Data privacy using Podium mechanism

Abstract

Systems and methods are provided for performing operations including: storing an input data set; generating a noise distribution based on a two-step function, wherein a height of the two-step function is determined by a privacy parameter, and a width of the two-step function is determined by minimizing a variance of the noise distribution, wherein a mean of the two-step function is determined by values ​​of the input data set to be privatized; applying the noise distribution to the input data set to generate privatized noise output data; and sending the resulting privatized noise output data in response to a request for a portion or a complete set of the input data.

Description

[0001] Priority claim

[0002] This application claims the benefit of priority to U.S. Patent Application Serial No. 16 / 741,193, filed on January 13, 2020, which claims the benefit of priority to U.S. Provisional Application No. 62 / 812,207, filed on February 28, 2019, the entire contents of which are incorporated herein by reference. Technical Field

[0003] The present disclosure generally relates to privacy management of user data. Background Art

[0004] Modern service providers often collect a variety of information from users to provide different services. The information collected can be used for specific transactions that users intend to conduct with service providers, as well as auxiliary services. For example, a user may provide personal information (e.g., sensitive data, including credentials such as credit card numbers, debit card numbers, and bank account numbers, as well as personal identification information such as social security numbers, names, and addresses) to access a given content delivery service, and the content delivery service may then use such information to run statistics or provide recommendations to the user. While the collection and analysis of such data is of great benefit not only to specific users but also to other users of the service provider, it can also be the subject of a great deal of abuse, such as providing information to third parties. Such abuse may prevent many other cooperating users from accessing the service provider and providing information to the service provider. For these reasons, as well as privacy regulations or regulatory restrictions, when personal information is stored in a database, the service provider who controls the data has a responsibility to protect the data from abuse. BRIEF DESCRIPTION OF THE DRAWINGS

[0005] In the drawings, which are not necessarily drawn to scale, the same reference numerals may describe similar components in different views. To easily identify the discussion of any particular element or behavior, the highest digit or digits in the reference number refer to the figure number in which the element is first introduced. Some embodiments are illustrated by way of example and not limitation in the accompanying drawings, in which:

[0006] Figure 1 is a block diagram illustrating an example messaging system for exchanging data (e.g., messages and associated content) over a network according to an example embodiment;

[0007] Figure 2 is a schematic diagram illustrating data that may be stored in a database of a messaging server system according to an example embodiment;

[0008] Figure 3 is a schematic diagram illustrating the structure of a message generated by a messaging client application for communication according to an example embodiment;

[0009] Figure 4 is a block diagram illustrating an example data privacy system according to an example embodiment;

[0010] Figure 5 is a flow chart illustrating an example operation of a data privacy system according to an example embodiment;

[0011] Figure 6-7 are illustrative inputs and outputs of a data privacy system according to an example embodiment;

[0012] Figure 8 is a block diagram illustrating a representative software architecture that may be used in conjunction with the various hardware architectures described herein according to an example embodiment; and

[0013] Fig. 9 is a block diagram illustrating components of a machine capable of reading instructions from a machine-readable medium (eg, a machine-readable storage medium) and performing any one or more of the methodologies discussed herein, according to an example embodiment. DETAILED DESCRIPTION

[0014] The following description includes systems, methods, techniques, instruction sequences, and computing machine program products that embody illustrative embodiments of the present disclosure. In the following description, for the purpose of explanation, many specific details are set forth to provide an understanding of various embodiments. However, it will be apparent to those skilled in the art that embodiments may be practiced without these specific details. Typically, well-known instruction instances, protocols, structures, and techniques need not be shown in detail.

[0015] Typical systems employ a variety of mechanisms to protect the user data they collect from exposure. Such mechanisms are often referred to as differential privacy, which introduces random data into a set of user data to prevent exposure of sensitive user information. Differential privacy is a statistical technique that seeks to provide a means to maximize the accuracy of queries from a statistical database while measuring (and thus hopefully minimizing) the privacy impact on the individuals whose information is in the database.

[0016] Typical systems introduce random data into a set of stored user data to protect the user data from exposure using a Laplace mechanism or a Staircase mechanism. The Laplace mechanism works by adding random data from a set of stored user data with a mean of zero and a scale of Laplace distributed noise is used to ensure ∈-differential privacy (also called differential privacy), where for the user data set x and ∈ is a privacy parameter less than 1. Noise is added so that:

[0017]

[0018] where L is a random variable with a probability density function defined as:

[0019]

[0020] The Staircase mechanism samples from a geometric mixture of uniform random variables with a probability density function defined as:

[0021]

[0022] in

[0023] and

[0024]

[0025] The mechanism works well under several assumptions and is derived to minimize an l1 or l2 (variance) loss function. It assumes that the domain of the output is the entire real line and that the input has a sensitivity of Δ. The noise distribution of the Staircase mechanism does not change based on the input x, and the mechanism optimizes for a single functional form that uses the same distribution regardless of whether noise is added to 0, or

[0026] While both previous methods generally work well, they both generate values ​​on the entire real line, which results in a loss of efficiency due to the possibility of extreme outliers. Furthermore, the Staircase mechanism involves complex algebraic operations to compute its parameters, which increases the computational complexity and hysteresis of noise generation.

[0027] The disclosed embodiments improve the efficiency of using electronic devices by addressing these shortcomings of existing methods for generating noise in user data. In particular, the disclosed embodiments generate a noise distribution based on the user data itself using, for example, a Podium distribution or mechanism that generates noise from a truncated distribution rather than a Laplace mechanism that generates noise on the entire real line. The disclosed method improves the accuracy of representing user data better than existing methods by providing a smaller variance. The disclosed noise distribution is sampled from a "truncated" distribution, meaning that its support is not the entire real line, but rather matches the sensitivity Δ as closely as possible by focusing the noise in an improved manner over existing methods. In addition, the shape of the distribution depends on the input value This ensures that the noise is centered around x. Certain parameters of the disclosed noise distribution can be pre-computed, which reduces computational complexity and lag during runtime when the noise distribution is used to generate noise values.

[0028] In some embodiments, an input data set is stored and a noise distribution is generated based on a two-step function. The height of the two-step function is determined by a privacy parameter, the width of the two-step function is determined by minimizing the variance of the noise distribution, and the mean of the two-step function is determined by the input data set to be privatized. The noise distribution is applied to the input data set to generate privatized noise output data, and the resulting privatized noise output data is sent in response to a request for a portion or the entire set of input data.

[0029] Figure 1 1 is a block diagram illustrating an example messaging system 100 for exchanging data (e.g., messages and associated content) over a network 106. The messaging system 100 includes a plurality of client devices 102, each client device hosting a plurality of applications, including a messaging client application 104 and a data privacy application 105. Each messaging client application 104 is communicatively coupled to other instances of the messaging client application 104, the data privacy application 105, and a messaging server system 108 via a network 106 (e.g., the Internet).

