Transaction-Based Pseudonyms in Audit Data for Privacy Respecting Intrusion Detection

Abstract. Privacy and surveillance by intrusion detection are potentially conflicting organizational and legal requirements. In order to support a balanced solution, audit data is inspected for personal data and identifiers referring to real persons are substituted by transaction-based pseudonyms. These pseudonyms are constructed as shares for a suitably adapted version of Shamir's cryptographic approach to secret sharing. Under sufficient suspicion, expressed as a threshold on shares, audit analyzers can perform reidentification.

• Type: Conference
• Year: 2000
• Where: RAID
• Authors: Joachim Biskup, Ulrich Flegel
• Keywords: Audit Data, Computer Networks, RAID 2000, Shamir's Cryptographic Approach, Transaction-based Pseudonyms