Differential privacy using count mean sketch

Abstract

The present disclosure relates to differential privacy using count mean sketch. Embodiments described herein provide a privacy mechanism for protecting data when transmitting user data to a server that estimates the frequency of such data among a set of client devices. In one embodiment, a differential privacy mechanism is implemented using a count mean sketch technique that can reduce the resource requirements needed to enable privacy while providing provable guarantees on privacy and utility. For example, the mechanism can provide the ability to customize utility (e.g., accuracy of estimates) according to resource requirements (e.g., transmission bandwidth and computational complexity).

Description

[0001] Cross-references

[0002] This application is a divisional application of the invention patent application with international application number PCT / US2018 / 024772, international application date of March 28, 2018, entry into the Chinese national phase date of November 21, 2019, Chinese national application number 201880033643.2, and invention title "Differential Privacy Using a Count Mean Sketch".

[0003] This application claims priority to U.S. Provisional Patent Application No. 62 / 514,933, filed June 4, 2017, which is incorporated herein by reference.

[0004] This application also claims priority to U.S. Patent Application No. 15 / 805,591, filed November 7, 2017, which is incorporated herein by reference.

[0005] This application also claims priority to U.S. Patent Application No. 15 / 805,611, filed November 7, 2017, which is incorporated herein by reference.

[0006] This application also claims priority to U.S. Patent Application No. 15 / 805,632, filed November 7, 2017, which is incorporated herein by reference. Technical Field

[0007] This disclosure relates generally to the field of differential privacy. More specifically, this disclosure relates to a system that implements an effective differential privacy mechanism while still maintaining privacy and utility guarantees. Background Technology

[0008] As the amount of information collected in the online environment grows, individuals are increasingly protecting the information they provide in various forms. Therefore, differential privacy has become an important consideration for providers aggregating online information. In a crowdsourcing client / server environment, local differential privacy introduces randomness into user data before clients share it with the server. The server can learn from the aggregation of crowdsourced data from all clients, but it cannot learn from data provided by any particular client. As more user information is collected, general patterns begin to emerge, which can inform and enhance the user experience. Thus, differential privacy provides insights from large datasets, but also offers mathematical proofs of keeping information about individual individuals private.

[0009] When employing local differential privacy, client devices need to perform various computations to create privatized data. These client-side computations may include encoding data, which can be resource-intensive in terms of computational cost and transmission bandwidth in some cases (e.g., when the order of random values ​​reaches thousands or millions). Furthermore, the server must also perform corresponding intensive computations to process the privatized data. Therefore, there is a continuous need to provide efficient mechanisms for achieving local differential privacy of user data. Summary of the Invention

[0010] The embodiments described herein provide a privacy mechanism for protecting data when transmitting user data to a server that estimates the frequency of such data across a set of client devices. In one embodiment, a differential privacy mechanism is implemented using a count mean sketch technique, which reduces the resource requirements for enabling privacy while providing provable guarantees regarding privacy and utility. For example, this mechanism can provide the ability to tailor utility (e.g., the accuracy of the estimate) based on resource requirements (e.g., transmission bandwidth and computational complexity).

[0011] One embodiment provides a non-transitory machine-readable medium storing instructions that, when executed by one or more processors of a computing device, cause the computing device to perform an operation comprising: selecting a user data value to be transmitted to a server from a set of possible user data values ​​collected on a client device; creating a hash entry for the user data value using a random hash function, wherein the random hash function is generated from a variant of the randomly selected entry, and wherein a set of possible variants of the entry is indexed; encoding at least a portion of the hash entry of the value as a vector, wherein the encoding includes updating the vector value at a position corresponding to the hash; privatizing the vector by changing at least some of the vector values ​​with a predefined probability; and transmitting the privatized vector and the index value of the randomly selected variant to the server, such that the server is able to estimate the frequency of user data values ​​on a set of client devices.

[0012] One embodiment provides an electronic device including one or more processors and a memory coupled to the one or more processors, the memory storing instructions that, when executed by the one or more processors, cause the one or more processors to select user data values ​​to be transmitted to a server from a set of possible user data values ​​collected on a client device; create hash entries for the user data values ​​using a random hash function, wherein the random hash function is generated from variants of the randomly selected entries, and wherein a set of possible variants of the entries is indexed; encode at least a portion of the created hash values ​​as a vector, wherein encoding at least the portion of the created hash includes: updating vector values ​​at positions corresponding to the created hash values; privatizing the vector by changing at least some of the vector values ​​with a predefined probability; and transmitting the privatized vector and the index values ​​of the randomly selected variants to a server, the server estimating the frequency of user data values ​​in a set of different client devices.

[0013] One embodiment provides a data processing system including one or more processors and a memory coupled to the one or more processors, the memory storing instructions that, when executed by the processors, cause the processors to perform operations including selecting user data values ​​to be transmitted to a server from a set of possible user data values ​​collected on a client device, the set of possible user data values ​​being used to create a hash item for the user data values ​​using a random hash function, wherein the random hash function is generated from variants of the randomly selected item, and wherein a set of possible variants of the item is indexed; encoding at least a portion of the created hash values ​​as a vector, wherein the encoding includes: updating the vector values ​​at positions corresponding to the created hash values; privatizing the vector differential by changing at least some of the vector values ​​with a predefined probability; and transmitting the privatized vector and the index value of the randomly selected variants to the server, wherein the server estimates the frequency of the user data values ​​by updating a frequency table indexed by a set of possible variants.

[0014] Other features of this embodiment will become apparent from the accompanying drawings and the following detailed description. Attached Figure Description

[0015] The embodiments disclosed herein are illustrated by way of example rather than limitation in the accompanying drawings, in which similar reference numerals refer to similar elements.

[0016] Figure 1 This is a block diagram illustrating an exemplary outline of a system environment according to an embodiment of the present disclosure.

[0017] Figure 2 This is a block diagram of a system for differentially privatizing shared user data according to an embodiment of this disclosure.

[0018] Figure 3 This is an exemplary process flow for the coded differential privatization of user data according to an implementation scheme of this disclosure.

[0019] Figure 4 An exemplary data stream is shown, according to an implementation scheme, for transmitting privatized encoding of user data to a server for frequency estimation.

[0020] Figures 5 to 6 A mathematical algorithm for a differential privacy mechanism based on the implementation scheme described herein is presented.

[0021] Figure 7 This is an exemplary flowchart illustrating a method for privatizing the encoded differential of user data to be transmitted to a server according to an implementation scheme.

[0022] Figures 8A to 8F These are exemplary flowcharts and diagrams regarding crowdsourcing user interaction and device resource consumption data, based on the implementation plan.

[0023] Figure 9 This is a block diagram illustrating an exemplary API architecture that can be used in some implementation schemes.

[0024] Figures 10A to 10B This is a block diagram of an exemplary API software stack according to the implementation plan.

[0025] Figure 11 It is a block diagram of the mobile device architecture according to the implementation plan.

[0026] Figure 12 This is a block diagram illustrating an exemplary computing system that can be used in conjunction with one or more embodiments of this disclosure. Detailed Implementation

[0027] In various scenarios, the user experience of computing devices can be improved by attempting to understand the current usage trends of these devices. For example, predictive keyboard suggestions can be improved by identifying which new words are popular or which emojis are most frequently selected. Web browser behavior can be adjusted based on detected user behavior when browsing certain websites. Additionally, battery life can be extended by identifying which websites currently exhibit issues that may affect device battery life. However, such data can be considered personal to the user and should be privatized or otherwise encoded to mask the identity of the user providing such data. The embodiments described herein provide differential privacy encoding for user data, which is used to estimate the frequency of such data across a set of client devices. Such embodiments provide differential privacy techniques that can be used to reduce resource requirements or enhance the user experience while providing provable guarantees regarding privacy and utility.

