APPARATUS AND METHOD FOR PRIVACY PRESERVATION, DEVICE, COMPUTING SYSTEM AND METHOD FOR A COMPUTING SYSTEM

An apparatus including interface circuitry configured to read, from a sensor, event data indicating an event detected by the sensor and identification data indicating a first identifier (ID) of a user involved in the event. The first interface circuitry is further configured to generate a data stream comprising at least the event data and the identification data. Additionally, the apparatus includes processing circuitry configured to generate an updated data stream based on the data stream by updating the first ID to a second ID using a deterministic update function, and by adding noise to at least the event data. The processing circuitry is further configured to determine whether sufficient privacy budget is left for the updated data stream, and, if so, generate encrypted data by encrypting the updated data stream. The apparatus includes second interface circuitry configured to output the encrypted data for transmission to an external data aggregator.

FIELD

The present disclosure relates to privacy preserving collection of data. In particular, examples relate to an apparatus and a method for privacy preservation, a device comprising the apparatus, a computing system and a method for a computing system.

BACKGROUND

Many distributed systems provide a shared software environment for user applications on a peripheral device. For example, applications can run in separated environments (sandboxes) on a smartphone. This trend will likely extend to future Internet of Things (IoT) devices.

A provider may deploy many connected IoT devices in the field. An individual may cause data traces across multiple IoT devices. When collecting the data, the privacy of a data subject (e.g. in the case of untrusted applications) across multiple sensing devices should be protected. Further, the cost of securing data for trusted applications should be reduced.

Hence, there may be a demand for a privacy preserving data collection.

SUMMARY

This demand is met by apparatuses and methods in accordance with the independent claims. Advantageous embodiments are addressed by the dependent claims.

According to a first aspect, the present disclosure provides an apparatus for privacy preservation. The apparatus comprises first interface circuitry configured to read, from a sensor, event data indicating an event detected by the sensor and identification data indicating a first identifier (ID). The first ID identifies a user involved in the event. The first interface is further configured to generate a data stream comprising at least the event data and the identification data. Additionally, the apparatus comprises processing circuitry configured to generate an updated data stream based on the data stream by updating the first ID to a second ID in the identification data using a deterministic update function, and by adding noise to at least the event data. The processing circuitry is further configured to determine whether sufficient privacy budget is left for the updated data stream. If it is determined that sufficient privacy budget is left for the updated data stream, the processing circuitry is configured to generate encrypted data by encrypting the updated data stream. The apparatus comprises second interface circuitry configured to output the encrypted data for transmission to an external data aggregator.

According to a second aspect, the present disclosure provides a device comprising an apparatus for privacy preservation according to the present disclosure. Further, the device comprises a sensor configured to generate the event data and the identification data upon detection of the event. The device additionally comprises a transmitter coupled to the second interface circuitry and configured to transmit the encrypted data to the data aggregator via a communication network.

According to a third aspect, the present disclosure provides a computing system comprising first interface circuitry, second interface circuitry, third interface circuitry and processing circuitry. The processing circuitry is configured to control the computing system to act as data aggregator for a plurality of devices by: controlling the first interface circuitry to receive a plurality of pieces of encrypted data from the plurality of devices, wherein each piece of encrypted data comprises at least event data indicating an event detected by a sensor of the respective device and identification data indicating an Identifier, ID, for a user involved in the event; controlling the second interface circuitry to receive, from an external orchestrator orchestrating the data aggregator and the plurality of devices, cryptographic data; decrypting the plurality of pieces of encrypted data using the cryptographic data in order to generate a plurality of pieces of decrypted data; storing the plurality of pieces of decrypted data in a data storage; grouping pieces of decrypted data in the data storage comprising identification data that indicate the same ID in order to generate a respective group for each ID; determining whether sufficient privacy budget is left for the ID of the respective group; and controlling the third interface circuitry to output the event data of the respective group if it is determined that sufficient privacy budget is left for the ID of the respective group.

According to a fourth aspect, the present disclosure provides a method for privacy preservation. The method comprises reading, from a sensor, event data indicating an event detected by the sensor and identification data indicating a first ID. The first ID identifies a user involved in the event. Further, the method comprises generating a data stream comprising at least the event data and the identification data. The method additionally comprises generating an updated data stream based on the data stream by updating the first ID to a second ID in the identification data using a deterministic update function, and by adding noise to at least the event data. Further, the method comprises determining whether sufficient privacy budget is left for the updated data stream. If it is determined that sufficient privacy budget is left for the updated data stream, the method comprises generating encrypted data by encrypting the updated data stream. In addition, the method comprises outputting the encrypted data for transmission to an external data aggregator.

DETAILED DESCRIPTION

FIG.1illustrates an example of an apparatus100for privacy preservation.

The apparatus100comprises first interface circuitry110configured to read event data and identification data from a sensor150. The sensor150is configured to generate the event data and the identification data upon detection of an event. The event data indicate (represent) the event detected by the sensor150. The identification data indicate (represent) a first ID identifying a user involved in the event. The sensor150may be any type of sensor and be configured to sense any type of event. The data recorded by the sensor150may be of low dimension. For example, the sensor150may report summarized, event-like information. The first interface circuitry110and the sensor150may be coupled via a wired and/or wireless coupling. The first interface110is further configured to generate a data stream111comprising at least the event data and the identification data.

