Privacy for directed data

Abstract

Directed data often conveys particularly sensitive information, such as user location. To protect user privacy, the directed data is replaced with modified directed data, where the modified directed data is selected based on the actual directed data, a privacy parameter, and a probability distribution over an n-dimensional sphere. As such, the modified directed data values are useful when aggregated with other modified directed data values, but do not infringe on the privacy of the user's directed data.

Description

TECHNICAL FIELD

[0001] The subject matter disclosed herein relates generally to directional data. In particular, the present disclosure seeks to provide systems and methods for privacy for directional data. BACKGROUND

[0002] Directional data is a class of data whose values lie on a closed curve. For example, geographic locations lie on the surface of an approximate sphere, rather than on a two-dimensional Cartesian plane. As another example, time of day or day of week can be interpreted as points lying on a circle. SUMMARY

[0003] According to an aspect of the present invention, there is provided a method comprising: accessing, by one or more processors of a device, directional data of the device; generating, by the one or more processors, modified directional data based on the directional data and a probability distribution on an n-dimensional sphere; and providing the modified directional data to a server via a network without allowing the server to access the directional data of the device.

[0004] According to an aspect of the present invention, there is provided a device comprising: a memory storing instructions; and one or more processors configured by the instructions to perform operations comprising: accessing directional data of the device; generating modified directional data based on the directional data and a probability distribution on an n-dimensional sphere; and providing the modified directional data to a server via a network without allowing the server to access the directional data of the device.

[0005] According to an aspect of the present invention, there is provided a non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a device, cause the one or more processors to perform operations comprising: accessing directional data of the device; generating modified directional data based on the directional data and a probability distribution on an n-dimensional sphere; and providing the modified directional data to a server via a network without allowing the server to access the directional data of the device. BRIEF DESCRIPTION OF DRAWINGS

[0006] Figure 1 FIG. 1 is a network diagram illustrating an example network environment suitable for providing privacy for directional data.

[0007] Figure 2 FIG. 2 is a block diagram of an example privacy server suitable for providing privacy for directional data.

[0008] Figure 3 FIG. 3 is a conceptual diagram of representing time of day as directional data on a 1 -sphere.

[0009] Figure 4 is a conceptual diagram of representing days of a week as directional data on a 1 -dimensional sphere.

[0010] Figure 5 is a block diagram of an example database schema suitable for storing directional data and a privacy measure for use in providing privacy for directional data.

[0011] Figure 6 is a schematic diagram representing example true directional data values and modified directional data values that protect privacy.

[0012] Figure 7 is a block diagram of an example user interface that enables a user to provide true directional data or modified directional data values that protect privacy.

[0013] Figure 8 is a flowchart showing operations of an example method suitable for protecting privacy of directional data.

[0014] Figure 9 is a flowchart showing operations of an example method suitable for protecting privacy of directional data.

[0015] Figure 10 is a block diagram representing one example of a software architecture for a computing device.

[0016] Figure 11 is a block diagram of a machine in the example form of a computer system in which instructions can be executed to cause the machine to perform any one or more of the methodologies discussed herein. DETAILED DESCRIPTION

[0017] Example methods and systems relate to protecting privacy for directional data. Privacy of directional data can be protected on a device that provides the directional data or on a server that aggregates the directional data.

[0018] While large-scale data collection and processing has become an important technology to drive business and innovation, the data collected in such scenarios is often privacy sensitive, and users can be reluctant to share their whereabouts during the course of a day. Directional data often conveys particularly sensitive information, such as user location.

[0019] Non-directional data can be anonymized by introducing random perturbations in the observed data values. Non-directional techniques can be applied to directional data by treating the directional data as non-directional. For example, a 24-hour day can be treated as a non-directional range from 00:00 to 23:59, ignoring the adjacency between the two edge values.

[0020] Directed data can be thought of as points on an n-sphere or as vectors from the origin of the n-sphere to points on the surface of the n-sphere. An n-sphere is a set of points in (n+1)-dimensional Euclidean space that are at a constant distance r (the radius of the n-sphere) from a center point (the center of the n-sphere). An n-sphere with a radius of 1 is referred to as a "unit n-sphere" or simply "n-sphere." Thus, a common 3-dimensional unit sphere can be referred to as a "2-sphere." Similarly, a 2-dimensional circle can be referred to as a "1-sphere." Mathematically, for n e N, the unit (n-1)-sphere S n-1 :={x e R n :‖x‖=1} is a set of unit vectors in n-dimensional Euclidean space. An (n-1)-sphere with a radius r > 0 is denoted as rS n-1 .

[0021] To protect the privacy of individuals while maintaining a data-driven business model, differential privacy can be used. The goal of differential privacy is to quantify the risk that an individual incurs from participating in data collection. In a central model, data is stored in a central database. Adjacent databases are databases that differ by at most one record. Then, a differentially private query on two adjacent databases produces results with similar probabilities, i.e., answers that are indistinguishable in probability. This can be achieved via a random mechanism that returns a noisy query result, thereby masking the influence of each individual. The amount of noise is determined by a predetermined parameter that defines a level of privacy for each record.

[0022] Previously, differential privacy mechanisms have been proposed for various settings and data types, but these methods do not inherently account for the potential directedness of the underlying data. For example, a standard Laplace mechanism is defined on an (infinite) real line, while a planar Laplace mechanism is defined for planar (i.e., non-spherical) locations. Post-processing, such as clipping or wrapping, can be applied to adapt these mechanisms to a periodic domain (e.g., treating 12:01 AM and 11:59 PM as being at the two ends of a linear 24-hour range, rather than nearly adjacent points in a periodic domain). However, due to the effects of post-processing, the amount of noise introduced using these mechanisms can increase, thereby decreasing the value of the data.

[0023] Using the systems and methods described herein, directed privacy is provided that operates on directed data intrinsically. By using these methods on directed data rather than treating directed data as undirected data, privacy is protected to an equivalent degree with reduced introduction of noise, thereby increasing the accuracy of systems that rely on collected data without compromising user privacy.

[0024] Additionally or alternatively, directed data privacy can be obtained by avoiding providing precise directed data from the client device. Rather than providing actual directed data values, modified directed data values can be provided. The client device can select the modified directed data values based on the actual directed data, a privacy parameter, and a probability distribution over an n-dimensional sphere. In this way, the modified directed data values are useful to the server when aggregated with other modified directed data values, but do not infringe on the privacy of the user’s directed data.

[0025] Accordingly, one or more methods described herein can improve a computing system by allowing more accurate measurement of aggregated user behavior without increasing the impact on user privacy. Alternatively, the same accuracy can be achieved using fewer records received from users. Similarly, computing resources used by one or more machines, databases, or networks can be reduced. Examples of such computing resources include processor cycles, network traffic, memory usage, data storage capacity, power consumption, and cooling capacity.

[0026] For a given set Z, P Z denotes the set of probability distributions (or measures) on Z, i.e., the set of normed and σ-additive functions P : σ(Z) → [0, 1], where σ(Z) is a σ-algebra on Z. Thus, the probability of an event Z e σ(Z) (i.e., a measurable subset of Z) is given by P[Z]. A distribution P is often specified by its probability density function (PDF), denoted by P[z]. For a univariate distribution on R, The cumulative distribution function (CDF) at Z is also denoted by P[z ≤ Z] (short for P[{z e R : z ≤ Z}]). A family of distributions parameterized by one or more parameters (such as μ or ∈) is denoted by adding the parameters in parentheses, like P(μ, ∈)[·] or simply P(μ, ∈).