[0028] Various embodiments and aspects will be described in detail below with reference to the accompanying drawings, which will illustrate the various embodiments. The following description and drawings are illustrative and should not be construed as limiting. Numerous specific details are described to provide a comprehensive understanding of the various embodiments. However, in some instances, well-known or conventional details have not been described in order to provide a concise discussion of the embodiments.

[0029] In this specification, "an embodiment," "an implementation," or "some embodiments" means that a particular feature, structure, or characteristic described in connection with that embodiment can be included in at least one embodiment. The phrase "implementation" appearing in various places in this specification does not necessarily refer to the same embodiment.

[0030] It should be noted that the flowcharts or steps (or operations) described herein may vary without departing from the implementation scheme described herein. For example, steps may be performed in parallel, simultaneously, or in a different order, or steps may be added, deleted, or modified.

[0031] This disclosure recognizes that the use of personal information data in the techniques described herein can be beneficial to users. For example, such personal information data can be used to deliver targeted content that is of interest to the user. Therefore, the use of such personal information data enables planned control over the delivered content. Furthermore, this disclosure also anticipates other uses of personal information data that are beneficial to the user.

[0032] This disclosure further envisions that entities responsible for the collection, analysis, disclosure, transmission, storage, or other use of such personal information data will comply with established privacy policies and / or privacy practices. Specifically, such entities should implement and adhere to privacy policies and practices that are recognized as meeting or exceeding industry or governmental requirements for maintaining the privacy and security of personal information data. For example, personal information from users should be collected for legitimate and reasonable purposes of the entity and not shared or sold outside of these legitimate purposes. Furthermore, such collection should only be conducted after the user's informed consent. Additionally, such entities should take any necessary steps to safeguard and protect access to such personal information data and ensure that others with access to such personal information data comply with their privacy policies and procedures. Furthermore, such entities may be subject to third-party evaluations to demonstrate their compliance with widely accepted privacy policies and practices.

[0033] Regardless of the foregoing, this disclosure also anticipates implementation schemes for users to selectively block the use or access to personal information data. That is, this disclosure anticipates providing hardware and / or software components to prevent or block access to such personal information data. For example, with respect to advertising delivery services, the technology of this disclosure can be configured to allow users to opt-in or opt-out during service registration to participate in the collection of personal information data. As another example, users can choose not to provide location information for targeted content delivery services. Yet another example is that users can choose not to provide precise location information but allow the transmission of location area information.

[0034] Differential privacy mechanism

[0035] The implementation described herein provides a differential privacy mechanism that can be used to privatize user data collected for crowdsourcing. As a general overview, local differential privacy introduces randomness into client-side user data before sharing it. In contrast to having a centralized data source D = {d1, ..., dn}, each data entry d... i Belongs to a separate client i. Given the transcript T that interacts with client i. i If data elements are replaced with null, the adversary may be unable to distinguish T. i The transcripts that should have already been generated. The degree of indistinguishability (e.g., the degree of privacy) is parameterized by ε, a privacy parameter representing the trade-off between the strength of privacy guarantees and the accuracy of published results. Typically, ε is considered a small constant. In some implementations, the value of ε can vary based on the type of data to be privatized, where more sensitive data is privatized to a higher degree. The following is a formal definition of local differential privacy.

[0036] Let n be the number of clients in the client-server system, let Γ be a set of all possible transcripts generated from any single client-server interaction, and let T be... i Let d be the transcript generated by differential privacy algorithm A during interaction with client i. i Let S be a data element of client i. Algorithm A is ε-local differential privacy if the following equation holds for all subsets T ⊆ Γ:

[0037] .

[0038] Here, d i = null refers to the case where the data element of client i is removed. In other words, an adversary with n-1 data points in the dataset cannot reliably test whether the nth data point is a specific value. Therefore, the differentially privatized dataset cannot be queried in a way that allows determination of any specific user's data.

[0039] The systems (and methods) disclosed herein include an ε-locally differentiated, private count-means sketching mechanism that provides improvements in accuracy, bandwidth, and computational cost relative to client and server while maintaining user privacy. A private count-means sketching mechanism can be provided within the system environment described herein. Using an average value in the count-means sketching mechanism allows for a trade-off between processing time and accuracy. Using other mechanisms, such as median-based mechanisms, the increased processing time may not lead to improved accuracy. Conversely, the count-means sketching mechanism can be used to achieve higher accuracy by spending more processing time.

[0040] Figure 1 This is a block diagram outlining such a system 100 according to embodiments of the present disclosure. As shown, system 100 may include client devices 110a-110c (or collectively referred to as 110) and server 130, which may be coupled via network 120. Network 120 may be any suitable type of wired or wireless network, such as a local area network (LAN), a wide area network (WAN), or a combination thereof. Client device 110 may include any type of computing device, such as a desktop computer, tablet computer, smartphone, set-top box, or other computing devices as described below in device architecture 1100 and / or system 1200. Exemplary client devices include, but are not limited to, devices such as iPhones. ® Apple ® Watch, Apple ® TV or other computing devices provided by Apple Inc. (Cupertino, California).

[0041] Client device 110 may be associated with users within a large user set (e.g., crowdsourcing). Each client device 110 may transmit private user data 112a-112c (collectively referred to as 112) as a differential private sketch (or encoding). The sketch is a computationally encoded representation of the user data values. The purpose of the sketch is to transmit the encoded representation of the user data to the server so that the server cannot directly learn the user data values ​​transmitted by a particular client. User data may be any form of information, such as information related to the user or information related to user actions performed on the client device. For example, the value may include websites visited, user interaction or behavioral data, words or emojis used by the user, deep links, preferences, data from questionnaires, or any other data that the user may wish to retain or request to keep private. In one embodiment, user data may be limited and of any form from a known set. For example, the known set may include a predefined set of possible values ​​known to server 130.

[0042] Server 130 may accumulate private user data 112 and determine statistical attributes such as user data frequency estimates 131 across a set of client devices 110. As described, server 130 may learn from aggregated crowdsourced data, but cannot learn from user data provided by any particular client device 110. Server 130 may be any type of server or server cluster and may include cloud-based servers, application servers, backend servers, or combinations thereof.

[0043] Figure 2 This is a block diagram of a system 200 for differentially privatizing user data according to an embodiment of this disclosure. Client device 110 may include a differential privacy engine (DPE) 228 and multiple applications 230A-230C, the differential privacy engine including a differential privacy daemon 225 and a differential privacy framework or application programming interface (API) 227. One or more of the applications 230A-230C can create user data 205, and DPE 228 can use various tools such as hash functions (or cryptographic hash functions) to privatize user data 205 using differential privacy mechanisms as further described herein.

[0044] In one implementation, client device 110 may store information related to interactions between users and applications or services. Data related to user and website interactions may include information related to interactions with various characteristics of the user and website. For example, user data may include various information related to the display settings of content provided by the website. For instance, user interaction data related to the autoplay of media content may be analyzed, such as whether the user stops or pauses the autoplay of media content. Therefore, various autoplay settings and / or device functions may be adjusted based on crowdsourced user interaction patterns.

[0045] In one implementation, user data 205 may be stored in a differentially private form on the client device. This privately stored user data 205 may be shared with server 130 (e.g., for secondary sampling) or used for other purposes, such as usage and diagnostic purposes. It should be noted that user data 205 may still be stored in a differentially private form even when it is not shared with server 130.

[0046] In one implementation, a whitelist stores a list of websites (or web pages) that have enabled specific features. For example, a whitelist may include a list of websites that have enabled autoplay as further described herein.

