Anonymous encrypted data

Techniques facilitating autonomously rendering an encrypted data anonymous in a non-trusted environment are provided. In one example, a computer-implemented method can comprise generating, by a system operatively coupled to a processor, a plurality of clusters of encrypted data from an encrypted dataset using a machine learning algorithm. The computer-implemented method can also comprise modifying, by the system, the plurality of clusters based on a defined criterion that can facilitate anonymity of the encrypted data.

BACKGROUND

The subject disclosure relates to rendering encrypted data anonymous, and more specifically, to rendering encrypted data anonymous via a cloud environment.

SUMMARY

According to an embodiment, a computer-implemented method is provided. The computer-implemented method can comprise generating, by a system operatively coupled to a processor, a plurality of clusters of encrypted data from an encrypted dataset using a machine learning algorithm. The computer-implemented method can also comprise modifying, by the system, the plurality of clusters based on a defined criterion that can facilitate anonymity of the encrypted data.

According to another embodiment, a system is provided. The system can comprise a memory that can store computer executable components. The system can also comprise a processor, that can be operably coupled to the memory, and that can execute the computer executable components stored in the memory. The computer executable components can comprise a clustering component that can generate a plurality of clusters of encrypted data from an encrypted dataset using a machine learning algorithm. Further, the computer executable components can comprise a modification component that can modify the plurality of clusters based on a defined criterion that can facilitate anonymity of the encrypted data

According another embodiment, a computer program product is provided. The computer program product can render an encrypted dataset anonymous. The computer program product can comprise a computer readable storage medium having program instructions embodied therewith. The program instructions can be executable by a processor to cause the processor to generate a plurality of clusters of encrypted data from the encrypted dataset using a machine learning algorithm. Also, the program instructions can further cause the processor to modify the plurality of clusters based on a defined criterion that can facilitate anonymity of the encrypted data.

DETAILED DESCRIPTION

Characteristics are as follows:

Service Models are as follows:

Deployment Models are as follows:

Referring now toFIG. 2, a set of functional abstraction layers provided by cloud computing environment50(FIG. 1) is shown. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity. It should be understood in advance that the components, layers, and functions shown inFIG. 2are intended to be illustrative only and embodiments of the invention are not limited thereto. As depicted, the following layers and corresponding functions are provided. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity.

Workloads layer90provides examples of functionality for which the cloud computing environment may be utilized. Examples of workloads and functions which may be provided from this layer include: mapping and navigation91; software development and lifecycle management92; virtual classroom education delivery93; data analytics processing94; transaction processing95; and rendering data anonymous96. Various embodiments of the present invention can utilize the cloud computing environment described with reference toFIGS. 1 and 2to facilitate rendering encrypted data anonymous over non-trusted environments (e.g., public cloud environments).

Data protection algorithms are becoming increasingly important to support modern business' needs for facilitating data sharing and data monetization. Rendering data anonymous is an important step before sharing data, and cloud services are increasing in popularity as an efficient solution to storing and managing data. However, third parties are often not trusted to store plaintext individual and/or sensitive data. Thus, data encryption has been adopted to protect against intentional and unintentional attempts to read individual and/or sensitive data. Therefore, a need exists to render encrypted data anonymous in non-trusted environments without the need to store plaintext data.

Various embodiments of the present invention can be directed to computer processing systems, computer-implemented methods, apparatus and/or computer program products that facilitate the efficient, effective, and autonomous (e.g., without direct human guidance) to render encrypted data anonymous in an non-trusted environment. For example, one or more embodiments described herein can use clustering techniques to render encrypted data anonymous on a non-trusted environment. As used herein, the term “non-trusted environment” can refer to an environment maintained and operated by a third party that is not the owner of the data stored in the environment. An example non-trusted environment includes, but is not limited to, a public cloud service provider. Further, one or more embodiments described herein can cluster similar records of encrypted data and modify the clusters to meet one or more security requirements. Moreover, various embodiments described herein can suppress and/or re-assign clusters of encrypted data in order to generate clusters comprising a minimum amount of members in order to obtain a desired level of anonymity.