[0027] Definition 1. Let X and Z be two sets. A random mechanism from X to Z is a function M : X → P Z where the function M assigns to each input x a probability distribution on Z. In particular, M can be specified by a parametric family of distributions M(x) on Z via M(x) = M(x) (x e X); then, we declare M to be the mechanism induced by M.

[0028] From an algorithmic perspective, a random mechanism M is run on a given input x by sampling a realization z from the distribution M(x). This is written as

[0029] Differential privacy can also be referred to as ε-indistinguishability. The goal of ε-indistinguishability is to provide semantic privacy by quantifying the risk that an individual incurs from participating in data collection. In the central model, the collected data can be stored in a central database, where each participant has a record. A neighboring database is a database that differs from another database by at most one record (i.e., one individual’s data). To provide differential privacy, a differentially private query on the two databases should yield matching results with similar probabilities, i.e., answers that are probabilistically indistinguishable. This is achieved via a random mechanism that returns noisy query results over the universe of the dataset D, thereby masking the influence of each individual.

[0030] Definition 2. Let ε > 0 be a privacy parameter. A random mechanism M: D → P Z satisfies ε-differential privacy, i.e., if for all neighboring databases x, x 0 ∈ D, and for all possible outputs Z

[0031] M(x)[Z] ≤ e ∈ · M(x 0 )[Z].

[0032] In the local model, noise is added locally at the data source before the data is collected and stored in a central database. A basic example is randomized response, where each survey participant, according to a toss of a fair coin, provides the true answer or provides a random answer.

[0033] A limitation of differential privacy is that indistinguishability is achieved between two records at the level of each record, without regard to the actual values of the two records. This can be especially problematic in the local model, where each user can submit only one record, in which case a differentially private mechanism with a small privacy parameter ε will force all submitted records to be indistinguishable, thereby rendering the collected data essentially useless.

[0034] Definition 3. Let ε > 0 be a privacy parameter. A mechanism M satisfies εd-privacy (also referred to as metric privacy) on a metric space (X, d) if for all x, x’ ∈ X and all

[0035] M(x)[Z]≤ exp(∈·d(x,x’))·M(x’)[Z].

[0036] Thus, the level of indistinguishability of any two points x,x 0 becomes ∈d(x,,x’), i.e., depends on ∈ and the distance of x,,x 0 . If we consider an arbitrary but fixed distance r > 0, then any two points with d(x,x’) ≤ r achieve at most a level of indistinguishability l := ∈r; thus, the ∈d-private mechanism M achieves a level of privacy l := ∈r within a protection radius r.

[0037] Note that if we use the record-level edit distance d ±1 , we recover the original notion of ∈-differential privacy on the space of databases X = D, since datasets x, x’ ∈ D differ by at most one record if and only if d ±1 (x,,x 0 ) ≤ 1.

[0038] Definition 4. Two inputs x,x’ ∈ X are adjacent (with respect to d) in a metric space (X,d) if d(x,x’) ≤ 1. This is written as x ~ d x’ (or, if d is inferred from the context, as x ~ x’).

[0039] Directed statistics is the field of statistics that is concerned with direction. Since direction is independent of magnitude, they can be identified by unit vectors, i.e., points on the unit sphere.

[0040] Definition 5. The unit (n - 1)-dimensional sphere S n-1 := {x ∈ R n : ‖x‖ = 1} is the set of unit vectors in n-dimensional Euclidean space. The (n - 1)-dimensional sphere of radius r > 0 is denoted by rS n-1 . Thus, the unit sphere S 0 includes the two points at +1 and -1 on the one-dimensional real line, the unit sphere S 1 is the unit circle in the two-dimensional plane, and the unit sphere S 2 is the ordinary unit sphere in three-dimensional space.

[0041] Fact 6. The surface area of the unit sphere S n-1 is

[0042]

[0043] For a sphere of radius r, multiply the above equation by r n-1 to obtain the surface area of the sphere.

[0044] Example 7. S n-1 Uni(S n-1 ) has a constant PDF

[0045]

[0046] S n-1 has a unimodal distribution around a mode μ ∈ S n-1 A distribution that is rotationally symmetric is called a rotationally symmetric distribution. The density P[x] of such a rotationally symmetric distribution depends on x only through the projection t = μ T x of x onto the modal axis from the origin 0 through μ T x. Thus, all points x = t of S share the same density value

[0047] Given a point μ ∈ S n-1 , any point x ∈ S n-1 can be decomposed into two orthogonal components, one along the axis (from the origin) through μ and the other along the unit vector ξ ⊥ μ, as:

[0048] Equation 1: where t = μ T x.

[0049] The term t = μ T x is called the mixing variable. The density of the mixing variable is called the mixing density and is defined as:

[0050]

[0051] Lemma 8. Given a rotationally symmetric distribution P with kernel function P's mixing density PMix[t] can be expressed in terms of the kernel function as:

[0052] Equation 2:

[0053] In addition to the mixing density at t = μ T x, we can also consider the angular density or arc length θ = arccos(μ T x) of the angle between any point x and the mode μ.

[0054] Lemma 9. Given a rotationally symmetric distribution P with kernel function P's angular density for an angle θ ∈ [0, π] is

[0055] Equation 3:

[0056] The (n-1)-dimensional VMF distribution (named after von Mises and Fisher) is a unit hypersphere S n-1 The probability distribution on.

[0057] Definition 10. In S n-1 The mean direction μ∈S is above. n-1 The VMF distribution with concentration parameter κ ≥ 0 is given by density.

[0058] Equation 4: VMF(μ,κ)[x]=C VMF (n,∈)·expκ·μ T x.

[0059] set up Normalization factor becomes

[0060]

[0061] The parameter κ characterizes the strength of the concentration of the random vector x ~ VMF(μ,,κ) along the mean direction μ. If κ > 0, the distribution is unimodal, and the mode matches μ. The VMF distribution with zero concentration (κ = 0) degenerates into a uniform distribution Uni(S) n-1 ).

[0062] Definition 11. At two points x, y ∈ rS n-1 The surface distance between them is given by the arc length d ] (x,y):=rarccos(x T y).

[0063] On a unit sphere (r=1), the surface distance between two points is... Equal to the closed angle (expressed in radians) between the two points, S n-1 and Together they form a measurement space for angles.

[0064] Definition 12. Let ∈>0 be a privacy parameter. In S n-1 The mechanism M satisfies the following conditions privacy That is, if for all x, x'∈S n-1 and all but

[0065]

[0066] Fact 13. Let f: D→S n-1 Let M be a query function. ∈ For in Sn-1 Let ∈d be a privacy mechanism with metric d. Then, the d-sensitivity of the ∈d privacy mechanism is:

[0067]

[0068] And composition. It is differentiatingly private to ∈.

[0069] Theorem 14. Let ∈>0 be a privacy parameter. In S n-1 The above is based on the fact that for x∈S n-1 of The induced VMF mechanism satisfies ∈d2 privacy.

[0070] Corollary 15. Because for any x, y∈S n-1 , Therefore, the VMF mechanism also satisfies... Privacy. According to fact 13, the VMF mechanism VMF(x,∈ / Δ) also provides a spherical value function f:D→S over the space of the database D. n -1 Provide differential privacy, where Δ is the sensitivity of f.

[0071] According to Equations 2 and 3, the mixing density and angular density of the VMF distribution are:

[0072] Equation 5:

[0073] Equation 6: VMFArc[θ]=C′ VMF ·sin n-2 (θ)e κcos(θ) ,

[0074] Among them, the normalization factor becomes

[0075] Equation 7:

[0076] To assess the error induced by the random mechanism, we can use statistical tools, such as the expected value of an error measure based on the fundamental distribution. Specifically, for a random vector x ~ VMF(μ,κ), we can provide an analytical expression for the expected Euclidean distance to the mode μ.