[0047] Server 130 may include receiving module 250 and frequency estimation module 260 to determine frequency estimates 131 that can be stored in various data structures such as frequency tables. Receiving module 250 may asynchronously receive crowdsourced data sketches of user data from a large number of client devices 110. Receiving module 250 may remove latent identifiers from the received sketch data. Latent identifiers may include IP addresses, metadata, session identifiers, or other data that can identify a specific client device 110 that sent the sketch. Frequency estimation module 260 may periodically process the received private user data 205 using operations such as, but not limited to, a count-means sketch operation, which is a variation of a count-minimum sketch operation that uses an average value instead of a minimum value. In one embodiment, frequency estimation module 260 may update the frequency table to determine frequency estimate 131, as further described herein.

[0048] Figure 3 This is an exemplary process flow for encrypting and privatizing user data to be transmitted to a server according to an embodiment of this disclosure. As shown in Figure 300, it may include, for example... Figure 1 The system within the client device 110 shown can select the user data 301 value to be transmitted to the server. In the illustrated example, the user data 301 value corresponds to the visited website. However, any type of data is contemplated, and the user data 301 value can be represented as item 302 in any suitable format.

[0049] As shown in the figure, this item can be the domain name of the website being visited. However, other types of representations can be used, such as, but not limited to, URIs (Uniform Resource Identifiers) or URLs. This item can also be a webpage visited on a website, where the representation identifies the domain name of the website being visited and a specific webpage on that website. As described herein, a webpage is a single page or document displayed or hosted by a website, but a single displayed webpage may include content from multiple documents. A website is a collection of related webpages displayed with the same name, grouping, or organization. Webpages from a website are typically (but not necessarily) hosted by the same domain. A single domain can host multiple websites, each of which includes multiple webpages. As described herein, when referring to a website, the reference can also apply to a collection of webpages associated with that website or a domain associated with that website.

[0050] A hash function can be used to convert item 302 into a numerical value. As shown in the figure, the SHA256 hash function is used in one implementation. However, any other hash function can also be used. For example, variants of SHA or other algorithms, such as SHA1, SHA2, SHA3, MD5, Blake2, etc., with various bit sizes, can be used. Therefore, any hash function (or block cipher) can be used in a specific implementation, as long as they are well known to both the client and the server.

[0051] As described above, embodiments of this disclosure can reduce the computational resources and bandwidth required for differential privacy algorithms. In one embodiment, the computational logic can use a portion of the created hash value along with a variant 304 of item 302 to resolve potential hash collisions when frequency counting is performed by the server, which improves computational efficiency while maintaining a provable level of privacy. Variant 304 may correspond to a set of k values ​​(or k index values) already known to the server. In one embodiment, to create variant 304, the system can append a representation of index value 306 to item 302. As shown in this example, an integer corresponding to the index value (e.g., "1,") can be appended to the URL to create variants (e.g., "1, apple.com" or "apple.com1", etc.). The system can then select a random variant 309 (e.g., a variant at a random index value r). Thus, the system can generate a random hash function 307 by using variants of item 304 (e.g., random variant 309), thereby enabling the generation of a series of k hash functions using variants. The set of hash functions is well known to the server, and the system can create hash value 303 using a randomly selected hash function 307. In one implementation, to reduce computation, the system may create only hash value 303 of a randomly selected variant 309. Alternatively, the system may create a complete set of hash values ​​(e.g., k hash values) or up to a randomly selected variant r. It should be noted that an integer sequence is shown as an example of an index value, but other forms of representation (e.g., various numbers of character values) or functions (e.g., another hash function) may also be used as index values, provided they are well known to both the client and the server.

[0052] Once hash value 303 is generated, the system can select a portion of hash value 308. In this example, a 16-bit portion can be chosen, but other sizes (e.g., 8, 16, 32, 64 bits, etc.) can be anticipated based on the desired level of precision or computational cost of the differential privacy algorithm. For example, increasing the number of bits (or m) increases the computational (and transmission) cost, but can result in improved precision. For example, using 16 bits provides 2... 16 -1 (e.g., approximately 65k) potential unique values ​​(or m value ranges). Similarly, increasing the value of variant k increases computational cost (e.g., the cost of calculating the sketch), but consequently increases the accuracy of the estimate. As described, the system can encode this value, and as shown in the figure, the encoding can be in the form of a vector 306. For example, a vector 306 can have 2 16 The vector is of size -1, and each position of the vector can correspond to a potential value of the created hash 303. It should be noted that for convenience and mathematical purposes, this paper describes a vector, but any suitable data structure, such as bit strings, objects, etc., can be implemented.

[0053] like Figure 3 As shown in pattern 350, the created hash value 303 (as a decimal number) can correspond to vector / bit position 305. Therefore, vector 306 can be encoded by updating the value at position 305 (e.g., setting the bit to 1). To account for any potential biases from 0 or null values, the system can use an initialization vector 317. In one embodiment, the initialization vector 317 can be a vector... v ←[-1] m × c ε Therefore, c ε Add noise with a mean of 0 to the initialization vector. The noise should be large enough to mask the individual items in the user data, but small enough to allow any pattern to appear in the dataset. It should be noted that these values ​​are used as mathematical terms, but can be encoded using bits (e.g., 0 = +c). ε, 1 = -c ε, Therefore, vector 306 can be used to create encoding 308 using initialization vector 317, where the value (or bit) at position 305 is changed (or updated). For example, the sign of the value at position 305 can be flipped, thus making the value c. ε (or + c) ε ), and all other values ​​are retained as -c ε As shown in the figure (or vice versa).

[0054] The system can then create a private code 312 by changing at least some of the values ​​with a predetermined probability 313. In one embodiment, the system can flip the sign of the value (e.g., (-) to (+), or vice versa) with a predetermined probability 313. As further described herein, in one embodiment, the predetermined probability is 1 / (1+ e ε ).

[0055] Therefore, the user data 301 value is now represented as a privacy code 312, which individually protects the user's privacy. This privacy code 313 can be stored on the client device 110 or transmitted to the server 130. The privacy code 313 can be transmitted individually or as part of a batch. To further ensure privacy, the client device 110 can also subsample the data. For example, the client device 110 can send only the most frequently visited websites on a given date or any other time period.

[0056] It should be noted that additional bits can be added to the above encoding to transmit additional information. For example, as further described herein, additional bits can be added based on the classification of user data values. For example, adding 2 bits (e.g., 2... 2It provides the ability to encode four categories. As mentioned above, the differential privacy mechanism allows for a large number of data elements (e.g., p), and therefore provides an efficient mechanism for transmitting data as described herein, which might be impractical due to the resource requirements of previous mechanisms.

[0057] Figure 4 An exemplary data stream 400 for transmitting privatized encoding of user data to a server for frequency estimation, according to an embodiment, is illustrated. As shown, server 130 may accumulate user data in the form of privatized data from different client devices 110a-b. When transmitting information, each client device may transmit privatized encoding 312 of the user data along with an index value (or a reference to an index value) of a random variable. For example, as shown, client device 110a transmits privatized encoding 312 for accessing the apple.com website. The random variant used for such encoding corresponds to the random variant at index value 1. Therefore, client device 110a may transmit the value "1" as the index value of the random variant. Similarly, client device 110b transmits privatized encoding 312 for accessing the itunes.com website along with a corresponding index value for the random variant used for encoding, which in this case is "15".

