EP4226268A1

EP4226268A1 - Method for evaluating the risk of re-identification of anonymized data

Info

Publication number: EP4226268A1
Application number: EP21810398.4A
Authority: EP
Inventors: Morgan GUILLAUDEUX; Olivier BREILLACQ
Original assignee: Big Data Sante
Current assignee: Big Data Sante
Priority date: 2020-10-07
Filing date: 2021-10-07
Publication date: 2023-08-16
Also published as: CA3194820A1; CA3194570A1; WO2022074301A1; WO2022074302A1; US20240005035A1; US20230367901A1; EP4226267A1; FR3114892A1

Abstract

The method delivers a degree of protection (txP3) representative of the risk of re-identification of data in the case of an inference attack comprising a deterministic search based on an external information source and a correspondence search based on a distance. The method comprises steps of E) defining a set of starting individuals (EDO) and a set of anonymous individuals (IA); F) identifying, in the set of starting individuals, individuals at risk (IOrs) via the deterministic correspondence search; G) evaluating a degree of failure of re-identification (txP1) for the sets of starting individuals and of anonymous individuals, on the basis of the correspondence search based on distance; H) computing the degree of protection as a function of a total number of individuals in the starting dataset, of a number (RS) of individuals at risk identified in step B) and of the degree of failure of reidentification (txP1).

Description

Title of the invention: PROCEDURE FOR ASSESSING THE RISK OF RE¬

IDENTIFICATION OF ANONYMIZED DATA

The invention generally relates to the anonymization of sensitive data intended to be shared with third parties, for example, for research, analysis or exploitation purposes. More particularly, the invention relates to a method for evaluating the risk of re-identification of anonymized data.

In general, data is a source of performance for organizations and constitutes an important asset for them. Data provides crucial and valuable information for the production of quality goods and services, as well as for decision-making. They provide a competitive advantage that allows organizations to survive and stand out from the competition. The sharing of data, for example in the form of open data known as "open data" in English, is today perceived as offering many opportunities, in particular for the extension of knowledge and human knowledge, innovation and creation of new products and services.

Data has become easily shareable with digital technologies and technological innovations, beyond the organizations that collect and store it for use. The digital transformation of society, with the rise of social networks, the generalization of online consumption, the dematerialization of services, etc., generates a phenomenon of massification of data called "big data" in English. This phenomenon of massification of data has increased with the adoption by a large number of countries of public policies known as "open data" which promote the opening and sharing of data. The technologies that are currently available allow the storage, processing and analysis of this ever-growing mass of data and make it possible to extract knowledge and actionable information from it.

The data may contain personal data, known as "personal data", which is subject to regulations relating to the protection of privacy. Thus, in general, the use, storage and sharing of personal data are subject in France to the European GDPR regulation, for "General Data Protection Regulation", and to the French law known as the "IT law". and freedoms >>. Certain data, such as those relating to the state of health, private and family life, assets and others, are particularly sensitive and must be subject to special precautions.

Several anonymization methods are known and used to process original data in such a way as to protect the privacy of individuals. Data anonymization can be defined as a process that removes the association between the identifying dataset and the data subject. The process of anonymization aims to prevent the singling out of an individual within a dataset, the link between two records within the same dataset, or between two distinct datasets, when one of the records matches to individual-specific data, and inferring information from the dataset. Thus, following an anonymization process, the data is presented in a form that should not allow individuals to be identified, even when combined with other data.

The anonymization method called "k-anonymization" is one of the most widely used methods. This method seeks to make each record of a data set indistinguishable from at least k-1 other records of this data set. The so-called "L-diversity" anonymization method is an extension of the "k-anonymization" method which allows better data protection by involving in each group of k records, called "k-group", the presence of at least L sensitive attribute values.

In general, the main known anonymization algorithms modify data by deleting, generalizing or replacing personal information in individual records. An alteration of the informative content of the data may be the consequence of excessive anonymization. However, it is important that anonymized data remains quality data that retains a maximum of informative content. It is on this condition that anonymized data remain useful for the extraction of knowledge through analysis and reconciliation with other data.

The choice of the anonymization algorithm and the adjustment of its operating parameters are important to reconcile both the obligation to respect privacy and the need to preserve the usefulness of the data. In the state of the art, there is no known single anonymization algorithm that adapts to all contexts and that gives the best result every time. Several anonymization algorithms exist with varying degrees of reliability and contexts of applicability. The context of applicability of anonymization algorithms is characterized, among other things, by the type of data to be anonymized and by the desired use of the anonymized data.