[0077] Theorem 16. The expected Euclidean distance between a random vector x ~ VMF(μ,κ) and the mode μ can be expressed as the expected value over the mixture density. This expected value is calculated as follows:

[0078] Equation 8:

[0079]

[0080] Theorem 17. Setting and The CDF of the VMF mixture distribution VMFMix(n,κ) in T∈[-1,1] can be written as:

[0081] Equation 9:

[0082] To generate the point x ~ VMF(μ,κ), we can sample the value t from the mixed distribution VMFMix(n,κ) and uniformly plot the orthogonal unit vector ξ∈S. n-2 ⊥μ, thus constructing a random vector through the tangent-normal decomposition of Equation 1.

[0083] To obtain a given input vector x∈S n-1 Execute the directed VMF privacy mechanism to generate samples. The mode is given by the input x, and the concentration parameter κ is defined by the privacy parameter ∈. Given a unit vector x∈S n-1 In order to achieve directed privacy using the privacy parameter ∈ (i.e., Privacy (Definition 12) allows setting κ to be equal to ∈ and plotting samples. (Inference 15)

[0084] Alternatively, privacy guarantees for metric privacy (Definition 3) and its variants can be viewed as providing a privacy (or indistinguishability) level l = ∈ r for any two points x, x' within the protection radius r > 0. For directed privacy, this is achieved by sampling from a directed distribution of the concentration parameter κ = l / r (instead of ∈). Thus, the (l / r) privacy mechanism achieves a privacy level l within the protection radius r.

[0085] It is important to note that, as a special case, when x = f(D) is a (query) function f: D → S n-1 As a result, pure differential privacy can be achieved by setting the protection radius r:=Δ to the (worst-case) sensitivity of f (i.e., by sampling with the concentration parameter κ=∈ / Δ, as discussed in Fact 13). Therefore, directed privacy allows pure differential privacy to be relaxed by specifying a protection radius r smaller than the sensitivity Δ.

[0086] Figure 1is a network diagram illustrating an example network environment 100 suitable for providing privacy for directional data. The network environment 100 includes a network-based application 110, client devices 160A and 160B, and a network 150. The network-based application 110 is provided by an application server 120 in communication with a database server 130 and a privacy server 140. The application server 120 accesses application data (e.g., application data stored by the database server 130) via a network interface 170 or an application interface 180 to provide one or more applications to the client devices 160A and 160B.

[0087] Each of the application server 120, the database server 130, the privacy server 140, and the client devices 160A and 160B can be implemented, in whole or in part, in a computer system, as described below with respect to Figure 11 The client devices 160A and 160B can be collectively referred to as client device(s) 160 or generally as a client device 160.

[0088] The client devices 160 provide directional data to the application server 120 for storage in a database of the database server 130. For example, location data (e.g., derived from a global positioning service (GPS) of a cellular phone) can be uploaded to the application server 120 via the network 150 and stored by the database server 130. The location data can be aggregated to provide various services, such as traffic flow measurements, population density measurements, peak time measurements for businesses, or any suitable combination thereof.

[0089] The privacy server 140 accesses the directional data from the database server 130. The privacy server 140 aggregates the directional data (e.g., to determine a mean, a median, a standard deviation, a variance, or any suitable combination thereof) and modifies the aggregated values to provide differential privacy for users that provided the directional data. The functionality of the privacy server 140 can be integrated into the database server 130.

[0090] Alternatively, the client devices 160 can provide privacy for directional data of users by modifying the data before it is uploaded to the application server 120. In either case, the modification can be performed based on a privacy parameter and a probability distribution over an n-sphere, where n is the dimension of the directional data minus one (e.g., one (for two-dimensional data such as a day and a time in a day located on a circle), two (for three-dimensional data such as a location on an (approximately) spherical Earth), or five (for six-dimensional data such as a location and an orientation on a combined sphere)).

[0091] Figure 1 Any of the machines, databases, or devices shown in any of FIGS. 1-3 can be implemented in a general-purpose computer with a software modification, e.g., configuration or programming, to perform the functions described herein for that machine, database, or device. For example, the following discussion with respect to FIG. 4 discusses a computer system that can implement any one or more of the methods described herein. Figure 11 As used herein, a “database” is a data storage resource and can store data structured as one of the following: a text file, a table, a spreadsheet, a relational database (e.g., an object-relational database), a triple store, a hierarchical data store, a document-oriented NoSQL database, a file store, or any appropriate combination thereof. The database can be an in-memory database. Further, as used herein, a “server” is a computer system that responds to requests from other computer systems over a data network. For example, a server can be a web server that responds to requests from web clients over the Internet. Figure 1 Any two or more machines, databases, or devices shown in any of FIGS. 1-3 can be combined as a single machine, a single database, or a single device, and the functions described herein for any single machine, single database, or single device can be subdivided among multiple machines, multiple databases, or multiple devices.

[0092] The application server 120, the database server 130, the privacy server 140, and the client devices 160A and 160B are connected by the network 150. The network 150 can be any network capable of communicating between or among machines, databases, and devices. Thus, the network 150 can be a wired network, a wireless network (e.g., a mobile or cellular network), or any appropriate combination thereof. The network 150 can include one or more portions that constitute a private network, a public network (e.g., the Internet), or any appropriate combination thereof.

[0093] Figure 2is a block diagram 200 of a privacy server 140 suitable for protecting the privacy of directed data. The privacy server 140 is represented as including a communication module 210, a privacy module 220, and a storage module 230, all of which are configured to communicate with one another (e.g., via a bus, shared memory, or a switch). Any one or more of the modules described herein can be implemented using hardware (e.g., a processor of a machine). For example, any of the modules described herein can be implemented by a processor configured to perform the operations described herein for that module. Moreover, any two or more of these modules can be combined into a single module, and the functions described herein for a single module can be subdivided among multiple modules. Furthermore, modules described herein as being implemented within a single machine, a single database, or a single device can be distributed across multiple machines, multiple databases, or multiple devices.

[0094] The communication module 210 receives data sent to the privacy server 140 and sends data from the privacy server 140. For example, the communication module 210 can receive directed data from the client device 160A or the client device 160B to be stored by the database server 130. The privacy server 140 can modify the received directed data before sending the modified data to the database server 130 via the communication module 210, thereby protecting the privacy of the user of the client device 160A or the client device 160B. As another example, the communication module 210 can receive a request for aggregated directed data, request the directed data from the database server 130, and provide the directed data to the privacy module 220 for processing in a manner that protects the privacy of the users who contributed the directed data. Communications sent and received by the communication module 210 can be intermediated by the network 150.

[0095] The privacy module 220 accesses directed data from the database server 130 and generates aggregated results based on the accessed directed data. The aggregated results can be modified based on predetermined privacy factors and probability distributions over n-spheres before being provided in response to a request for the aggregated results. Thus, the provided results are similar to the actual results, but the recipients cannot determine exactly how they differ, thereby protecting the privacy of the users who contributed the underlying directed data.

[0096] The storage module 230 stores predetermined privacy factors and other data used by the privacy module 220 to modify directed data to protect privacy. The storage module 230 can store programming instructions for the communication module 210, the privacy module 220, or both.

[0097] The privacy module 220 is described as part of the privacy server 140, operating on data accessed to the database server 130. Alternatively, the privacy module 220 can be part of the client device 160A and the client device 160B, operating on data generated by the client devices, before providing the privacy-protected directed data to the database server 130.