The computer processing systems, computer-implemented methods, apparatus and/or computer program products employ hardware and/or software to solve problems that are highly technical in nature (e.g., encrypting plaintext data, transferring the encrypted data to a non-trusted environment, and rendering the encrypted data anonymous in the non-trusted environment), that are not abstract and cannot be performed as a set of mental acts by a human. For example, a human, or a plurality of humans, cannot efficiently analyze encrypted data to generate a plurality of clusters in order to render the encrypted data anonymous. In contrast, various embodiments of the computer processing systems, computer-implemented methods, apparatus and/or computer program products employing hardware and/or software described herein can efficiently analyze enormous amounts of encrypted data and perform cluster-based anonymousness. Further, it is undesirable to even attempt such an endeavor using a human, or plurality of humans, as one of the advantageous of the embodiments described herein is that the processed data is anonymous. Attempts to use a human to execute the embodiments described herein would be contrary to the purpose of rendering data anonymous as it would result in at least one human having intricate knowledge of the data that is meant to be anonymous.

FIG. 3illustrates a block diagram of an example, non-limiting system300that can facilitate rendering encrypted data anonymous in a non-trusted environment. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity. Aspects of systems (e.g., system300and the like), apparatuses or processes in various embodiments of the present invention can constitute one or more machine-executable components embodied within one or more machines, e.g., embodied in one or more computer readable mediums (or media) associated with one or more machines. Such components, when executed by the one or more machines, e.g., computers, computing devices, virtual machines, etc. can cause the machines to perform the operations described.

As shown inFIG. 3, the system300can comprise one or more first servers302, one or more networks304, one or more second servers306, and one or more client devices308. The first server302can comprise processing component310. The processing component310can further comprise first reception component312, encryption component314, decryption component316, and a security component317. Also, the first server302can comprise or otherwise be associated with at least one first memory318. The first server302can further comprise a first system bus320that can couple to various components such as, but not limited to, the processing component310and associated components, first memory318and/or a first processor322. While a first server302is illustrated inFIG. 3, in other embodiments, multiple devices of various types can be associated with or comprise the features shown inFIG. 3. Further, the first server302can communicate with the cloud environment depicted inFIGS. 1 and 2via the one or more networks304. In various embodiments, the “first server” and/or “second server(s)” can be comprised of processors and/or one or more pieces of hardware and/or software in various embodiments.

The one or more networks304can comprise wired and wireless networks, including, but not limited to, a cellular network, a wide area network (WAN) (e.g., the Internet) or a local area network (LAN). For example, the first server302can communicate with the second server306(and vice versa) using virtually any desired wired or wireless technology including for example, but not limited to: cellular, WAN, wireless fidelity (Wi-Fi), Wi-Max, WLAN, Bluetooth technology, a combination thereof, and/or the like. Further, although in the embodiment shown the processing component310can be provided on the one or more first servers302, it should be appreciated that the architecture of system300is not so limited. For example, the processing component310, or one or more components of processing component310, can be located at another computer device, such as another server device, a client device, etc.

The second server306can comprise classification component324. The classification component324can further comprise second reception component326, clustering component328, and modifying component330. Also, the second server306can comprise or otherwise be associated with at least one second memory332. The second server306can further comprise a second system bus334that can couple to various components such as, but not limited to, the classification component324and associated components, second memory332and/or a second processor336. While a second server306is illustrated inFIG. 3, in other embodiments, multiple devices of various types can be associated with or comprise the features shown in FIG.3. Further, the second server306can communicate with the cloud environment depicted inFIGS. 1 and 2via the one or more networks304.

The one or more client devices308can be computers and/or computerized devices operated by entities that want to analyze, store, and/or otherwise use data owned by one or more entities that manage the first server302. The one or more client devices308can be operably coupled to the first server302and the second server306via the one or more networks304(e.g., via the Internet, a local network, and/or a direct electrical connection). Further, the one or more client devices308can be operably coupled to the first server302using a first means and to the second server306using a second means, wherein the first and second means can be available via the one or more networks304. For example, the one or more client devices308can be in direct electrical connection with the first server302while being operably coupled to the second server306via the Internet.

