Encoding Sensitive Data with Linear Equations for Privacy

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for releasing aggregate statistics from sensitive datasets face challenges in measuring privacy risk and data utility, with theoretical models being difficult to interpret and potentially overly pessimistic, and privacy-preserving techniques often resulting in a trade-off between privacy protection and data utility.

Innovation Solution

A computer-implemented method that encodes aggregate statistics using linear equations to represent relationships between sensitive attributes, employing a penetration testing system to determine privacy protection parameters and apply noise to protect against attacks, while maintaining data utility.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If theoretical privacy models such as differential privacy are used to assess risk, then privacy protection metric is provided, but the metric is difficult to map to intuitive understanding and the models are impractically pessimistic

Engineering Contradiction:

Improveprivacy protection metricVSAvoidinterpretability of privacy metric

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The patent introduces an intermediary translation layer that converts the abstract differential privacy parameter epsilon into concrete, interpretable risk metrics. This intermediary system simulates actual attacks on the released statistics and translates the theoretical privacy guarantee into practical risk assessments that stakeholders can understand and evaluate intuitively.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If suppression of statistics about small groups is applied, then private attribute disclosure is protected, but information that can be released decreases

Engineering Contradiction:

Improveprivacy protectionVSAvoiddata utility

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent dynamically adjusts the suppression threshold parameter based on the specific characteristics of the dataset and the privacy requirements. Instead of applying a fixed suppression threshold, the system optimizes this parameter to achieve the best balance between privacy protection and data utility, allowing more information to be released while maintaining adequate privacy safeguards.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent implements dynamic suppression strategies where the suppression decisions are not static but adapt based on the queried statistics and potential attack vectors. The system continuously evaluates which statistics should be suppressed or released based on current privacy risks, allowing flexible adjustment between privacy protection and information availability rather than rigid pre-suppression.

Inventive Principle:

Principle #15Dynamics

3Reliability

If random noise is added to statistics, then private information leakage is mitigated, but data distortion increases

Engineering Contradiction:

Improveprivacy protectionVSAvoiddata accuracy

Core Design Contradiction:

ReliabilityVSManufacturing precision

Solution Approach 1:

The patent applies noise addition selectively rather than uniformly across all statistics. The system identifies which specific statistics are most vulnerable to privacy attacks and applies noise only to those particular statistics, while leaving other statistics with lower vulnerability unchanged or with minimal noise. This localized approach preserves data accuracy for non-sensitive statistics while providing privacy protection where needed.

Inventive Principle:

Principle #3Local quality

4Difficulty of detecting and measuring

If manual output checks are performed, then some private information leakage can be detected, but not all unintended disclosures are found

Engineering Contradiction:

Improvedetection of private information leakageVSAvoidcompleteness of detection

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent performs preliminary automated privacy risk assessments and simulations before the actual data release. By conducting penetration testing and attack simulations in advance, the system identifies potential privacy vulnerabilities and applies appropriate mitigations beforehand, rather than relying solely on manual post-release checks. This preliminary action ensures more comprehensive detection and protection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent implements a feedback loop where the results of penetration testing and attack simulations are used to continuously improve the privacy protection measures. The system learns from the simulated attacks and adjusts the noise parameters, suppression thresholds, and other privacy controls based on the feedback from these tests, creating an iterative improvement process that enhances both detection capability and protection effectiveness.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS20220277097A1Method or system for querying a sensitive dataset

Publication Date: 2022.09.01 PRIVITAR LTD

AI summary

A computer implemented method is presented for querying a dataset that contains sensitive attributes. The method comprises the steps of receiving a query specification, generating a set of aggregate statistics derived from the sensitive dataset based on the query specification and encoding the set of aggregate statistics using a set of linear equations. The relationships of each sensitive attribute represented in the set of aggregate statistics are also encoded into the set of linear equations.