[0098] Figure 3 is a conceptual diagram of representing time of day as directed data on a 1 -dimensional sphere (circle) 300. Time of day is represented as a 24-hour clock, connecting all times of day continuously. A vector 310 represents time 1 :30. To simplify calculations, the circle 300 can be a unit circle (a circle with radius one), and the vector 310 can be a unit vector (a vector with length one). The arc distance between two vectors can be measured as the smaller angle between the two vectors, regardless of where the two vectors are located on the circle 300. Thus, the arc distance between 23:00 and 1 :00 is radians (30 degrees), even though the 0:00 value is between 23:00 and 1 :00. Since the circle is a unit circle, the distance between the ends of the vectors on the surface of the circle 300 is equal to the arc distance in radians. If the directed data is viewed as linear data ranging from 0 to 23:59, the distance between 1 :00 and 23:00 would be measured as 22 hours apart.

[0099] Figure 4 is a conceptual diagram of representing days of week as directed data on a 1 -dimensional sphere (circle) 400. Days of week are represented in a continuous ring, with no interruption between the starting day and the ending day of the week. A vector 410 represents the day of Monday. To simplify calculations, the circle 400 can be a unit circle, and the vector 410 can be a unit vector. As in Figure 3 , the arc distance between two vectors can be measured as the smaller angle between the two vectors, regardless of where the two vectors are located on the circle 400. Thus, the arc distance between Saturday and Monday is radians, even though the start of the week is between Saturday and Monday. If the directed data is viewed as linear data ranging from Sunday to Saturday, the distance between Monday and Saturday would be measured as five days apart.

[0100] Figure 5is a block diagram of an example database schema 500 suitable for storing directed data and for use in providing privacy for directed data using a privacy measure. The database schema 500 includes a location table 510, a sleep schedule table 540, and a privacy table 570. The location table 510 includes a row 530A, a row 530B, and a row 530C of the format 520. The sleep schedule table 540 includes a row 560A, a row 560B, and a row 560C of the format 550. The privacy table 570 includes a row 590A, a row 590B, and a row 590C of the format 580.

[0101] Each row of the location table 510 stores a user's location on Earth at a certain date and time. The user identifier (ID) field stores a unique identifier for the user. To improve privacy protection, the user ID field can be replaced with a unique record ID, changed for each client device 160 after a predetermined period of time (e.g., every 15 seconds or every 60 seconds), or removed entirely. The fields for latitude and longitude store the user's location at the date and time indicated in the date field. For a client-side privacy protection mechanism, the location data in each row can have been modified by the client before the client uploads the data to the database server 130. For a server-side privacy protection mechanism, the location data in each row can be accurate, but the data will be modified by the privacy module 220 before it is provided to another server or client by the privacy server 140.

[0102] The rows of the sleep schedule table 540 store a user's sleep times and wake-up times. The user ID field stores a unique identifier for the user. The sleep time and wake-up time fields store the times at which the identified user went to sleep and woke up (e.g., as self-reported, as a measured average, or with additional date / day information that allows for multiple rows per user). For a client-side privacy protection mechanism, the time data in each row can have been modified by the client before the client uploads the data to the database server 130. For a server-side privacy protection mechanism, the time data in each row can be accurate, but the data will be modified by the privacy module 220 before it is provided to another server by the privacy server 140.

[0103] The privacy table 570 stores a corresponding epsilon value for each type of directed data. A higher epsilon value increases the privacy of the directed data, but decreases the accuracy of the values reported by the privacy server 140.

[0104] Figure 6 is a diagram 600 representing a true directed data value 620 and a perturbed (or modified) directed data value 650 that protects privacy. The true directed data value 620 is a unit vector μ 620 that identifies a point on the surface of a unit n-sphere 610. Based on the true directed data value 620, the privacy module 220 generates a perturbed directed data value 650 that is within a certain distance of the true directed data value 620. The distance is determined by an epsilon value that is based on the type of directed data and the privacy requirements for the directed data. Figure 5the value t 640 is determined as cos(a). Alternatively, the value t 640 can be sampled from the mixture distribution VMFMix(n, e).

[0105] A unit vector x 650 is randomly selected from the set of unit vectors that are orthogonal to the unit vector m 620. The n-dimensional sphere 610 is viewed as a 2-dimensional circle, and the vector x is selected from the two unit vectors that are orthogonal to m. In Figure 6 In the example of the n-dimensional sphere 610 being a 3-dimensional sphere, the vector x is selected from all unit vectors that are orthogonal to m and pass through the origin of the n-dimensional sphere 610 in a 2-dimensional plane. When the n-dimensional sphere 610 is a hypersphere of dimension greater than 3, the vector x is selected from all unit vectors that are orthogonal to m and pass through the origin of the n-dimensional sphere 610 in an (n-1)-dimensional hyperplane.

[0106] The n-dimensional sphere 610 is viewed as a 3-dimensional sphere, and the vector x is selected from all unit vectors that are orthogonal to m and pass through the origin of the n-dimensional sphere 610 in a 2-dimensional plane. When the n-dimensional sphere 610 is a hypersphere of dimension greater than 3, the vector x is selected from all unit vectors that are orthogonal to m and pass through the origin of the n-dimensional sphere 610 in an (n-1)-dimensional hyperplane.

[0107] A hyperplane is a subspace of one less dimension than the space in which it is embedded. For example, a common 2-dimensional plane exists in 3-dimensional space and can be referred to as a 2-dimensional hyperplane. As another example, a 1-dimensional line in 2-dimensional space is a 1-dimensional hyperplane.

[0108] The modified directional data value x 660 is given by the following equation

[0109]

[0110] A unit vector x (represented by the modified directional data value 650) is randomly selected from the vectors of the locus of points defined by the intersection of the (n-2)-dimensional hyperplane that is perpendicular to m and intersects m at a distance t from the origin of the n-dimensional sphere 610.

[0111] Although the n-dimensional sphere 610 is described as a unit n-dimensional sphere, an n-dimensional sphere with a different radius can also be used. Regardless, in each case, the vector m that identifies a point on the surface of the n-dimensional sphere 610 is a vector from the center of the n-dimensional sphere 610 to the point on the surface of the n-dimensional sphere 610 that has a magnitude equal to the radius of the n-dimensional sphere 610.

[0112] Figure 7 is a block diagram of an example user interface 700 that enables a user to provide real directional data or modified directional data values that protect privacy. The user interface 700 includes an information area 710 and interactive elements 720, 730, and 740.

[0113] The information area 710 indicates that the application is requesting the user's location data (e.g., provided by a GPS device, triangulation of cell tower signals, cumulative motion read from a gyroscope sensor from a known location, or any suitable combination thereof). The user can choose to provide an exact location using the interactive element 720, provide an approximate location using the interactive element 730, or deny the request using the interactive element 740.

[0114] If the user selects the interactive element 720, the user's exact location is provided to the application (e.g., to the network-based application 110 via the network 150). In this case, if the user's directional privacy is protected, this is implemented by the privacy server 140.

[0115] In response to the user's selection of the interactive element 730, only the user's approximate location is provided to the application. For example, the location can be selected from a probability distribution over an n-dimensional sphere based on the user's true location and a privacy parameter (e.g., an epsilon value in the privacy table 570 for the type of directional data being provided).

[0116] As a third option, the user can select the interactive element 740 to completely deny the application's request for location data. Although the user interface 700 relates to location data, similar user interfaces can be used for other types of directional data. By using the user interface 700, the user is enabled to exercise finer control over the user's data than if a simple allow / deny interface were used. As a result, the application can be authorized to access privacy-protected directional data, rather than being completely denied, thereby improving the functionality of the application. Additionally or alternatively, the user can authorize access to privacy-protected directional data, rather than exact directional data, thereby improving the user's privacy.