The first reception component312can be operably coupled to the encryption component314, the decryption component316, the first memory318, and/or the first processor322via the first system bus320. Further, in one or more embodiments the first reception component312can be operably coupled to the encryption component314, the decryption component316, the first memory318, and/or the first processor322via one or more networks304(e.g., a local area network). Similarly, the second reception component326can be operably coupled to the clustering component328, the modifying component330, the second memory332, and/or the second processor336via the second system bus334. Further, in one or more embodiments, the second reception component326can be operably coupled to the clustering component328, the modifying component330, the second memory332, and/or the second processor336via one or more networks304(e.g., a local area network).

The security component317can receive one or more security requirements from an operator of the first server302. Parameters stipulated by the one or more security requirements can include, but are not limited to: a desired number of anonymous clusters to be outputted by the second server306and/or a desired number of member per cluster (e.g., at least k members per cluster, wherein k is an integer greater than zero).

The clustering component328can cluster encrypted data using a machine learning algorithm. The machine learning algorithm can be a distance based algorithm such as a k-means clustering algorithm. The machine learning algorithm (e.g., k-means clustering algorithm) can partition the encrypted data into a plurality of clusters based on one or more parameters, such as a location identifier (e.g., global positioning coordinates). However, the number of members per cluster is data dependent and the machine learning algorithm does not support generating a minimum number of members per cluster. In other words, the clustering component328can use the machine learning algorithm generate a plurality of clusters with the members of each cluster being similar based on one or more parameters, but the number of members in each cluster may not be guaranteed.

In various embodiments, the modifying component330can modify the plurality of clusters based on a defined criterion (e.g., one or more of the security requirements) to facilitate rendering the encrypted data anonymous. In one or more embodiments, the modifying component330can modify the plurality of clusters in order to achieve k-anonymity, wherein k is the number of members comprising each cluster and is an integer greater than zero. For instance, the modifying component330can modify the plurality of clusters to achieve 2-anonymity wherein the one or more security requirements stipulate that each cluster comprises at least two members.

For example, the clustering component328can use the machine learning algorithm to generate clusters A, B, and C from ten records of encrypted data. In this example: cluster A can contain four members; cluster B can contain five members, and cluster C can contain one member. Further, the one or more security requirements can stipulate that each cluster is desired to have at least two members. The modifying component330can modify clusters A, B, and/or C such that the modified set of clusters each comprise at least two members in order to achieve two-anonymity.

In various embodiments, the modifying component330can modify the plurality of clusters by performing suppression operations and/or re-assignment operations. While performing suppression operations, the modifying component330can remove a defined amount of the encrypted data and/or clusters in order to eliminate outliers from the plurality of clusters. While performing re-assignment operations, the modifying component330can re-assign one or more encrypted data records and/or one or more clusters to another cluster.

In one or more embodiments, the modifying component330can suppress a defined amount of encrypted data based on a suppression threshold. The suppression threshold can be an input parameter that defines an amount of encrypted data (e.g., a percentage of records) that can be discarded. For each member of a cluster that fails to meet the one or more security requirements (e.g., fails to have a minimum number of members), the modifying component330can calculate the distance between the respective member and the centroid of the rest of the clusters and save only the minimum of these distances. Then the modifying component330can sort the saved minimum distances in descending order and identify the suppression threshold amount as far outliers. Thus, those members with the highest minimum distance from the rest of the clusters would be identified as far outliers. Further, the modifying component330can remove, and/or instruct the removal, of the far outliers. In one or more embodiments, the modifying component330can utilize suppression to discard one or more entire clusters. In one or more embodiments, the modifying component330can utilize suppression to generate a new set of encrypted data from which the clustering component328can generate a new plurality of clusters.

In one or more embodiments, the modifying component330can re-assign one or more encrypted data records from one cluster to another and/or merge existing clusters. For example, if a cluster fails to meet the security requirements (e.g., fails to have a minimum number of members), the modifying component330can re-assign the nearest members of clusters with excess members (e.g., clusters having more than the minimum number of members) to the non-compliant cluster. In another example, if a cluster fails to meet the security requirements (e.g., fails to have a minimum number of members), the modifying component330can re-assign the members of the non-compliant cluster to the nearest cluster with respect to the member. In another example, if a cluster fails to meet the security requirements (e.g., fails to have a minimum number of members), the modifying component330can merge the non-compliant cluster with the nearest cluster.

