Secure Enclave Differential Privacy Synopsis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in balancing privacy obligations with audit requirements, particularly in retaining data for compliance while ensuring individual user privacy.
Innovation Solution
A method involving the generation of a private synopsis by adding noise to personal data, aggregating it, and creating a summary that satisfies differential privacy guarantees, alongside the use of a secure enclave for encryption and decryption, ensuring data is expunged while retaining a privacy-protected summary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If personal data is retained for audit purposes, then audit compliance is satisfied, but privacy requirements are violated due to risk of re-identification
Solution Approach 1:
The patent introduces a private synopsis as an intermediary representation of the original personal data. This synopsis is created through differential privacy processing that adds controlled noise to the data, allowing auditors to verify compliance without accessing the actual personal data. The synopsis serves as a mediator that satisfies audit requirements while preventing re-identification of individuals.
Solution Approach 2:
The patent transforms the original personal data into a private synopsis by changing its parameters through differential privacy techniques. Noise is added to the data with carefully controlled magnitude and distribution, fundamentally altering the data's identifying characteristics while preserving statistical properties needed for audit verification. This parameter transformation enables simultaneous satisfaction of both audit and privacy requirements.
2Object-affected harmful factors
If noise is added to protect privacy, then differential privacy guarantee is satisfied, but data accuracy for auditing deteriorates
Solution Approach 1:
The patent applies partial action by adding noise only to the extent necessary to satisfy differential privacy guarantees, rather than obscuring all data. The noise magnitude is carefully calibrated based on the sensitivity of the data and the desired privacy parameter epsilon, providing just enough protection while maintaining maximum possible accuracy for audit purposes.
Solution Approach 2:
The patent systematically controls the parameters of noise addition, including noise magnitude, distribution type, and injection point in the data processing pipeline. By adjusting these parameters, the system optimizes the balance between privacy protection and data accuracy, ensuring the private synopsis retains sufficient fidelity for auditing while providing adequate privacy guarantees.
3Object-affected harmful factors
If data is expunged to satisfy privacy requirements, then privacy obligations are met, but audit trail retention is compromised
Solution Approach 1:
The patent extracts the essential audit information from the original personal data to create a separate private synopsis. This synopsis contains the necessary audit trail information while being decoupled from the identifiable personal data. The original data can then be securely expunged, satisfying privacy requirements, while the extracted synopsis remains available for audit purposes.
Solution Approach 2:
The private synopsis acts as an intermediary that preserves audit information without requiring retention of original personal data. Auditors can review the synopsis to verify compliance while the system eliminates the privacy risk associated with retaining identifiable information. This intermediary structure resolves the conflict between data expungement and audit trail retention.
4Object-affected harmful factors
If aggregation is performed at lowest level to satisfy privacy, then privacy guarantee is strengthened, but audit reporting capability is reduced
Solution Approach 1:
The patent segments the aggregation process into multiple levels: a fine-grained private synopsis created at the lowest aggregation level to maximize privacy guarantees, and coarser-grained reports generated from the synopsis for audit purposes. This segmentation allows the system to optimize for privacy at the synopsis level while still providing sufficient detail in derived reports to satisfy audit requirements.
Solution Approach 2:
The patent resolves the contradiction by operating in different dimensional spaces: the private synopsis exists in a high-dimensional space with fine-grained detail optimized for privacy, while audit reports are generated in lower-dimensional spaces with aggregated metrics optimized for reporting needs. This dimensional transformation allows both privacy protection and reporting capability to coexist.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A secure enclave may be used to satisfy privacy requirements and audit requirements. Code may be loaded into the secure enclave. The code may generate a predefined report based on data and added noise. The pre-defined report may be subject to audit requirements. The data may be subject to the privacy requirements. The secure enclave may generate an encryption key and a decryption key based on the code. Only the secure enclave may have access to the decryption key. And the secure enclave may allow only a verified copy of the code to access the decryption key. With the added noise, the report may satisfy a pre-defined differential privacy guarantee. Encrypting the code and ensuring that the report satisfies the differential privacy guarantee may satisfy the privacy requirements. Retaining the report, the code, the secure enclave, and the encrypted data may satisfy the audit requirements.