[0117] Figure 8 is a flowchart showing operations of an example method 800 suitable for protecting the privacy of directional data. The method 800 includes operation 810, operation 820, and operation 830. By way of example and without limitation, the method 800 can be performed by Figure 1 the client device 160A using Figures 2 to 7 modules, databases, structures, and user interfaces shown in FIGS. 1-7 to communicate with the network-based application 110 to perform.

[0118] In operation 810, one or more processors of the client device 160A access directional data of the device. For example, location data of the device indicating a current location of the device as reported by a GPS receiver can be accessed.

[0119] In operation 820, the client device 160A generates modified directional data based on the directional data and a probability distribution over an n-dimensional sphere. For example, a 2-dimensional sphere S2may be used. 2(3-dimensional sphere) based on a probability of a predetermined privacy parameter from a set of locations centered on the current location of the device. The selected location is the modified directional data.

[0120] In operation 830, the client device 160A provides the modified directional data to a server (e.g., to the application server 120 via the network 150) without allowing the server to access the directional data of the device. Thus, the application server 120 is able to use the location data of the user to aggregate metrics (such as tracking traffic), but is unable to pinpoint the precise location of the user, thereby providing a measure of directional privacy to the user.

[0121] By way of example and not limitation, operations 810-830 in the example method 800 are described above as operating on 3-dimensional spherical location data (e.g., GPS data). Alternatively or additionally, operations 810-830 can operate on 2-dimensional circular data of time of day, 2-dimensional circular data of day of week, or 6-dimensional hyperspherical location / orientation data.

[0122] Figure 9 is a flowchart illustrating operations of an example method 900 suitable for protecting the privacy of directional data. The method 900 includes operation 910, operation 920, operation 930, and operation 940. By way of example and not limitation, the method 900 can be performed by Figure 1 the privacy server 140 using the modules, databases, structures, and user interfaces shown in Figures 2 to 7 FIG. 9.

[0123] In operation 910, a server (e.g., the privacy server 140) accesses directional data of a plurality of devices. For example, the plurality of client devices 160 can store directional data of the plurality of client devices 160 in the database server 130 using the database schema 500. The privacy server 140 can perform a database query to select a set of directional data (e.g., to select all location data within an identified time period).

[0124] In operation 920, the server determines a value based on the directional data. For example, the directional data can be used to determine a mean, a median, a standard deviation, a variance, or any appropriate combination thereof.

[0125] In operation 930, the server modifies the determined value based on a probability distribution over an n-dimensional sphere. For example, the probability distribution can identify a set of points having a corresponding probability centered on the determined value. A point is selected from the set of points according to the respective probabilities of the points, and a vector pointing from the center of the n-dimensional sphere to the selected point is used as the modified value.

[0126] In response to a request for a value determined based on the directional data, the server instead provides a modified value (operation 940). Thus, the provided directional data value is based on the actual directional data, but is not identical to the actual directional data, thereby protecting the privacy of individual contributors to the directional data. For example, a request for an average location can be made after each individual location data is provided to the application server 120. The average location provided in each request will be close to the actual average location as determined by the probability distribution. However, it will not be possible to reverse engineer the exact location of each contributing user, thereby providing differential privacy to the users.

[0127] In contrast, if the exact average value is taken from the database and the exact number of values that contributed to the average value is known, then the value of a single additional record can be determined from the updated exact average value. For example, if the mean of the values is known to be 5 and the number of records is known to be 2, and after a single record is added the mean is now 6, then hiding the value of the third record behind a statistical aggregate does not protect the value of the third record. The sum of the original two values was known to be 10 (so the mean was 5), and the sum of the three values is known to be 18 (so the mean is 6). Accordingly, the third value is 8. Thus, even when data is provided in the form of aggregated statistics, differential privacy is not provided without adding some form of differential privacy protection.

[0128] In view of the subject matter described herein, the following examples list is disclosed, wherein an individual feature or more than one feature of an example considered in isolation in combination with one or more features of one or more further examples and optionally in combination with each other is a further example falling within the scope of the disclosure.

[0129] Example 1 is a method comprising: accessing, by one or more processors of a device, directional data of the device; generating, by the one or more processors, modified directional data based on the directional data and a probability distribution over an n-dimensional sphere; and providing the modified directional data to a server via a network without allowing the server to access the directional data of the device.

[0130] In Example 2, the subject matter of Example 1 includes, wherein: the directional data is data of time of day; and the n-dimensional sphere is a 2-dimensional circle.

[0131] In Example 3, the subject matter of Examples 1-2 includes, wherein: the directional data is data of day of week; and the n-dimensional sphere is a 2-dimensional circle.

[0132] In Example 4, the subject matter of Examples 1-3 includes, wherein: the directional data is global positioning data; and the n-dimensional sphere is a 3-dimensional sphere.

[0133] In Example 5, the subject matter of Examples 1-4 includes, wherein: the probability distribution is based on a predetermined privacy parameter.

[0134] In Example 6, the subject matter of Examples 1-5 includes, wherein: the n-dimensional sphere has a center, a radius, and a surface; the directional data of the device is represented as a vector from the center of the n-dimensional sphere to a first point on the n-dimensional sphere, the vector having a magnitude equal to the radius of the n-dimensional sphere; and the generating of the modified directional data includes: selecting the modified directional data from a set of vectors from the center of the n-dimensional sphere to a point on the surface of the n-dimensional sphere and a point on an (n-1)-dimensional hyperplane, wherein the (n-1)-dimensional hyperplane is orthogonal to the vector and intersects the vector at a second point within the n-dimensional sphere.

[0135] In Example 7, the subject matter of Example 6 includes, wherein: the modified directional data is selected based on a sampled value from a mixture distribution.

[0136] Example 8 is a device comprising: a memory storing instructions; and one or more processors configured by the instructions to perform operations comprising: accessing directional data of the device; generating modified directional data based on the directional data and a probability distribution over an n-dimensional sphere; and providing the modified directional data to a server via a network without allowing the server to access the directional data of the device.

[0137] In Example 9, the subject matter of Example 8 includes, wherein: the directional data is data of a time of day; and the n-dimensional sphere is a 2-dimensional circle.

[0138] In Example 10, the subject matter of Examples 8-9 includes, wherein: the directional data is data of a day of week; and the n-dimensional sphere is a 2-dimensional circle.

[0139] In Example 11, the subject matter of Examples 8-10 includes, wherein: the directional data is global positioning data; and the n-dimensional sphere is a 3-dimensional sphere.

[0140] In Example 12, the subject matter of Examples 8-11 includes, wherein: the probability distribution is based on a predetermined privacy parameter.

[0141] In Example 13, the subject matter of Examples 8-12 includes, wherein: the n-dimensional sphere has a center, a radius, and a surface; the device's directional data is represented as a vector from the center of the n-dimensional sphere to a first point on the n-dimensional sphere, the vector having a magnitude equal to the radius of the n-dimensional sphere; and the generating of the modified directional data includes: selecting the modified directional data from a set of vectors from the center of the n-dimensional sphere to a point on the surface of the n-dimensional sphere and a point on an (n-1)-dimensional hyperplane, wherein the (n-1)-dimensional hyperplane is orthogonal to the vector and intersects the vector at a second point within the n-dimensional sphere.

[0142] In Example 14, the subject matter of Example 13 includes, wherein: the modified directional data is selected based on a sampled value from a mixture distribution.