The apparatus100additionally comprise processing circuitry120. For example, the processing circuitry120may be a single dedicated processor, a single shared processor, or a plurality of individual processors, some of which or all of which may be shared, a digital signal processor (DSP) hardware, an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA). The processing circuitry120may optionally be coupled to, e.g., read only memory (ROM) for storing software, random access memory (RAM) and/or non-volatile memory. The processing circuitry120is coupled to the first interface circuitry110.

The processing circuitry120is configured to generate an updated data stream113based on the data stream111by a) updating the first ID to a second ID (Intermediate ID, IID) in the identification data using a deterministic update function and b) by adding noise to at least the event data. The deterministic update function is a function which, given a particular input, will always produce the same output. For example, the deterministic update function may be a hashing function or an encryption function. The update of the ID may allow to protect the first ID sent by the sensor, even in the case the raw ID dictionary of the sensor150is not secured. The hashing or encryption is secret to avoid brute force inversion.

In the example ofFIG.1, the modification of the data stream111is done in two consecutive steps. First, the processing circuitry120updates the first ID to the second ID in the identification data using the deterministic update function in order to generate an intermediate data stream112comprising at least the event data and the updated identification data. Second, the processing circuitry120adds noise to the event data of the intermediate data stream112in order to generate the updated data stream113. It is to be noted that the present disclosure is not limited to this order. In alternative examples, the processing circuitry120may first add noise to the event data and then update the first ID to the second ID. In still other examples, the processing circuitry120may add noise to the event data and update the first ID to the second ID in parallel (i.e. in one step).

The processing circuitry120is further configured to determine whether sufficient privacy (loss) budget is left for the updated data stream113. The privacy (loss) budget is a quantity defining how much privacy may be lost (leaked) by publishing (outputting) the data in the updated data stream113and originates from the concept of Differential Privacy (DP). In other words, the processing circuitry120determines whether it is still tolerable (acceptable) to publish (output) the updated data stream113given the limited amount of privacy that may be lost.

If it is determined by the processing circuitry120that sufficient privacy budget is left for the updated data stream113, the processing circuitry120is further configured to generate encrypted data (e.g. an encrypted data stream)114by encrypting the updated data stream113.

The apparatus100comprises second interface circuitry130configured to output the encrypted data114for transmission to an external data aggregator. The external data aggregator is a computing system compiling data (i.e. information) from various entities such as the apparatus100with the intent to prepare combined data sets for data processing and/or analysis. The second interface circuitry130may further run (execute) one or more applications for providing the herein described functionality and may be understood as a Data Access Application Programming Interface (API).

The apparatus100may allow to randomize the event data by adding the noise. Further, the first (original) ID of the user may be protected due to the update of the identification data using the deterministic update function. The randomization of the event data, the update of the ID and the privacy budget check may allow to preserve the privacy of the user. In addition, the encryption of the updated data stream may allow to prevent, e.g., revealing the first (original) ID by brute force inversion.

The processing circuitry120may run (execute) one or more applications as indicated inFIG.1for providing the herein described functionalities.

The apparatus100may, e.g., be provided as a chipset for a device such as a mobile device (e.g. mobile phone or tablet-computer) or an IoT device. The apparatus100may enable Local Differential Privacy (LDP). According to examples, the apparatus100may be an LDP chipset. The proposed apparatus100(e.g. implemented as a chipset) may allow to secure the privacy of identified subjects at the source, while still allowing statistical analysis where identification is necessary. The apparatus100may allow to scramble events using LDP.

For example, a device according to present disclosure may at least comprise the apparatus100, the sensor150and a transmitter (not illustrated inFIG.1) coupled to the second interface circuitry130. The transmitter may be configured to transmit the encrypted data to the data aggregator via one or more communication networks such as a Local Area Network (LAN), a Wireless LAN (WLAN), a Metropolitan Area Network (MAN), a Wide Area Network (WAN), a Global Area Network (GAN) or the Internet. The device and the first data aggregator may exchange data with each other by wired and/or wireless communication.

The processing circuitry120may optionally be further configured to add cryptographic nonce to the updated data stream113prior to encrypting the updated data stream113. In particular, the processing circuitry120may add cryptographic nonce to one or more data elements of the updated data stream113. For example, the processing circuitry120may add cryptographic nonce to the identification data of the updated data stream113. Additionally or optionally, the processing circuitry120may add a nonce-header to the updated data stream113. Adding cryptographic nonce may allow improved protection for the ID of the user. At the same time, adding cryptographic nonce may allow to recover any second ID generated by the apparatus100by the data aggregator.

If it is determined that no sufficient (i.e. only insufficient) privacy budget is left for the second ID, the processing circuitry120is configured to block transmission of data of the updated data stream113to the data aggregator. Accordingly, further transmission of data of the updated data stream113to the data aggregator may be interrupted at least temporarily once the privacy budget is exceeded. Similarly, the privacy of the user may be preserved by increasing the amount of noise added to at least the event data of the data stream111or by reducing the amount of data output by the apparatus100for transmission to the external data aggregator. For example, the amount of added noise may be increased if it is determined that the left privacy budget for the updated data stream113is below a predefined threshold.

