Anonymous Malware Data Collection via Client-Side Anonymization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information security solutions face challenges in securely and anonymously collecting malware-related data from client devices, particularly due to stringent data protection regulations like GDPR and jurisdictional requirements that necessitate minimizing personal data storage and processing within specific territorial boundaries.
Innovation Solution
A method involving a network node that receives encrypted data from client devices, transforms client identifiers into anonymized identifiers, and transmits these along with malware-related data to a server, ensuring the server cannot access or view the original identifiers or personal data, thus maintaining anonymity and compliance with data protection regulations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If personal data is collected and stored on servers for malware analysis, then the ability to analyze malware patterns and threats is improved, but compliance with data protection regulations (GDPR, territorial data storage laws) deteriorates
Solution Approach 1:
The patent extracts personal data from the data structure before transmission to the server. The client device removes or anonymizes personally identifiable information (PII) such as device identifiers, user names, and contact information, retaining only non-personal malware data for server analysis. This extraction principle resolves the contradiction by enabling malware analysis while eliminating regulatory compliance risks associated with personal data storage.
Solution Approach 2:
The patent segments the data structure into personal data portions and non-personal malware data portions. The client device separates these segments, transmitting only the non-personal portions to the server while keeping or locally deleting personal data portions. This segmentation allows the server to perform malware analysis on technical data without receiving or storing personal information, thus maintaining both analysis capability and regulatory compliance.
2Measurement precision
If client identifiers are transmitted to servers for data association, then the ability to track and analyze malware patterns from specific devices is improved, but user anonymity and data protection are worsened
Solution Approach 1:
The patent extracts client identifiers from the data structure before server transmission. The client device removes device identifiers, IP addresses, and other tracking information, sending only anonymized malware data to the server. This enables the server to analyze malware patterns without the ability to trace them back to specific users or devices, maintaining both analytical utility and user anonymity.
3Reliability
If encrypted data is transmitted from client devices, then data security during transmission is improved, but the complexity of data processing and storage infrastructure is worsened
Solution Approach 1:
The patent applies preliminary action by encrypting data at the client device before transmission. The client device performs encryption using public key infrastructure (PKI) or other cryptographic methods, so that data is secured during transmission and storage. The server receives already-encrypted data and can store or process it without needing to implement its own encryption infrastructure, thus reducing server-side complexity while maintaining high security standards.
Data Source
AI summary
Systems and methods for anonymous collection of malware-related data from client devices. The system comprising a network node configured to (i) receive a first data structure from a client device, wherein the first data structure contain an identifier of the client device and an encrypted data that includes an identifier of a user of the client device and/or personal data of the user, and wherein the encrypted data was encrypted by the client device with a public key of the client device, wherein the public key was provided to the client device by an independent certification authority, (ii) transform the received first data structure by replacing the identifier of the client device with an anonymized identifier, and (iii) transmit the transformed first data structure containing the anonymized identifier and the encrypted data to a server.