[0143] Example 15 is a non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a device, cause the one or more processors to perform operations comprising: accessing directional data of the device; generating modified directional data based on the directional data and a probability distribution over an n-dimensional sphere; and providing the modified directional data to a server via a network without allowing the server to access the directional data of the device.

[0144] In Example 16, the subject matter of Example 15 includes, wherein: the directional data is data of a time of day; and the n-dimensional sphere is a 2-dimensional circle.

[0145] In Example 17, the subject matter of Examples 15-16 includes, wherein: the directional data is data of a day of week; and the n-dimensional sphere is a 2-dimensional circle.

[0146] In Example 18, the subject matter of Examples 15-17 includes, wherein: the directional data is global positioning data; and the n-dimensional sphere is a 3-dimensional sphere.

[0147] In Example 19, the subject matter of Examples 15-18 includes, wherein: the probability distribution is based on a predetermined privacy parameter.

[0148] In Example 20, the subject matter of Examples 15-19 includes, wherein: the n-sphere has a center, a radius, and a surface; the directional data of the device is represented as a vector from the center of the n-sphere to a first point on the n-sphere, the vector having a magnitude equal to the radius of the n-sphere; and the generating of the modified directional data includes: selecting the modified directional data from a set of vectors from the center of the n-sphere to a point on the surface of the n-sphere and a point on an (n-1)-dimensional hyperplane that is orthogonal to the vector and intersects the vector at a second point within the n-sphere.

[0149] Example 21 is at least one machine readable medium comprising instructions, which, when executed by processing circuitry, cause the processing circuitry to perform operations to implement any of Examples 1-20.

[0150] Example 22 is an apparatus comprising means for implementing any of Examples 1-20.

[0151] Example 23 is a system implementing any of Examples 1-20.

[0152] Example 24 is a method implementing any of Examples 1-20.

[0153] Figure 10 is a block diagram 1000 representing one example of a software architecture for a computing device 1002. The architecture 1002 can be used in conjunction with various hardware architectures ranging from a Figure 10 is a non-limiting example of a software architecture, and that many other architectures can be implemented to facilitate the functionality described herein. A representative hardware layer 1004 is illustrated and can represent, for example, any of the computing devices described above with reference to the illustrative examples. In some examples, the hardware layer 1004 can be implemented by one or more processors of a mobile or stationary computing device. Figure 10 in accordance with the architecture of the computer system 1000.

[0154] The representative hardware layer 1004 includes one or more processing units 1006 having associated executable instructions 1008. The executable instructions 1008 represent executable instructions of the software architecture 1002, including implementation of the methods, modules, subsystems, and so on, described herein, and the representative hardware layer 1004 can also include memory and / or storage modules 1010 that also have executable instructions 1008. The hardware layer 1004 can also include other hardware 1012 that indicates any other hardware of the hardware layer 1004, such as hardware that is not software-enabled or some of the hardware that is software-enabled.

[0155] In Figure 10In the example architecture of FIG. 10, the software architecture 1002 can be conceptualized as a stack of layers, where each layer provides particular functionality. For example, the software architecture 1002 can include layers such as an operating system 1014, libraries 1016, frameworks / middleware 1018, applications 1020, and a presentation layer 1044. Operationally, the applications 1020 and / or other components within the layers can invoke application programming interface (API) calls 1024 and, in response to the API calls 1024, one or more of the layers can perform operations in response to the API calls 1024. The illustrated layers are representative and not all software architectures have all layers. For example, some mobile or special purpose operating systems can not provide a frameworks / middleware 1018 layer, while others can provide such a layer. Other software architectures can include additional or different layers.

[0156] The operating system 1014 can manage hardware resources and provide common services. The operating system 1014 can include, for example, a kernel 1028, services 1030, and drivers 1032. The kernel 1028 can act as an abstraction layer between the hardware and the other software layers. For example, the kernel 1028 can be responsible for memory management, processor management (for example, scheduling), component management, networking, security settings, and so on. The services 1030 can provide other common services for the other software layers. In some examples, the services 1030 include an interrupt service. The interrupt service can detect receipt of an interrupt and, in response, cause the architecture 1002 to pause the current processing of the architecture 1002 and execute an interrupt service routine (ISR) when access to the interrupt is made.

[0157] The drivers 1032 can be responsible for controlling or interfacing with the underlying hardware. For instance, depending upon the hardware configuration, the drivers 1032 can include display drivers, camera drivers, flash memory drivers, serial communication drivers (for example, Universal Serial Bus (USB) drivers), audio drivers, NFC drivers, audio drivers, power management drivers, and so on.

[0158] ​The library 1016 can provide a common infrastructure that can be utilized by the applications 1020 and / or other components and / or layers. The library 1016 typically provides functionality that allows other software modules to perform tasks in an easier fashion than to interface directly with the underlying operating system 1014 functionality (e.g., kernel 1028, services 1030 and / or drivers 1032). The library 1016 can include system libraries 1034 (e.g., C standard library) that can provide functions such as memory allocation functions, string manipulation functions, mathematical functions, and the like. Further, the library 1016 can include API libraries 1036 such as media libraries (e.g., libraries to support presentation and manipulation of various media formats such as MPEG4, H.264, MP3, AAC, AMR, JPG, PNG), graphics libraries (e.g., an OpenGL framework that can be used to render two-dimensional and three-dimensional graphics on a display), database libraries (e.g., SQLite that can provide various relational database functions), web libraries (e.g., WebKit that can provide web browsing functionality), and the like. The library 1016 can also include a wide variety of other libraries 1038 to provide many other APIs to the applications 1020 and other software components / modules.

[0159] The framework / middleware 1018 can provide more high level common infrastructure that can be utilized by the applications 1020 and / or other software components / modules. For example, the framework / middleware 1018 can provide various graphical user interface (GUI) functions, high-level resource management, high-level location services, and so forth. The framework / middleware 1018 can provide a broad spectrum of other APIs that can be utilized by the applications 1020 and / or other software components / modules, some of which can be specific to a particular operating system or platform.

[0160] The applications 1020 include built-in applications 1040 and / or third-party applications 1042. Examples of representative built-in applications 1040 can include, but are not limited to, a contacts application, a browser application, a book reader application, a location application, a media application, a messaging application, and / or a game application. Third-party applications 1042 can include any built-in applications as well as a broad assortment of other applications. In a specific example, the third-party application 1042 (e.g., which is developed by an entity other than the vendor of the particular platform) can be an application developed using the Android TM or iOS TM software development kit (SDK) by the vendor of the particular platform (e.g., the operating system and / or development tools provided by Apple® or Google®). TM TM ​​Mobile software running on a mobile operating system of a phone or other mobile computing device. In this example, the third-party application 1042 can invoke API calls 1024 provided by the mobile operating system, such as operating system 1014, to push functionality described herein.

[0161] The applications 1020 can utilize built-in operating system functions (e.g., kernel 1028, services 1030 and / or drivers 1032), libraries (e.g., system libraries 1034, API libraries 1036, and other libraries 1038), frameworks / middleware 1018 to create user interfaces to interact with users. Alternatively, or additionally, in some systems, interaction with users can occur through presentation layers, such as presentation layer 1044. In these systems, the application / module "logic" can be separated from the aspects of the application / module that interact with users.

[0162] Some software architectures utilize virtual machines. In Figure 10 In the example of FIG. 10, this is illustrated by virtual machine 1048. The virtual machine creates a software environment where applications / modules can execute as if the applications / modules were executing on a hardware computing device. The virtual machine is hosted by a host operating system (operating system 1014) and typically, although not always, has a virtual machine monitor 1046 that manages the operation of the virtual machine 1048 and the interface with the host operating system (i.e., operating system 1014). A software architecture executes within the virtual machine 1048 (such as operating system 1050, libraries 1052, frameworks / middleware 1054, applications 1056, and / or presentation layer 1058). These layers of the software architecture executing within the virtual machine 1048 can be the same as or different from the corresponding layers previously described.

