844 VIEWS
Pinterest LinkedIn LINE

In the previous article, “My Number and Privacy: Requirements for Identifiers,” I wrote as follows.

Next, as a hypothetical example, consider a common number for taxation and social security, including pensions. It would need to meet the requirements of both the Basic Pension Number and the taxpayer identification number. In other words, it would have to combine the “long duration” required for pension administration with the “broad scope” required for taxation. This means that it would need to be an identifier that remains stable “over a long period and across a broad scope.” Because this does not satisfy Requirement 3, it can be regarded as an ill-conceived combination.

Using this as our starting point, I would now like to consider the nature of the risks created by identifiers.

Types of Identifiers

Before getting to the main subject, let us first review the definition of an identifier and examine the different types of identifiers.

Identifier: A combination of attributes that can uniquely distinguish, or identify, an individual or thing from others within a given population.

That is right. An identifier is not limited to something ordinarily thought of as an “individual number.” A combination such as “name, sex, date of birth, and address”—the basic 4 items of information—is also an identifier.

For this classification, we will use 3 dimensions: “scope of use,” “period of use,” and “reassignability.” “Scope of use” means how many people, companies, organizations, and other parties use the identifier. “Period of use” means how long the identifier is used. “Reassignability” means whether the identifier may be reused for someone else.

Classification by Scope of Use
  • Omnidirectional identifier (omnidirectional identifier): An identifier used regardless of the party with whom one is interacting.
  • Unidirectional identifier (directional identifier, sectoral identifier): An identifier used only within a relationship with a particular party.
Classification by Period of Use
  • Persistent identifier (persistent identifier): An identifier that does not change over a long period. It ordinarily remains unchanged for as long as the entity exists.
  • Ephemeral identifier (ephemeral identifier): An identifier that changes over a short period.
Classification by Reassignability
  • Reassignable identifier (reassignable identifier): An identifier that is reused for another entity.
  • Non-reassignable identifier (non-reassignable identifier): An identifier that is not reused.
Every identifier can be classified in all of these ways. A name, for example, is used everywhere, so in terms of scope of use it is an “omnidirectional identifier.” Its period of use is long, making it a “persistent identifier.” And because different people can have the same name, it is a “reassignable identifier.” A name is therefore an “omnidirectional, persistent, reassignable identifier.” This article focuses on the first two dimensions and, among the many associated risks, considers the “record-linkage risk.” Risks also arise from reassignable identifiers, but I will leave those for another occasion.

Identifier Record-Linkage Risk Viewed as Period × Scope

The risk of privacy infringement can arise from many causes. A typical example is an “information leak,” the kind frequently reported in newspapers. Here, however, I will focus on “record-linkage risk.” This is because an information leak itself does not, strictly speaking, cause the actual harm associated with privacy. The harm arises when leaked information is “matched, or linked,” with other information—for example, prior knowledge held by someone who knows the victim—and a portrait of that person is formed against their wishes. Even if information leaks, there is almost no risk if no one ever sees it and it simply sinks to the bottom of the sea.

One aspect of the record-linkage risk posed by an identifier can be understood as the area represented by period × scope, as shown in the following diagram.

識別子流通のリスク
Figure 1: Risk from Identifier Circulation

The horizontal axis represents the period during which the identifier circulates, and the vertical axis represents the scope across which it circulates. The period indicates how long the identifier is used, while the scope indicates how broadly its use extends. A web cookie, for example, is used only on the relevant site, so its scope of circulation can be considered extremely narrow. An identifier based on the so-called sectoral model is likewise narrow because it is used only within that sector. By contrast, identifiers such as the U.S. SSN are used everywhere, so their scope of circulation is broad.

Figure 1 depicts an identifier with a long circulation period but a narrow circulation scope. A pension number is an identifier of this kind. Figure 2, by contrast, illustrates an identifier with a short circulation period but a broad circulation scope. A tax number that changes every year, for example, would fall into this category.

図2 識別子のリスク
Figure 2: Identifier Risk—When the Period Is Short

The risk of using such identifiers together is the sum of the risk in each case.

