The diversity of information sources available to educational institutions makes it necessary to mash up information in order to get the highest performance through learning analytics. Data mashup requires the implementation of data anonymisation methods in order to protect the privacy of the learners who appear in the data partitions. However, the process of anonymising this data mashup can lead to a loss of data utility. This paper presents a protocol for merging data mashups that preserves privacy by k-anonymising the data while preserving its analytical utility.
Today, large datasets about students’ activity are available to educational institutions from a variety of sources [16]. These datasets collect important data on student performance and learning, but also contain demographic data. To integrate and compile information from all sources, current e-learning environments rely on data mashups, which offer a broader view of the learner through the exploitation of Learning Analytics (LA) [28].
The confidence of the education community is fundamental to the adoption of LA-based tools [13]. Mashing up information with personal content from a variety of sources is not welcome, as this may compromise individuals’ privacy. Even if unique identifiers that identify the information are removed, correlation through potentially identifiable attributes (quasi-identifiers) could assist in re-identification of the individual [24]. Therefore, the need for a protocol to anonymise data and guarantee the usefulness of learning data is fundamental.
This paper presents and applies on a dataset of higher education students, a protocol to mashup data and then anonymise it without losing the statistical usefulness of the data [20].
Data privacy is one of the biggest challenges in LA research [3]. The solutions that can be found in this context are based on approaches that prevent access to data by people who should not have access to it, either by defining role-based data access [4] or by storing information locally and avoiding cloud solutions [2].
Applying LA is essential if practitioners want a snapshot of their students’ learning process, since LA is fundamental to exploit the large amount of information from the learners’ work in the different virtual learning environments [17]. Thus, a mashup of the datasets contained in the partitions from different providers has to be performed while guaranteeing the learners’ privacy.
The datasets provided can come from either vertical or horizontal partitioning. While in horizontal partitions, different datasets follow the same schema but store different users [15, 21]. In vertical partitions, different datasets store different sets of attributes of the same users (identified by a common attribute) [6]. Vertical partitioning is the typical configuration of datasets used to build next-generation of Virtual Learning Environments (VLEs). Databases to store and query e-learning data can be implemented with different storage techniques, including graph databases [22], e.g. RDF (Resource Description Framework) triple stores and relational databases [1].
Techniques used in previous work on vertically partitioned datasets achieve anonymisation by kgeneralising the dataset [15, 21, 19, 9]. Generalisation techniques have the disadvantage that they either require high computational cost to find an optimal generalisation that minimises information loss [18], or they require an ad hoc taxonomic binary tree for each attribute to be anonymised [8]. It would be desirable to incorporate more practical k-anonymisation techniques in vertical data mashups, such as those based on microaggregation.
With respect to LA, the way in which learner data is represented in VLE is critical to the performance of LA methods [26]. One of the main goals of FAIR (Findability, Accessibility, Interoperability, and Reusability) [27] and open data principles is to improve data representation by enriching metadata with multiple attributes. However, intelligent computing techniques such as machine learning have ethical and security issues that may be discordant with compliance with these principles [23]. Hence, when applied to the field of technology-enhanced learning, FAIR and open data principles can be an advantage for the support of human learning, as well as a risk to human privacy.
The application of Privacy-by-Design (PbD) techniques is crucial for LA research and analytics in educational institutions. Given that current VLEs rely on data from cloud-based environments [16, 5], LA requires enhanced Privacy-Preserving Data Publishing (PPDP) methods capable of operating on data mashups, so that privacy constraints do not impose a limitation on LA solutions [10]. This research aims to address the problem that the PPDP solutions used for LA [14, 11] have not taken into account the actual mashup structure of current VLEs. For the sake of privacy-driven learning analytics, PPDP techniques have been limited to k-anonymity, since others as differential privacy have been proven to provide a worse balance between privacy and utility [12]. The limits and misuse of differential privacy regarding data publishing, which is the main purpose of this research, have been confirmed previously [7].