For managing (adjusting) the operation (behavior) of the apparatus100, the apparatus100further comprises third interface circuitry140. The third interface circuitry140is accessible exclusively by an external orchestrator199orchestrating the apparatus100and the data aggregator. The orchestrator is a device or system that performs and supports automated configuration, coordination, and management of the system formed by the apparatus100, the data aggregator and optionally further devices. The third interface circuitry140may run (execute) one or more applications for providing the herein described functionality and may be understood as a Management API. As the third interface circuitry140is accessible exclusively by the external orchestrator199, only a trusted party can use it. For example, the third interface circuitry140is isolated from an Operating System (OS) of a device comprising the apparatus100, which is in principle not trusted. Securing the third interface circuitry140may be done according to known techniques and is, hence, not described in detail in the present disclosure.

The third interface circuitry140is configured to receive configuration data from the orchestrator199. Accordingly, the processing circuitry120is configured to adjust its operation based on the configuration data. In other words, the operational behavior of the processing circuitry120is adjustable by means of the configuration data. The configuration data may be manifold. In the following, some specific examples will be described. However, it is to be noted that the present disclosure is not limited to these specific examples.

For example, the configuration data may comprise noise level data indicating a target noise level. Accordingly, the processing circuitry120may be configured to add noise to at least the event data in the data stream111according to the target noise level. Similarly, the configuration data may comprise privacy budget data indicating the privacy budget. In other words, the configuration data may indicate the LDP policy by any data, setting, function etc. that define the noise level and the privacy budget management. The configuration data may further indicate other privacy policy information like a rate of replenishment of the privacy budget.

Additionally or alternatively, the configuration data may comprise cryptographic data (material) indicating (representing, including) an encryption key for the apparatus100. Accordingly, the orchestrator may assign a specific (predefined) encryption key to the apparatus100(an exemplary assignment is described below with reference toFIG.3). The processing circuitry120may be configured to encrypt the updated data stream113using the provided encryption key.

In other words, the configuration data may indicate the settings for the encryption and anonymization functions of the apparatus100.

The privacy preserving data collection by the apparatus100may be triggered by a query of the data aggregator. For example, the second interface circuitry130may be further configured to receive first query data from the data aggregator. The first query data indicate (represent) a query of the data aggregator for data of the sensor150. Accordingly, the processing circuitry120may be configured to control the first interface circuitry110to read the event data and the identification data in response to receiving the query data. The query data may indicate (represent) various pieces of information related to the query of the data aggregator. For example, the query data may indicate (represent) an ID of the requestor, i.e. the data aggregator requesting the data of the sensor150. The query data may alternatively be empty, for example in case the privacy budget management is not dependent on the requestor. In other words, the processing circuitry120may determine whether sufficient privacy budget is left for the updated data stream113based on the ID of the requestor of the data of the sensor150.

The first interface circuitry110may be configured to generate the data stream111to comprise second query data indicating one or more parameters of the query of the data aggregator. The second query data are derived from the first query data. In other words, the first interface circuitry110may include at least some of the parameters included in the first query data into the data stream111as second query data. For example, the second query data may indicate (represent) a requestor ID of the data aggregator requesting the data of the sensor150. Accordingly, the processing circuitry120may read the requestor ID from the data stream111for determining whether sufficient privacy budget is left for the updated data stream113.

It is to be noted that the apparatus100may read more than one sensor. In particular, the apparatus100may be queried by the data aggregator to read more than one sensor. For example, the first query data may indicate (represent) a query of the data aggregator for data of the sensor150and another sensor (not illustrated inFIG.1). Accordingly, the first interface circuitry110may optionally be configured to additionally read further event data from the other sensor. The further event data indicate an event detected by the other sensor. The event detected by the other sensor may be the same as the event detected by the sensor150or be different from the event detected by the sensor150. Similar to what is described above, the first interface circuitry110may further be configured to read further identification data indicating a third ID identifying a user involved in the event detected by the other sensor. The user involved in the event detected by the other sensor may be the same user as the user involved in the event detected by the sensor150or be different from the user involved in the event detected by the sensor150. Accordingly, the third ID may be identical to or be different from the first ID. The first interface circuitry110may generate the first data stream to additionally comprise the further event data and the further identification data read from the other sensor. The processing circuitry120may perform data processing on the further event data and the further identification data analogously to what is described above for the event data and the identification data read from the sensor150.

Similarly, the apparatus100may handle multiple data streams in parallel. For example, the second interface may be further configured to receive third query data from another data aggregator. The third query data indicate (represent) a query of the other data aggregator for data of the sensor150and/or another sensor. Accordingly, the processing circuitry120may be configured to control the first interface circuitry110to read the event data and the identification data from the sensor150and/or the further event data and the further identification data from the other sensor in response to receiving the third query data. Similarly to what is described above, the first interface circuitry110may be configured to generate another data stream comprising at least the event data and the identification data read from the sensor150and/or the further event data and the further identification read from the other sensor.