[0030] Thus, each messaging client application 104 and data privacy application 105 is able to communicate and exchange data with another messaging client application 104 and data privacy application 105 and with the messaging server system 108 via the network 106. The data exchanged between the messaging client applications 104, the data privacy applications 105, and between the messaging client applications 104 and the messaging server system 108 includes functions (e.g., commands to invoke functions) and payload data (e.g., text, audio, video, or other multimedia data).

[0031] The data privacy application 105 is an application that includes a set of functions that allow the client device 102 to access the data privacy system 124. In some implementations, the data privacy application 105 is a component or feature that is part of the messaging client application 104. The data privacy application 105 allows a given user to request access to a user data set or perform statistical analysis on a user data set. For example, the user data may represent the age of a group of users and the data privacy application 105 may request the average age of the group of users. The data privacy application 105 communicates with the data privacy system 124, which applies a noise distribution to the data set (e.g., using the Podium mechanism) to add random data and generate a result corresponding to the request. For example, the result may represent the average age of the user taking into account the added random data. By adding random data, the data of a particular user is not exposed in response to the request.

[0032] The messaging server system 108 provides server-side functionality to specific messaging client applications 104 via the network 106. Although certain functions of the messaging system 100 are described herein as being performed by the messaging client application 104 or by the messaging server system 108, it is understood that the location of certain functions within the messaging client application 104 or the messaging server system 108 is a design choice. For example, it may be technically preferable to initially deploy certain technologies and functions within the messaging server system 108, but later migrate the technologies and functions to the messaging client application 104 if the client device 102 has sufficient processing power.

[0033] The messaging server system 108 supports various services and operations provided to the messaging client applications 104. Such operations include sending data to the messaging client applications 104, receiving data from the messaging client applications 104, and processing data generated by the messaging client applications 104. The data may include, for example, message content, client device information, geolocation information, media annotations and overlays, virtual objects, message content persistence conditions, social network information, and live event information. The data exchange within the messaging system 100 is invoked and controlled via functions available through the user interface (UI) of the messaging client applications 104.

[0034] Turning now to the messaging server system 108, an application program interface (API) server 110 is coupled to and provides a programming interface to an application server 112. The application server 112 is communicatively coupled to a database server 118, which facilitates access to a database 120 in which data associated with messages processed by the application server 112 is stored.

[0035] Specifically, the API server 110 receives and sends message data (e.g., commands and message payloads) between the client device 102 and the application server 112. Specifically, the API server 110 provides a set of interfaces (e.g., routines and protocols) that can be called or queried by the messaging client application 104 in order to invoke the functions of the application server 112. The API server 110 exposes various functions supported by the application server 112, including account registration; login functionality; sending messages from a particular messaging client application 104 to another messaging client application 104 via the application server 112; sending media files (e.g., images or videos) from a messaging client application 104 to a messaging server application 114 and for possible access by another messaging client application 104; setting up collections of media data (e.g., stories); retrieving such collections; retrieving a friend list of a user of a client device 102; retrieving messages and content; adding and removing friends from a social graph; positioning of friends within a social graph; accessing user conversation data; accessing avatar information stored on the messaging server system 108; and opening application events (e.g., events related to a messaging client application 104).

[0036] The application server 112 hosts multiple applications and subsystems, including a messaging server application 114, an image processing system 116, a social networking system 122, and a data privacy system 124. The messaging server application 114 implements a variety of message processing techniques and functions, particularly techniques and functions related to aggregation and other processing of content (e.g., text and multimedia content) included in messages received from multiple instances of the messaging client application 104. As will be described in further detail, text and media content from multiple sources can be aggregated into content collections (e.g., called stories or galleries). These collections are then made available to the messaging client application 104 by the messaging server application 114. Given the hardware requirements for other processor- and memory-intensive data processing, such processing can also be performed on the server side by the messaging server application 114.

[0037] Application server 112 also includes image processing system 116 that is dedicated to performing various image processing operations, typically on images or videos received within the payload of messages at messaging server application 114. Portions of image processing system 116 may also be implemented by data privacy system 124.

[0038] The social networking system 122 supports various social networking functional services and makes these functionalities and services available to the messaging server application 114. To do this, the social networking system 122 maintains and accesses an entity graph within the database 120. Examples of functionalities and services supported by the social networking system 122 include identification of other users in the messaging system 100 who have a relationship with a particular user or who a particular user "follows," as well as identification of other entities and interests of the particular user. Such other users may be referred to as friends of the user. The social networking system 122 may access location information associated with each of the user's friends to determine where they live or are currently geographically located. The social networking system 122 may maintain a location profile for each of the user's friends, indicating the geographic location where the user's friends reside.

[0039] The application server 112 is communicatively coupled to a database server 118, which facilitates access to a database 120 in which data associated with messages processed by the messaging server application 114 is stored. The database 120 may be a third-party database. For example, the application server 112 may be associated with a first entity, and the database 120 or a portion of the database 120 may be associated with and hosted by a different second entity. In some implementations, the database 120 stores user data collected by the first entity about various users of a service provided by the first entity. For example, the user data includes a user name, password, address, friends, activity information, preferences, videos or content consumed by the user, etc. The data may be voluntarily provided by the user or may be automatically collected and stored in the database 120 by the first entity. In some implementations, the data is provided by the user for use in a specific function of the service provided by the first entity. In some cases, the same data may be used by another new function or feature or service provided by the first entity. The user may or may not be interested in the new function or feature or service provided by the first entity, and therefore, the way the user data is used may be limited without the user's explicit permission. These uses are usually controlled and regulated under privacy regulations.

[0040] Figure 2 2 is a diagram illustrating data that may be stored in database 120 of messaging server system 108 according to certain example embodiments. Although the contents of database 120 are illustrated as including a plurality of tables, it should be understood that data may be stored in other types of data structures (e.g., as an object-oriented database).

[0041] The database 120 includes message data stored in a message table 214. The entity table 202 stores entity data, including an entity graph 204. Entities (whose records are maintained in the entity table 202) may include individuals, corporate entities, organizations, objects, places, events, etc. Regardless of the type, any entity with which the messaging server system 108 stores data may be an identified entity. Each entity is provided with a unique identifier, as well as an entity type identifier (not shown).

[0042] The entity graph 204 additionally stores information about relationships and associations between entities. For example only, such relationships may be social, professional (e.g., working in a common company or organization), interest-based, or activity-based.

[0043] The message table 214 may store a collection of conversations between a user and one or more friends or entities. The message table 214 may include various attributes for each conversation, such as a list of participants, the size of the conversation (e.g., the number of users and / or the number of messages), the chat color of the conversation, a unique identifier for the conversation, and any other features related to the conversation.

