Systems and methods for manipulation of private information on untrusted environments

Systems and methods for manipulation of private information in untrusted environments are disclosed. In one embodiment, in a trusted computing environment comprising at least one computer processor, for a plurality of data records, a method for manipulation of private information in untrusted environments may include: (1) separating each data record into a confidential data attribute and a non-confidential data attribute; (3) calculating an encrypted value for the confidential data attribute using an encryption key; (4) calculating an authentication value for the confidential data attribute using a hash value key; (5) associating the encrypted value and the authentication value in a protected data set; and (6) associating the non-confidential data record with the associated encrypted value and the authentication value; and (7) exporting the protected data set to an untrusted computing environment.

BACKGROUND OF THE INVENTION

1. Field Of The Invention

The present disclosure generally relates to systems and methods for manipulation of private information in untrusted environments.

2. Description Of The Related Art

Data that contains proprietary and confidential elements must be protected when taken out beyond the boundaries of a trusted domain managed by the data owner, due to laws and regulations of respective jurisdictions and data owner's fiduciary responsibilities. This normally involves encrypting data in transit and at rest while outside of the trusted domain in order to ensure data confidentiality, and calculating message authentication code for the data sets in order to ensure data integrity. This means that the data is unusable for processing by standard analytical tools when strong encryption methods are used for protection of data confidentiality and integrity.

As the result, in order to process confidential data outside of the trusted domain (e.g., on public clouds or in untrusted environments) the data must be either decrypted before processing, or lower strength encryption methods must be used, or processing becomes extremely slow. All of the above introduces vulnerabilities in data processing and negates benefits of using public infrastructures such as, but not limited to, public clouds.

SUMMARY OF THE INVENTION

Systems and methods for manipulation of private information in untrusted environments are disclosed. In one embodiment, in a trusted computing environment comprising at least one computer processor, for a plurality of data records, a method for manipulation of private information in untrusted environments may include: (1) separating each data record into a confidential data attribute and a non-confidential data attribute; (2) calculating an encrypted value for the confidential data attribute using an encryption key; (3) calculating an authentication value for the confidential data attribute, wherein the authentication value is a unsigned hash or a signed hash; (4) associating the encrypted value and the authentication value in a protected data set; and (5) associating the non-confidential data record with the associated encrypted value and the authentication value; and (6) exporting the protected data set to an untrusted computing environment.

In one embodiment, the confidential data attribute may include personal identifiable information.

In one embodiment, the encryption key may be used in a strong encryption algorithm. The strong encryption algorithm may be a AES/CBC algorithm or an AES/GCM algorithm.

In one embodiment, confidential data attributes having the same value have the same authentication value.

In one embodiment, the signed hash comprises a HMAC.

In one embodiment, the method may further include aggregating data in the protected data set based on the authentication values.

In one embodiment, the untrusted computing environment may include a public cloud, a private cloud, a hybrid cloud, or a third-party managed infrastructure.

In one embodiment, the method may further include executing a query against the authentication values in the protected data set; returning a responsive authentication value for the query; returning at least one encrypted value associated with the responsive authentication value to the trusted computing environment; and decrypting the at least one encrypted value resulting in the confidential data attribute for that at least one encrypted value.

According to another embodiment, a system for manipulation of private information in untrusted environments may include a trusted computing environment comprising a data set preparation engine, a data encryption key store, and an authenticator key store, and an untrusted computing environment comprising an analytical engine. The data encryption engine may receive a plurality of data records, and, for each data record, the data encryption engine may separate the data record into a confidential data attribute and a non-confidential data attribute, calculate an encrypted value for the confidential data attribute using an encryption key, calculate an authentication value for the confidential data attribute, wherein the authentication value is a unsigned hash or a signed hash, associate the encrypted value and the authentication value in a protected data set, and associate the non-confidential data record with the associated encrypted value and the authentication value. The data encryption engine may export the protected data set to the untrusted computing environment.

In one embodiment, the confidential data attribute may include personal identifiable information.

In one embodiment, the encryption key may be used in a strong encryption algorithm. The strong encryption algorithm may be a AES/CBC algorithm or an AES/GCM algorithm.