The degree of reliability of the anonymization algorithm is directly related to the risk of re-identification of anonymized data. This risk includes the risk of individualization, that is to say, the possibility of isolating an individual, the risk of correlation, that is to say, the possibility of linking distinct sets of data concerning the same individual, and the risk of inference, that is, the possibility of inferring information about an individual. However, faced with the evolution of information technologies which make it possible to link data from different sources, it is almost impossible to guarantee anonymization which would offer a zero risk of re-identification. Different methods for evaluating the risk of re-identification of a set of data having undergone anonymization processing, also referred to as “metrics” below, have been proposed and provide quantitative evaluations of this risk.

Some of these metrics use a method called record-linkage, which is described by Robinson-Cox J. F. in the article “A record-linkage approach to imputation of missing data: Analyzing tag retention in a tag-recapture experiment >>, Journal of Agricultural, Biological, and Environmental Statistics 3(1), 1998, pp. 48-61. This method, which consists of comparing individuals from a data set that has undergone anonymization treatment with an original data set, was initially developed to improve data quality by linking in files distinct from records relating to the same person. It also makes it possible to assess the robustness of anonymization processing in the face of a re-identification attempt in which the attacker would be in possession of the set of anonymized data and original data of one or more individuals of whom he seeks to prove membership in the anonymized cohort.

Deterministic linking methods, discussed by Gill L. in the article "Methods for Automatic Record Matching and Linking and Their Use in National Statistics", National Statistics Methodology Series no. 25, 2001, London: Office for National Statistics, assumes the existence of a set of common variables in the files to be linked. The major problem with such an assumption is that an exact matching procedure for the values taken by the variables common to the individuals is not always possible, or sufficient, to establish a link between the records. This issue is addressed by Winkler W.E. in the article “Matching and record linkage”, Cox B. G. (Ed.), Business Survey Methods, Wiley, New York, 1995, pp. 355-384. In reality, there are between the variables common to two matched records a multitude of small or large differences resulting from several factors which prevent a perfect correspondence of the values of these variables.

To overcome the aforementioned problem, non-deterministic methods have been developed and make it possible to establish a link between two records, with a matching that can be probabilistic or based on a distance between individuals.

Probabilistic matching makes it possible to establish probabilities of links between records. Two records are considered linked when the probability of a link between them exceeds a certain threshold. Probabilistic matching is described by Fellegi LP. et al., Jaro MA, and Winkler WE in their respective articles "A theory of record linkage", Journal of the American Statistical Association 64, 1969, pp. 1 183-1210, "Advances in record-linkage methodology as applied to matching the 1985 Census of Tampa, Florida", Journal of the American Statistical Association 84, 1989, pp. 414-420, and “Advanced methods for record linkage”, Proceedings of the American Statistical Association Section on Survey Research Methods, 1995, pp. 467-472. Distance-based matching is described by Pagliuca D. et al. in the publication "Some Results of Individual Ranking Method on the System of Enterprise Accounts Annual Survey, Esprit SDC Project", Deliverable MI-3/D2, 1999. In this approach, distances are established between individuals and each individual is associated the closest record or the second closest record, and is said respectively “linked to nearest” or “linked to 2nd nearest”, in English.

The article "Disclosure risk assessment via record linkage by a maximumknowledge attacker", presented by Josep Domingo-Ferrer, 13th Annual Conference on Privacy, Security and Trust (PST), 2015, concerns the assessment of the risk of disclosure via the coupling of folders by an attacker with maximum knowledge. Comparisons of coupling distance distributions of an original data set and an anonymized data set are described. The interest of a minimum distance to obtain an acceptable level of protection is underlined.

The risk of disclosure in anonymized datasets when an attacker benefits from external information or general knowledge is dealt with in a general way in the article "Assessing Disclosure Risk in Anonymized Datasets", Alexei Kounine et al., FloCon 2008 Conference.

The objective of the present invention is to provide a new method for evaluating the risk of re-identification of anonymized data during a search for correspondence attack comprising a deterministic search based on external sources of information and a search based on the distance.