[0044] The database 120 also stores annotation data in the form of examples of filters in the annotation table 212. The database 120 also stores the annotation content received in the annotation table 212. The filter (whose data is stored in the annotation table 212) is associated with and applied to the video (whose data is stored in the video table 210) and / or the image (whose data is stored in the image table 208). In one example, the filter is displayed as an overlay on the image or video during presentation to the recipient user. The filter can be of various types, including user-selected filters from a filter gallery, which is presented to the sending user by the messaging client application 104 when the sending user writes a message. Other types of filters include geographic location filters (also called geographic filters), which can be presented to the sending user based on the geographic location. For example, based on the geographic location information determined by the global positioning system (GPS) unit of the client device 102, the messaging client application 104 can present a geographic location filter specific to a neighborhood or a specific location in the UI. Another type of filter is a data filter, which can be selectively presented to the sending user by the messaging client application 104 based on other input or information collected during the message creation process by the client device 102. Examples of data filters include the current temperature at a particular location, the current speed the sending user is traveling, the battery life of the client device 102, or the current time.

[0045] Other annotation data that may be stored in the image table 208 is so-called "shot" data. A "shot" may be real-time special effects and sounds that may be added to an image or video.

[0046] As described above, the video table 210 stores video data, which in one embodiment is associated with a message (a record of which is maintained within the message table 214). Similarly, the image table 208 stores image data associated with a message (the message data of which is stored in the entity table 202). The entity table 202 may associate various annotations from the annotation table 212 with the various images and videos stored in the image table 208 and the video table 210.

[0047] The user data collection 207 stores previously collected data about multiple users of the application server 112. Such data includes any personal information provided by multiple users and interaction data about the users. For example, the data represents which videos or content each user has watched or consumed, and how long the content was consumed. The data represents any of the following: avatar features of each user, the current location of each user, demographic information about each user, a list of friends of each user on the social networking system 122, the birth date of each user, a credit card number, a social security number, the frequency of each user's access to the messaging client application 104, pictures and videos captured by one or more user devices of each user, and / or any combination thereof.

[0048] Noise distribution parameters 209 store a database including parameters and / or random data used by data privacy system 124. For example, noise distribution parameters 209 store Figure 8 , which includes parameters of a previously calculated noise distribution function (e.g., Podium mechanism). Specifically, the noise distribution parameters 209 may store a table having a list of values ​​corresponding to different privacy parameters ∈, distribution parameters d, expansion Δ of the input data set, width w of the two-step function, multiplicative margin m, and unconstrained parameter s. By storing these pre-calculated parameters, the efficiency and speed of generating random variables from the noise distribution may be improved.

[0049] The story table 206 stores data about collections of messages and associated images, video, or audio data compiled into a collection (e.g., a story or gallery). The creation of a particular collection may be initiated by a particular user (e.g., each user for whom a record is maintained in the entity table 202). A user may create a "personal story" in the form of a collection of content that the user has created and sent / broadcasted. To this end, the UI of the messaging client application 104 may include a user-selectable icon to enable the sending user to add specific content to his or her personal story.

[0050] A collection may also constitute a "Live Story," which is a collection of content from multiple users created manually, automatically, or using a combination of manual and automatic techniques. For example, a "Live Story" may constitute a curated stream of user-submitted content from different locations and events. For example, a user whose client device has location services enabled and who is at a public location event at a specific time may be presented with an option via the UI of the messaging client application 104 to contribute content to a specific Live Story. Live Stories may be identified to a user by the messaging client application 104 based on his or her location. The end result is a "Live Story" told from a community perspective.

[0051] Another type of content collection is called a "location story," which enables a user whose client device 102 is located in a particular geographic location (e.g., on a college or university campus) to contribute to a particular collection. In some embodiments, contributions to location stories may require a second level of authentication to verify that the end user belongs to a particular organization or other entity (e.g., is a student on a university campus).

[0052] Figure 3 is a schematic diagram illustrating the structure of a message 300 according to some embodiments, the message 300 being generated by a messaging client application 104 for communicating with another messaging client application 104 or a messaging server application 114. The content of a particular message 300 is used to populate a message table 214 stored in a database 120 and accessible by a messaging server application 114. Similarly, the content of the message 300 is stored in memory as "in transit" or "in flight" data of a client device 102 or application server 112. The message 300 is shown to include the following components:

[0053] Message identifier 302 : a unique identifier that identifies the message 300 .

[0054] Message text payload 304 : text generated by the user via the UI of the client device 102 and included in the message 300 .

[0055] Message image payload 306 : Image data captured by a camera component of the client device 102 or retrieved from the memory of the client device 102 and included in the message 300 .

[0056] Message video payload 308 : Video data captured by a camera component or retrieved from a memory component of the client device 102 and included in the message 300 .

[0057] Message audio payload 310 : audio data captured by a microphone or retrieved from a memory component of the client device 102 and included in the message 300 .

[0058] Message annotation 312: Annotation data representing an annotation (eg, a filter, sticker, or other enhancement) to be applied to the message image payload 306, the message video payload 308, or the message audio payload 310 of the message 300.

[0059] Message duration parameter 314: A parameter value indicating the amount of time in seconds that the content of the message (eg, message image payload 306, message video payload 308, message audio payload 310) will be presented via the messaging client application 104 or made accessible to the user.

[0060] Message geolocation parameters 316: Geolocation data (e.g., latitude and longitude coordinates) associated with the content payload of the message. Multiple message geolocation parameter 316 values ​​may be included in the payload, each of which is associated with a content item included in the content (e.g., a specific image within a message image payload 306, or a specific video in a message video payload 308).

[0061] Message story identifier 318: An identifier value that identifies one or more content collections (e.g., "stories") associated with a particular content item in the message image payload 306 of the message 300. For example, multiple images within the message image payload 306 may each be associated with multiple content collections using an identifier value.

[0062] Message tags 320: Each message 300 may be tagged with a plurality of tags, each of which indicates the subject of the content included in the message payload. For example, where a particular image included in the message image payload 306 depicts an animal (e.g., a lion), a tag value may be included within the message tags 320 indicating the relevant animal. The tag values ​​may be manually generated based on user input, or may be automatically generated using, for example, image recognition.

[0063] Message sender identifier 322: An identifier (eg, a messaging system identifier, an email address, or a device identifier) ​​that indicates the user of the client device 102 on which the message 300 was generated and from which the message 300 was sent.

[0064] Message recipient identifier 324: An identifier (eg, a messaging system identifier, an email address, or a device identifier) ​​indicating the user of client device 102 to which message 300 is addressed. In the case of a conversation between multiple users, this identifier may indicate each user participating in the conversation.

[0065] The content (e.g., values) of the various components of message 300 may be pointers to locations in a table where content data values ​​are stored. For example, an image value in message image payload 306 may be a pointer to a location (or address) within image table 208. Similarly, a value within message video payload 308 may point to data stored within video table 210, a value stored within message annotation 312 may point to data stored in annotation table 212, a value stored within message story identifier 318 may point to data stored in story table 206, and values ​​stored in message sender identifier 322 and message recipient identifier 324 may point to user records stored in entity table 202.

[0066] Figure 4 is a block diagram illustrating an example data privacy system 124 according to an example embodiment. The data privacy system 124 includes a user data input module 414, a noise distribution module 416, a noise distribution pattern selection module 417, and a result generation module 418.