In one embodiment, confidential data attributes having the same value have the same authentication value.

In one embodiment, the signed hash may include a HMAC.

In one embodiment, the analytical engine may aggregate data in the protected data set based on the authentication values.

In one embodiment, the untrusted computing environment may include a public cloud, a private cloud, a hybrid cloud, or a third-party managed infrastructure.

In one embodiment, the analytical engine may execute a query against the authentication values in the protected data set; return a responsive authentication value for the query; and return at least one encrypted value associated with the responsive authentication value to the trusted computing environment. The data encryption engine may decrypt the at least one encrypted value resulting in the confidential data attribute for that at least one encrypted value.

Embodiments allow the use of strong cryptographic methods and ability to process data without the necessity of decrypting it.

In one embodiment, a data set preparation engine may include a data iterator; a data cypher; a data authentication code generator; an aggregator for element encryption and element authentication code for confidential elements; and a non-confidential element copier.

In embodiments, participants may include data producers and data consumers. In one embodiment, the unprotected data set constructed by producer may be converted to protected data set suitable for consumption by data consumers without removing the data protection.

In one embodiment, the protected data set confidential elements may be encrypted using strong encryption algorithms and authenticated to protect the confidential information.

In one embodiment, the protected data set may be manipulated and analyzed without necessity of decrypting the data.

DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS

Embodiments are directed to systems and methods for manipulation of private information in untrusted environments.

In embodiments, a data record may include multiple data attributes. For example, a data record may include data attributes such as an individual's name, date of birth, address (e.g., street address, city, state, zip code), social security number, contact information (e.g., email address, phone number, etc.), demographic information, and any information about goods or services that may be provided to the individual (e.g., account types, account numbers, transactions, etc.). It should be recognized that these data records are exemplary only, and the actual data records may vary depending on the organization with which the data records are used, the goods/services provided by the organization, etc.

Some of the data attributes may include confidential, or personally identifiable information (PII). For example, the name, date of birth, social security number, contact information (e.g., email address, phone number, etc.), account numbers, etc. may include such confidential information, while others, such as certain parts of the address (e.g., city, state, zip code), account type, etc. may be non-confidential.

Embodiments include the creation of two data values from a single confidential data attribute. The first value is a one-way hashed value of the confidential data attribute, using, for example Keyed-Hashing for Message Authentication (HMAC), such as HMAC-SHA256. Other types of hashes may be used as is necessary and/or desired.

Because the same hash may be used on similar confidential data attributes, the hashed confidential data attributes will all have the same value. The hash, however, is irreversible, so the confidential data attributes cannot be recreated or recovered.

The second element is a non-deterministic encrypted value the confidential data attribute. For example, AES256 in Galois/Counter Mode (GCM) may be used. Other encryption methods may be used as is necessary and/or desired.

Embodiments may use a key management service (KMS) to secure the encryption key and/or the authentication key.

By de-identifying certain portions of the data attribute and using those as reference data, and using the hash and encrypted confidential data, analysis may be performed in the public cloud without compromising security.

Referring toFIG.1, a system for open manipulation of private information is disclosed according to one embodiment. System100may include trusted zone110and untrusted zone150. Trusted zone110may include data set preparation engine120that implements protection of data set160by converting it into protected data set170and placing it in untrusted zone150for subsequent analysis.

Trusted zone110may further include authenticator key store135and data encryption key store130.

Authenticator key store135may store and generate keys, such as HMAC keys.

Data encryption key store130may generate and store encryption keys that may be used to encrypt confidential data attributes.

Data set preparation engine120may be executed by a server (not shown) as a privacy program or application. In one embodiment, the server running may be any suitable electronic device, including servers, workstations, computers, cloud, etc. Data set preparation engine120may receive data set160, may identify confidential data elements in the data records, and may hash and encrypt the confidential data elements.

Data set preparation engine120may include iterator122, cypher124, datum copier125, HMAC126, and aggregator128. Iterator122may separate data elements from data set160into non-confidential data elements and confidential (e.g., PII) data elements.

