Query Aggregation Constraints for Privacy-Safe Shared Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data sharing methods fail to effectively protect personal identifying information (PII) while enabling secure and scalable collaboration between organizations, as heuristic anonymization techniques expose individual rows and differential privacy methods require complex parameter settings and noise addition, leading to accuracy issues and usability challenges.
Innovation Solution
Implementing aggregation constraints in a cloud data platform to enforce restrictions on how data can be used, ensuring queries return only aggregated data, thereby protecting sensitive information and allowing secure data sharing and collaboration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If heuristic anonymization techniques are used to protect PII, then data sharing is enabled, but individual rows are exposed and privacy protection is insufficient
Solution Approach 1:
The patent segments data access by separating individual row access from aggregate data access. It introduces the concept of aggregation constraints that divide the data into groups (e.g., by customer ID, product category) and allow access only to aggregated statistics rather than individual records, thus preventing PII exposure while enabling data sharing for analysis.
Solution Approach 2:
The patent introduces an intermediary layer between data providers and consumers - the aggregation constraint enforcement mechanism. This intermediary processes queries and ensures that only aggregated data is returned, acting as a mediator that enables data sharing while protecting privacy by blocking direct access to individual rows containing PII.
2Object-affected harmful factors
If differential privacy methods are used to protect PII, then privacy is improved, but complex parameter settings and noise addition lead to accuracy issues
Solution Approach 1:
The patent extracts the privacy protection function from the data itself and places it in the query processing layer. Instead of modifying data with noise (as in differential privacy), it extracts and enforces aggregation constraints on queries, allowing accurate data analysis while protecting privacy through access control rather than data transformation.
Solution Approach 2:
The patent inverts the traditional approach: instead of adding noise to data to protect privacy (which reduces accuracy), it inverts the problem by restricting query access to aggregate data only. This inversion eliminates the accuracy-privacy trade-off by preventing access to individual rows that would compromise privacy, while maintaining full analytical accuracy through proper aggregation.
3Object-affected harmful factors
If attribute removal is used to protect PII, then privacy is improved, but data utility is reduced and analysis capability is limited
Solution Approach 1:
The patent applies preliminary action by pre-defining aggregation constraints and groupings before data access is requested. Instead of removing attributes and hoping for privacy protection, it pre-establishes the aggregation framework that will govern all queries, ensuring that privacy is protected while full data utility is maintained through the predefined grouping structure.
Solution Approach 2:
The patent changes the parameter of data access from individual row level to aggregate level. By changing the granularity parameter from row-level access to group-level aggregation, it maintains privacy protection while preserving data utility for analysis, as aggregates provide sufficient statistical information for meaningful insights without exposing PII.
Data Source
AI summary
A system is disclosed that includes one or more hardware processors and at least one memory storing instructions. The system receives a first query directed towards a shared dataset and accesses a first set of data from a first table in the shared dataset. The system determines that an aggregation constraint policy is attached to the first table, which restricts output of data values stored in the table. The system performs a uniqueness check on join keys for a join operation associated with the first table, verifying that at least one row from the first table is not amplified in the result. The system enforces the aggregation constraint policy on the first query based on this verification. The system generates an output to the first query based on the first set of data. This approach helps control data aggregation and ensures privacy when accessing shared datasets.