[0058] The accumulated user data can then be processed by the server (in batches or as a data stream) to generate frequency estimates 131. In one implementation, the server may maintain the frequency estimates 131 in sketch form, such as a frequency table. The frequency table may be indexed by a set of possible variant index values ​​k. The rows of the frequency table corresponding to the index values ​​of randomly selected variants are then updated using a privatized vector. In one implementation, the frequency estimates may be based on a count mean sketch. For a specific item (e.g., such as...) Figure 3 In item 302), server 130 can calculate each variant of the hash value series and add the corresponding frequency to the list. Server 130 can calculate the frequency of a specific item (e.g., item apple.com). For example, the hash value of h1(apple.com) = SHA256(1, apple.com) = position 305b. The server can obtain the frequency at the corresponding position (e.g., as shown in Figure 9) and add that frequency to the list. The server can obtain the frequencies of all values ​​1-k to obtain a list of all frequencies of the item. The server can then determine the average of the frequencies in the list (e.g., a count mean sketch). However, it should be noted that other counting techniques, such as count minimum sketch, count median sketch, or count maximum sketch, can also be used. The mechanism enables frequency estimation with accurate variance bounds, whereas previous mechanisms typically only provide upper bounds. For example, and in one embodiment, server 130 can estimate the frequency of any element s as a random variable whose average is equal to the value of the hash value of the element s. The defined true count and standard deviation, of which Defined by the following formula:

[0059]

[0060] Figures 5 to 6 A more formal (mathematical) algorithm for the differential privacy mechanism according to the implementation scheme is described. As described, the system can create a sketch (e.g., privatization encoding 312) to provide a concise data structure, thereby maintaining the elements S = {s1, ..., s} present in the data stream D = {d1, ...}. p The frequency of the domain}. Therefore, a frequency oracle that maintains user privacy can be generated on the server using an ε-local differential private version of the count mean sketch. The frequency oracle is a function that returns an estimated count of data items s∈S based on data D = {d1, ...} received from n clients. The differential privacy mechanism can be one of two types: (1) ε-local differential private implementation A CLIENT Or (2) Hadamard ε-local differential private implementation A CLIENT-Hadamard .

[0061] Figure 5 An ε-local differential private implementation A according to an embodiment of this disclosure is shown. CLIENT Process 500. Process 500 may be implemented by an algorithm executed by the processing logic described herein, which may include software, hardware, or a combination thereof. For example, it may be implemented by a system (such as, e.g., Figure 1 System 100) executes process 500.

[0062] Client-side ε-local differential private algorithm A CLIENT This may include: (1) a privacy parameter ε; (2) a hash range, m; (3) an index value r; and (4) a data element: d∈S. Therefore, the system (e.g., client device 110) can implement algorithm A. CLIENT To generate an ε-local difference private sketch based on the following operations.

[0063] In Operation 501, the system can calculate constants. And initialize vector v: The constant c ε Noise is allowed to increase in order to maintain privacy at zero mean, thus preserving non-bias.

[0064] In operation 502, the system can select a random variant r of the data element d.

[0065] In operation 503, the system can set n←hash (d of r) part.

[0066] In operation 504, the system can set v[n] ← c. ε .

[0067] In operation 505, the system can handle vectors b∈{-1,+1} m Sampling is performed, where each b j They are independent and have a probability of . The +1 has the same distribution.

[0068] In operation 506, the system can generate .

[0069] In operation 507, the system can return the vector v. priv and index value r.

[0070] Figure 6 Hadamard version A, an ε-local differential private implementation according to an embodiment of this disclosure, is shown. CLIENT-Hadamard Method (or algorithm) 600. ε-local differential private implementation client-side A CLIENT-Hadamard Versions may include: (1) a privacy parameter, ε; (2) a hash range, m; (3) an index value, r; and (4) a data element: d∈S. Therefore, the system (e.g., Figure 1 Client device 110 in system 100 can use algorithm A CLIENT-Hadamard A Hadamard version with an ε-local differential private implementation is generated based on the following operations.

[0071] In operation 601, the system can calculate constants. And initialize vector v: v←[0] m .

[0072] In operation 602, the system can select a random variant r of the data element d.

[0073] In operation 603, the system can set the part of n ← hash (d of r).

[0074] In operation 604, the system can set v[n] ← c. ε .

[0075] In operation 605, the system can generate vector v. Hadamard H m It is a Hadamard matrix of dimension m. A Hadamard matrix is ​​a square matrix, and its entries are either +1 or -1 and its rows are mutually orthogonal.

[0076] In operation 606, the system can sample index j and bit b ∈ {-1, 1}, where index j is independently and identically distributed in [m], thus making b a probability of +1.

[0077] In operation 607, the system returns c. ε ·b·v Had1amard [j], the selected index j and index value r.

[0078] Based on the specific algorithm (or method) used by the client device, the server (e.g., server 130) can generate a frequency table or other data structure to perform frequency estimation of user data values ​​across different client devices. As mentioned above, this estimation can be based on a count mean sketch (e.g., a variant of a count minimum sketch). The values ​​in the frequency table can be based on the client using an ε-local difference private sketch algorithm A. CLIENT Or Hadamard's ε-local difference private sketch algorithm A CLIENT-Hadamard And it increments. The operations used for each are described below.

[0079] If the client uses A CLIENT The algorithm accumulates the sketch, so the vector v priv Add to matching sketch data W k,m ,as follows:

[0080] For the corresponding to the generation of v priv The selected variant of W h Okay, W h Set to W h + v priv .

[0081] If the client uses A CLIENT-Hadamard The algorithm generates a sketch, so the vector v Hadamard Add to matching sketch data W k,m ,as follows:

[0082] 1. For the corresponding to the generation of v Hadamard The selected variant of W h Okay, set W h = W h + v Hadamard .

[0083] 2. Before determining the count mean sketch W, convert the rows from the Hadamard basis to the standard basis:

[0084] H m It is a Hadamard matrix of dimension m.

[0085] Figure 7This is an exemplary flowchart illustrating a process 700 for encrypting and privatizing user data to be transmitted to a server according to an embodiment of this disclosure. Process 700 can be executed by processing logic, which may include software, hardware, or a combination thereof. For example, process 700 may be performed by... Figure 1 System 100 is executed via client device 110.

[0086] In 701, the system can select the user data value to be transmitted to the server from a set of possible user data values ​​collected on the client device.

[0087] In 702, the system can create hash entries for user data values ​​using a random hash function. To generate a random hash function, the system can hash using variations of randomly selected entries. In one implementation, a set of possible variations of the value can be indexed. In one implementation, the user data value can be a string, and the set of possible variations of the user data value includes one or more characters that represent the corresponding index value appended to the variation of the string.

[0088] In 703, the system can encode at least a portion of the created hash value as a vector. In one embodiment, the encoding includes updating the vector value at a position corresponding to the representation. For example, the sign of the value at the position corresponding to the representation can be flipped. In one embodiment, the encoding may include initializing the vector with a uniform value and sign. In one embodiment, initializing the vector may further include multiplying each vector value by a constant c. ε = ( e ε + 1) / ( e ε - 1). In addition, as mentioned above, the encoded vector can also be in the form of a Hadamard matrix.

[0089] In 704, the system can privatize the vector difference by changing at least some of the vector values ​​with predefined probabilities. In one implementation, the predefined probabilities could be 1 / (1+ e ε ), where ε is the privacy parameter.

[0090] In 705, the system can transmit the index values ​​of the privatized vector and randomly selected variants to the server. As described above, the server can estimate the frequency of user data values ​​across a set of different client devices. The server can estimate the frequency of user data values ​​by updating a frequency table indexed by this set of possible variants. For example, the rows or columns of the frequency table corresponding to the index values ​​of the randomly selected variants can be updated using the privatized vector. Furthermore, only the index values ​​of the privatized vector and the randomly selected variants can be transmitted to the server as information representing user data values. In one embodiment, the randomly selected variants can prevent hash collisions by using only this portion of the created hash value and reduce the number of computations required for the server to create the frequency table while still maintaining the ε-local differential privacy of the user data values.

