Trusted Data Anonymization for Multi-Tenant Threat Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data anonymization tools are inflexible and one-size-fits-all, failing to accommodate varying privacy and utility requirements of different data owners and processors, leading to either high privacy at the cost of data utility or high utility with low privacy, and are unable to handle multi-tenant data effectively.
Innovation Solution
A system and method for multi-entity data anonymization and analysis using a security management system with Trusted Execution Environments (TEEs) that negotiates privacy and utility levels, customizing anonymization parameters for each data owner while ensuring minimum usability for analysis, and correlating anonymized data across tenants.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If data is anonymized with high privacy protection, then privacy compliance is improved, but data utility for analysis deteriorates
Solution Approach 1:
The system dynamically adjusts anonymization parameters (k-anonymity level, l-diversity, sensitivity thresholds) based on the specific data type, analysis requirements, and privacy risk assessment. This allows optimization of the privacy-utility tradeoff for different datasets and analysis scenarios rather than applying fixed anonymization rules.
Solution Approach 2:
The anonymization approach transitions from static one-size-fits-all methods to dynamic adaptive anonymization where parameters are adjusted in real-time based on data characteristics, analysis needs, and privacy requirements. The system can modify anonymization intensity for different data fields and adjust based on feedback from analysis results.
2Device complexity
If a one-size-fits-all anonymization approach is used, then system complexity is reduced, but adaptability to different data owners' requirements deteriorates
Solution Approach 1:
The system segments data into different categories (sensitive personal information, behavioral data, device information) and applies customized anonymization strategies to each segment. Different data owners can select from pre-defined anonymization templates tailored to their specific data types and requirements, reducing complexity while maintaining adaptability.
Solution Approach 2:
The system provides a universal anonymization framework that can handle multiple data types and requirements through configurable parameters and templates. A single platform serves multiple data owners with different needs by allowing customization within a unified architecture, achieving both simplicity and versatility.
3Measurement precision
If data from multiple tenants is analyzed centrally, then detection capability for subtle threats is improved, but privacy breach risk across customers increases
Solution Approach 1:
The system introduces anonymization as an intermediary layer between multi-tenant data collection and central analysis. Data is anonymized before being aggregated for central analysis, preventing direct identification of individual customers while maintaining the ability to detect subtle threats through patterns in the anonymized data.
Solution Approach 2:
Different anonymization strategies are applied to different data elements based on their sensitivity and importance for threat detection. Critical data elements retain more detail for analysis while highly sensitive information receives stronger anonymization, optimizing the balance between detection capability and privacy protection for each data type.
4Reliability
If local analysis within each administrative domain is performed, then privacy protection is improved, but detection efficiency for subtle attacks deteriorates
Solution Approach 1:
The system merges anonymized data from multiple local administrative domains into a central analysis platform. By combining datasets from different domains after anonymization, the system achieves economies of scale in threat detection, enabling identification of subtle attacks that span multiple domains while maintaining privacy protection through the anonymization barrier.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A security management system including a first TEE and a common TEE is provided. The first TEE is a secured environment for data associated with a first entity. The common TEE is a secured environment for data associated with any one of a plurality of entities. First anonymization parameters are shared between the first TEE and the common TEE. The first anonymization parameters are based at least in part on at least one privacy requirement of the first entity and at least one utility requirement of the security management system. The security management system includes processing circuitry configured to: anonymize first data associated with the first entity based at least in part on the first anonymization parameters, analyze at least the anonymized first data for performing data investigation, and generate analysis results based at least in part on the analysis of at least the anonymized first data.