[0067] The user data input module 414 communicates with the user data set 207 and / or the data privacy application 105. The user data input module 414 provides the input data set to the noise distribution module 416 to add noise or random values ​​to the input data set. The user data input module 414 also provides a request for access or statistical analysis of the input data set received from the data privacy application 105. Instead of responding to the request with actual real information using only the input data set, the result generation module 418 responds to the request from the data privacy application 105 using the additional data generated using the noise distribution module 416.

[0068] The noise distribution module 416 implements the Podium mechanism to generate random values ​​based on the input data set received from the user data input module 414. Let X be a continuous random variable collected from a local privacy model with a given privacy budget or parameter ∈. Let M be a random mechanism (e.g., a Podium mechanism) that adds a variance σ to each raw data point x. 2 Zero-mean noise. Let x′=M(x) be an observed noisy data point that satisfies the differential privacy property. In this case, if for all input x i and x j and all outputs x′, P(M(x i )=x′)≤e ∈ P(M(x j )=x″, then the random mechanism M satisfies differential privacy.

[0069] The sensitivity (or spread) of the data collection Δ can be defined before data collection as

[0070] The Podium mechanism is implemented as a two-step function, where the height of the step is determined by the privacy parameter, the width of the step is determined by minimizing the variance of the distribution, and its position is specified by the input value x or its mean. Figure 6 Four illustrative distributions for different values ​​of x are shown. Specifically, Figure 6 The Podium mechanism is shown for Δ=1 and E=log(9) for different input values ​​x (different means). The steps take on different shapes for values ​​in between, from left (Δm / 2) to right (Δm / 2). The shaded area highlights the range of input values. The support of the distribution is defined by the margin m and the sensitivity Δ. In this case, m=2.102601 and the width w=0.7540498. The horizontal lines 602 and 604 represent the probabilities of random values ​​generated by the noise distribution, and the vertical line 606 represents the mean of the values ​​corresponding to the horizontal lines 602 and 604.

[0071] In addition to the privacy parameters and the sensitivity of the data set, the Podium distribution includes three additional parameters, m, w, and t. The first m is the multiplicative margin on Δ, which describes the support of the distribution. In some embodiments, this parameter is generated to have the smallest possible m (i.e., m=1) to allow the noise distribution to match the range of input and output values. For example, if the input data includes age, which extends from 13 to 120 (Δ=107), the noise distribution is designed to output corresponding noise values ​​in the same range. This parameter depends only on the privacy parameters and is determined by minimizing the variance of the Podium distribution.

[0072] The second parameter w describes the width of the step. Its value also comes from the variance optimization. It depends on the privacy parameter and Δ and can be pre-computed once. The third parameter t describes the step position under the constraint that the mean (μ) of the Podium distribution is equal to the input value x. The range of this parameter t is between Δm / 2 and Δm / 2. Since it varies depending on x, it is calculated every time during the collection process (for example, whenever a request for data is received from the client device 102). In an implementation, in order to avoid constrained optimization, t is parameterized using another unconstrained parameter s according to the following equation:

[0073]

[0074] It converts the actual value s into the interval [-Δm / 2, Δm / 2].

[0075] In some embodiments, to derive the shape of the noise distribution of the Podium distribution, the noise distribution module 416 minimizes its variance. The noise distribution module 416 changes the shape and variance of the distribution depending on the mean of the distribution. The noise distribution module 416 performs such minimization under the constraint that its mean is equal to Δ / 2 or its most extreme shape. The noise distribution module 416 assigns a margin m to balance the distribution. The noise distribution is a shape where the second parameter w becomes a function of t because the distribution becomes a mixture of two uniform variables instead of three. The distribution is schematically shown in Figure 7 As shown in Figure 7 The density shown in represents the likelihood of generating a value from the corresponding horizontal line. The ratio of two horizontal lines is set as a function of the privacy parameter (e.g., e ε ).

[0076] The noise distribution module 416 performs a variance optimization calculation at the rightmost shape of the Podium distribution and has two unknowns (m and s) and two constraints. The first constraint is μ = Δ / 2, and the second constraint is that the area under the Podium function sums to 1 to be a proper distribution. Because it is a two-component mixture distribution with mean μ, its variance can be calculated according to the following formula:

[0077]

[0078] where p is the proportion of the first component, μ1 and μ2 are the means of each component, and σ2 and σ2 are their corresponding variances.

[0079] First, the noise distribution module 416 calculates the probability of the first component p, which is a function of the differential parameters ∈ and s only. Let d be the density (height) of the first component. To ensure ∈-differential privacy, the second component must be equal to de ∈ In such cases, p can be calculated according to the following formula:

[0080]

[0081] The noise distribution module 416 can simplify this equation to determine:

[0082]

[0083] Again, because these must sum to 1 to produce the proper density function, the noise distribution module 416 solves for d according to the following formula:

[0084]

[0085] Substituting d into the first component probability yields the following equation:

[0086] This does not depend on m or the range of the input data.

[0087] Since each component is just a uniform random variable on the interval [a, b], its mean is given by (a+b) / 2 and its variance is given by (ba)^2 / 12. Therefore, the mean of the first component is given by:

[0088]

[0089] And the mean of the second component is given by:

[0090]

[0091] Their variance can be calculated according to the following equation:

[0092]

[0093]

[0094] The second constraint can be considered that the mean of the distribution is equal to Δ / 2, which means:

[0095]

[0096] And the noise distribution module 416 calculates m according to the following equation:

[0097]

[0098] Substituting the various parts into the total variance formula above, after combining and rearranging the terms, we get:

[0099]

[0100] And taking the first derivative we get:

[0101]

[0102] This is a quartic function (fourth-degree polynomial) in s. Set Equal to 0 and solving for s allows the calculation of s according to Equation 1:

[0103]

[0104] in

[0105] A=(4(e 2∈ -e 4∈ )) 1 / 3

[0106] and

[0107]

[0108] The second-order derivative is given by is given, and is always positive, since the domain of cosh(x) is ≥ 1. This means that the solution is the true global minimum. The value of s can be approximated by s = ∈ / 3, which does not affect the privacy of the Podium mechanism and only affects its relative efficiency.

[0109] The noise distribution module 416 calculates the width parameter w according to the following equation:

[0110]

[0111] Both m and s are agnostic to the sensitivity or input data spread, while w is linearly proportional to the spread.

[0112] The noise distribution module 416 can be configured in one of a plurality of modes to generate the noise distribution. The modes include an exact mode for calculating the s value exactly and an approximate mode for calculating the s value approximately. The mode is selected by the noise distribution mode selection module 417.

[0113] To generate random variables from the noise distribution module 416 given the collection parameters ∈ and Δ, the noise distribution module 416 can pre-calculate m, w, and d. This can be done once before the collection process begins. For example, if the noise distribution mode selection module 417 selects the exact mode, the value of s can be calculated according to Equation 1 or can be obtained from Figure 8 The previously stored values ​​shown are obtained from the table.

