How Aircloak Insights Can Help

How Does Aircloak Insights Work?

Instead of anonymizing or pseudonymising the source data prior to analysis, Aircloak Insights still performs analytics on the unprocessed data. The analytics output is then instantly and automatically anonymized as queries are run. This avoids the risk that the anonymization might destroy or reduce the utility of the data. This gives the strongest possible level of anonymity while retaining the accuracy of the results.

The key to this design is the way that the analytics and anonymization steps are performed simultaneously.

This approach avoids the usual problems faced when doing data anonymization. If the data is anonymized before it is analysed, you may well lose much of the utility in the data. But if the data is anonymized after the analysis you don’t have sufficient knowledge of the underlying data to know whether the anonymization is strong enough.

Aircloak Insights consists of two discrete modules that work together. Both components are deployed as standard Docker containers and can run equally well on bare metal servers or your own virtual server infrastructure.

Insights Air

Insights Air is a web-based control centre that ships as an integral part of Aircloak Insights. Insights Air offers you full granular control over who sees your data and provides all the necessary data security and audit functions needed to ensure you are compliant with any data protection legislation. Insights Air incorporates LDAP and provides full authentication and authorisation functionality to verify the identity of analysts are ensure they are only accessing datasets they are allowed to.

Administrators also get full visibility of the system health and a detailed audit log tracking all queries and system actions. One of the best features is the live query tracker, which allows you to see exactly what queries are currently being run, who is running them, and what impact they are having on your system resources.

Insights Cloak

Insights Cloak handles the actual queries, passing them to the data storage and anonymizing the results as they come back. It is able to do the anonymization properly because it understands the actual data. This means it can apply the most suitable anonymization to the results before passing these back to the analyst.

Insights Cloak is designed so that it can be deployed within the secure perimeter round your data sources. This means that no personal data ever passes the secure perimeter. In turn this means that Insights Cloak doesn’t open up any new attack vectors, reducing the risk compared with other solutions.

As we saw in the Anonymization section, there are two approaches to anonymization. The first approach is to completely anonymize the dataset before you query it. This gives a strong anonymity but carries a risk of degrading your results so much they are useless. The other approach is dynamic anonymization where you anonymize the data on a query-by-query basis.

The Aircloak approach is dynamic, but it has been designed to ensure privacy in all the query functions. It uses custom implementations of standard analytics primitives such as AVERAGE, SUM and COUNT that are anonymization-aware by design. These take account of the scope of the query semantics and will ignore irrelevant information from the dataset when anonymizing the data. The anonymized results are then returned to the analyst. Because the anonymization is just being run on the relevant data, the anonymization only needs to take into account those dimensions that are part of the query itself. This allows fine grained anonymization while still removing the risks of data exposure.

How Does This Approach Gives GDPR Compliance?

Dynamic anonymization works by marginally altering the values produced from the query. You can either alter the dimensions of the data or more often the aggregate values. Generally, aggregates are altered by the addition of small amounts of random noise (Gaussian or some other random noise source). The problem is that truly random noise leads to the concept of the privacy budget in approaches like Differential Privacy. Once you have exhausted the privacy budget, that dataset can no longer be used for analysis.

Aircloak takes a different approach. Rather than applying truly random noise, it uses pseudo-random layers of noise. This means that every time a query is run, the noise added to it is the same, so you can run the query as often as you want without increasing the risk of leaking the original data. Not only that, but queries that are different, but semantically equivalent also return the same data with the same noise applied. This removes the risk of revealing the data by repeatedly querying it in different ways. This means that the data will remain anonymous and hence this approach is GDPR compliant.

What Other Benefits Does This Approach Bring

This new approach to anonymization should help you streamline the process or running analytics. Chief among these is the fact that any suitable team member can run analytics over the whole dataset without the need for specific per-use-case authorizations. This also applies to suitably vetted external contractors or business divisions that are usually separated by Chinese Walls.

This means all organisations who store valuable data, such as health, location, or financial data, can now instantly and safely monetise the data regardless of its format.

Finally, the provision of full audit trails reduces the cost of mandatory reporting and ensures compliance with the relevant parts of GDPR.