In-Memory Data Anonymization Using K-Anonymity and L-Diversity

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current data anonymization techniques are limited in their ability to protect personal information in databases, particularly for textual data types, and often expose sensitive information due to reliance on methods like K-anonymity.

Innovation Solution

The Data Anonymizer (DA) system employs techniques such as K-anonymity, L-diversity, and T-closeness to anonymize data by grouping records into equivalence classes, suppressing or obscuring personally identifiable information (PII) while maintaining data integrity, using a column-store in-memory database to efficiently perform anonymization operations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If K-anonymity is used for data anonymization, then individual identities are protected, but sensitive information may still be exposed

Engineering Contradiction:
Improveidentity protectionVSAvoidsensitive information exposure
Core Design Contradiction:
ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent combines multiple anonymization techniques (K-anonymity, L-diversity, and T-closeness) into a composite approach. K-anonymity groups records so each individual is indistinguishable from at least K-1 others, L-diversity ensures each group contains at least L different sensitive attribute values, and T-closeness maintains similarity between sensitive attribute distributions in groups and the overall dataset. This composite methodology simultaneously achieves identity protection and sensitive information protection.

Inventive Principle:
Principle #40Composite materials

2Reliability

If data anonymization is applied to protect privacy, then personal information is protected, but data utility may be reduced

Engineering Contradiction:
Improveprivacy protectionVSAvoiddata utility
Core Design Contradiction:
ReliabilityVSLoss of information

Solution Approach 1:

The patent adjusts anonymization parameters (K, L, and T values) based on the specific data characteristics and privacy requirements. By dynamically changing these parameters, the system optimizes the balance between privacy protection and data utility retention, ensuring that anonymization is strong enough to protect privacy but not so strong as to render the data unusable for analytical purposes.

Inventive Principle:
Principle #35Parameter changes

3Adaptability or versatility

If current anonymization techniques are used, then numerical and hierarchical data can be anonymized, but textual data cannot be anonymized

Engineering Contradiction:
Improvedata type coverageVSAvoidanonymization applicability
Core Design Contradiction:
Adaptability or versatilityVSEase of manufacture

Solution Approach 1:

The patent creates a universal anonymization framework that can handle multiple data types including numerical, hierarchical, and textual data. The system uses data type detection to identify the format of input data and applies appropriate anonymization algorithms for each type, enabling the same system to serve multiple data formats without requiring separate specialized tools for each data type.

Inventive Principle:
Principle #6Universality (Multi-functionality)

Data Source

PatentEP3477530B1K-anonymity and l-diversity data anonymization in an in-memory database
Publication Date: 2021.10.20 SAP SE
  • EP3477530B1 patent drawingFigure 1
  • EP3477530B1 patent drawingFigure 2
  • EP3477530B1 patent drawingFigure 3

AI summary

Disclosed herein are system, method, and computer program product embodiments for data anonymization in an in-memory database. An embodiment operates by receiving an indication to perform data anonymization based on quasi attributes of a data set. Partitioning is recursively performed on the data set based on one or more of the quasi attributes until both a first anonymization threshold corresponding to the quasi attributes is satisfied and a second anonymization threshold corresponding to the one or more sensitive attributes is satisfied for each of a plurality of sub-partitions produced as a result of the partitioning. A resultant data set including a plurality of records of the data set corresponding to the plurality of sub-partitions that satisfy both the first anonymization threshold and the second anonymization threshold is provided.