識別子を組み合わせた場合のリスク：連携の場合
Figure 3: Risk When Identifiers Are Combined—The Federation Case

When the identifiers are consolidated, on the other hand, the result is as shown in the next diagram, and the risk becomes greater than when the identifiers are used together without consolidation. If the purposes of use remain limited to the respective purposes that applied when the identifiers were separate, the benefits do not change. This additional amount is therefore an increase in risk without any corresponding benefit. I will call it “excess risk.”

識別子を組み合わせた場合のリスク：統合の場合
Figure 4: Risk When Identifiers Are Combined—The Consolidation Case

 

This excess risk is why I described a common number for taxation and pensions as an ill-conceived approach.

The Cost of Federation

Why, then, would anyone promote a method that creates excess risk in this way? The reason is probably the belief that “federation is costly.” Such costs appear to fall into 2 categories: operational costs and system costs.

First, let us consider operational costs. Would federation actually increase them?

The operations must originally have been carried out using separate numbers or identifiers. If so, I do not see why federation would increase the cost. All that is required is to define the “scope” appropriately. (This is why defining the sector is said to be important in a sectoral model.)

Next, let us consider system costs. Consolidation would certainly eliminate the work of converting between different identifiers, making the system cheaper to that extent. But how much cheaper would it be? Let us estimate the conversion cost.

First, assume that the identifiers for both individuals and organizations are 4-byte integers. As unsigned integers, they range from 0 to 4,294,967,295. Japan has only 100 million 3,000 ten-thousand people, while this range contains approximately 4.3 billion values, so it should be sufficient for the time being. We concatenate the two identifiers. We could encrypt this directly with a key, but that would seem somewhat vulnerable to a plaintext attack. We therefore introduce 8 bytes of random data, XOR the identifiers with it, concatenate the result with the random data to produce 16 bytes, and encrypt that using AES128. In practice there would also be costs for random-number generation, packing, and other operations, but their computational burden is small, so I will ignore them here[1]. For the test, I used the Core i3 3.06 GHz iMac (OS X 10.8.1) on my desk, which was 2 years old and worth about ¥110,000 at the time, and simulated the operation with $ openssl speed aes. The result was as follows:
Doing aes-128 cbc for 3s on 16 size blocks: 21715758 aes-128 cbc’s in 3.00s
This suggests a throughput of about 7 million operations per second per CPU. If a Core i3 at 3.06 GHz can achieve that, a Core i7 at 3.90 GHz could likely handle about 10 million operations per second per CPU. With 4 machines, each with 2 CPUs, that would be 80 million operations per second. There probably would not be many processes involving all 130 million people, but even such a process would take less than 2 seconds.
In short, this is not a significant cost. If excess risk can be eliminated at such a low cost, it is a bargain[2]. There is no reason not to do it.

Conclusion

Here, then, is the conclusion.
  • Consolidating identifiers with different characteristics creates substantial excess risk from record linkage.
  • Federation is extremely inexpensive and does not justify excess risk.
  • A common number for taxation and pensions is therefore an ill-conceived approach.
In future articles, I would like to examine risks arising from reassignable identifiers, the relationship between risk and the quality of information linked to an identifier, and related topics[3].

Footnotes

  1. Strictly speaking, this should use an AEAD algorithm such as GCM rather than CBC. CBC requires an integrity mechanism, and its cost is not insignificant. With hmac(md5), only about 2.4 million operations per second per CPU can be performed.
  2. Even so, it would be overwhelmingly cheaper than implementing the various security measures needed to control excess risk.
  3. That said, when it comes to an identification-number system, we first need to discuss what we want to accomplish—its “purpose”—before even examining the risks. Unless the purpose is settled, it is difficult to determine whether those risks are worth taking. I think we need an easy-to-understand objective, such as cutting the cost of administrative procedures to 1/2.

Related posts

What Digital Identity Requires

Recently, all kinds of articles about Digital Identity have been circulating. In this blog, I plan to jot down whatever comes to mind, ranging from meta-level…

Identity · 2004-09-29