In this section we present a protocol to mashup vertical data partitions from different data providers. The protocol consists of two phases: the setup protocol, and the anonymisation and integration protocol. In the first phase, the mashup coordinator identifies the data providers that could provide the data partitions to be used by the data consumer. While in the second phase, the data providers and the mashup coordinator anonymise and vertically integrate the data partitions to obtain the de-identified dataset.
We assume that the vertical data partitions contain three types of attributes: identifying attributes, quasi-identifying attributes —whose combinations may be identifying if cross-referenced with other sources of information— and confidential attributes. 3.1.
As shown in figure 1, the mashup coordinator is responsible for initiating the setup protocol as soon as it receives a request from a data consumer. The mashup coordinator’s tasks include the following: 1. Identification of the providers that can contain the information required by the request. Providers publish their data schema, indicating: their identifying attributes, their quasi-identifying and confidential attributes. 2. Construction of the final mashup schema. This schema should include the identifier attribute that will be used for the join of the data partitions, the aggregate quasi-identifiers, the privacy level that will be applied to the aggregate quasi-identifiers and the set of confidential attributes. 3. Designation of the leading provider that will initiate the anonymisation and integration protocol.
This example aims to demonstrate how the setup protocol is implemented. To do this, we assume that the coordinator has received a request for information about the evaluations of a set of students along with their demographic data, and starts the setup protocol.
First, the mashup coordinator identifies potential data providers. In this ex-ample the mashup coordinator will consider two providers.
• Provider 1 (P 1): student demographic data that comes from an LMS database table (figure 2, left side). • Provider 2 (P 2): a LRS containing the assessments of a set of students in an activity (figure 2, right side).
Second, the mashup coordinator builds the data mashup scheme. In this ex-ample, the coordinator uses the RDF view strategy described in [25] and defines the mashup name-space to map the linked data attributes of the aforementioned schemes, as the linked data vocabularies, e.g. foaf and schema.org, might not be easily found or mapped to the attributes of the providers.
Each tuple t in P1.demographic produces the following set of RDF triples: mup:student#t.student_id rdf:type foaf:Person
For each tuple t in P1.demographic and each local QI attribute identifiable as such in P1, generate one RDF tuple. For each local QI attribute, the protocol follow the following strategy: • If a standard vocabulary exists to represent it, the attribute is mapped. For instance, gender. • If it does not exist, it is defined directly in the namespace (mup). For in-stance, disability. mup:student#t.student_id schema:gender mup:student#t.gender mup:student#t.student_id mup:disability mup:student#t.disability mup:student#t.student_id mup:age mup:student#t.age
The mashup coordinator can also use foaf : age as a valid mapping instead of using directly mup : age adding the following triple: foaf:age owl:sameAS mup:age
For each tuple t in P1.demographic and u in P2.activity such that t.student id = u.student id, a triple of the following structure is generated: mup:student#t.student_id mup:failed mup:student#u.activity_id Thirdly, the mashup coordinator chooses the leading provider so that the latter can initiate the integration and anonymisation protocol. 3.2.
This protocol carries out the vertical integration of the data partitions identified in the setup protocol and the k-anonymisation of the aggregate quasi-identifier, which is built by vertically joining the quasiidentifier attributes of each partition. Privacy-preserving data collection and integration is achieved by decoupling the collection of quasi-identifiers from the collection of confidential data and by using what are known as privacy-preserving connectors (ppc) [20] —a pseudonym of that identifier attribute shared by all the vertical partitions. The ppc for a given record is computed as a collision-resistant hash function of the value that the identifier attribute holds in the record and a nonce common to all records. The nonce—one-time arbitrary number—is used to prevent reusing the connector and strengthen the connector against dictionary attacks.
Two ppc are used in the protocol: one to integrate the data partitions received in the quasi-identifier collection, named Qppc, and another to integrate the data partitions received in the confidential data collection, named Cppc. This segregated collection of attributes contributes to anonymising data because it allows confidential attributes to be disassociated from quasi-identifiers and, thus, prevents the mashup coordinator from linking the original values of the quasi-identifiers with sensitive information.