In various embodiments, when performing re-assignment operations, the modifying component330can sort clusters that fail to meet the security requirements (e.g., fail to have a minimum number of members) by size (e.g., from the cluster with the fewest members to the cluster with the most members). Starting with the smallest cluster (e.g., the non-compliant cluster with the fewest members), the modifying component330can re-assign each respective member of the smallest cluster to closest cluster. Once the members of the smallest cluster are re-assigned, the modifying component330can remove said cluster from the plurality of clusters and re-analyze the plurality of clusters for non-compliant clusters. Further, the modifying component330can repeat the re-assigning process until all the remaining clusters are compliant with the one or more security requirements.

FIG. 4illustrates a block diagram of an example, non-limiting processes that can be performed between the first server302and the second server306. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity. The first memory318can store one or more plaintext databases402that can comprise one or more records of data without encryption. The first memory318can be operably coupled to the processing component310via the first system bus320. The encryption component314can retrieve one or more plaintext databases402(e.g., from the first memory318) and subject the plaintext database402to one or more encryption schemes404to generate one or more encrypted datasets406. An encryption scheme404can encrypt a plaintext database402using an encryption algorithm and/or an encryption key. Example encryption schemes404can include, but are not limited to: advanced encryption standard (AES); the cryptosystem of Boneh, Goh, and Nissim (BGN); triple data encryption standard (triple DES); Rivest, Shamir, and Adelman (RSA) encryption algorithm; blowfish encryption; and/or twofish encryption. In one or more embodiments, the encryption component314can subject a plaintext database402to a plurality of different encryption schemes404to generate a plurality of encrypted datasets406based on the same plaintext database402. For example, the encryption component314can subject a plaintext database402to AES encryption and BGN encryption to create two encrypted datasets406.

The first server302(e.g., via the encryption component314) can transmit one or more encrypted datasets406to the second server306via one or more networks304. Further the first server302(e.g., via the security component317) can transmit one or more security requirements to the second server306. The security requirements can comprise one or more parameters that the second server306must meet when rendering the one or more encrypted databases anonymous. An example security requirement can include, but is not limited to, a number indicating the minimum amount of members allowed in one or more generated clusters.

The second server306can be a non-trusted environment. Further, the second server306can comprise a federated cloud environment. For example, as illustrated inFIG. 4, the second server306can comprise a first cloud408and a second cloud410. In various embodiments, the second server306can comprise more than two clouds (e.g., 3, 4, 5, or more clouds). The second reception component326can be located on the first cloud408and can receive the one or more encrypted datasets406and the one or more security requirements.

The clustering component328can be located on the first cloud408or the second cloud410. Also the modifying component316can be located on the first cloud408or the second cloud410. The first cloud408and the second cloud410can be operably coupled via one or more networks304to facilitate clustering communication412. Clustering communications412between the first cloud408and the second cloud410can facilitate rendering the encrypted datasets406anonymous. In various embodiments, the second server306(e.g., a non-trusted federated cloud environment) can produce an anonymous encrypted dataset414from the encrypted dataset406in accordance with one or more security requirements. Thus, the second server306can retain the practical usefulness of the encrypted dataset406(e.g., any insights drawn from the encrypted anonymous data can be similar to the insights from non-anonymous encrypted data) while providing a guarantee that entities subject to the data cannot be identified.

The second server306can transmit one or more anonymous encrypted datasets414to the first server302via the one or more networks304. The first reception component312can receive the anonymous encrypted data and send the anonymous encrypted data to the decryption component316. The decryption component316can decrypt the anonymous encrypted dataset414using a decryption scheme416to produce an anonymous plaintext database418.

FIG. 5illustrates a block diagram of a non-limiting example of the communications and processes that can be performed by the system300. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity. At502, the first server302can transmit one or more encrypted datasets406and/or one or more security requirements to the first cloud408of the second server306. For example, the first server302can send an AES encrypted dataset406and a BGN encrypted dataset406to the first cloud408. Also, the AES encrypted dataset406and the BGN encrypted dataset406can be based on the same plaintext database402. In various embodiments, the one or more security requirements sent to the first cloud408by the first server302(e.g., via security component317) can comprise a defined criterion that facilitates anonymity of the one or more encrypted datasets406, such as a minimum number of members per cluster generated by the clustering component328and modified by the modifying component316. The second memory332can be located in the first cloud408and store the one or more encrypted datasets406and the one or more security requirements.