[0091] Improve user experience using private crowdsourced data

[0092] In another aspect of this disclosure, systems (and methods) for collecting crowdsourced data using the differential privacy mechanisms described herein to enhance user experience are described. For example, user experience can be enhanced by inferring potential user preferences from analyzing crowdsourced user interaction data. In some embodiments, crowdsourced data may be collected in relation to a specific website, application, or service. For example, in one embodiment, user interactions related to the display of content such as content from online sources may be analyzed. Furthermore, in one embodiment, websites exhibiting specific characteristics may be identified while masking the identities of users who help determine these characteristics. For example, privatized crowdsourced data may be used to identify websites that consume a certain amount of client resources. Data is collected into a privatized crowdsourced dataset where the identities of individual contributors are masked. Contributor data may be masked on the contributor's user device before being transmitted for inclusion in the dataset. Differential privacy may be maintained for the crowdsourced dataset, thereby making it impossible to determine the identities of individual contributors to the dataset through multiple structured queries on the dataset. For example, the dataset may be privatized, thereby preventing an adversary with any background knowledge of the dataset from inferring that a particular record in the input dataset bears significantly greater responsibility for the observed output than the set of other input records.

[0093] The number of contributions a given user can make to a crowdsourced dataset within a given time period can be finite. In one implementation, a privacy budget is established for a specific type of crowdsourced data. The number of contributions from each user is then limited based on this privacy budget. The privacy budget for a specific type of data can also be associated with an ε value (privacy parameter) used when privatizing that specific type of data. For example, the privacy budget and privacy parameter can vary depending on the sensitivity of the data.

[0094] While differential privacy techniques are described herein, other methods for privatizing user data can be employed as alternatives or complements to the differential privacy techniques described herein. Some implementations may implement other privatization techniques, including secure multi-party computation and / or homomorphic encryption. Secure multi-party computation enables multiple parties to collaboratively compute input functionality while keeping these inputs private. Homomorphic encryption is a form of encryption that allows computation to be performed on ciphertext (encrypted data) to produce an encrypted result, which, upon decryption, matches the result of the operation performed on the plaintext. In all implementations, user data to be used for crowdsourcing is sanitized before transmission. Additionally, user data to be transmitted can be stored locally in a privatized encoded manner.

[0095] Figures 8A to 8F These are exemplary flowcharts and diagrams regarding crowdsourcing user interaction and device resource consumption data, based on the implementation plan. Figure 8A This is an exemplary flowchart illustrating crowdsourced user interaction data according to the implementation scheme. Figure 8B This is an exemplary flowchart illustrating a method for processing crowdsourced user interaction data according to an implementation scheme. Figure 8C This is an exemplary flowchart illustrating a resource-consumption-based crowdsourcing data method according to an implementation scheme. Figure 8D This is an exemplary flowchart illustrating a method for processing crowdsourced data based on resource consumption according to an implementation scheme. Figure 8E An exemplary illustration according to the implementation plan is shown, illustrating various usage and frequency information that can be derived from crowdsourced resource consumption data. Figure 8F The illustration shows the content of the implementation scheme described herein, for which crowdsourced data on user interactions and resource consumption can be collected.

[0096] Figure 8A An exemplary process 800 is shown, which may include software, hardware, or a combination thereof. For example, process 800 may be executed by client device 110 of system 100, such as... Figure 1 As shown.

[0097] In 801, the system can monitor user interactions with applications, services, or domains. For example, the system can monitor user interactions with a website (or web application, application, service, etc.). The system can analyze various user interactions and determine (or infer) user preferences. For example, the system can determine (or infer) preferences for enabling or disabling autoplay media content relative to a specific website. As another example, the system can determine preferences for content display settings. For example, the system can infer preferences for reader modes (e.g., modes that do not display tools or menu items, for example, to simulate reading a book). As yet another example, the system can infer preferences for content blocking settings. For example, based on user interactions, the system can determine which types of elements within a website (e.g., unsafe or malicious) should be blocked.

[0098] As described above, in one implementation, the system can monitor user actions related to a website that initiates or attempts to initiate autoplay of media content. As referred to herein, autoplay involves media content configured to automatically begin playing without explicit input from the user (e.g., selecting a play button) (e.g., via code, script, or other logic associated with the website). Furthermore, autoplay can occur under various circumstances. Typically, autoplay is initiated when a user visits the website; however, it should be noted that autoplay can also be initiated under other circumstances, such as when the user scrolls to a specific section of a webpage or when the media content is ready to play (e.g., buffering). Additionally, as referred to herein, media content can include various multimedia, such as video (with or without audio) or audio in various formats. In one implementation, media content may also include various add-ons or plugins, such as Flash. ® A website may initiate autoplay in response to a specific event. As mentioned above, a website typically initiates autoplay when the website is accessed (e.g., a URL is submitted). However, it should be noted that in some cases, it may take a certain amount of time to load the media content. Therefore, in some situations, a user may be able to browse the website (e.g., a text section) before the website starts playing back media content set to autoplay. In such instances, the system may monitor user interaction after the media content is ready (e.g., buffered) to begin playback (or in response to this).

[0099] In operation 802, the system can categorize user interactions. In one implementation, categorizing user interactions includes associating websites or web pages with categories based on the user interactions. When monitoring user interactions related to the autoplay of media content, the system can infer a preference for enabling autoplay. Therefore, the system can monitor various user interactions that provide indications to users who prefer to enable autoplay. For example, user interactions may include allowing media content to autoplay for more than a predetermined time value once it has been presented to the user. As referred to herein, the time value may include a time interval (e.g., 10 seconds) or various other values ​​such as a percentage (e.g., viewing more than 50% of the length of the content item). As another example, user interactions may include maximizing or expanding media content within a time value of accessing a web page. As yet another example, user interactions may include playing a video within a certain time value of accessing a web page. For example, a user who wants to play a video immediately may be given an indication that the user may prefer to enable autoplay on that particular website.

[0100] Furthermore, user actions may include selecting to play a video with autoplay disabled (e.g., via default system settings or preferences). In one embodiment, this may include selecting to play a video with autoplay disabled for a predetermined time value during webpage access. It should be noted that user interactions described herein may be collected in an environment where the system can automatically adjust parameters for autoplay. For example, the system may implement user preferences for enabling or disabling autoplay. As another example, the system may adjust one or more parameters, such as volume, mute, size, or delay, to be set for the display of media content that autoplays. Further non-limiting examples of setting autoplay preferences based on aggregated data can be found in commonly assigned U.S. Patent Application No. 62 / 506,685, filed May 16, 2017, entitled “Device, method, and graphical user interface for managing website presentation settings,” the entire contents of which are incorporated herein by reference.

[0101] The system can also monitor various user interactions that provide instructions to users who prefer to disable autoplay. For example, user actions may include interrupting the autoplay of media content within a predetermined time value after which the media content is displayed to the user. Interrupting autoplay may include stopping or pausing the media content, and muting or reducing the volume to a certain level (e.g., below a threshold in percentage or value form). User interactions may also include closing or minimizing the application or a tab associated with the webpage. Furthermore, user interactions may include performing system functions such as enabling system mute or reducing system volume. For example, when autoplay is disabled, user interactions may include navigating (e.g., scrolling) away from content items set to autoplay without selecting to play the media content.

[0102] Furthermore, user interaction can include a variety of interactions that can be monitored using one or more sensors on the device. For example, various sensors on the device can monitor user engagement or disengagement. For instance, a user being near the device and actively interacting with it can infer a degree of engagement. Conversely, a user looking away from the device or moving away from it can infer a degree of disengagement. Therefore, one or more sensors on the device can be used to determine or infer user behavior.

[0103] Furthermore, it should be noted that other categories besides those discussed above can also be used. For example, categories that provide a certain degree of preference (e.g., very strong, strong, weak, very weak) or any other classification technique can also be used.

[0104] Once user interaction data is collected, it can be sent to the server for analysis. As described in this article, the system can ensure user privacy by implementing a differential privacy mechanism. Furthermore, to further protect user privacy, only sampled data can be sent to the server.