The anonymisation and integration protocol is summarised as follows: 1. The leading provider generates the nonces Qnonce and Cnonce used to build the privacypreserving connectors. 2. The leading provider shares the nonces with the other data providers participating in the process by using a secure channel between communicating parties, such as TLS (Transport Layer Security). 3. Each provider derives the connectors Qppc and Cppc for each of the records in the partition. 4. Each provider sends the quasi-identifier attributes of its partition, along with the corresponding
Qppc connectors, to the mashup coordinator via a secure channel. 5. The mashup coordinator vertically integrates the received data partitions through the connector
Qppc to build the aggregate quasi-identifier. 6. The mashup coordinator initiates the anonymisation process of the aggregate quasi-identifier.
Any PPDP method that satisfies k-anonymity, such as those based on aggregation or generalisation mentioned in Section 2, can be used to anonymise the quasi-identifier attributes. 7. The mashup coordinator sends the anonymised aggregate quasi-identifier to each data provider.
Because the anonymisation of the quasi-identifiers has been delegated to the mashup coordinator, the data providers must make sure before reporting confidential information that the result satisfies the requirements of k-anonymity. 8. Each provider integrates the anonymised aggregate quasi-identifier with its confidential data through the connector Qppc. 9. Each provider sends its confidential data, along with the connectors Cppci and the anonymised aggregate quasi-identifier, to the mashup coordinator via a secure channel. 10. The mashup coordinator vertically integrates the received data partitions through the connector Cppci to yield the de-identified dataset provided to the data consumer. This dataset satisfies kanonymity because at least k records share the same values in the aggregate quasi-identifier.
This contribution has shown a new PPVD (Privacy-Preserving Vertical Data) protocol with the following features.
• It serves requests for learning datasets from data consumers. • Identifies learning data sources, i.e. the different data providers that can satisfy a particular information request. • Vertically integrates learning data from different educational sources without revealing the learners’ identities referenced in the data. • Finally, it provides the resulting k-anonymised dataset to the data consumer.
The protocol provides an effective integration of learning data and a PbD solu-tion for educational interoperable data architectures, while reconciling LA with privacy. The protocol can be used in any field of application beyond LA systems.
Supported by the Spanish National Research Agency (AEI), through the project CRÊPES (ref. PID2020-115844RB-I00).
[4] Cesconetto, J., Augusto Silva, L., Bortoluzzi, F., Navarro-Caceres, M., Zeferino, C., R. Q.
Leithardt, V.: PRIPRO-privacy profiles: User profiling management for smart environments.
Electronics 9(9) (2020). https://doi.org/10.3390/electronics9091519
[5] Conde, M.A., Hernandez-Garcıa, A.: Data driven education in personal learning environments –
what about learning beyond the institution? International Jour-nal of Learning Analytics and
Artificial Intelligence for Education 1(
IEEE Intelligent Systems 31(
Online at https://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html
[25] Vidal, V.M.P., Casanova, M.A., Cardoso, D.S.: Incremental maintenance of RDF views of
relational data. In: Meersman, R., Panetto, H., Dillon, T., Eder, J., Bel-lahsene, Z., Ritter, N., De
Leenheer, P., Dou, D. (eds.) On the Move to Meaningful Internet Systems Conference. Lecture
Notes in Computer Science, vol. 8185, pp. 572–587. Springer, Berlin, Heidelberg (2013).
https://doi.org/10.1007/978-3-642-41030-7 42
[26] Waheed, H., Hassan, S.U., Aljohani, N.R., Hardman, J., Alelyani, S., Nawaz, R.: Predicting
academic performance of students from vle big data using deep learning models. Computers in
Human Behavior 104, 106189 (2020). https://doi.org/10.1016/j.chb.2019.106189
[27] Wilkinson, M.D., Dumontier, M., Aalbersberg, I.J., Appleton, G., Axton, M., Baak, A., Blomberg,
N., Boiten, J.W., da Silva Santos, L.B., Bourne, P.E., et al.: The fair guiding principles for scientific
data management and stewardship. Scien-tific data 3(