[0114] If the noise distribution mode selection module 417 selects the approximate mode, the value of s is calculated by the noise distribution module 416 as s=ε / 3. In both modes, the noise distribution module 416 calculates the remaining parameters and stores them in the noise distribution parameters 209 as follows:

[0115]

[0116] The result generation module 418 uses the noise distribution generated by the noise distribution module 416 to add noise (e.g., Podium noise) to the request data set. In some embodiments, since the shape of the distribution depends on the input value x, the result generation module 418 performs a process (described below) for each noise addition. The only shape parameter that changes is t, which is the position of the step. After calculating t, the result generation module 418 randomly selects one of the three mixture components by generating a standard uniform random variable, and then randomly selects from the selected component with the help of another uniform random variable.

[0117] In some embodiments, the result generation module 418 receives as input the privacy parameter ∈, the range Δ of the data set, the parameters m, w, d, and x. x may be a value provided by the client device 102 using the data privacy application 105. The result generation module 418 calculates t according to the following equation:

[0118]

[0119] The result generation module 418 calculates the probability p1 of the first component and the probability p2 of the second component according to the following equations:

[0120]

[0121] p2=de ∈ w.

[0122] The result generation module 418 generates a uniform random variable Y in [0, 1]. The result generation module 418 determines whether Y is less than the probability p1 of the first component. If so, the result generation module 418 returns to the privacy application 105 If Y is not less than the probability p1 of the first component, the result generation module 418 determines whether Y is less than the sum of the probability p1 of the first component and the probability p2 of the second component. If so, the result generation module 418 returns the uniform random variable X2 in [t, t+w) to the privacy application 105. If the result generation module 418 determines that Y is not less than the sum of the probability p1 of the first component and the probability p2 of the second component, the result generation module 418 returns A uniform random variable X3 in .

[0123] The noise distribution provided by the noise distribution module 416 provides differential privacy according to the following conditions:

[0124] When μ = 0, the variance of the noise distribution is calculated according to the following equation:

[0125]

[0126] The distribution has the largest variance when the steps are farthest from the center (e.g., when most of the mass is in one of the tails, its mean is equal to or ), and in such cases the variance is calculated according to the following equation:

[0127]

[0128] In the case of high privacy mechanisms (e.g., (∈→0)), the step width w is equal to Δm (e.g., the Podium distribution is equivalent to the interval In this case, the variance is equal to It represents perfect privacy. In the low privacy regime (∈→∞), the Podium mechanism has a shape equal to This makes the Podium mechanism exponentially more efficient than the existing techniques that use the Laplace mechanism in low-privacy mechanisms.

[0129] Figure 5 5 is a flow chart illustrating example operations of the data privacy system 124 in performing process 500 according to an example embodiment. Process 500 may be embodied in computer-readable instructions for execution by one or more processors such that the operations of process 500 may be performed in part or in whole by functional components of the messaging server system 108 and / or the data privacy application 105; accordingly, process 500 is described below by way of example with reference thereto. However, in other embodiments, at least some of the operations of process 500 may be deployed on various other hardware configurations. Thus, process 500 is not intended to be limited to the messaging server system 108 and may be implemented in whole or in part by any other component. Some or all of the operations of process 500 may be performed in parallel, out of order, or omitted entirely.

[0130] At operation 501 , the data privacy system 124 stores an input data set.

[0131] At operation 502, the data privacy system 124 generates a noise distribution based on a two-step function, wherein the height of the two-step function is determined by the privacy parameter, the width of the two-step function is determined by minimizing the variance of the noise distribution, and wherein the mean of the two-step function is determined by the values ​​of the input data set to be privatized.

[0132] At operation 503 , the data privacy system 124 applies the noise distribution to the input data set to generate privatized noisy output data.

[0133] At operation 504 , the data privacy system 124 sends the resulting privatized noisy output data in response to the request for a portion or a complete set of input data.

[0134] Figure 8 is a block diagram illustrating an example software architecture 806 that may be used in conjunction with the various hardware architectures described herein. Figure 8 is a non-limiting example of a software architecture, and it should be understood that many other architectures may be implemented to facilitate the functionality described herein. Software architecture 806 may be implemented in a system such as Fig. 9 900, which includes, among other things, a processor 904, a memory 914, and input / output (I / O) components 918. A representative hardware layer 852 is shown and may represent, for example, Fig. 9The machine 900 of the embodiment of the present invention. The representative hardware layer 852 includes a processing unit 854 having associated executable instructions 804. The executable instructions 804 represent executable instructions of the software architecture 806, including implementations of the methods, components, etc. described herein. The hardware layer 852 also includes a memory and / or storage module memory / storage device 856, which also has executable instructions 804. The hardware layer 852 may also include other hardware 858.

[0135] exist Figure 8 In the example architecture of , software architecture 806 can be conceptualized as a stack of layers, each of which provides specific functionality. For example, software architecture 806 can include layers such as operating system 802, library 820, framework / middleware 818, application 816, and presentation layer 814. In operation, applications 816 and / or other components within a layer can call API call 808 through the software stack and receive message 812 in response to API call 1108. The layers shown are representative in nature, and not all software architectures have all layers. For example, some mobile or dedicated operating systems may not provide framework / middleware 818, while other operating systems may provide such layers. Other software architectures may include additional layers or different layers.

[0136] The operating system 802 can manage hardware resources and provide public services. The operating system 802 may include, for example, a kernel 822, services 824, and drivers 826. The kernel 822 may act as an abstraction layer between the hardware and other software layers. For example, the kernel 822 may be responsible for memory management, processor management (e.g., scheduling), component management, networking, security settings, etc. Services 824 may provide other public services to other software layers. Drivers 826 are responsible for controlling the hardware or interfacing with the underlying hardware. For example, depending on the hardware configuration, drivers 826 include display drivers, camera drivers, drives, flash drives, serial communications drivers (e.g., Universal Serial Bus (USB) drivers), drivers, audio drivers, power management drivers, and more.

[0137] The library 820 provides a common infrastructure used by the application 816 and / or other components and / or layers. The library 820 provides functions that allow other software components to perform tasks in a more convenient manner than directly interfacing with the underlying operating system 802 functions (e.g., kernel 822, service 824, and / or driver 826). The library 820 may include a system library 844 (e.g., a C standard library), which may provide functions such as memory allocation functions, string manipulation functions, mathematical functions, etc. In addition, the library 820 may include an API library 846, such as a media library (e.g., a library for supporting the presentation and operation of various media formats, such as MPREG4, H.264, MP3, AAC, AMR, JPG, PNG), a graphics library (e.g., an OpenGL framework that can be used to present two-dimensional and three-dimensional graphics content on a display), a database library (e.g., SQLite that can provide various relational database functions), a web library (e.g., WebKit that can provide web browsing functions), etc. The library 820 may also include various other libraries 848 to provide many other APIs to the application 816 and other software components / modules.