At504, the first server302can transmit, via the one or more networks304, a secret encryption key regarding one or more of the encrypted datasets406to the second cloud410of the second server306. For example, the first server302can transmit an AES encrypted dataset406and a BGN encrypted dataset406to the first cloud408and also transmit a BGN secret key to the second cloud410regarding the BGN encrypted dataset406.

At506, the first cloud408(e.g., via the clustering component328) can randomly select a number of encrypted data records from an encrypted dataset406to act as the initial centers of the plurality of clusters. The number of initial centers can be designated by the one or more security requirements. In various embodiments, one or more encrypted data records can be selected as initial centers of the plurality of clusters based on parameters of the encrypted data record. For example, one or more encrypted data records can be selected based on one or more location identifiers associated with the encrypted data records, wherein the location identifiers can designate one or more geographical coordinates regarding the source of the subject encrypted data record.

At510, the first cloud408(e.g., via the clustering component328) can send the second cloud410(e.g., the modifying component330) encrypted cluster sums and number. In various embodiments, the first cloud408(e.g., the clustering component328) can generate clusters based on location identifiers associated with encrypted data records in the one or more encrypted datasets406. For example, the clustering component328can determine a distance between each encrypted data record and the randomly selected initial cluster centers. The first cloud408can send to the second cloud410: the total number of encrypted data records in a subject encrypted data set406, the determined distances (e.g., determined by the clustering component328), the number of desired clusters (e.g., designated by the one or more security requirements), the initial cluster centers (e.g., selected by the clustering component328), and/or the number of desired cluster members (e.g., designated by the one or more security requirements).

At512, the second cloud410(e.g., via the modifying component330can compute a new means for clustering the encrypted data records of the subject encrypted dataset406based on the inputs received from the first cloud408. In one or more embodiments, the second cloud410(e.g., via the modifying component330) can determine a new means for clustering by dividing cluster sums by their respective cluster number.

At514, the second cloud410(e.g., via the modifying component330) can return the new computed clustering means to the clustering component328of the first cloud408, whereupon the clustering component328can adjust the generated one or more clusters based on the new clustering means. The communication between the first cloud408and the second cloud410(e.g., at508,510, and514) can comprise the clustering communication412. In various embodiments, the second server306can repeat the clustering communication412multiple times in order to generate a desired convergence based on at least the one or more security requirements. Thus, the first cloud408can utilize the second cloud410to partition the encrypted data records of one or more encrypted datasets406while revealing a minimum amount of information regarding the encrypted dataset406, such as the similarity of one or more encrypted data records to an initial cluster center based on a desired parameter.

FIG. 6illustrates a block diagram of another non-limiting example of the communications and processes that can be performed by the system300with regard to a client device's308query. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity. At602, the first server302can transmit (e.g., via the encryption component314and one or more networks304) a public encryption key regarding one or more of the encrypted datasets406to one or more of the client devices308. For example, the first server302can transmit an AES encrypted dataset406and a BGN encrypted dataset406to the first cloud408and also transmit a BGN public key to one or more client devices308regarding the BGN encrypted dataset406. At604, one or more of the client devices308can send an encrypted query to the first cloud408(e.g., via one or more networks304) using the public encryption key.

At606, the first cloud408(e.g., via the clustering component328) can calculate the distance (e.g., squared Euclidean distance) between one or more encrypted data records and the encrypted query. At608, the first cloud408(e.g., via the clustering component328) can send the encrypted distances along with one or more identifiers (e.g., anonymous identifiers) to the second cloud410. The identifiers can regard respective encrypted data records associated with the distances. For example, the identifiers can include, but are not limited to, row identifiers (e.g., anonymous row identifiers) that indicate an encrypted data record's location in an encrypted dataset406.

In various embodiments, wherein the first cloud408receives multiple encrypted datasets406regarding the same plaintext database402, the first cloud408only sends the encrypted distances of one of the encrypted datasets406, preferably the encrypted dataset406having an encryption scheme relating to the secret encryption key sent to the second cloud410at504. For example, wherein the first cloud408receives an AES encrypted dataset406and a BGN encrypted dataset406, and the second cloud410receives a BGN encrypted secret key, the first cloud408can send to the second cloud410only BGN encrypted distances. Thus, the second cloud410can utilize the encrypted secret key to decrypt the computed encrypted distances.