According to a first aspect, the invention relates to a data processing method implemented by computer for the evaluation of a risk of re-identification of anonymized data, the method providing a protection rate representative of the risk of re-identification in the case of a match-seeking attack comprising a deterministic search based on at least one external source of information and a distance-based match search, the method comprising the steps of E) grouping an original data set comprising a plurality of original individuals and a set of anonymized data comprising a plurality of anonymous individuals, the anonymous individuals being produced by an anonymizing process of the original individuals; F) identifying in said source data set at-risk source individuals as being source individuals having at least one remarkable, or unique, value in at least one considered variable, or at least one combination of remarkable values , or unique, in a set of considered variables, in a deterministic matching search and to which can be associated only one respective anonymous individual approaching by the deterministic matching search; G) Evaluate a re-identification failure rate for the original and anonymized datasets, from matching based on a distance between each original individual and one or more most anonymous individuals relatives identified by a so-called “k-NN” method; H) calculate the protection rate given a total number of original individuals in the original dataset, a number of original individuals at risk identified in step B) and the re-identification failure rate obtained in step G).

According to a particular characteristic of the method, in step F), an anonymous individual is considered to be an anonymous individual approaching an individual of origin at risk considered when 1) the anonymous individual has a variable of the same modality as a considered variable of the original individual at risk in the search for correspondence in the case where the variable is a qualitative variable, or when 2) the anonymous individual has a value for the considered variable equal to within a tolerance interval to the value of the same variable considered of the original individual at risk in the case where the variable considered in the search for deterministic correspondence is a continuous variable.

According to another particular characteristic of the method, step G) comprises the sub-steps of a) linking the set of original data to the set of anonymized data; b) transforming the original individuals and the anonymous individuals in Euclidean space, the original individuals and anonymous individuals being represented by coordinates in Euclidean space; c) identify for each said original individual one or more closest anonymous individuals on the basis of a distance, by the so-called "k-NN" method; and d) calculating the re-identification failure rate as a percentage of cases where a closest anonymous individual identified in substep c) for a considered original individual is not a corresponding valid anonymous individual to this original individual.

According to yet another particular characteristic of the method, the aforementioned distance is a Euclidean distance.

According to another particular characteristic of the method, the transformation of sub-step b) is carried out by a factorial method and/or using an artificial neural network called an “auto-encoder”.

According to yet another particular characteristic of the method, the factorial method used for the transformation of sub-step b) is a method called "Principal Component Analysis" when the individuals include variables of continuous type, a method called "Analysis of Multiple Correspondences >> when individuals include qualitative type variables or a method called "Factor Analysis of Mixed Data" when individuals include mixed "continuous/qualitative" type variables.

The invention also relates to a data anonymization computer system comprising a data storage device storing program instructions for implementing the method as described briefly above.

The invention also relates to a computer program product comprising a medium in which are recorded program instructions readable by a processor for implementing the method as described briefly above. Other advantages and characteristics of the present invention will appear more clearly on reading the description below of several particular embodiments with reference to the appended drawings, in which:

[Fig.1] Fig.1 is a flowchart showing the major steps included in a particular embodiment of the method according to the invention.

[Fig.2] Fig.2 represents an illustrative diagram of a method used in the particular embodiment of the method of the invention of Fig.1, to evaluate a re-identification failure rate of a attacking when searching for a match based on distance.

[Fig.3] Fig.3 shows an example of a general architecture of a data anonymization computer system in which the method according to the invention is implemented.

In the description that follows, for purposes of explanation and not limitation, specific details are provided in order to facilitate an understanding of the technology described. It will be apparent to those skilled in the art that other modes or embodiments may be practiced outside of the specific details described below. In other cases, detailed descriptions of well-known methods, techniques, etc. are omitted so as not to complicate the description with unnecessary detail.

Assessing the risk of re-identification requires comparing a set of original data made up of so-called original individuals with a set of anonymized data made up of so-called anonymous individuals. Individuals are typically data records. Each anonymized individual in the anonymized dataset represents an anonymized version of a corresponding original individual. A pair formed by an original individual and a corresponding anonymous individual is referred to as an “original/anonymous pair”. Re-identification risk is the risk that an attacker will successfully link an original individual to their anonymized record, i.e. the corresponding anonymous individual, thereby forming a valid original/anonymous pair.

The method according to the invention for the evaluation of the risk of re-identification of data provides a metric, based on an individual-centric approach, which makes it possible to quantify the risk of re-identification of personal data during a match search comprising a deterministic search based on external sources of information and a search based on distance.