[0138] Framework / middleware 818 (also sometimes referred to as middleware) provides a higher level common infrastructure that can be used by applications 816 and / or other software components / modules. For example, framework / middleware 818 can provide various graphical UI (GUI) functions, advanced resource management, advanced location services, etc. Framework / middleware 818 can provide a wide range of other APIs that can be used by applications 816 and / or other software components / modules, some of which can be specific to a particular operating system 802 or platform.

[0139] Applications 816 include built-in applications 838 and / or third-party applications 840. Examples of representative built-in applications 838 may include, but are not limited to, contact applications, browser applications, book reader applications, location applications, media applications, messaging applications, and / or game applications. Third-party applications 840 may include applications that are hosted by entities other than the vendor of a particular platform using ANDROID TM or IOS TM Software Development Kit (SDK) for developing applications and can be used on platforms such as IOS TM ANDROID TM , Mobile software running on the mobile operating system of the Phone or other mobile operating systems. The third-party application 840 can call API calls 808 provided by the mobile operating system (such as the operating system 802) to facilitate the functions described herein.

[0140] Applications 816 may use built-in operating system functionality (e.g., kernel 822, services 824, and / or drivers 826), libraries 820, and framework / middleware 818 to create a UI to interact with a user of the system. Alternatively or additionally, in some systems, interaction with the user may occur through a presentation layer, such as presentation layer 814. In these systems, the application / component "logic" may be separated from the aspects of the application / component that interact with the user.

[0141] Fig. 9 is a block diagram illustrating components of a machine 900 according to some example embodiments, the machine 900 being capable of reading instructions from a machine-readable medium (e.g., a machine-readable storage medium) and performing any one or more of the methods discussed herein. Specifically, Fig. 9 A graphical representation of a machine 900 in the example form of a computer system is shown within which instructions 910 (e.g., software, programs, applications, applet programs, application software, or other executable code) for causing the machine 900 to perform any one or more of the methods discussed herein may be executed. In this way, the instructions 910 may be used to implement the modules or components described herein. The instructions 910 convert a general-purpose, unprogrammed machine 900 into a specific machine 900 that is programmed to perform the functions described and illustrated in the manner described. In alternative embodiments, the machine 900 operates as a standalone device or may be coupled (e.g., networked) to other machines. In a networked deployment, the machine 900 may operate in the capacity of a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. The machine 900 may include, but is not limited to, a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), an entertainment media system, a cellular phone, a smart phone, a mobile device, a wearable device (e.g., a smart watch), a smart home device (e.g., a smart appliance), other smart devices, a web appliance, a network router, a network switch, a network bridge, or any machine capable of executing, sequentially or otherwise, instructions 910 specifying actions to be taken by the machine 900. In addition, while only a single machine 900 is shown, the term "machine" should also be construed to include a collection of machines that individually or jointly execute instructions 910 to implement any one or more of the methodologies discussed herein.

[0142] The machine 900 may include a processor 904, memory / storage 906, and I / O components 918 that may be configured to communicate with each other, for example, via a bus 902. In an example embodiment, the processor 904 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, a processor 908 and a processor 912, which may execute instructions 910. The term "processor" is intended to include a multi-core processor 904, which may include two or more independent processors (sometimes referred to as "cores") that may execute instructions simultaneously. Although Fig. 9 A plurality of processors 904 are shown, but the machine 900 may include a single processor with a single core, a single processor with multiple cores (eg, a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0143] The memory / storage device 906 may include a memory 914, such as a main memory or other memory storage device, and a storage unit 916, both of which are accessible by the processor 904, such as via the bus 902. The storage unit 916 and the memory 914 store instructions 910 that embody any one or more of the methods or functions described herein. The instructions 910 may also reside, in whole or in part, within the memory 914, within the storage unit 916, within at least one of the processors 904 (e.g., within a cache memory of the processor), or any suitable combination thereof during execution thereof by the machine 900. Thus, the memory 914, the storage unit 916, and the memory of the processor 904 are examples of machine-readable media.

[0144] I / O components 918 may include a variety of components to receive input, provide output, generate output, send information, exchange information, capture measurements, etc. The specific I / O components 918 included in a particular machine 900 will depend on the type of machine. For example, a portable machine such as a mobile phone may include a touch input device or other such input mechanism, while a headless server machine may not include such a touch input device. It should be understood that I / O components 918 may include Fig. 9Many other components not shown in the figure. The I / O components 918 are grouped according to function only to simplify the following discussion, and the grouping is by no means restrictive. In various example embodiments, the I / O components 918 may include output components 926 and input components 928. The output components 926 may include visual components (e.g., displays such as plasma display panels (PDPs), light emitting diode (LED) displays, liquid crystal displays (LCDs), projectors, or cathode ray tubes (CRTs)), acoustic components (e.g., speakers), tactile components (e.g., vibration motors, resistor mechanisms), other signal generators, etc. The input components 928 may include alphanumeric input components (e.g., keyboards, touch screens configured to receive alphanumeric input, optical keyboards, or other alphanumeric input components), point-based input components (e.g., mice, touch pads, trackballs, joysticks, motion sensors, or other pointing instruments), tactile input components (e.g., physical buttons, touch screens that provide the location and / or force of touch or touch gestures, or other tactile input components), audio input components (e.g., microphones), etc.

[0145] In further example embodiments, the I / O component 918 may include a biometric component 930, a motion component 934, an environmental component 936, or a positioning component 938, among a wide range of other components. For example, the biometric component 939 may include a component that detects expressions (e.g., hand expressions, facial expressions, voice expressions, body postures, or eye tracking), measures biosignals (e.g., blood pressure, heart rate, body temperature, sweat, or brain waves), identifies a person (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition), etc. The motion component 934 may include an acceleration sensor component (e.g., an accelerometer), a gravity sensor component, a rotation sensor component (e.g., a gyroscope), etc. Environmental component 936 may include, for example, an illumination sensor component (e.g., a photometer), a temperature sensor component (e.g., one or more thermometers that detect ambient temperature), a humidity sensor component, a pressure sensor component (e.g., a barometer), an acoustic sensor component (e.g., one or more microphones that detect background noise), a proximity sensor component (e.g., an infrared sensor that detects nearby objects), a gas sensor component (e.g., a gas detection sensor that detects hazardous gas concentrations for safety or measures pollutants in the atmosphere), or other components that may provide indications, measurements, or signals corresponding to the surrounding physical environment. Positioning component 938 may include a positioning sensor component (e.g., a GPS receiver component), an altitude sensor component (e.g., an altimeter or barometer that can detect the air pressure from which altitude can be derived), an orientation sensor component (e.g., a magnetometer), etc.

[0146] Various technologies may be used to implement communications. I / O components 918 may include a communication component 940 that is operable to couple machine 900 to network 937 or device 929 via coupler 924 and coupler 922, respectively. For example, communication component 940 may include a network interface component or other suitable device to interface with network 937. In further examples, communication component 940 may include a wired communication component, a wireless communication component, a cellular communication component, a near field communication (NFC) component, Components (e.g. Low power consumption) Components and other communication components to provide communication via other modes. Device 929 can be another machine or any of a variety of peripheral devices (e.g., a peripheral device coupled via USB).