[0163] Modules, components, and logic.

[0164] A computer system can include a logic, component, module, mechanism, or any suitable combination thereof. A module can constitute software modules (e.g., code contained in (1) a non-transitory machine-readable medium or in (2) a transmission signal) or hardware-implemented modules. A hardware-implemented module is tangible unit capable of performing certain operations and can be configured or arranged in a certain manner. One or more computer systems (e.g., a standalone, client or server computer system) or one or more hardware processors can be configured by software (e.g., an application or application portion) as a hardware-implemented module that operates to perform certain operations.

[0165] A module implemented by hardware can be implemented with both analog and digital hardware, and can include, for example, an application- specific integrated circuit (ASIC) adapted to perform some or all of the applicable operations disclosed in this specification. Additionally, a module implemented by hardware can be implemented with a general purpose processor, a special purpose processor, and / or a special purpose computer, e.g., a microprocessor, a microcontroller, an impact controller, a programmable logic controller, a field-programmable gate array (FPGA), a digital signal processor (DSP), etc.

[0166] Accordingly, the term "module implemented by hardware" should be understood to encompass a tangible entity that is physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain manner and / or to perform certain operations described herein. A module implemented by hardware can be temporarily configured (e.g., programmed) by inputs. In this case, the module does not require permanent configuration (e.g., hardwiring), and each of the modules need not be configured or instantiated at the same instance in time. For example, where the module comprises a general-purpose processor configured using software, the general-purpose processor can be configured as respective different modules at different times. For example, the software can configure a processor, for example, to constitute a particular module at one instance of time and to constitute a different module at a different instance of time.

[0167] A module implemented by hardware can provide information to, and receive information from, other modules implemented by hardware. Accordingly, such modules implemented by hardware can be regarded as communicating with each other. Where multiple of such modules exist contemporaneously, communications can be achieved through signal transmission (e.g., over appropriate circuits and buses) that is well known to those skilled in the art. Multiple modules implemented by hardware can be configured or instantiated at different times. Communications between such modules implemented by hardware can be achieved by storing information in a memory structure to which the modules have access and by causing the modules to access the memory structure at different times. For example, one module implemented by hardware can perform an operation and store the output of that operation in a memory device to which it is communicatively coupled. A further module implemented by hardware can then, at a later time, access the memory device to retrieve and process the stored output. Modules implemented by hardware can also initiate communications with input or output devices, and can operate on resources (e.g., a collection of information).

[0168] The various operations of the example methods described herein can be performed, at least in part, by one or more processors that are temporarily or permanently configured (e.g., via software) to perform the relevant operations. Whether temporarily or permanently configured, such processors can constitute processor-implemented modules that operate to perform one or more operations or functions. Modules referred to herein can include processor-implemented modules.

[0169] Similarly, the methods described herein can be implemented at least partially by a processor. For example, at least some operations of the method can be performed by one or more processors or modules implemented by processors. The execution of a particular operation can be distributed across one or more processors, wherein the one or more processors reside not only within a single machine but are also deployed across multiple machines. The one or more processors can be located in a single location (e.g., in a home environment, in an office environment, or within a server cluster), or the processors(s) can be distributed across multiple locations.

[0170] One or more processors may also be operable to support the execution of related operations in a “cloud computing” environment or as “Software as a Service” (SaaS). For example, at least some operations may be performed by a group of computers (as an example of a machine that includes processors), and these operations may be accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs).

[0171] Electronic devices and systems

[0172] The systems and methods described herein can be implemented using digital electronic circuits, computer hardware, firmware, software, computer program products (e.g., computer programs tangibly contained in an information carrier (e.g., in a machine-readable medium for performing or controlling the operation of a data processing apparatus by the operation of a data processing apparatus (e.g., a programmable processor, a computer, or a plurality of computers)) or any suitable combination thereof.

[0173] Computer programs can be written in any programming language (including compiled or interpreted languages) and can be deployed in any form (including as stand-alone programs or as modules, subroutines, or other units suitable for use in a computing environment). Computer programs can be deployed to execute on a single computer or multiple computers at a single site, or they can be deployed across multiple sites (e.g., cloud computing) and interconnected via communication networks. In cloud computing, server-side functionality can be distributed across multiple computers connected via a network. Load balancers are used to distribute work among multiple computers. Therefore, a cloud computing environment for executing a method is a system comprising multiple processors on multiple computers tasked with performing operations to execute the method.

[0174] The operations can be performed by one or more programmable processors executing a computer program to perform functions by operating on input data and generating output. Method operations can also be performed by, and apparatus of a system can be implemented as, special purpose logic circuitry, e.g., an FPGA or an ASIC, for example.

[0175] The computing system can include a client and a server. The client and the server are generally remote from each other and typically interact through a communication network. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other. Programmable computing systems can deploy hardware architectures, software architectures, or both, for deployment. Specifically, it will be appreciated that a choice of hardware and software architectures can impact the design of a particular system. Examples of hardware and software architectures that can be deployed, are listed below.

[0176] Example machine architectures and machine-readable media

[0177] Figure 11 is a block diagram of a machine in an example form of a computer system 1100 that can perform instructions 1124 to cause the machine to perform any one or more of the methodologies discussed herein. The machine can operate as a standalone device or can be connected (e.g., networked) to other machines. In a networked deployment, the machine can operate in the capacity of a server or a client machine in server-client network environments or other peer-to-peer (or distributed) network environments. The machine can be a personal computer (PC), a tablet PC, a set-top box (STB), a personal digital assistant (PDA), a cellular telephone, a web appliance, a network router, switch or bridge, or any machine capable of executing instructions (sequential or otherwise) that specify actions to be taken by that machine. Further, while only a single machine is illustrated, the term "machine" shall also be taken to include any collection of machines that individually or jointly execute a set (or multiple sets) of instructions to perform any one or more of the methodologies discussed herein.

[0178] The example computer system 1100 includes a processor 1102 (e.g., a central processing unit (CPU), a graphics processing unit (GPU) or both), a main memory 1104 and a static memory 1106, which communicate with each other via a bus 1108. The computer system 1100 can further include a video display unit 1110 (e.g., a liquid crystal display (LCD) or a cathode ray tube (CRT)). The computer system 1100 also includes an alphanumeric input device 1112 (e.g., a keyboard or a touch-sensitive display screen), a user interface (UI) navigation (or cursor control) device 1114 (e.g., a mouse), a storage unit 1116, a signal generation device 1118 (e.g., a speaker), and a network interface device 1120.

[0179] Machine-readable medium

[0180] The storage unit 1116 includes a machine-readable medium 1122 on which is stored one or more sets of instructions 1124 (e.g., software) containing any one or more of the methodologies or functions described herein, or data structures utilized thereby. The instructions 1124 can also reside, completely or at least partially, within the main memory 1104 and / or within the processor 1102 during execution thereof by the computer system 1100, the main memory 1104 and the processor 1102 also constituting machine-readable media 1122.

