HANA Data Privacy & Anonymization Visualized
I wanted to share a visual example that describes some of the HANA data privacy capabilities and anonymization features. There’s a YouTube video below that shows these exposed through SAP Analytics Cloud (SAC).
HANA anonymisation covers multiple features
- Data Masking
- Differential Privacy
1. Data Masking
This is the most obvious of the data protection features. This masks out specified parts of data with a pattern using a replacement character. I have applied masking to home telephone numbers and social security numbers.
The masking was applied in the Calculation View in the Semantics, but this can also be done at table level.
Data Masking is achieved using SQL Expressions
2. Differential Privacy
This features adds noise to the specified fields, while still keeping it statistically relevant.
To visualise this, I have used a Geographic Hierarchy, so that you and see how the noise differs within the hierarchy.
The differential privacy parameters that control how much noise and the probability an individual contributes to the result, reside in the anonymization view. Details of these parameters can be found in the SAP HANA Data Anonymization Guide.
I built a simple calculation view for consumption with SAC, here we use an outer join Geographic Hierarchy
To use the k-anonymity feature we need to define our anonymization rules
- Quasi Identifiers
Quasi Identifiers specify which fields could potentially be used to identify individuals. In the dataset below, we chose SITE, GENDER and AGE
Hierarchies/Groupings – How can the quasi identifiers be generalised to allow them to be used. Here we can group ages into age bands, and sites role up a geographic hierarchy. For gender there is no generalisation possible.
K-anonymity, k has been set as 3. This is the minimum number of records needed before we expose the quasi identifiers and sensitive data.
To Generalise the SITE column we used a parent child hierarchy using the structure as below.
We stored the data for this hierarchy with a parent child structure.
We used the following hierarchy view in the anonymization view.
To simplify things, in the first instance I have only specified SITE as the quasi identifier.
I reconstructed the geographic hierarchy to allow the data to be visualised more easily with an SAC story against the anonymization views. In this example I used k=3.
The other parameters are commented out.
On the left side the Employee column shows the raw data. We can see in Toronto there are only 2 employees which is below our threshold of 3.
In the middle panel, with the strict anonymization applied we can see in the Geographic Hierarchy we no longer see Toronto (as expected), but we also lose Boston and Dallas
On the right side we can have used the more relaxed approach with the “recoding”: “multi_dimensional_strict”
When using multiple quasi identifier in the anonymization view, it makes sense to view the output as a grid. Looking at the dataset we can see ID 29 from Vancouver is anonymized differently depending upon the strict vs relaxed approaches.
SAP HANA Anonymization provides an easy way to ensure privacy rules are adhered to. By using an SAC story with hierarchies makes that easier to understand.
Please check out the video below to see the live demo.