Cypher124may calculate encrypted values of confidential data attributes. In one embodiment, the encryption algorithm used may be a strong encryption algorithm, and may include algorithms such as AES/CBC, AES/GCM, elliptic curve, etc.

Datum copier125may copy non-confidential data elements into protected data set170.

HMAC126may calculate an authentication code for the confidential data attributes. In one embodiment, the authentication code may be signed; in another embodiment, the authentication code may be unsigned. The hashing algorithm used for producing the authentication code may be a strong algorithm, such as SHA-256, elliptic curve based algorithms, etc.

Aggregator128may combine the hash and encrypted values of the confidential data attributes and may place them into protected data set170.

Data set160may be any suitable set of data records from any suitable data source (not shown). Each data record may include confidential and non-confidential data attributes. In one embodiment, data set160may be provided by a static data source, a streaming data source, etc.

Untrusted zone150may be any suitable storage, including off-premises cloud storage (e.g., AWS, Azure, etc.). In one embodiment, untrusted zone150may be a public cloud; in another embodiment, untrusted zone150may be a private cloud; in yet another embodiment, untrusted zone150may be an infrastructure hosted by another entity different from a public cloud. Untrusted zone150may also be a hybrid cloud if a need arises.

In one embodiment, untrusted zone may be provided with analytical engine155. Analytical engine155may be implemented as an analysis program or an application, and may access and manipulate data (e.g., the reference data, hash, and/or encrypted data) in untrusted zone150. In one embodiment, Analytical engine155may perform analysis and/or manipulation of the data, such as performing queries, etc. The results may be returned to a device (not shown) within trusted zone110, where the encrypted data attributes may be decrypted.

Analytical engine155may execute on a cloud or any suitable electronic device, such as servers, desktop computers, notebook computers, laptop computers, tablet computes, terminals, smartphones, smart watches, Internet of Things (IoT) devices, etc.

In another embodiment, the electronic device that executes analytical engine155may be within trusted zone150.

Referring toFIG.2, a method for open manipulation of private information is disclosed according to one embodiment.

In step205, a data record may be received. In one embodiment, the data record may be received, or retrieved, from a data source, such as a database that may store data having PII data.

In step210, the data record may be separated into non-confidential data attributes and confidential (e.g., PII) data attributes.

In step215, confidential data attributes may be delivered to an encryption module, such as a cypher module.

In step220, an encryption key may be generated for encrypting the confidential data attributes. In another embodiment the encryption key may be stored for subsequent use. In yet another embodiment, the encryption key may be retrieved from the key store for use.

In step225, encrypted values for the confidential data attributes may be calculated. The encryption used may be a strong encryption algorithm, including algorithms such as AES/CBC, AES/GCM, elliptic curve, etc.

In step230, confidential data attributes may also be delivered to an authentication module.

In step235, a key may be generated for generating a signed hash value for the confidential data attributes. In another embodiment, the encryption key may be stored for subsequent use. In yet another embodiment, the encryption key may be retrieved from the key store for use.

In step240, the authentication value for confidential data attributes may be calculated. The authentication value may be signed or unsigned. The hashing algorithm used for producing the authentication code is a strong algorithm and may be but not limited to SHA-256 or elliptic curve based.

It should be noted that although steps215-225and230-240are illustrated as being in parallel, it should be noted that these steps may occur in any order as is necessary and/or desired. For example, these steps may be performed in parallel, sequentially, or in any combination thereof.

In step245, the authentication values may be delivered for combination with other elements, such as the encrypted values. In one embodiment, the encrypted values and the authentication values may be combined using, for example, an aggregator.

In one embodiment, after they are combined, the combined encrypted value and authentication value for confidential data attributes may be provided as a protected data set.

In step250, non-confidential attributes may be copied and may be associated with, combined with, or stored in the protected data set.

In step255, the protected data set may be provided outside of the trusted zone to an untrusted zone, such as to a cloud, a third-party managed infrastructure, etc.

In step260, the data outside the trusted zone may be analyzed. For example, data aggregation and/or other operations may be performed on the reference data, the hash value, and the encrypted value. For example, certain data may be considered to be “measures,” as mathematical operations may be performed on this data, such as averaging, summation, comparison, ordering, etc.