The processing circuitry120may process the other data stream analogously to what is described above. For example, the processing circuitry120may be configured to generate another updated data stream based on the other data stream by updating the first ID to the second ID in the identification data of the other data stream using the deterministic update function, and by adding noise to at least the event data in the other data stream (similarly the third ID may be updated to a fourth ID in case the other data stream comprises the further identification data read from the other sensor, noise may be added to the further event data in case the other data stream comprises the further event data read from the other sensor). Further, the processing circuitry120may be configured to determine whether sufficient privacy budget is left for the other updated data stream. If it is determined that sufficient privacy budget is left for the other updated data stream, the processing circuitry120may be configured to generate other encrypted data by encrypting the other updated data stream. The second interface circuitry130may be configured to output the other encrypted data for transmission to the other data aggregator.

The handling (i.e. updating the ID and adding noise) of the data stream111and the other data stream by the apparatus100may be done in parallel and independent from each other. Also the privacy budgets used for handling the updated data stream113and the other updated data stream may be different from each other. In other words, the privacy budget for the other updated data stream may be different from the privacy budget for the updated data stream. In alternative examples, the same privacy budget may be used.

FIG.2illustrates a system using the apparatus100for collecting data traces of a user in a privacy preserving manner. The arrow to bottom in the left part ofFIG.2illustrates a user201's movement over time. The user201being a data subject may be sensed by multiple sensors over time. In the example ofFIG.2, two sensors110-1and110-2are illustrated. However, it is to be noted that any number of sensors N≥1 may be used. Similarly, a user may be sensed multiple times by a single sensor, i.e. by the same sensor. In the example ofFIG.2, the user201is sensed twice by the sensor110-1. However, it is to be noted that any other of the sensors may as well sense the multiple times. In the example ofFIG.2, the sensor110-1senses the user201at a first time t1, the sensor110-2senses the user201at a second time t2>t1 and the sensor110-1senses the user201again a third time t3>t2.

Each of the sensors110-1and110-2is coupled with a respective apparatus100-1,100-2for privacy preservations as described above with respect toFIG.1. Accordingly, the ID of the user201provided by each of the sensors110-1and110-2is encrypted (scrambled) by of the apparatuses100-1and100-2using the respective deterministic update function. In the example ofFIG.2, each of the sensors110-1and110-2outputs identification data that indicate a first ID. As the apparatuses100-1and100-2use different deterministic update function, the apparatus100-1updates the first ID to a second ID (IID1) and the apparatus100-2updates the first ID to a third ID (IID2) different from the second ID. In other words, the apparatuses100-1and100-2update the first ID provided by the sensors differently. The result of the ID update may vary over time for the respective apparatus (e.g. the apparatus100-1).

Further, the event data provided by each of the sensors110-1and110-2are randomized according to the LDP principles by the apparatuses100-1and100-2as described above. The randomized events may be understood as LDP events.

Accordingly, the apparatus100-1outputs first encrypted data114-1comprising the anonymized and scrambled data of the sensor110-1when sensing the user201at the first time t1. Similarly, the apparatus100-1outputs second encrypted data114-2comprising the anonymized and scrambled data of the sensor110-2when sensing the user201at the second time t2. As the sensor110-1senses the user201again at the third time t3, the apparatus100-1subsequently outputs third encrypted data114-3comprising the anonymized and scrambled data of the sensor110-1when sensing the user201at the third time t3. The first encrypted data114-1and the third encrypted data114-3indicate (represent) the same second ID (IID1) as the ID provided by the sensor110-1is processed by the same apparatus110-1. To the contrary, the second encrypted data114-2indicate (represent) the third ID (IID2) as the ID provided by the sensor110-2is processed by the apparatus110-2using another deterministic update function.

The pieces of encrypted data114-1,114-2and114-3are aggregated to a data aggregator (Secure Aggregator, SA)220. The data aggregator220compiles the encrypted data114-1,114-2and114-3originating from the sensors110-1and110-2and prepares one or more combined data sets for data processing by various data consumers. In the example ofFIG.2, three data consumers230-1,230-2and230-3are illustrated. However, it is to be noted that the present disclosure is not limited thereto. In general, the data aggregator may serve any number of data consumers.

An exemplary computing system300that may be used as the data aggregator220is illustrated inFIG.3. Further illustrated inFIG.3is the orchestrator199orchestrating the apparatuses for privacy preservation and the data aggregator (i.e. the computing system300). In the example ofFIG.3, it is assumed that the orchestrator199orchestrates at least the apparatuses100-1and100-2described above in connection withFIG.2.

As described above with reference toFIG.1, the orchestrator199generates the respective deterministic update function Fi for each of the apparatuses for privacy preservation. Additionally, the orchestrator generates the respective cryptographic data for the encrypted data transmission for each of the apparatuses for privacy preservation. As indicated inFIG.3, the respective deterministic update function and the respective encryption key is transmitted by the orchestrator to the respective third interface circuitry of the apparatuses for privacy preservation. InFIG.3, the third interface circuitries140-1and140-2of the apparatuses100-1and100-2described above in connection withFIG.2are illustrated as examples.