At610, the second cloud410(e.g., via modifying component330) can decrypt the one or more distances (e.g. squared Euclidean distances) and find the identifiers associated with distances of at least a predetermined value. For example, the second cloud410(e.g., via modifying component330) can identify the distances having the smallest computed distance from the encrypted query. Further, the second cloud410(e.g., via modifying component330) can identify a minimum number of distances identified based on one or more security requirements.

In one or more embodiments, the second cloud410(e.g., via the modifying component330) can select identifiers based on a plurality of security requirements. For example, the plurality of security requirements can stipulate a minimum number of clusters to partition one or more encrypted datasets406into and a minimum number of members per cluster.

At612, the second cloud410(e.g., via the modifying component330) can send the selected identifiers to the first cloud408. Based on the selected identifiers, the first cloud408(e.g., via the clustering component328) can identify one or more encrypted data records from one or more of the encrypted datasets406. Further, the first cloud408(e.g., via the clustering component328) can generate a cluster representative for each cluster associated with the one or more identifiers to generate an anonymous encrypted dataset414. Thus, the first cloud408can cluster the encrypted data without decrypting the encrypted datasets406, and the second cloud can modify the plurality of clusters without knowledge of the encrypted dataset406except the computed distances.

At614, the first cloud408(e.g., via the clustering component328) can send the anonymous encrypted dataset414to the first server302. The first server302can receive the anonymous encrypted dataset414(e.g., via first reception component312) and decrypt the anonymous encrypted dataset414using a decryption scheme416(e.g., via the decryption component316) to generate an anonymous plaintext database418. At616, the first server302can send the anonymous plaintext database418to the one or more client devices308that sent the encrypted query at604.

FIGS. 7A, 7B, 7C, and 7Dillustrate various diagrams of cluster modifications that can be performed by the system300. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity.FIG. 7Aillustrates a diagram700in which fifteen encrypted data records can be represented as circles, wherein the encrypted data records can be partitioned into three clusters: a first cluster702designated by dotted circles, a second cluster704designated by diagonally striped circles, and a third cluster706designated by empty circles. The diagram700illustrates three example clusters that can be generated by the clustering component328without modification.

FIG. 7Billustrates another diagram708of the same fifteen encrypted data records; however the first cluster702and the third cluster706have been modified (e.g., via the modifying component330) based on one or more security requirements. With regards to the modification illustrated by diagram708, the security requirement can stipulate that each cluster have at least three members. As shown inFIG. 7A, the third cluster706comprised only two members, which is less than the three member security requirement. In order to meet the security requirement, the modifying component330can modify the first cluster702and the third cluster706such that the two encrypted data records previously included in the third cluster706are re-assigned to the first cluster702. Thus, the modifying component330can re-assign one or more encrypted data records and/or one or more entire clusters to a different cluster based on one or more security requirements.

FIG. 7Cillustrates another diagram710of sixteen encrypted data records partitioned into the first cluster702, the second cluster704, the third cluster706, and a fourth cluster712designated by horizontally striped circles. The diagram710illustrates four example clusters that can be generated by the clustering component328without modification.

FIG. 7Dillustrates another diagram714of the same sixteen encrypted data records; however, the third cluster706and the fourth cluster712have been modified (e.g., via the modifying component330) based on one or more security requirements. With regards to the modification illustrated by diagram714, the security requirement can stipulate that each cluster have at least three members. As shown inFIG. 7C, the third cluster706(with two members) and the fourth cluster712(with one member) each have less than the three members stipulated by the security requirement. The modifying component330can order the clusters based on the number of members in each cluster and modify the clusters in order starting with the cluster with the fewest number of members (e.g., the fourth cluster712). As shown inFIG. 7D, the modifying component330can re-assign the encrypted data records of one cluster (e.g., the fourth cluster712) to another cluster (e.g., the third cluster706) in order to meet the one or more security requirements (e.g., a minimum number of at least three members). Thus, in instances wherein the clustering component328generates a plurality of clusters that fail to meet the one or more security requirements, the modifying component330can merge multiple non-compliant clusters together in order to form a cluster that does meet the one or more security requirements.

