or a data item. For this purpose, asymmetric cryptography is used, i.e., a key pair is generated that consists of a _signing key_ and a _verification key_. The signing key is kept secret by the signer, while the verification key is shared with the public. To sign a data object, the signer encrypts it with his or her signing key. The data object can only be verified with the corresponding verification key. If the verification is successful, it is ensured on the one hand that the data object has not been tampered with and on the other hand that it originates from the alleged source, since only this source has access to that signing key. An _attribute-based signature_ uses keys that are composed of a set of attributes. A signed object can only be successfully verified if the key used for this purpose has a certain subset of these attributes. In SMARTEN, we also use attribute-based signatures, except that the non-disclosure requirements of the data producers are used instead of attributes. However, attribute-based encryption algorithms require a lot of computational power. Therefore, we adopt an approach introduced by [PERSON] et al. [91], in which the computations are distributed and can be partially outsourced. Our adapted approach is shown in Figure 5.  
In addition to the actual two stages that are used to specify the privacy thresholds in the data preparation phase and the privacy requirements in the data processing phase, our approach also includes a preliminary phase for organizational purposes. Key Generation and Deployment.Initially, a data producer announces his or her non-disclosure requirements to a trusted authority. When dealing with sensitive data, regulations such as the GDPR mandate that there has to be an independent supervisory authority (Art. 51 and Art. 52). This can, for instance, serve as the trusted authority. This authority then generates two key pairs for the signature. Let \(\tau\) be the set of privacy thresholds and \(\lambda\) be the set of requested privacy levels for the knowledge gained from processing the data. Then, _full keys_ (depicted in black) reflect the union of these two sets \(\varphi=\tau\cup\lambda\), while _delegated keys_ (depicted in white) reflect only \(\lambda\), i.e., a true subset of \(\varphi\). The full keys are provided to the data producer, while the delegated keys are provided to the data processor. Full Authentication.To ensure that the data are not tampered with and that the non-disclosure requirements are not lost during transmission, the data producer signs the raw data with his or her full key. In the data preparation phase, the data processor verifies the signature against his or her privacy policy \(\rho_{1}\). This policy describes which privacy thresholds are applied by the privacy assessor. Only if the requirements in \(\tau\) are satisfied by \(\rho_{1}\) is the applied privacy policy valid and the raw data in question can be preprocessed. Figure 5: Two-stage approach to specify non-disclosure requirements applied in SMARTEN. This is monitored on behalf of the data processors by their privacy officer. A privacy officer requires no technical knowledge, as the privacy thresholds sufficiently specify how the data may be processed.