Similarly, the orchestrator provides the respective cryptographic data (e.g. a decryption key) to the computing system300such that the computing system300is able to decrypt the respective encrypted data provided by the apparatuses for privacy preservation.

The computing system300comprises processing circuitry310and at least first interface circuitry320, second interface circuitry330and third interface circuitry340. The processing circuitry310is configured to control the computing system300to act as data aggregator for a plurality of devices such as the devices comprising the apparatuses for privacy preservation100-1and100-2described above in connection withFIG.2. For example, the processing circuitry310may be a single dedicated processor, a single shared processor, or a plurality of individual processors, some of which or all of which may be shared, a DSP hardware, an ASIC or a FPGA. The processing circuitry310may optionally be coupled to, e.g., ROM for storing software, RAM and/or non-volatile memory.

In particular, the processing circuitry310controls the computing system300to act as data aggregator for a plurality of devices by controlling the first interface circuitry320to receive a plurality of pieces of encrypted data from the plurality of devices. In the example ofFIG.3, the first interface circuitry320receives the pieces of encrypted data114-1,114-2and114-3from the devices comprising the apparatuses for privacy preservation100-1and100-2described above in connection withFIG.2. As described above, each piece of encrypted data comprises at least event data indicating an event detected by a sensor of the respective device and identification data indicating an ID for a user involved in the event. As described above, the ID contained in the respective piece of encrypted data is anonymized (scrambled). The pieces of encrypted data114-1,114-2and114-3are encrypted by the apparatuses for privacy preservation100-1and100-2using the respective cryptographic data provided by the orchestrator199.

The orchestrator199provides the respective cryptographic data198(e.g. a decryption key) to the computing system300such that the computing system300is able to decrypt the respective piece of encrypted data114-1,114-2and114-3. Accordingly, the processing circuitry310controls the computing system300to act as data aggregator for the plurality of devices by controlling the second interface circuitry330to receive from the orchestrator199cryptographic data198(e.g. indicating the respective decryption key for the plurality of devices).

Further, the processing circuitry310performs decrypting the plurality of pieces of encrypted data114-1,114-2and114-3using the cryptographic data198in order to generate a plurality of pieces of decrypted data. The processing circuitry310stores the plurality of pieces of decrypted data in a data storage360. The data storage360is a non-transitory machine-readable medium for storing data. For example, the data storage360may comprise a magnetic data storage and/or an electronic data storage.

Further, the processing circuitry310performs grouping pieces of decrypted data in the data storage360comprising identification data that indicate (represent) the same ID in order to generate a respective group for each ID. In other words, the processing circuitry310selects those pieces of decrypted data in the data storage360that indicate the same ID. Accordingly, the event data for a respective specific ID can be grouped (aggregated). For example, the processing circuitry310may select the decrypted data in the data storage360indicating the second ID (IID1) and group them. Similarly, the processing circuitry310may select the decrypted data in the data storage360indicating the third ID (IID2) and group them.

The processing circuitry310further determines whether sufficient privacy budget is left for the ID of the respective group. For example, the processing circuitry310may determine whether sufficient privacy budget is left for the group belonging to the second ID (IID1). Similarly, the processing circuitry310may determine whether sufficient privacy budget is left for the group belonging to the third ID (IID2).

If it is determined that sufficient privacy budget is left for the ID of the respective group, the processing circuitry310controls the third interface circuitry340to output the event data of the respective group. For example, if it is determined that sufficient privacy budget is left for the group belonging to the second ID (IID1), the event data of this group are output via the third interface circuitry340. Accordingly, the event data of the respective group may be provided to a data consumer such as one of the data consumers230-1,230-2and230-3illustrated inFIG.2for further analysis.

The computing system300may enable to group the events received from the plurality of devices using secure computation, without human intervention. The data aggregator environment (process) provided by the computing system300may allow to check the privacy budget for each ID and, hence, allow to preserve privacy. The security of the central instances processing the gathered data is crucial to guarantee the overall security of the system. Compared to an approach in which the reconstruction of the final ID is done in the same environment that is used to serve the data to consumers, the computing system300is less risky. As the output amount of information linked to a specific ID is managed by the computing system300, it is not possible for a heavy user to exceed the privacy budget even in case the event data is aggregated from several devices.

The processing circuitry310may be configured to control the third interface circuitry340to output the event data of the respective group free from data indicating the ID of the respective group. In other words, the data subject identifiers may be discarded once the aggregation is done. Although, the IDs in the received pieces of encrypted data114-1,114-2and114-3are already anonymized by the apparatuses for privacy preservation110-1and110-2, outputting the event data of the respective group free from data indicating the ID of the respective group may allow to further improve the privacy preservation.

If it is determined that the left privacy budget for the ID of the respective group is below a predefined threshold, the processing circuitry310may be further configured to apply an anonymization on the event data of the respective group. For example, the processing circuitry310may add additional noise to the event data of the respective group for further anonymizing the event data of the respective group.

