Secure Multi-Party Heavy Hitters With Differential Privacy

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing methods for performing analytics on sensitive data face challenges in sharing data among mutually distrusting parties without compromising privacy, as trusted third parties may be unfeasible or vulnerable to compromise.

Innovation Solution

Implementing secure multi-party computation (MPC) protocols HH1 and HH2 to determine differentially private top-k values across multiple clients, ensuring privacy and accuracy without revealing individual data, using cryptographic protocols to replace trusted third parties and adding noise to protect privacy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If trusted third party is used to perform analytics on sensitive data, then data sharing and computation can be achieved, but security and privacy are compromised due to potential compromise of the trusted third party

Engineering Contradiction:
Improvedata sharing capabilityVSAvoidprivacy security
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The patent introduces secure multi-party computation protocols as an intermediary mechanism that enables data analysis without requiring a trusted third party. The computation is performed directly between parties using cryptographic techniques, eliminating the security vulnerability of centralized trusted intermediaries while maintaining the ability to share and analyze sensitive data across multiple organizations

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the computation process into multiple independent cryptographic operations performed by different parties. Each party maintains control over their own data and participates in the computation through secure protocols, rather than consolidating all data in a single trusted third party system. This segmentation distributes trust and eliminates the single point of failure

Inventive Principle:
Principle #1Segmentation

2Measurement precision

If plaintext data is shared for analytics, then computation accuracy is improved, but privacy protection deteriorates

Engineering Contradiction:
Improvecomputation accuracyVSAvoidprivacy exposure
Core Design Contradiction:
Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The patent transforms the data representation parameters throughout the computation process. Data is encoded into cryptographic forms that preserve mathematical relationships needed for accurate computation while removing direct interpretability. The transformation maintains computational utility while eliminating privacy exposure risks associated with plaintext sharing

Inventive Principle:
Principle #35Parameter changes

3Reliability

If secure multi-party computation is implemented, then privacy protection is improved, but communication overhead increases

Engineering Contradiction:
Improveprivacy guaranteeVSAvoidcommunication overhead
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent performs preliminary actions by pre-establishing cryptographic protocols and computation plans before the actual data processing. Parties agree on the computation structure, data formats, and protocol parameters in advance, which reduces the communication overhead during the actual execution phase while maintaining strong privacy guarantees

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS12572684B2Secure multi-party computation of differentially private heavy hitters
Publication Date: 2026.03.10 SAP SE
  • US12572684B2 patent drawing
  • US12572684B2 patent drawing
  • US12572684B2 patent drawing

AI summary

According to an aspect, a method may include receiving a candidate value; in response to a received candidate value matching one of the entries in the table, incrementing a corresponding count; in response to the received candidate value not matching one of the entries in the table and the table not exceeding a threshold size, adding an entry to the table; in response to the received candidate value not matching one of the entries in the table and the table exceeding the threshold size, decrementing the counts in the table and deleting entries having a count of zero; adding noise to the corresponding counts in the entries of the table and deleting any noisy corresponding counts less than a threshold value; and outputting at least a portion of the table as the top-k value result set.