With reference to Figs.1 and 2, a particular embodiment, designated MR3, of the method of the invention is now described, having an interesting applicability in the context of a straddling attack between a deterministic correspondence search based on one or more external sources of information and a match search based on distance.

As visible in Fig.1, this embodiment MR3 essentially comprises ten steps S3-1 to S3-10. The first step S3-1 performs data join processing and combines a set of original data EDO comprising a plurality of original individuals IO with a set of anonymized data EDA comprising a plurality of anonymized individuals IA. EDA anonymized data is that provided by an anonymization process that has processed the original EDO data and corresponds to it.

The second step S3-2 is a step of identifying individuals of origin at risk, hereinafter designated IOr, in the EDO set considered which comprises M individuals of origin IO. In this step S3-2, the individuals of origin IO having at least one remarkable or unique value in at least one variable considered or at least one combination of remarkable or unique values in a set of values considered are sought. , in deterministic matching. Those individuals of IO origin having a remarkable or unique value or combination of values are those identified as being the individuals of IO origin exposed to a risk of re-identification. It is considered here that R individuals of origin at IOr risk are identified among the M individuals of IO origin considered.

The third step S3-3 is a step of identifying anonymous individuals close to the original individuals at risk IOr identified in step S3-2, hereinafter designated IAP. In this step S3-3, close anonymous individuals IA _P are sought for each of the R original individuals at risk IOr.

When the variables taken into account in the search for deterministic correspondence are qualitative variables, the anonymous individuals IA which are retained as being approaching anonymous individuals IA _P are those having the same modalities as the original individual at risk IOr considered.

When the variables taken into account in the search for deterministic correspondence are continuous variables, the anonymous individuals IA which are retained as being approaching anonymous individuals IA _P are those whose variables have values equivalent to those of the variables of the individuals of origin , that is to say, equal to within a tolerance interval. Thus, the tolerance interval could be predefined at plus or minus (+/-) 2.5% for example of the variance of the variable considered.

The fourth step S3-4 is a step of identifying, according to the results of step S3-3, the individuals potentially most exposed among the original individuals at risk IOr identified in step S3-2. In this step S3-4, only the individuals of IOr origin having a unique approaching anonymous individual IA _P are retained as being potentially the most exposed to risks of re-identification. These selected individuals of IOr origin are referred to below as lOrs. It is considered here that RS original individuals at risk have been identified. The unique approaching anonymous RS individuals corresponding to the original RS individuals lOrs are designated IA _prs .

The fifth to eighth following steps S3-5 to S3-8 implement a method, designated MR1 , making it possible to evaluate, for the sets EDO and EDA, a txP1 re-identification failure rate of an attacker during a distance-based match-seeking attack.

In step S3-5, the original data set EDO comprising the original individuals IO is linked to the anonymized data set EDA comprising the anonymized individuals IA.

Step S3-6 performs transformation processing of individuals IO and IA in Euclidean space. In accordance with the invention, various transformation methods may be used. Typically, but not exclusively, a factorial method or an artificial neural network called "autoencoder", or "autoencoder" in English, can be used to convert the individuals IO and IA in the form of coordinates in a Euclidean space.

Different factorial methods can be used depending on the type of data. Thus, Principal Component Analysis, known as “PCA”, or “PCA” in English for “Principal Component Analysis”, will typically be used when the variables are continuous. Multiple Correspondence Analysis, known as “ACM”, or “MCA”, in English for “Multiple Correspondence Analysis”, will typically be used if the variables are qualitative. The "Factor Analysis of Mixed Data" called "AFDM", or "FAMD" in English for "Factor Analysis of Mixed Data", will typically be used if the variables are mixed, that is to say, continuous type and qualitative type.

In the example embodiment discussed here, a factorial method is used in step S3-6. In this step S3-6, significant axes of variance are identified in the data sets by multivariate data analysis. These significant axes of variance determine the axes of Euclidean space onto which individuals IO and IA are projected.

The transformation of individuals IO and IA in Euclidean space makes it possible to calculate the mathematical distance between individuals, from their coordinates. The method of the invention provides for a privileged use of a Euclidean distance as a mathematical distance. However, it should be noted that the use of various other mathematical distances, such as a Manhattan distance, a Mahalanobis distance and the like, is included within the scope of the present invention.

