Privacy-Preserving Attribute Matching via Partitioned Data Sharding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing attribute-based matching systems raise concerns about user privacy as they may learn and leak sensitive information about users' links to their attributes, compromising privacy both from third parties and service providers.
Innovation Solution
A computer-implemented matching service is designed to perform attribute-based matching without learning associations between entities and attributes by using a partitioned data structure where user identities and attributes are sharded across multiple non-colluding partitions, allowing for rich matching while protecting linkages between user identities and attributes, and enabling direct communication between matched entities without revealing their identities to the service.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a centralized matching service stores all user attributes and identities together, then matching functionality is simple and efficient, but user privacy is compromised as the service can learn linkages between entities and attributes
Solution Approach 1:
The system divides the matching service into multiple non-trusting partitions, where each partition stores only a subset of user attributes and identities. No single partition contains complete user data, preventing any one partition from learning the full linkage between entities and attributes while collectively performing matching operations.
Solution Approach 2:
The system introduces cryptographic intermediaries including trusted execution environments (TEEs) and homomorphic encryption mechanisms that enable matching operations without exposing raw user data. These intermediaries allow the service to perform computations on encrypted data, preventing privacy leakage while maintaining functionality.
2Object-affected harmful factors
If user data is encrypted to protect privacy, then privacy is improved, but matching operations become more complex and computationally intensive
Solution Approach 1:
The system changes the cryptographic parameters and encryption schemes used across different partitions, employing various homomorphic encryption schemes and TEE configurations. This allows optimization of the balance between privacy protection and computational complexity based on specific operational requirements.
Solution Approach 2:
By segmenting data across multiple partitions with different encryption schemes, the system distributes computational complexity rather than concentrating it in a single complex encryption layer, making the overall system more manageable and efficient.
3Object-affected harmful factors
If multiple non-trusting partitions are used to protect privacy, then privacy is improved, but system complexity and communication overhead increase
Solution Approach 1:
The system designs a universal coordination protocol that handles multiple functions (data distribution, matching coordination, result aggregation) across partitions. This multi-functional protocol reduces the need for separate specialized mechanisms, simplifying the overall system architecture despite the distributed nature.
Solution Approach 2:
The system merges the coordination functions of multiple partitions into a unified matching operation, where partitions collectively perform matching tasks through standardized interfaces. This combining approach reduces communication overhead compared to fully distributed approaches by enabling batch operations and coordinated processing.
Data Source
AI summary
Described herein are technologies pertaining to protecting user privacy in connection with attribute-based matching services. A user registers with a platform that includes a plurality of non-collaborating partitions, where registration includes transmitting a message to the platform that indicates that the user has one or more attributes corresponding thereto. Through selective encryption and a communications protocol amongst the partitions, none of the partitions are able to ascertain that the user has the attributes. Acting in conjunction, however, the plurality of partitions perform rich attribute.