Privacy-Preserving Analysis System Using Proxy Data Oversampling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to adequately protect individual privacy when analyzing disparate data sets, as anonymization and secure multiparty computation are insufficient to prevent re-identification due to the risk posed by quasi-identifiers, which can reveal personal information when combined.
Innovation Solution
A privacy-preserving analysis system creates a proxy data set by oversampling and randomly masking fields, using distributed encryption and secure multiparty computing to prevent individual re-identification, even through repeated analysis, by ensuring duplicate identifiers are not created and using a centrally stored master person index.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is anonymized by encrypting personally-identifying information, then privacy protection is improved, but quasi-identifiers can still be combined to re-identify individuals
Solution Approach 1:
The system performs preliminary actions by creating multiple synthetic duplicate records before any analysis occurs. Each original record is replicated N times with randomized variations in quasi-identifier fields, establishing a foundation of uncertainty that prevents later re-identification attempts. This preliminary synthetic data generation ensures that even if analysis results are examined repeatedly, the underlying uncertainty remains because the synthetic duplicates make it impossible to determine which record corresponds to which individual.
Solution Approach 2:
The system changes parameters by introducing controlled randomness in the quasi-identifier fields of synthetic duplicate records. Specifically, it randomizes values in fields like date of birth, gender, and location across the N duplicates of each original record. This parameter variation creates sufficient uncertainty in the data that when combined with secure multiparty computation, it becomes computationally infeasible to re-identify individuals through quasi-identifier matching, while still preserving the statistical validity of correlation analyses.
2Reliability
If secure multiparty computation is used to compute functions over inputs without revealing inputs, then privacy is improved, but repeated queries can still leak information through pattern analysis
Solution Approach 1:
The system performs preliminary action by pre-generating synthetic duplicate records with randomized quasi-identifiers before any secure multiparty computation queries are executed. This preliminary synthetic data layer ensures that even when multiple queries are run through the secure computation protocol, the results remain obscured by the pre-established uncertainty from the synthetic duplicates, preventing pattern analysis from revealing information about specific individuals across repeated queries.
Solution Approach 2:
The synthetic duplicate records act as an intermediary layer between the original sensitive data and the analysis queries. This intermediary synthetic data with randomized quasi-identifiers absorbs the information leakage risk from repeated queries, allowing the secure multiparty computation to proceed while the synthetic layer prevents direct inference about original individuals. The intermediary synthetic data thus mediates between privacy protection and analytical utility.
3Productivity
If multiple data sets with different quasi-identifiers are combined, then analytical capability is improved, but the combination becomes vulnerable to re-identification
Solution Approach 1:
The system performs preliminary action by generating synthetic duplicate records with randomized quasi-identifiers for each data set before combining them. This preliminary synthetic data generation ensures that when multiple data sets are combined for analysis, each contributes synthetic records with already-randomized quasi-identifiers, preventing the combination from creating a vulnerable profile that could be used for re-identification while maintaining the analytical capability to find correlations across the combined data.
Solution Approach 2:
The system applies parameter changes by introducing controlled randomness in quasi-identifier parameters across synthetic duplicate records in each data set. When data sets are combined, this parameter randomization ensures that quasi-identifiers like date of birth, location, and gender vary sufficiently across synthetic duplicates from different sources, making it computationally infeasible to re-identify individuals through combined quasi-identifier matching while preserving the ability to perform cross-data-set correlation analysis.
Data Source
AI summary
A privacy-preserving analysis system that provides functionality to analyze disparate data sets (and identify correlations) while making individual re-identification prohibitively difficult (even through repeated analysis). The system creates a large proxy data set by oversampling the underlying data and randomly masking a predictable number of fields in the proxy data sets to create sufficient uncertainty in the analysis results. The system may also use a distributed encryption process, secure communications, and secure multiparty computing to prevent personally-identifying information in remotely-stored underlying data from being determined. In the distributed encryption process, each of a plurality of distributed computing devices may be configured to encrypt personally-identifying information using an identical process (and identical encryption keys).