Understanding the Architecture and Components

Protegrity Anonymization processes datasets through generalization to ensure the risk of re-identification stays within tolerable thresholds. The anonymization process affects data utility. However, Protegrity Anonymization optimizes the privacy-utility trade-off to maximize data quality within defined privacy goals.

Protegrity Anonymization uses Kubernetes for data anonymization at scale and provides deployment support for AWS EKS.

Component Diagram

The following diagram shows the deployment architecture and communication between components.

graph TD
    User([User / Client Application]) -->|HTTPS :443| GW[PPC Gateway]
    User --> SDK[Anonymization Python SDK]
    SDK -->|HTTPS :443| GW

    GW -->|:8000  /pty/anonymization/v3| App[anon-app\nREST Server]
    GW -->|:8786  /pty/dask| Sched[anon-scheduler\nDask Scheduler]

    App -->|:5432| DB[(anon-db\nPostgreSQL)]
    App --> Sched
    Sched -->|random ports| W1[anon-worker]
    Sched -->|random ports| W2[anon-worker]
    W1 <-->|read / write| S3[(S3 Bucket\nAnon-Storage)]
    W2 <-->|read / write| S3

    subgraph EKS [EKS Cluster  ·  anon-ns]
        GW
        App
        DB
        Sched
        W1
        W2
    end

    subgraph AWS
        S3
        IAM[IAM Role\nPod Identity]
    end

    App -.->|assumes| IAM
    IAM -.->|grants access| S3

Communication Ports

The following table lists the ports used for communication between the components.

Components

The deployment consists of the following components:

• Anonymization REST Server or anon-app: Exposes the REST API at /pty/anonymization/v3. It receives anonymization requests, submits tasks to the Dask scheduler, and stores job metadata in PostgreSQL. The system queues and executes tasks in first-in first-out (FIFO) order.

  Note: Only one Anonymization task runs at a time.

• Dask Scheduler or anon-scheduler: Receives tasks from the REST server and distributes them to available Dask workers. Communicates with workers over random ports.

• Dask Workers or anon-worker: Executes the anonymization algorithm. Workers read input datasets from and write output datasets to the S3 bucket. Workers scale horizontally using replicaCount.

• Anon-DB or anon-db: Stores job metadata, including status, configuration, and result references, in a PostgreSQL database.

• S3 Storage or Anon-Storage: Stores input and output datasets in an S3 bucket. An IAM role using EKS Pod Identity grants workers access.

• Python SDK: Interacts programmatically with the REST server using the Python client library. For more information about the Python SDK, refer to the Python SDK Installation section.