If it is determined that no sufficient (i.e. only insufficient) privacy budget is left for the ID of the respective group, the processing circuitry310may be configured to block output of data of the respective group. Accordingly, further transmission of data of the respective group to a data consumer may be interrupted at least temporarily once the privacy budget is exceeded.

The processing circuitry310may further provide statistics on privacy budget consumption. For example, the processing circuitry310may determine anonymous statistics on privacy budget consumption based on results of the determination whether sufficient privacy budget is left for the ID of the respective group. The processing circuitry310may control fifth interface circuitry360of the computing system300to output the anonymous statistics on privacy budget consumption. The anonymous statistics on privacy budget consumption may allow for global privacy policy optimization. For example, the orchestrator199may adjust one or more settings of one or more of the apparatuses for privacy preservation100-1and100-2based on the anonymous statistics on privacy budget consumption.

The computing system300may only serve temporarily as data aggregator in order to further increase the security of the data aggregation. For example, after a predetermined retention time lapses, the processing circuitry310may be configured to control the computing system300to stop acting as the data aggregator for the plurality of devices and to delete all data from the computing system300stored while acting as the data aggregator for the plurality of devices. For example, the storage360may be cleared such that all pieces of decrypted data are deleted. Similarly, all cryptographic material received from the orchestrator199while acting as the data aggregator for the plurality of devices may be deleted from the computing system300. In other words, the computing system300may destroy the data aggregator functionality after a predetermined retention time lapses.

For example, the computing system300may comprise fourth interface circuitry350configured to receive retention time data301indicating a target retention time. Accordingly, the processing circuitry310may be configured to set the retention time to the target retention time. The retention time data301may, e.g., be received from (provided by) the orchestrator199or any other suitable entity.

The computing system300may restage the data aggregator functionality after destruction. For example, the data aggregator functionality may be destroyed and restaged periodically by the computing system300.

A data aggregation system such as the one illustrated inFIG.2may optionally comprise more than one data aggregator. For example, for further increased security and/or anonymity, the grid of devices may be sharded and each managed by a different data aggregator instance. In that case, users identified by devices in different segments of the grid would be considered as different subjects. Furthermore, the system state may be reset periodically to mitigate the risk of a specific master key leakage.

FIG.4illustrates an exemplary overview on the ID encryption scheme described above.

The ID provided by the sensor is to be hidden from any untrusted entity in order to preserve the user's identity. Therefore, the data is encrypted (indicated by function E inFIG.4) by the apparatus100for privacy preservation and subsequently decrypted (indicated by function D inFIG.4) by the computer system300acting as data aggregator. As indicated inFIG.4, cryptographic nonce such as a random nonce header may be added to further increase the security. The encryption and decryption may allow to reduce the trust requirements for any interface400such as an OS of a device comprising the apparatus100and/or one or more communication networks between the apparatus100and the computer system300acting as data aggregator.

As the security of the ID space is not controlled in the proposed architecture, a compromised data aggregator might link the first ID as output by the sensor to the second ID (IID) provided by the apparatus100to the computer system300acting as data aggregator by brute force inversion in case the deterministic update function (indicated by function F inFIG.4) was public.

To mitigate this risk, a private deterministic update function is used. As described above, the orchestrator199may manage the deterministic update function for the apparatus100for privacy preservation and ensure that the deterministic update function remains secret. For example, the deterministic update function may be set when the system is instantiated and the encryption key is set on the apparatus100. Re-identification of the data at the computer system300acting as data aggregator would require obtaining the deterministic update function from the apparatus100(and optionally the other apparatuses for privacy preservation that provide their data to the computer system300acting as data aggregator). Therefore, the security of the proposed data aggregation architecture is very high.

For further highlighting the functionality of the apparatus for privacy preservation described above,FIG.5illustrates a flowchart of a method500for privacy preservation. The method500comprises reading502, from a sensor, event data indicating an event detected by the sensor and identification data indicating a first ID. The first ID identifies a user involved in the event. Further, the method500comprises generating504a data stream comprising at least the event data and the identification data. The method500additionally comprises generating506an updated data stream based on the data stream by updating the first ID to a second ID in the identification data using a deterministic update function, and by adding noise to at least the event data. Further, the method500comprises determining508whether sufficient privacy budget is left for the updated data stream. If it is determined that sufficient privacy budget is left for the updated data stream, the method500comprises generating510encrypted data by encrypting the updated data stream. In addition, the method500comprises outputting512the encrypted data for transmission to an external data aggregator.

The method500may allow to preserve the privacy of the user as set out above for the apparatus100.

More details and aspects of the method500are explained in connection with the proposed technique or one or more examples described above (e.g.FIGS.1,2and4). The method500may comprise one or more additional optional features corresponding to one or more aspects of the proposed technique or one or more examples described above.

