Abstract: When publishing data with multiple sensitive attributes, an adversary may be able to get some sensitive attribute information, attack other sensitive attribute information through a combination of this background knowledge with quasi-identifier information. To avoid this problem, a formal multiple sensitive attributes data publication model is defined, named （Dou-l）-anonymity. The corresponding （Dou-l）-anonymity implementation algorithm is proposed based on the idea of multi-sensitive bucketization and lossy join. The findings are verified by experiments with real data.

Key words: privacy preserving, multiple sensitive attributes, data publishing, background knowledge

摘要： 在匿名数据发布中，当敏感属性为多维时，攻击者有可能能够获取一维或几维敏感属性信息，并且结合准标识符信息对其他敏感属性进行推理攻击。针对此问题提出（Dou-l）-匿名模型，更好地保护了敏感信息。基于多维桶和分解思想，提出（Dou-l）-匿名算法，使得即便攻击者掌握了部分敏感数据，仍然能较好地保护其他敏感属性数据的隐私安全性。实际数据实验证明，算法可以较好地均衡发布数据的安全性和可用性。

关键词: 隐私保护, 多敏感属性, 数据发布, 背景知识