[0105] Therefore, in 803, the system can privatize the encoding of entities associated with user interactions (e.g., a webpage or a website associated with that webpage) and user interaction categories (e.g., a preference to enable or disable autoplay). The encoding can utilize any of the encoding techniques described herein, and various privatization techniques can be used to mask the individual contributors to the data. In one embodiment, the techniques described herein are used to make the encoding differentially privatized.

[0106] In 804, the system can transmit differential privatization encoding to the server to estimate the classification frequency of entities in the crowdsourced data. As described above, the server can perform various operations (e.g., count mean sketching) to determine the frequency estimates. The server can determine the frequency estimates based on a classification scheme. For example, it can determine the frequency estimates where users prefer to enable autoplay for a particular webpage or website, and the frequency estimates where users prefer to disable autoplay for that webpage or website.

[0107] Figure 8B This is an exemplary flowchart illustrating a process 810 for processing crowdsourced user interaction data according to an embodiment of this disclosure. Process 810 may use processing logic, which may include software, hardware, or a combination thereof. For example, process 810 may be performed by a server as described herein (e.g., server 130).

[0108] In operation 811, the system may receive a proprietary encoding of an entity and an associated category representation from each of a set of client devices. The entity may be a webpage or a website associated with that webpage. In one embodiment, the entity may be a webpage, and the representation (e.g., a URL) identifies a website or domain associated with that webpage. In one embodiment, the category may relate to inferring a user preference for enabling or disabling autoplay of media content on a webpage of a website. In one embodiment, the proprietary encoding may be an identifier or locator of the website. In one embodiment, the interactive data may be associated with an application including a web application, wherein the web application is a website-hosted application coded in a language such as Java or JavaScript, or an HTML5-based application that can be loaded as a webpage.

[0109] In operation 812, the system can accumulate frequency estimates of the proprietary codes received from the group of client devices. For example, the system can use sketches such as Figure 4 The frequency table shown.

[0110] In operation 813, the system can estimate the frequency of selected entities associated with a category among the frequencies included in the sketch. For example, as described above, the system can use the count mean sketch operation to determine the frequency.

[0111] In some implementations, the system can also add or remove specific entities (e.g., web pages, websites) from a whitelist based on a determined frequency, as shown in operation 814. For example, a website with a high percentage of users (e.g., over 90%) inferred to prefer enabling autoplay can be added to the whitelist. Similarly, a website with a percentage of users (e.g., over 50%) indicating a preference for disabling autoplay can be removed from the whitelist (or added to the blacklist).

[0112] As described above, in another aspect of this disclosure, user experience can be enhanced by identifying specific websites exhibiting particular characteristics. In one embodiment, websites associated with high resource consumption can be identified. For example, high resource consumption can be identified based on thresholds for specific resources such as CPU, memory, and power usage. By identifying such websites, developers can determine which websites may be problematic or which websites might be candidate sites for development work.

[0113] Figure 8C This is an exemplary flowchart illustrating process 820 for crowdsourcing data based on resource consumption according to an implementation scheme. Process 820 may use processing logic, which may include software, hardware, or a combination thereof. For example, process 820 may be executed by client device 110 as described herein.

[0114] In operation 821, the system can monitor resource consumption associated with an application. This application can be a native application running on a client device or a web application running on a website. The application can also be a plug-in application running based on content from a website, and the system can monitor resource consumption while the device is browsing the website. In one implementation, resource consumption may include one or more of the following: processor (e.g., CPU, graphics processor, etc.) usage, memory usage, power usage, or transmission bandwidth usage. However, it is conceivable that any other usage or statistics can be monitored.

[0115] In operation 822, the system can determine that resource consumption exceeds a threshold. For example, if a particular process or application, or a process or application associated with a website, uses a certain percentage of the CPU (e.g., more than 20%), the resource threshold may be exceeded.

[0116] In operation 823, the system may use any of the encoding methods described herein to privatize the encoding of the application's identifier, and in one implementation, to privatize one or more use classes. For the purposes of a web application, plugin, or other web-related application, the identifier may include the name or URL of a website or webpage. Although other privatization and / or anonymization techniques may be used, the system may use the differential privacy techniques described herein to privatize the encoding.

[0117] In operation 824, the system can transmit differential privatization encoding to the server. As described above, the server can perform various operations (e.g., count mean sketching) to determine frequency estimates. For example, the server can determine the frequency of applications and / or websites exceeding a certain threshold. Similarly, the server can determine the frequency of applications and / or websites falling within a specific threshold range or storage area, such as... Figure 8E As shown.

[0118] Figure 8D This is an exemplary flowchart illustrating a process 840 for processing crowdsourced data based on resource consumption according to an embodiment of the present disclosure. Process 840 may use processing logic, which may include software, hardware, or a combination thereof. For example, process 840 may be provided by... Figure 1 The system 100 is executed on server 130.

[0119] In 841, the system can receive a proprietary encoding of an application or website identifier from each of a set of client devices. In response to exceeding a resource consumption threshold, each application or website is selected for transmission. This identifier can be the application name, the website, or both.

[0120] In 842, the system can accumulate frequency estimates of proprietary codes received from this group of client devices. The frequency estimates may include sketches, such as... Figure 4 The frequency table shown.

[0121] In 843, the system can estimate the frequency with which a selected application, website, or website page exceeds a specific threshold. For example, as described above, the system can use a count mean sketch operation to determine the frequency.

[0122] In some implementations, the system in 844 can also adjust resource consumption thresholds based on analysis of resource consumption patterns. For example, the system can determine that the percentage of websites exceeding a predetermined threshold has increased over a period of time (e.g., several months). Therefore, the predetermined threshold that triggers an indication of high resource consumption can be dynamically adjusted (e.g., increased) based on continuous analysis of crowdsourcing data.

[0123] Figure 8E Exemplary illustrations according to an implementation scheme are shown, illustrating various usage and frequency information that can be derived from crowdsourced resource consumption data. For example, as shown, the number of websites 852 within specific tiers of CPU and memory usage can be determined. Furthermore, multiple websites exceeding specific thresholds can be identified, as shown. Similarly, the frequency 857 of websites 855 exhibiting specific characteristics can be determined. For example, the frequency at which specific websites might cause application crashes can be monitored, and the frequency of access to the most popular websites can be tracked. It should be noted that these examples are merely illustrative, and numerous other metrics can be used depending on the specific application.

[0124] Figure 8F The illustration shows the content of an embodiment described herein, for which crowdsourced data regarding user interactions and resource consumption can be collected. As shown, application 860 can be used in the data processing system or electronic device described herein, such as... Figure 1 It executes on client device 110. Application 860 can provide... Figure 2The application 860 is one of applications 230A-230C and can generate user data that can be privatized and submitted as privatized crowdsourced data. In one embodiment, application 860 is a web browser application, but can be any application executing on an electronic device or data processing system, including mobile applications executing on mobile, handheld, or wearable electronic devices. In one embodiment, application 860 generates user data relative to the user's interaction with the content displayed by the application relative to the application. In one embodiment, application 860 generates data relative to the application's resource consumption, for example, when the application displays content such as a webpage or web application.

[0125] In the case that application 860 is a web browser, the application can be used to navigate to websites hosted on a network such as the Internet. Application 860 may display multiple tabs 861, each displaying the same or different content 870. Content 870 may be displayed from a webpage (e.g., example.html 826) hosted on a website (e.g., www.example.com 863). Webpage 862 may be one of several webpages on a website, and website 863 may be one of several websites hosted on a domain (e.g., example.com). Webpage 862, website 863, or domain name may be included in a representation of user data that is privatized and transmitted to a crowdsourcing server. Content 870 may include various types of content items, including text content 871, 872 and media content 880. Media content 880 may display media item 882 as a content item, and media controls 884 for starting, pausing, or stopping playback of media item 882. For example, if automatic playback is enabled for media item 882, the user can use media control 884 to pause playback of the media item. Users can also use media control 882 to initiate playback of media items set to autoplay, but autoplay is blocked due to display settings of content 870. Application 860 may include settings that configure the display of content 870. For example, application 860 may include user interface element 864 to enable reader mode settings 864 as described herein. Reader mode settings can be used to restrict the display of content 870 to only certain text content 871, 822. Additionally, application 860 may provide users with the option to block specific elements of content 870.