For further highlighting the functionality of the data aggregator described above,FIG.6illustrates a flowchart of a method600for controlling a computing system to act as data aggregator for a plurality of devices. The method600comprises controlling602first interface circuitry of the computing system to receive a plurality of pieces of encrypted data from the plurality of devices. Each piece of encrypted data comprises at least event data indicating an event detected by a sensor of the respective device and identification data indicating an ID for a user involved in the event. The method600further comprises controlling604second interface circuitry of the computing system to receive, from an external orchestrator orchestrating the data aggregator and the plurality of devices, cryptographic data. In addition, the method600comprises decrypting606the plurality of pieces of encrypted data using the cryptographic data in order to generate a plurality of pieces of decrypted data. Further, the method600comprises storing608the plurality of pieces of decrypted data in a data storage. In addition, the method600comprises grouping610pieces of decrypted data in the data storage comprising identification data that indicate the same ID in order to generate a respective group for each ID. The method600comprises determining612whether sufficient privacy budget is left for the ID of the respective group. If it is determined that sufficient privacy budget is left for the ID of the respective group, the method600comprises controlling614third interface circuitry of the computing system to output the event data of the respective group.

The method600may allow to preserve the privacy of the user as set out above for the computing system300.

More details and aspects of the method600are explained in connection with the proposed technique or one or more examples described above (e.g.FIGS.3and4). The method600may comprise one or more additional optional features corresponding to one or more aspects of the proposed technique or one or more examples described above.

Examples of the present disclosure may provide a privacy-preserving collection of data traces of identified individuals across multiple devices. Further, the proposed technique may enable privacy enforcement on IoT sensing devices.

The secure hardware component100(e.g. a chipset), when integrated in sensing devices (e.g. IoT sensors, mobile phones) may identify data subjects. The computing system300as a secure processing component (secure aggregator) may aggregate events from a same user across a network of sensing devices without disclosing identifiable data. A combination of encryption and statistical anonymization (LDP) may allow to guarantee that an individual maximum privacy budget is respected by the system. When collecting the data, the privacy of a data subject (e.g. in the case of untrusted applications) across multiple sensing devices may be protected according to the proposed architecture. Further, the cost of securing data for trusted applications may be reduced according to the proposed architecture.

The following examples pertain to further embodiments:

(1) An apparatus for privacy preservation, the apparatus comprising:first interface circuitry configured to read, from a sensor, event data indicating an event detected by the sensor and identification data indicating a first Identifier, ID, the first ID identifying a user involved in the event, wherein the first interface circuitry is further configured to generate a data stream comprising at least the event data and the identification data;processing circuitry configured to:generate an updated data stream based on the data stream by updating the first ID to a second ID in the identification data using a deterministic update function, and by adding noise to at least the event data;determine whether sufficient privacy budget is left for the updated data stream; andif it is determined that sufficient privacy budget is left for the updated data stream, generate encrypted data by encrypting the updated data stream; andsecond interface circuitry configured to output the encrypted data for transmission to an external data aggregator.

(2) The apparatus of (1), wherein the processing circuitry is configured to add cryptographic nonce to the updated data stream prior to encrypting the updated data stream.

(3) The apparatus of (1) or (2), further comprising: third interface circuitry accessible exclusively by an external orchestrator orchestrating the apparatus and the data aggregator, wherein the third interface circuitry is configured to receive configuration data from the orchestrator, and wherein the processing circuitry is configured to adjust its operation based on the configuration data.

(4) The apparatus of (3), wherein the configuration data comprise noise level data indicating a target noise level, and wherein the processing circuitry is configured to add noise to at least the event data in the data stream according to the target noise level.

(5) The apparatus of (3) or (4), wherein the configuration data comprise privacy budget data indicating the privacy budget.

(6) The apparatus of any one of (3) to (5), wherein the configuration data comprise encryption key data indicating an encryption key for the apparatus, wherein the processing circuitry is configured to encrypt the updated data stream using the encryption key.

(7) The apparatus of any one of (3) to (6), wherein the configuration data comprise update function data indicating one or more parameters for the deterministic update function, and wherein the processing circuitry is configured to set the deterministic update function according to the one or more parameters indicated by the update function data.

(8) The apparatus of any one of (1) to (7), wherein the second interface circuitry is further configured to receive, from the data aggregator, first query data indicating a query of the data aggregator for data of the sensor, wherein the processing circuitry is configured to control the first interface circuitry to read the event data and the identification data in response to receiving the query data.

(9) The apparatus of (8), wherein the first interface circuitry is further configured to generate the data stream to comprise second query data indicating one or more parameters of the query of the data aggregator.

(10) The apparatus of (8) or (9), wherein the second interface circuitry is further configured to receive, from another data aggregator, third query data indicating a query of the other data aggregator for data of the sensor, wherein the processing circuitry is configured to control the first interface circuitry to read the event data and the identification data in response to receiving the third query data, wherein the first interface circuitry is further configured to generate another data stream comprising at least the event data and the identification data, and wherein the processing circuitry is further configured to:generate another updated data stream based on the other data stream by updating the first ID to a second ID in the identification data using the deterministic update function, and by adding noise to at least the event data;determine whether sufficient privacy budget is left for the other updated data stream;if it is determined that sufficient privacy budget is left for the other updated data stream, generate other encrypted data by encrypting the other updated data stream,wherein the second interface circuitry configured to output the other encrypted data for transmission to the other data aggregator.

(11) The apparatus of (10), wherein the privacy budget for the other updated data stream is different from the privacy budget for the updated data stream.