At step S3-7, the method of the “k nearest neighbors” called “k-NN” (from “k-Nearest Neighbors” in English) is used to identify the anonymous individuals IA closest to the individuals of origin IO, with a mathematical distance such as a Euclidean distance.

In step S3-8, based on the distance measurement results obtained in the previous step S3-7, the re-identification failure rate txP1 of an attacker employing a match search is calculated. based on distance. In this step S3-8, the re-identification failure rate txP1 is represented by the percentage of cases where an individual of IO origin and the individual anonymous closest match IA, identified in step S3-7, does not form a valid origin/anonymous pair.

The processing performed by the fifth to eighth steps S3-5 to S3-8 described above is shown in Fig.2. In the example of Fig.2, described above. The original 10 individuals and the anonymous IA individuals are represented by black circles and white circles, respectively, in a Euclidean space with coordinate axes A1 and A2.

We consider here the example of an attacker who is in possession of a data set containing anonymous data (AI individuals) of 100 people, including a person considered i. The attacker is also in possession of the original data (individual IOi) of the considered person i. The attacker tries to prove that the original data (individual IOi) of the considered person i is part of the anonymized cohort.

In order to re-identify the valid origin/anonymous pair (IOi, IAi), the attacker must perform a matching of individuals and uses for this a mathematical distance between them, such as a Euclidean distance. The attacker identifies the anonymous individual IAk as the closest anonymous individual to the original individual IOi, as shown schematically in Fig.2, and associates the anonymous individual IAk with the original individual Ii. Fig.2 shows the case of a failed attacker who failed to identify the valid origin/anonymous pair (IOi, IAi) based on distance. Thus, for example, if the attacker fails for 95 people out of the 100 people considered, the re-identification failure rate txP1 is equal to 95%.

Referring again to Fig.1, the ninth step S3-9 is a step of evaluating the number m of successful re-identifications by the attacker on the original individuals lOrs, from the failure rate of re-identification txP1 obtained in step S3-8 and the original individual RS number lOrs. For these successful identifications, the identified valid anonymous individuals IA are the unique approaching anonymous individuals IA _prs (step S3-4) of the original individuals lOrs. The number m is given by the following equality: m= ((100-txP1 )/100)*RS, the rate txP1 being in percentage (%).

The tenth step S3-10 calculates a protection rate, hereinafter referred to as txP3, for the considered original data set EDO. The protection rate txP3 is given here by the equality: txP3=(1 -m/M)*100, m being the number of successful re-identifications by the attacker which is determined in step S3-9 and M being the total number of individuals of IO origin in the EDO set. The protection rate txP3 therefore corresponds to the percentage of IO individuals that have not been re-identified by the attacker in the original EDO dataset.

By way of example, we consider a set of anonymized data comprising M=100 individuals and an attacker wanting to re-identify people using external sources such as an electoral list register. The attacker, for example, has access to three variables from the anonymized dataset, for example, gender, age and home zip code. According to the method of the invention, in its embodiment MR3 described above, individuals of origin at risk having a value or a combination of values, remarkable, or unique, for these three variables are first searched in the original set of individuals. Thus, for example, R=15 individuals at risk are identified among the M=100 individuals.

For these R=15 individuals at risk, those with a unique approaching anonymous individual are sought (the same value for the categorical variables and +/- 2.5% of the variance for the continuous variables, as indicated above). RS=4 individuals, for example, are identified as fulfilling the above condition.

The attacker's re-identification failure rate during a distance-based match-finding attack is evaluated at txP1 = 50%. It follows that among the RS=4 original individuals having a unique approaching anonymous individual, m=((100-txP1 )/100)*RS = 2 original individuals are potentially reidentifiable. The protection rate txP3 in this example is therefore given by: txP3=(1 -m/M)*100=(1 -2/100)*100=98%.

A general architecture of a data anonymization computer system SAD in which the method according to the invention for evaluating the risk of re-identification is implemented is shown by way of example in FIG.

The SAD system is implemented here in a local computer system DSL and comprises two software modules MAD and MET. The MAD and MET software modules are hosted in data storage devices SD, such as memory and/or hard disk, of the local computer system DSL. The local computer system DSL also hosts an original database BDO in which original data DO is stored and an anonymized database BDA in which anonymized data DA is stored.