[0126] In one implementation, privatized crowdsourced data is collected based on detected interactions related to content items (e.g., media item 882) of the displayed content 870. Based on the interactions, the displayed content 870 may be associated with categories. These categories may be selected from a set of categories associated with an inferred preference for the display of the displayed content. For example, application 860 may include various settings controlling how the content 870 is displayed. Interactions can be used to place the content 870 into categories associated with the inferred settings. For example, based on the interaction, content 870 may be associated with a category related to the inferred preference to allow autoplay of media item 882. Content 870 may also be associated with a category related to the inferred preference to prevent autoplay of media item 882. In one implementation, content may be associated with an inferred preference to enter reader mode. In one implementation, content may be associated with an inferred preference to prevent the display of certain content items. Privatized encoding may be created on the client device, including a representation of the displayed content 870 and a representation of the category to which the displayed content is associated. The privatized codes can then be transmitted to a server that can accumulate privatized codes from multiple devices to estimate the frequency with which displayed content is associated with specific categories. Privatized data relative to user interactions with content can be used to crowdsource various display or presentation settings associated with the content. Categories can be determined relative to user preferences for scaling settings, brightness settings, or any application or device settings. In one implementation, a set of desired layouts for user interface elements or content items can be determined based on crowdsourced data regarding user interactions with user interface elements and content items.

[0127] It should be noted that the data sampling described herein is an example, and therefore it is conceivable that any type of data can be sampled (e.g., collected) in a differentially private manner to determine various frequencies or statistics. For example, the methods described above can be equally applied to various user information or user interactions that may occur with various components of a system, application, or service.

[0128] Therefore, as described above, the mechanism of this disclosure leverages the potential of crowdsourced data to potentially gain valuable insights for development work while maintaining user privacy (e.g., via a local differential privacy mechanism).

[0129] Exemplary Application Programming Interface Diagram

[0130] The implementation described herein includes one or more application programming interfaces (APIs) in an environment, where calling program code interacts with other program code invoked through one or more programming interfaces. Various function calls, messages, or other types of calls may further include various parameters, which can be transferred via the API between the calling program and the called program code. Furthermore, the API may provide the calling program code with the ability to use data types or categories defined in the API and implemented in the called program code.

[0131] An API allows developers of API-calling components (which can be third-party developers) to utilize specified features provided by the API-implemented components. There can be one API-calling component or more such components. An API can be a source code interface provided by a computer system or library to support service requests from applications. An operating system (OS) can have multiple APIs to allow applications running on the OS to call one or more of those APIs, and a service (such as a library) can have multiple APIs to allow applications using the service to call one or more of those APIs. APIs can be specified according to the programming language that can be interpreted or compiled when the application is built.

[0132] In some implementations, the API implementation component may provide more than one API, each providing a different view or having different aspects that access different aspects of the functionality implemented by the API implementation component. For example, one API of the API implementation component may provide a first set of functions and be exposed to third-party developers, while another API of the API implementation component may be hidden (not exposed) and provide a subset of the first set of functions, as well as another set of functions, such as test or debug functions not in the first set. In other implementations, the API implementation component itself may call one or more other components via a lower-level API, thus acting as both an API calling component and an API implementation component.

[0133] An API defines the language and parameters used by an API-invoking component when accessing and using specified features of an API-implemented component. For example, an API-invoking component accesses specified features of an API-implemented component through one or more API calls or references exposed by the API (e.g., implemented by function or method calls), and passes data and control information using parameters via these API calls or references. An API-implemented component may return a value via the API in response to an API call from an API-invoking component. While an API defines the syntax and results of API calls (e.g., how an API call is initiated and what it can do), it may not reveal how the API call completes the function specified by the API call. Various API calls are transmitted via one or more application programming interfaces between the invoking component (API-invoking component) and the API-implemented component. Transmitting API calls may include issuing, initiating, referencing, calling, receiving, returning, or responding to function calls or messages; in other words, transmissions can describe the actions of either the API-invoking component or the API-implemented component. API function calls or other references may send or receive one or more parameters via parameter lists or other structures. Parameters can be constants, keys, data structures, objects, object classes, variables, data types, pointers, arrays, lists, or pointers to functions or methods, or references to data or other items to be passed via the API.

[0134] Furthermore, data types or classes can be provided by the API and implemented by API implementation components. Therefore, API calling components can declare variables using definitions provided in the API, use pointers to such types or classes, and use or instantiate constant values ​​of such types or classes.

[0135] Typically, an API can be used to access services or data provided by an API implementation component, or to initiate operations or computations provided by the API implementation component. By way of example, the API implementation component and the API calling component can each be any of an operating system, library, device driver, API, application, or other module (it should be understood that the API implementation component and the API calling component can be modules of the same or different types). In some cases, the API implementation component may be implemented at least partially in firmware, microcode, or other hardware logic components. In some implementations, the API may allow client programs to use services provided by a Software Development Kit (SDK) library. In other implementations, applications or other client programs may use APIs provided by an application framework. In these implementations, applications or client programs may incorporate calls into functions or methods provided by both the SDK and the API, or use data types or objects defined in the SDK and provided by the API. In these implementations, the application framework may provide a main event loop for the program, which responds to various events defined by the framework. The API allows applications to specify events and responses to events using the application framework. In some implementations, API calls can report the capabilities or status of hardware devices to the application, including capabilities or status related to input capabilities and status, output capabilities and status, processing capabilities, power status, storage capacity and status, communication capabilities, etc., and the API may be implemented in part by firmware, microcode, or other low-level logic components that execute in part on the hardware components.

[0136] API call components can be local components (i.e., on the same data processing system as the API implementation component) or remote components (i.e., on a different data processing system than the API implementation component), which communicate with the API implementation component via a network through the API. It should be understood that an API implementation component can also act as an API call component (i.e., it can make API calls to APIs exposed by different API implementation components), and an API call component can also act as an API implementation component by implementing APIs exposed to different API call components.

[0137] An API can allow multiple API calling components written in different programming languages ​​to communicate with an API implementation component (therefore, the API may include features for translating calls and returns between the API implementation component and the API calling component); however, the API may be implemented in a specific programming language. In one implementation, the API calling component may call APIs from different providers, such as one set of APIs from an OS provider and another set of APIs from a plugin provider, as well as another set of APIs from another provider (e.g., a software library provider) or the creator of another set of APIs.

[0138] Figure 9 This is a block diagram illustrating an exemplary API architecture that may be used in some of the implementations described herein. API architecture 900 includes an API implementation component 910 (e.g., an operating system, library, device driver, API, application, software, or other module) that implements API 920. API 920 specifies one or more functions, methods, classes, objects, protocols, data structures, formats, and / or other characteristics of the API implementation component that can be used by API calling component 930. API 920 may specify at least one calling convention that specifies how functions in the API implementation component receive parameters from the API calling component and how functions return results to the API calling component. API calling component 930 (e.g., an operating system, library, device driver, API, application, software, or other module) makes API calls through API 920 to access and use the characteristics of API implementation component 910 specified by API 920. API implementation component 910 may return values ​​to API calling component 930 through API 920 in response to API calls.