[0147] In addition, the communication component 940 can detect an identifier or include a component operable to detect an identifier. For example, the communication component 940 can include a radio frequency identification (RFID) tag reader component, an NFC smart tag detection component, an optical reader component (e.g., an optical sensor for detecting one-dimensional bar codes such as universal product codes (UPC) bar codes, multi-dimensional bar codes such as Quick Response (QR) codes, Aztec codes, Data Matrix, Dataglyph, MaxiCode, PDF417, Supercode, UCC RSS-2D bar codes, and other optical codes), or an acoustic detection component (e.g., a microphone for identifying an audio signal of a tag). In addition, various information can be derived via the communication component 940, such as location via Internet Protocol (IP), geographic location via Internet Protocol (IP), location information via Internet Protocol (IP), and other information. The location of signal triangulation, the location of an NFC beacon signal via detection that can indicate a specific location, etc.

[0148] Glossary

[0149] "Carrier signal" in this context refers to any intangible medium capable of storing, encoding or carrying transitory or non-transitory instructions for execution by a machine, and includes digital or analog communications signals or other intangible media to facilitate communication of such instructions. Instructions may be sent or received over a network using a transitory or non-transitory transmission medium via a network interface device and using any of a number of well-known transmission protocols.

[0150] A "client device" in this context refers to any machine that interfaces with a communication network to obtain resources from one or more server systems or other client devices. A client device may be, but is not limited to, a mobile phone, a desktop computer, a laptop computer, a PDA, a smart phone, a tablet computer, an ultrabook, a netbook, a laptop computer, a multiprocessor system, a microprocessor-based or programmable consumer electronics product, a game console, a set-top box, or any other communication device that a user can use to access a network.

[0151] A "communication network" in this context refers to one or more parts of a network, which may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), the Internet, a part of the Internet, a part of the public switched telephone network (PSTN), a plain old telephone service (POTS) network, a cellular telephone network, a wireless network, A network, another type of network, or a combination of two or more such networks. For example, the network or a portion of the network may include a wireless or cellular network, and the coupling may be a code division multiple access (CDMA) connection, a global system for mobile communications (GSM) connection, or other type of cellular or wireless coupling. In this example, the coupling may implement any of various types of data transmission technologies, such as single carrier radio transmission technology (1xRTT), evolution data optimized (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rates for GSM evolution (EDGE) technology, the third generation partnership project (3GPP) including 3G, fourth generation wireless (4G) networks, universal mobile telecommunications system (UMTS), high speed packet access (HSPA), world wide interoperability for microwave access (WiMAX), long term evolution (LTE) standards, other standards defined by various standards development organizations, other remote protocols, or other data transmission technologies.

[0152] A "short message" in this context refers to a message that is accessible for a time-limited duration. A short message can be text, an image, a video, etc. The access time for a short message can be set by the sender of the message. Alternatively, the access time can be a default setting or a setting specified by the recipient. Regardless of the setting technique, the message is transient.

[0153] "Machine-readable medium" in this context refers to a component, identification or other tangible medium capable of temporarily or permanently storing instructions and data, and may include, but is not limited to, random access memory (RAM), read-only memory (ROM), buffer memory, flash memory, optical media, magnetic media, cache memory, other types of memory (e.g., erasable programmable read-only memory (EEPROM)), and / or any suitable combination thereof. The term "machine-readable medium" should be deemed to include a single medium or multiple media (e.g., a centralized or distributed database, or associated caches and servers) capable of storing instructions. The term "machine-readable medium" should also be deemed to include any medium or combination of multiple media capable of storing instructions (e.g., code) executed by a machine, such that the instructions, when executed by one or more processors of the machine, cause the machine to perform any one or more of the methods described herein. Thus, "machine-readable medium" refers to a single storage device or device, as well as a "cloud-based" storage system or storage network comprising multiple storage devices or devices. The term "machine-readable medium" excludes the signal itself.

[0154] "Component" in this context refers to a device, physical entity or logic with boundaries defined by function or subroutine calls, branch points, APIs or other techniques that provide partitioning or modularization of specific processing or control functions. Components can be combined with other components via their interfaces to perform machine processes. A component can be a packaged functional hardware unit that is designed to be used with other components and a part of a program that generally performs a specific function of related functions. A component can constitute a software component (e.g., a code embodied on a machine-readable medium) or a hardware component. A "hardware component" is a tangible unit that can perform certain operations and can be configured or arranged in a certain physical manner. In various example embodiments, one or more computer systems (e.g., an independent computer system, a client computer system or a server computer system) or one or more hardware components of a computer system (e.g., a processor or a group of processors) can be configured by software (e.g., an application or an application portion) to be a hardware component that operates to perform certain operations as described herein.

[0155] Hardware components can also be implemented mechanically, electronically, or any suitable combination thereof. For example, a hardware component may include a dedicated circuit or logic that is permanently configured to perform certain operations. A hardware component may be a dedicated processor, such as a field programmable gate array (FPGA) or an ASIC. A hardware component may also include a programmable logic or circuit that is temporarily configured by software to perform certain operations. For example, a hardware component may include software executed by a general-purpose processor or other programmable processor. After being configured by the software, the hardware component becomes a specific machine (or a specific component of a machine) that is uniquely customized to perform the configured functions and is no longer a general-purpose processor. It should be understood that the decision to mechanically implement a hardware component in a dedicated and permanently configured circuit or in a temporarily configured circuit (e.g., configured by software) can be driven by cost and time considerations. Therefore, the phrase "hardware component" (or "hardware-implemented component") should be understood to include a tangible entity, i.e., an entity of physical construction, permanent configuration (e.g., hard wiring) or temporary configuration (e.g., programming), operating in some way or performing certain operations described herein. Considering embodiments in which hardware components are temporarily configured (e.g., programmed), it is not necessary to configure or instantiate each of the hardware components at any one time. For example, where the hardware components include a general-purpose processor that is configured by software to be a special-purpose processor, the general-purpose processor can be configured as a corresponding different special-purpose processor (e.g., including different hardware components) at different times. The software configures a specific one or more processors accordingly, for example, to constitute a specific hardware component at one time and to constitute a different hardware component at a different time.

[0156] Hardware components can provide information to other hardware components and receive information therefrom. Therefore, the described hardware components can be considered as being communicatively coupled. In the case where multiple hardware components exist simultaneously, communication can be achieved by signal transmission (e.g., by appropriate circuits and buses) between two hardware components or among more hardware components. In embodiments where multiple hardware components are configured or instantiated at different times, communication between the hardware components can be achieved, for example, by storing and obtaining information in a memory structure accessible to multiple hardware components. For example, a hardware component can perform an operation and store the output of the operation in a storage device communicatively coupled thereto. Then, another hardware component can access the storage device later to obtain and process the stored output.