[0181] While Figure 11 Although the machine-readable medium 1122 is illustrated in the example of FIG. 11 as a single medium, the term“machine-readable medium” can include a single medium or multiple media (e.g., a centralized or distributed database, and / or associated caches and servers) that store the one or more sets of instructions 1124 or data structures. The term“machine-readable medium” shall also be taken to include any tangible medium that is capable of storing, encoding or carrying the instructions 1124 for execution by a machine and that cause the machine to perform any one or more of the methodologies of the present disclosure, or that is capable of storing, encoding or carrying data structures utilized by or associated with such instructions 1124. The term“machine-readable medium” shall accordingly be taken to include, but not be limited to, solid-state memories, and optical and magnetic media. Specific examples of machine-readable media 1122 include non-volatile memory, including by way of example semiconductor memory devices (e.g., erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM)) and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and compact-disc read-only memory (CD-ROM) and digital versatile disc read-only memory (DVD-ROM) disks. The machine-readable media 1122 do not include carrier waves.

[0182] Transmission medium

[0183] The instructions 1124 can further be transmitted or received using a transmission medium via the network interface device 1120 and any one of a number of well-known transfer protocols (e.g., hypertext transfer protocol (HTTP)). Examples of communication networks include a local area network (LAN), a wide area network (WAN), the Internet, mobile telephone networks, plain old telephone (POTS) networks, and wireless data networks (e.g., WiFi and WiMAX networks). The term “transmission medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying the instructions 1124 for execution by the machine, and includes digital or analog communications signals or other intangible media to facilitate communication of such software.

[0184] Although specific examples were described herein, it will be apparent to those skilled in the art that various modifications and changes can be made to the examples without departing from the broader spirit and scope of the disclosure. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense. The accompanying drawings, which are part of the detailed description, illustrate the specific examples described herein by way of example, not by way of limitation. The examples shown are full detailed descriptions of specific examples that can be practiced by those skilled in the art.

[0185] Some portions of the subject matter discussed herein can be presented in terms of algorithms or symbolic representations of operations on data stored as bits or binary digital signals within a machine memory (e.g., a computer memory). Such algorithms or symbolic representations are examples of techniques used by those of ordinary skill in the data processing arts to convey the substance of their work to others. As used herein, an “algorithm” is a self-consistent sequence of operations or similar processing leading to a desired result. In this context, algorithms and operations involve physical manipulation of physical quantities. Typically, but not necessarily, such quantities can take the form of electrical, magnetic, or optical signals capable of being stored, accessed, transferred, combined, compared, or otherwise manipulated by a machine. It is convenient at times to refer to these signals using words such as “data,” “content,” “bits,” “values,” “elements,” “symbols,” “characters,” “terms,” “numbers,” “numerals,” or the like. However, it should be clear that these words are simply convenient labels and are to be associated with appropriate physical quantities.

[0186] Unless specifically stated otherwise, discussions herein using terms such as "processing," "computing," "calculating," "determining," "presenting," "displaying," or the like, can refer to actions or processes of a machine (e.g., a computer) that manipulates or transforms data represented as physical (e.g., electronic, magnetic, or optical) quantities within one or more memories (e.g., volatile memory, non-volatile memory, or any suitable combination thereof), registers, or other machine components that receive, store, communicate, or display information. Furthermore, unless specifically stated otherwise, the terms "a" and "an" are herein used, as is common in patent documents, to include one or more than one instance. Finally, as used herein, the conjunction "or" refers to a non-exclusive "or," unless specifically stated otherwise.

Claims

1. A method for privacy of directed data, comprising: The directed data of the device is accessed by one or more processors of the device; The one or more processors generate modified directed data based on the directed data and a probability distribution on an n-dimensional sphere; and The modified directed data is provided to the server via the network, but the server is not allowed to access the directed data of the device; wherein: The probability distribution is based on predetermined privacy parameters; The n-dimensional sphere has a center, a radius, and a surface; The directed data of the device is represented as a vector from the center of the n-dimensional sphere to a first point on the n-dimensional sphere, the magnitude of which is equal to the radius of the n-dimensional sphere; and The generation of the modified directed data includes: The modified directed data is selected from the set of vectors from the center of the n-dimensional sphere to points on the surface of the n-dimensional sphere and points on the (n-1)-dimensional hyperplane, wherein the (n-1)-dimensional hyperplane is orthogonal to the vector and intersects the vector at a second point within the n-dimensional sphere; The modified directed data is selected based on sampled values ​​from a mixed distribution; and The modified directed data is selected by the client device based on the directed data, the privacy parameters, and the probability distribution on the n-dimensional sphere.

2. The method according to claim 1, wherein: The directed data is data on the time of day; and The n-dimensional sphere is a 2-dimensional circle.

3. The method according to claim 1, wherein: The directed data refers to the data for the days of the week; and The n-dimensional sphere is a 2-dimensional circle.

4. The method according to claim 1, wherein: The directed data is global positioning data; and The n-dimensional sphere is a 3-dimensional sphere.

5. A device for privacy of directed data, comprising: Memory, storing instructions; as well as One or more processors, configured by the instructions to perform operations, the operations including: Access directed data of the device; Modified directed data is generated based on the directed data and the probability distribution on the n-dimensional sphere; and The modified directed data is provided to the server via the network, but the server is not allowed to access the directed data of the device; wherein: The probability distribution is based on predetermined privacy parameters; The n-dimensional sphere has a center, a radius, and a surface; The directed data of the device is represented as a vector from the center of the n-dimensional sphere to a first point on the n-dimensional sphere, the magnitude of which is equal to the radius of the n-dimensional sphere; and The generation of the modified directed data includes: The modified directed data is selected from the set of vectors from the center of the n-dimensional sphere to points on the surface of the n-dimensional sphere and points on the (n-1)-dimensional hyperplane, wherein the (n-1)-dimensional hyperplane is orthogonal to the vector and intersects the vector at a second point within the n-dimensional sphere; The modified directed data is selected based on sampled values ​​from a mixed distribution; and The modified directed data is selected by the client device based on the directed data, the privacy parameters, and the probability distribution on the n-dimensional sphere.

6. The device according to claim 5, wherein: The directed data is data on the time of day; and The n-dimensional sphere is a 2-dimensional circle.

7. The device according to claim 5, wherein: The directed data refers to the data for the days of the week; and The n-dimensional sphere is a 2-dimensional circle.

8. The device according to claim 5, wherein: The directed data is global positioning data; and The n-dimensional sphere is a 3-dimensional sphere.

9. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a device, cause the one or more processors to perform operations, the operations comprising: Access directed data of the device; The modified directed data is generated based on the directed data and the probability distribution on the n-dimensional sphere; as well as The modified directed data is provided to the server via the network, but the server is not allowed to access the directed data of the device; wherein: The probability distribution is based on predetermined privacy parameters; The n-dimensional sphere has a center, a radius, and a surface; The directed data of the device is represented as a vector from the center of the n-dimensional sphere to a first point on the n-dimensional sphere, the magnitude of which is equal to the radius of the n-dimensional sphere; and The generation of the modified directed data includes: The modified directed data is selected from the set of vectors from the center of the n-dimensional sphere to points on the surface of the n-dimensional sphere and points on the (n-1)-dimensional hyperplane, wherein the (n-1)-dimensional hyperplane is orthogonal to the vector and intersects the vector at a second point within the n-dimensional sphere; The modified directed data is selected based on sampled values ​​from a mixed distribution; and The modified directed data is selected by the client device based on the directed data, the privacy parameters, and the probability distribution on the n-dimensional sphere.

10. The computer-readable medium according to claim 9, wherein: The directed data is data on the time of day; and The n-dimensional sphere is a 2-dimensional circle.

11. The computer-readable medium according to claim 9, wherein: The directed data refers to the data for the days of the week; and The n-dimensional sphere is a 2-dimensional circle.

12. The computer-readable medium according to claim 9, wherein: The directed data is global positioning data; and The n-dimensional sphere is a 3-dimensional sphere.

Images