Because all confidential data attributes may be hashed with the authentication key, groupings, aggregations, operations, etc. may be performed on the hash values without knowing what the hash values represent.

As a result of the analysis, a result set that include the reference data, the encrypted value, and any reference and/or measure data may be returned.

In step265, the encrypted value(s) may be decrypted using the key stored in the key store.

The following non-limiting example ofFIGS.3-5is provided for illustrative purposes only. It should be noted that some of the authentication and encrypted values provided have been simplified for inclusion in this application, and may not reflect actual authentication or encrypted values. For example, the authentication and encrypted values are represented as fewer digits or characters than would be used to simplify the presentation of this example, and are not actual authentication or encrypted values for the underlying data.

FIG.3depicts an exemplary illustration of an original data set according to one embodiment. The example shows confidential attributes, such as Name and AddrName, and non-confidential attributes such as CityName, StateName, ZIPCode, and Spoken Language. In one embodiment, this data set may reside in the clear in a trusted zone.

FIG.4depicts an exemplary illustration of a resulting protected data set according to one embodiment. The protected data set is obtained by processing the original data set using, for example, HMAC-SHA256 authentication and AES/GCM encryption methods. For example, the confidential data attributes Name and Address have both had an authentication value (i.e., NameHash and AddressHash) and encrypted value (i.e., NameCipherText and AddressCipherText) generated, while the non-confidential data attributes CityName, StateName, ZIPCode, and SpokenLanguage, have not.

FIG.5illustrates an exemplary subset of the resulting protected data set disclosed onFIG.4.

The “ID” provides a linkage of lines between the exemplary illustrations of the original data set disclosed inFIG.3, the protected result set ofFIG.4, and the extract from the protected result set disclosed inFIG.5

FIG.5provides an exemplary illustration of an answer to the question “how many languages each household can speak” according to one embodiment. The question “how many languages each household can speak” may translate into the statement select AddrHash, min(AddrCiperText), CityName, StateName, count(SpokenLanguages) as Languages group by select AddrHash, CityName, StateName.

For example, a question such as “What is the household in the state of New York with largest number of spoken languages?” can be answered by analyzing the resulting data set from the exemplary illustrations depicted inFIGS.4and5. In this example, the reference element of spoken language may be converted into measures, such as the number of spoken languages, and compared to each other.

From the exemplary illustration disclosed onFIG.5it can be observed that the household in NY state with the highest number of spoken languages belongs to the household with an authentication value (e.g., AddressHash) of 5a26801db6, and address encrypted value (e.g., AddressCipherText) of 043cea8761. By decrypting this value, it can be seen that the household's address is 396 Heights Dr, Red Hook, N.Y., 10307.

As can be seen fromFIG.4, one person lives in this household, since the authentication value for the name (e.g., NameHash) is the same (3fe888999f), and the address authentication value (e.g., AddressHash) for 5a26801db6 identifies the city Red Hook, N.Y.

There are three different encrypted name values for the authentication value for the name (e.g., NameHash): a6435c995a, 40011066d7, and 543d1c06d4. Decrypting any of the associated encryption values (e.g., NameCipher) results in the name of Helen Smith, who lives at 396 Heights Dr, Red Hook, N.Y., 10307 and speaks Italian, French, and Spanish. This information may be obtained from the protected set disclosed onFIG.4only, without necessity of consulting the original set disclosed onFIG.3.

It should be recognized that the embodiments disclosed herein are not exclusive to each other; features and elements from one embodiment may be used with others as is necessary and/or desired.

The processing machine used to implement the invention may utilize a suitable operating system. Thus, embodiments of the invention may include a processing machine running the iOS operating system, the OS X operating system, the Android operating system, the Microsoft Windows™ operating systems, the Unix operating system, the Linux operating system, the Xenix operating system, the IBM AIX™ operating system, the Hewlett-Packard UX™ operating system, the Novell Netware™ operating system, the Sun Microsystems Solaris™ operating system, the OS/2™ operating system, the BeOS™ operating system, the Macintosh operating system, the Apache operating system, an OpenStep™ operating system or another operating system or platform.