[0157] The hardware component may also initiate communication with an input or output device and may operate on a resource (e.g., a collection of information). The various operations of the example methods described herein may be performed at least in part by one or more processors that are temporarily configured (e.g., by software) or permanently configured to perform the relevant operations. Whether temporarily or permanently configured, the processor may constitute a processor-implemented component that is used to perform one or more operations or functions described herein. As used herein, a "processor-implemented component" refers to a hardware component implemented using one or more processors. Similarly, the methods described herein may be implemented at least in part by a processor, wherein a specific processor or processors are examples of hardware. For example, at least some of the operations of the method may be performed by one or more processors or processor-implemented components. In addition, one or more processors may also operate to support the performance of relevant operations in a "cloud computing" environment or as "software as a service" (SaaS). For example, at least some of the operations in the operation may be performed by a group of computers (as an example of a machine including a processor), which may be accessed via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs). The performance of certain operations in the operation may be distributed among processors, not only residing in a single machine, but also deployed on multiple machines. In some example embodiments, the processor or processor-implemented components may be located in a single geographic location (e.g., in a home environment, an office environment, or a server farm). In other example embodiments, the processor or processor-implemented components may be distributed across multiple geographic locations.

[0158] A "processor" in this context refers to any circuit or virtual circuit (a physical circuit simulated by logic executed on an actual processor) that manipulates data values ​​according to control signals (e.g., "commands," "opcodes," "machine code," etc.) and produces corresponding output signals applied to operate a machine. For example, a processor may be a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an ASIC, a radio frequency integrated circuit (RFIC), or any combination thereof. A processor may further be a multi-core processor having two or more independent processors (sometimes referred to as "cores") that can execute instructions simultaneously.

[0159] In this context, a "timestamp" refers to a sequence of characters or encoded information that identifies when a particular event occurred, such as giving a date and time of day, sometimes with accuracy to fractions of a second.

[0160] Changes and modifications may be made to the disclosed embodiments without departing from the scope of the present disclosure. These and other changes or modifications are intended to be included within the scope of the present disclosure as expressed in the following claims.

Claims

1. A method for privacy management of user data, comprising: One or more processors store an input data set, generating, by the one or more processors, a noise distribution based on a two-step function, the height of the two-step function being determined by a privacy parameter, the width of the two-step function being determined by minimizing a variance of the noise distribution, and the mean of the two-step function being determined by a value of a sum of the input data sets to be privatized, wherein a Podium mechanism is implemented as the two-step function; applying, by the one or more processors, the noise distribution to the input data set to generate privatized noise output data; as well as The privatized noise output data is sent by the one or more processors in response to a request for a portion or a complete set of the input data. 2 . The method of claim 1 , further comprising selecting a pattern from a plurality of patterns of the noise distribution.

3. The method according to claim 2, wherein: The plurality of modes include an exact mode and an approximate mode.

4. The method according to claim 3, further comprising: determining that the selected mode corresponds to the exact mode, and When the selected pattern corresponds to the exact pattern, a previously stored unconstrained parameter s of the noise distribution is retrieved, the previously stored unconstrained parameter being previously calculated based on the privacy parameter.

5. The method according to claim 3, further comprising: determining that the selected mode corresponds to the approximate mode; as well as When the selected pattern corresponds to the approximate pattern, an unconstrained parameter s of the noise distribution is calculated as a part of the privacy parameter.

6. The method according to claim 1, wherein: Generating the noise distribution includes: calculating a multiplicative margin m over an extension Δ of the input data set, wherein the multiplicative margin describes the support of the noise distribution; calculating the width w of the two-step function based on the extension of the input data set, the multiplicative margin m and an unconstrained parameter s; and A distribution parameter d is calculated based on the extension of the input data set, the multiplicative margin m, the unconstrained parameter s and the privacy parameter.

7. The method according to claim 6, wherein: The multiplicative margin m is calculated according to the following equation: where ∈ is the privacy parameter.

8. The method according to claim 7, wherein: The width w is calculated according to the following equation:

9. The method according to claim 8, wherein: The distribution parameter d is calculated according to the following equation:

10. The method according to claim 6, further comprising: Receiving a request for a given data x of the input data set; Calculate the position of the two-step function based on the given data x, the width w, the distribution parameter d and the privacy parameter; calculating a probability p1 of a first component based on the distribution parameter d, the location, the spread of the input data set and the multiplicative margin m; and The probability p2 of the second component is calculated according to the distribution parameter d, the width w and the privacy parameter.

11. The method according to claim 10, wherein: The position is calculated according to the following equation: Where x is the input value and ∈ is the differentiation parameter.

12. The method according to claim 11, wherein: The probability p1 of the first component is calculated according to the following equation:

13. The method according to claim 10, wherein: The probability p2 of the second component is calculated according to the following equation: p2=de ∈ In.

14. The method according to claim 10, further comprising: In response to generating the privatized noise output data, selecting which component of the two-step function to extract noise from by generating a uniform random variable and determining which component the random variable is located in; If the first component is randomly selected with the probability p1, the privatized noise output data result is calculated as The first uniform random variable in the range ; If the second component is randomly selected with probability p2, the privatized noise output data result is calculated as a second uniform random variable within the range defined as [t, t+w); as well as Otherwise, the privatized noise output data result is calculated as defined in A third uniform random variable in the range, where t describes the step position under the constraint that the mean of the noise distribution is equal to the input value.

15. A system for privacy management of user data, comprising: A processor configured to perform operations comprising: A collection that stores input data; generating a noise distribution based on a two-step function, the height of the two-step function being determined by a privacy parameter, the width of the two-step function being determined by minimizing the variance of the noise distribution, and the mean of the two-step function being determined by the values ​​of the input data set to be privatized, wherein the Podium mechanism is implemented as the two-step function; applying the noise distribution to the input data set to generate privatized noise output data; and The privatized noise output data is sent in response to a request for a portion or a complete set of the input data.

16. The system of claim 15, wherein: The operations further include selecting a pattern from a plurality of patterns of the noise distribution.

17. The system of claim 16, wherein: The plurality of modes include an exact mode and an approximate mode.

18. The system of claim 17, wherein: The operations further include: determining that the selected mode corresponds to the exact mode; and When the selected pattern corresponds to the exact pattern, previously stored unconstrained parameters s of the noise distribution are retrieved, the previously stored parameters being previously calculated based on the privacy parameters.

19. The system of claim 17, wherein: The operations further include: determining that the selected mode corresponds to the approximate mode; and When the selected pattern corresponds to the approximate pattern, an unconstrained parameter s of the noise distribution is calculated as a part of the privacy parameter.

20. A non-transitory machine-readable storage medium comprising instructions that, when executed by one or more processors of a machine, cause the machine to perform operations comprising: A collection that stores input data; generating a noise distribution based on a two-step function, wherein the height of the two-step function is determined by a privacy parameter, and the width of the two-step function is determined by minimizing the variance of the noise distribution, wherein the mean of the two-step function is determined by the value of the input data set to be privatized, and the Podium mechanism is implemented as the two-step function; applying the noise distribution to the input data set to generate privatized noise output data; and The privatized noise output data is sent in response to a request for a portion or a complete set of the input data.

Images