FIG. 8illustrates a flow chart of a computer-implemented method800that can facilitate rendering encrypted data anonymous in a non-trusted environment. At802, the method800can comprise generating, by a system300operatively coupled to a processor (e.g., first processor322), a plurality of clusters (e.g. via clustering component328) of encrypted data from an encrypted dataset406using a machine learning algorithm. At the804, the method800can also comprise modifying, by the system300, the plurality of clusters (e.g., via the modifying component330) based on a defined criterion that can facilitate anonymity of the encrypted data.

FIG. 9illustrates a flow chart of a computer-implemented method900that can facilitate rendering encrypted data anonymous in a non-trusted environment. At902, the method900can comprise generating, by a system300operatively coupled to a processor (e.g., first processor322), a plurality of clusters (e.g. via clustering component328) of encrypted data from an encrypted dataset406using a machine learning algorithm, wherein the machine learning algorithm can be a distance based algorithm. Also, generating the plurality of clusters can be based on one or more location identifiers associated with the encrypted data.

At the904, the method900can also comprise modifying, by the system300, the plurality of clusters (e.g., via the modifying component330) based on a defined criterion that can facilitate anonymity of the encrypted data. For example, the defined criterion can set a minimum number of members per cluster from the plurality of clusters. At906, the method900can further comprise generating a cluster representative for each cluster of the plurality of clusters (e.g., via the clustering component328). The cluster representative can be generated before or after modification of the plurality of clusters.

In various embodiments, modifying the plurality of clusters can comprise suppressing a cluster from the plurality of clusters based on a suppression threshold that can designate an amount of encrypted data from the encrypted dataset406to be removed. Also, suppressing the cluster can comprise: identifying, by the system300, encrypted data within the cluster to be removed based on a location identifier associated with the encrypted data (e.g., via the modifying component330); removing, by the system300, the identified encrypted data from the encrypted dataset406to generate a second encrypted dataset (e.g., via the modifying component330); and generating, by the system300, a second plurality of clusters of encrypted data from the second encrypted dataset using the machine learning algorithm (e.g., via the clustering component328).

In one or more embodiments, modifying the plurality of clusters can comprise re-assigning the encrypted data from one cluster (e.g., third cluster706) from the plurality of clusters to another cluster (e.g., first cluster702) from the plurality of clusters based on a parameter (e.g., a location identifier). In various embodiments, the modifying component330can perform both suppressing operations and re-assigning operations to the encrypted data. In one or more embodiments, the modifying component330can only perform suppressing operations to the encrypted data. In one or more embodiments, the modifying component330can only perform re-assigning operations to the encrypted data.

In order to provide a context for the various aspects of the disclosed subject matter,FIG. 10as well as the following discussion are intended to provide a general description of a suitable environment in which the various aspects of the disclosed subject matter can be implemented.FIG. 10illustrates a block diagram of an example, non-limiting operating environment in which one or more embodiments described herein can be facilitated. Repetitive description of like elements employed in other embodiments described herein is omitted for sake of brevity. With reference toFIG. 10, a suitable operating environment1000for implementing various aspects of this disclosure can include a computer1012. The computer1012can also include a processing unit1014, a system memory1016, and a system bus1018. The system bus1018can operably couple system components including, but not limited to, the system memory1016to the processing unit1014. The processing unit1014can be any of various available processors. Dual microprocessors and other multiprocessor architectures also can be employed as the processing unit1014. The system bus1018can be any of several types of bus structures including the memory bus or memory controller, a peripheral bus or external bus, and/or a local bus using any variety of available bus architectures including, but not limited to, Industrial Standard Architecture (ISA), Micro-Channel Architecture (MSA), Extended ISA (EISA), Intelligent Drive Electronics (IDE), VESA Local Bus (VLB), Peripheral Component Interconnect (PCI), Card Bus, Universal Serial Bus (USB), Advanced Graphics Port (AGP), Firewire, and Small Computer Systems Interface (SCSI). The system memory1016can also include volatile memory1020and nonvolatile memory1022. The basic input/output system (BIOS), containing the basic routines to transfer information between elements within the computer1012, such as during start-up, can be stored in nonvolatile memory1022. By way of illustration, and not limitation, nonvolatile memory1022can include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), flash memory, or nonvolatile random access memory (RAM) (e.g., ferroelectric RAM (FeRAM). Volatile memory1020can also include random access memory (RAM), which acts as external cache memory. By way of illustration and not limitation, RAM is available in many forms such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), enhanced SDRAM (ESDRAM), Synchlink DRAM (SLDRAM), direct Rambus RAM (DRRAM), direct Rambus dynamic RAM (DRDRAM), and Rambus dynamic RAM.