(12) The apparatus of any one of (1) to (11), wherein, if it is determined that no sufficient privacy budget is left for the updated data stream, the processing circuitry is configured to block transmission of data of the updated data stream to the data aggregator.

(13) A device, comprising:an apparatus for privacy preservation according to any one of (1) to (12);a sensor configured to generate the event data and the identification data upon detection of the event; anda transmitter coupled to the second interface circuitry and configured to transmit the encrypted data to the data aggregator via a communication network.

(14) A computing system comprising first interface circuitry, second interface circuitry, third interface circuitry and processing circuitry, wherein the processing circuitry is configured to control the computing system to act as data aggregator for a plurality of devices by:controlling the first interface circuitry to receive a plurality of pieces of encrypted data from the plurality of devices, wherein each piece of encrypted data comprises at least event data indicating an event detected by a sensor of the respective device and identification data indicating an Identifier, ID, for a user involved in the event;controlling the second interface circuitry to receive, from an external orchestrator orchestrating the data aggregator and the plurality of devices, cryptographic data;decrypting the plurality of pieces of encrypted data using the cryptographic data in order to generate a plurality of pieces of decrypted data;storing the plurality of pieces of decrypted data in a data storage;grouping pieces of decrypted data in the data storage comprising identification data that indicate the same ID in order to generate a respective group for each ID; anddetermining whether sufficient privacy budget is left for the ID of the respective group; andcontrolling the third interface circuitry to output the event data of the respective group if it is determined that sufficient privacy budget is left for the ID of the respective group.

(15) The computing system of (14), wherein the processing circuitry is configured to control the computing system to act as the data aggregator for the plurality of devices by controlling the third interface circuitry to output the event data of the respective group free from data indicating the ID of the respective group.

(16) The computing system of (14) or (15), wherein the processing circuitry is configured to control the computing system to act as the data aggregator for the plurality of devices by applying an anonymization on the event data of the respective group if it is determined that the left privacy budget for the ID of the respective group is below a predefined threshold.

(17) The computing system of any one of (14) to (16), wherein the processing circuitry is configured to control the computing system to act as the data aggregator for the plurality of devices by determining anonymous statistics on privacy budget consumption based on results of the determination whether sufficient privacy budget is left for the ID of the respective group.

(18) The computing system of any one of (14) to (17), wherein, after a predetermined retention time lapses, the processing circuitry is configured to control the computing system to stop acting as the data aggregator for the plurality of devices and to delete all data from the computing system stored while acting as the data aggregator for the plurality of devices.

(19) The computing system of (18), further comprising:fourth interface circuitry configured to receive retention time data indicating a target retention time, wherein the processing circuitry is configured to set the retention time to the target retention time.

(20) A method for privacy preservation, the method comprising:reading, from a sensor, event data indicating an event detected by the sensor and identification data indicating a first Identifier, ID, the first ID identifying a user involved in the event;generating a data stream comprising at least the event data and the identification data;generating an updated data stream based on the data stream by updating the first ID to a second ID in the identification data using a deterministic update function, and by adding noise to at least the event data;determining whether sufficient privacy budget is left for the updated data stream;if it is determined that sufficient privacy budget is left for the updated data stream, generating encrypted data by encrypting the updated data stream; andoutputting the encrypted data for transmission to an external data aggregator.

(21) A method for controlling a computing system to act as data aggregator for a plurality of devices, the method comprising:controlling first interface circuitry of the computing system to receive a plurality of pieces of encrypted data from the plurality of devices, wherein each piece of encrypted data comprises at least event data indicating an event detected by a sensor of the respective device and identification data indicating an Identifier, ID, for a user involved in the event;controlling second interface circuitry of the computing system to receive, from an external orchestrator orchestrating the data aggregator and the plurality of devices, cryptographic data;decrypting the plurality of pieces of encrypted data using the cryptographic data in order to generate a plurality of pieces of decrypted data;storing the plurality of pieces of decrypted data in a data storage;grouping pieces of decrypted data in the data storage comprising identification data that indicate the same ID in order to generate a respective group for each ID;determining whether sufficient privacy budget is left for the ID of the respective group; andcontrolling third interface circuitry of the computing system to output the event data of the respective group if it is determined that sufficient privacy budget is left for the ID of the respective group.

(22) A non-transitory machine-readable medium having stored thereon a program having a program code for performing the method according to any one of (1) to (21), when the program is executed on a processor or a programmable hardware.

(23) A program having a program code for performing the method according to any one of (1) to (21), when the program is executed on a processor or a programmable hardware.

Examples may further be or relate to a (computer) program including a program code to execute one or more of the above methods when the program is executed on a computer, processor or other programmable hardware component. Thus, steps, operations or processes of different ones of the methods described above may also be executed by programmed computers, processors or other programmable hardware components. Examples may also cover program storage devices, such as digital data storage media, which are machine-, processor- or computer-readable and encode and/or contain machine-executable, processor-executable or computer-executable programs and instructions. Program storage devices may include or be digital storage devices, magnetic storage media such as magnetic disks and magnetic tapes, hard disk drives, or optically readable digital data storage media, for example.