The MAD software module implements a data anonymization process which processes the original data DO and outputs the anonymized data DA.

The software module MET implements the method according to the invention for the evaluation of the risk of re-identification of the data. The software module MET receives as input original data DO and anonymized data DA and provides as output a protection rate TP against the risk of re-identification. The implementation of the method according to the invention is ensured by the execution of code instructions of the software module MET by a processor (not shown) of the local computer system DSL. The protection rate TP provided by the software module MET provides a measure of the performance of the data anonymization process implemented by the software module MAD.

Of course, the invention is not limited to the embodiments which have been described here by way of illustration. The person skilled in the art, depending on the applications of the invention, may make various modifications and variants falling within the scope of protection of the invention.

Claims

Claims Computer-implemented data processing method for evaluating a risk of re-identification of anonymized data, said method providing a protection rate (txP3) representative of said risk of re-identification in the event of a a match-seeking attack comprising a deterministic search based on at least one external source of information and a distance-based match search, said method comprising the steps of E) grouping an original data set (EDO) comprising a plurality of original individuals (IO) and a set of anonymized data (EDA) comprising a plurality of anonymous individuals (IA), said anonymous individuals (IA) being produced by a process of anonymizing said original individuals ( IO); F) identifying in said original data set (EDO) at-risk original individuals (lOrs) as being original individuals (IO) having at least one remarkable, or unique, value in at least one considered variable , or at least one remarkable or unique combination of values in a set of considered variables, in a deterministic matching search and to which only one respective approaching anonymous individual (IA _prs ) can be associated by said deterministic matching search ; G) evaluating a re-identification failure rate (txP1) for said original data set (EDO) and anonymized data set (EDA), from said match search based on a distance between each said individual of origin (IO) and one or more said closest anonymous individuals (IA) identified by a so-called “k-NN” method; H) calculating said protection rate (txP3) as a function of a total number (M) of original individuals (IO) in said original data set (EDO), of a number (RS) of original individuals at risk (IO _re ) identified in step B) and said re-identification failure rate (txP1 ) obtained in step G). Method according to claim 1, characterized in that, in step F), an anonymous individual (IA) is considered to be a said approaching anonymous individual (IA _P , IA _prs ) of a said original individual at risk (lOrs) considered when 1) said anonymous individual (IA) has a variable of the same modality as a considered variable of said original individual at risk (lOrs) in said correspondence search in the case where said variable is a qualitative variable, or when 2) said anonymous individual has a value for said considered variable equal to within a tolerance interval of the value of said same considered variable of said original individual at risk (lOrs) in the event that said variable considered in said search for deterministic correspondence is a continuous variable. Method according to claim 1 or 2, characterized in that step G) comprises the substeps of a) linking said set of original data (EDO) to said set of anonymized data (EDA); b) transforming (PGA, MCA, FAMD) said original individuals (IO) and said anonymous individuals (IA) into a Euclidean space (A1, A2), said original individuals (IO) and anonymous individuals (IA) being represented by coordinates in said Euclidean space (A1, A2); c) identify for each said original individual (10) one or more said anonymous individuals (IA) closest on the basis of said distance, by the method known as "k-NN"; and d) calculating said re-identification failure rate (txP1 ) as being a percentage of cases where a said anonymous individual (IAk) closest identified in sub-step c) for a said original individual (IOi ) is not a valid anonymous individual (IAi) corresponding to said original individual (IOi). Method according to Claim 3, characterized in that the said distance is a Euclidean distance. Method according to Claim 3 or 4, characterized in that the transformation of sub-step b) is carried out by a factorial method (PCA, MCA, FAMD) and/or using an artificial neural network called " auto-encoder”. Method according to Claim 5, characterized in that the said factorial method is a method called "Principal Component Analysis" (PCA) when the said individuals (IO, IA) comprise variables of continuous type, a method called "Multiple Correspondence Analysis">> (MCA) when said individuals (IO, IA) include qualitative type variables, or a method called “Factorial Analysis of Mixed Data” (FAMD) when said individuals (IO, IA) include mixed type variables “ continuous/qualitative >>. Data anonymization computer system (SAD) comprising a data storage device (SD) storing program instructions (MET) for implementing the method according to any one of Claims 1 to 6. computer comprising a medium in which are recorded program instructions (MET) readable by a processor for implementing the method according to any one of Claims 1 to 6.