Computer1012can also include removable/non-removable, volatile/non-volatile computer storage media.FIG. 10illustrates, for example, a disk storage1024. Disk storage1024can also include, but is not limited to, devices like a magnetic disk drive, floppy disk drive, tape drive, Jaz drive, Zip drive, LS-100 drive, flash memory card, or memory stick. The disk storage1024also can include storage media separately or in combination with other storage media including, but not limited to, an optical disk drive such as a compact disk ROM device (CD-ROM), CD recordable drive (CD-R Drive), CD rewritable drive (CD-RW Drive) or a digital versatile disk ROM drive (DVD-ROM). To facilitate connection of the disk storage1024to the system bus1018, a removable or non-removable interface can be used, such as interface1026.FIG. 10also depicts software that can act as an intermediary between users and the basic computer resources described in the suitable operating environment1000. Such software can also include, for example, an operating system1028. Operating system1028, which can be stored on disk storage1024, acts to control and allocate resources of the computer1012. System applications1030can take advantage of the management of resources by operating system1028through program modules1032and program data1034, e.g., stored either in system memory1016or on disk storage1024. It is to be appreciated that this disclosure can be implemented with various operating systems or combinations of operating systems. A user enters commands or information into the computer1012through one or more input devices1036. Input devices1036can include, but are not limited to, a pointing device such as a mouse, trackball, stylus, touch pad, keyboard, microphone, joystick, game pad, satellite dish, scanner, TV tuner card, digital camera, digital video camera, web camera, and the like. These and other input devices can connect to the processing unit1014through the system bus1018via one or more interface ports1038. The one or more Interface ports1038can include, for example, a serial port, a parallel port, a game port, and a universal serial bus (USB). One or more output devices1040can use some of the same type of ports as input device1036. Thus, for example, a USB port can be used to provide input to computer1012, and to output information from computer1012to an output device1040. Output adapter1042can be provided to illustrate that there are some output devices1040like monitors, speakers, and printers, among other output devices1040, which require special adapters. The output adapters1042can include, by way of illustration and not limitation, video and sound cards that provide a means of connection between the output device1040and the system bus1018. It should be noted that other devices and/or systems of devices provide both input and output capabilities such as one or more remote computers1044.

Computer1012can operate in a networked environment using logical connections to one or more remote computers, such as remote computer1044. The remote computer1044can be a computer, a server, a router, a network PC, a workstation, a microprocessor based appliance, a peer device or other common network node and the like, and typically can also include many or all of the elements described relative to computer1012. For purposes of brevity, only a memory storage device1046is illustrated with remote computer1044. Remote computer1044can be logically connected to computer1012through a network interface1048and then physically connected via communication connection1050. Further, operation can be distributed across multiple (local and remote) systems. Network interface1048can encompass wire and/or wireless communication networks such as local-area networks (LAN), wide-area networks (WAN), cellular networks, etc. LAN technologies include Fiber Distributed Data Interface (FDDI), Copper Distributed Data Interface (CDDI), Ethernet, Token Ring and the like. WAN technologies include, but are not limited to, point-to-point links, circuit switching networks like Integrated Services Digital Networks (ISDN) and variations thereon, packet switching networks, and Digital Subscriber Lines (DSL). One or more communication connections1050refers to the hardware/software employed to connect the network interface1048to the system bus1018. While communication connection1050is shown for illustrative clarity inside computer1012, it can also be external to computer1012. The hardware/software for connection to the network interface1048can also include, for exemplary purposes only, internal and external technologies such as, modems including regular telephone grade modems, cable modems and DSL modems, ISDN adapters, and Ethernet cards.