[0139] It should be understood that API implementation component 910 may include additional functions, methods, classes, data structures, and / or other features not specified through API 920 and not available to API calling component 930. It should be understood that API calling component 930 may be on the same system as API implementation component 910, or may be remotely located and accessed via a network using API 920. Although Figure 9 The example shows a single API call component 930 interacting with API 920, but it should be understood that other API call components, written in different languages ​​(or the same language) and different from API call component 930, can use API 920.

[0140] API implementation component 910, API 920, and API call component 930 may be stored in machine-readable media, including any mechanism for storing information in a machine-readable form (e.g., a computer or other data processing system). For example, machine-readable media include disks, optical disks, random access memory, read-only memory, flash memory devices, etc.

[0141] Figures 10A to 10B This is a block diagram of exemplary API software stacks 1000 and 1010 according to the implementation plan. Figure 10A An exemplary API software stack 1000 is illustrated, wherein application 1002 can use service APIs to invoke service A or service B and use OS APIs to invoke operating system 1004. Furthermore, services A and B can use several OS APIs to invoke operating system 1004.

[0142] Figure 10B An exemplary software stack 1010 is illustrated, including application 1, application 2, service 1, service 2, and operating system 1004. As shown, service 2 has two APIs, one (service 2 API 1) receiving calls from application 1 and returning values, and the other (service 2 API 2) receiving calls from application 2 and returning values. Service 1 (e.g., a software library) calls OS API 1 and receives the returned values, and service 2 (e.g., a software library) calls both OS API 1 and OS API 2 and receives the returned values. Application 2 calls OS API 2 and receives the returned values.

[0143] Additional exemplary computing devices

[0144] Figure 11 This is a block diagram of a device architecture 1100 for a mobile or embedded device according to an implementation scheme. Device architecture 1100 includes a memory interface 1102, a processing system 1104 including one or more data processors, an image processor and / or graphics processing unit, and a peripheral device interface 1106. Various components can be coupled via one or more communication buses or signal lines. These components can be individual logic components or devices or can be integrated into one or more integrated circuits, such as system-on-a-chip (SoC) integrated circuits.

[0145] The memory interface 1102 can be coupled to the memory 1150, which may include high-speed random access memory, such as static random access memory (SRAM) or dynamic random access memory (DRAM) and / or non-volatile memory, such as, but not limited to, flash memory (e.g., NAND flash, NOR flash, etc.).

[0146] Sensors, devices, and subsystems can be coupled to peripheral interface 1106 to facilitate multiple functions. For example, motion sensor 1110, light sensor 1112, and proximity sensor 1114 can be coupled to peripheral interface 1106 to facilitate mobile device functionality. One or more biometric sensors 1115 may also be present, such as a fingerprint scanner for fingerprint recognition or an image sensor for facial recognition. Other sensors 1116 may also be connected to peripheral interface 1106, such as positioning systems (e.g., GPS receivers), temperature sensors, or other sensing devices to facilitate related functions. Camera functions, such as taking photos and video clips, can be facilitated using camera subsystem 1120 and optical sensors 1122 (such as charge-coupled devices (CCDs) or complementary metal-oxide-semiconductor (CMOS) optical sensors).

[0147] Communication functions can be facilitated by one or more wireless communication subsystems 1124, which may include radio frequency receivers and transmitters and / or optical (e.g., infrared) receivers and transmitters. The specific design and implementation of the wireless communication subsystem 1124 may depend on the communication network through which the mobile device intends to operate. For example, a mobile device including the illustrated device architecture 1100 may include a wireless communication subsystem 1124 designed to operate over a GSM network, CDMA network, LTE network, Wi-Fi network, Bluetooth network, or any other wireless network. Specifically, the wireless communication subsystem 1124 may provide a communication mechanism in which a media playback application can retrieve resources from a remote media server or retrieve scheduled events from a remote calendar or event server.

[0148] The audio subsystem 1126 can be coupled to the speaker 1128 and microphone 1130 to facilitate voice-enabled functions such as speech recognition, speech copying, digital recording, and telephone functionality. In the smart media device described herein, the audio subsystem 1126 may include a high-quality audio system supporting virtual surround sound.

[0149] I / O subsystem 1140 may include touchscreen controller 1142 and / or other input controller 1145. For computing devices including display devices, touchscreen controller 1142 may be coupled to touch-sensitive display system 1146 (e.g., a touchscreen). Touch-sensitive display system 1146 and touchscreen controller 1142 may detect contact and movement or pressure using, for example, any of a variety of touch and pressure sensing technologies, including but not limited to capacitive, resistive, infrared, and surface acoustic wave technologies, as well as other proximity sensor arrays or other elements for determining one or more points of contact with touch-sensitive display system 1146. Display output of touch-sensitive display system 1146 may be generated by display controller 1143. In one embodiment, display controller 1143 may provide frame data to touch-sensitive display system 1146 at a variable frame rate.

[0150] In one embodiment, a sensor controller 1144 is included to monitor, control, and / or process data received from one or more of a motion sensor 1110, a light sensor 1112, a proximity sensor 1114, or other sensors 1116. The sensor controller 1144 may include logic to interpret the sensor data to determine the occurrence of one of a plurality of motion events or activities by analyzing the sensor data from the sensors.

[0151] In one embodiment, the I / O subsystem 1140 includes one or more other input controllers 1145 that can be coupled to other input / control devices 1148, such as one or more buttons, rocker switches, thumb wheels, infrared ports, USB ports, and / or pointer devices such as styluses, or control devices such as up / down buttons for volume control of speakers 1128 and / or microphones 1130.

[0152] In one implementation, memory 1150, coupled to memory interface 1102, may store instructions for operating system 1152, including POSIX-compliant and incompatible operating systems or embedded operating systems. Operating system 1152 may include instructions for handling basic system services and for performing hardware-related tasks. In some specific implementations, operating system 1152 may be a kernel.

[0153] The memory 1150 may also store communication instructions 1154 to facilitate communication with one or more additional devices, one or more computers, and / or one or more servers, such as retrieving web resources from a remote web server. The memory 1150 may also include user interface instructions 1156, including graphical user interface instructions to facilitate graphical user interface processing.

[0154] In addition, memory 1150 may store sensor processing instructions 1158 to facilitate sensor-related processing and functions; telephone instructions 1160 to facilitate telephone-related processes and functions; instant messaging instructions 1162 to facilitate electronic messaging-related processes and functions; web browser instructions 1164 to facilitate web browsing-related processes and functions; media processing instructions 1166 to facilitate media processing-related processes and functions; location service instructions including GPS and / or navigation instructions 1168 and Wi-Fi-based location instructions to facilitate location-based functionality; camera instructions 1170 to facilitate camera-related processes and functions; and / or other software instructions 1172 to facilitate other processes and functions, such as security processes and functions, and system-related processes and functions. Memory 1150 may also store other software instructions, such as web video instructions to facilitate web video-related processes and functions; and / or online shopping instructions to facilitate online shopping-related processes and functions. In some specific implementations, media processing instructions 1166 are divided into audio processing instructions and video processing instructions, respectively, to facilitate audio processing-related processes and functions and video processing-related processes and functions. Mobile device identifiers, such as International Mobile Equipment Identity (IMEI) 1174 or similar hardware identifiers, may also be stored in memory 1150.

[0155] Each of the instructions and applications identified above may correspond to a set of instructions for performing one or more of the functions described above. These instructions do not need to be implemented as a separate software program, process, or module. Memory 1150 may include additional instructions or fewer. Furthermore, various functions may be performed in hardware and / or software, including in one or more signal processing and / or application-specific integrated circuits.

[0156] Figure 12 This is a block diagram illustrating a computing system 1200 that can be used in conjunction with one or more of the embodiments described herein. The computing system 1200 shown may represent any device or system (e.g., client device 110, server 130) that performs any of the processes, operations, or methods described herein. It should be noted that while various components are illustrated in the computing system diagram, it is not intended to represent any particular architecture of the components or the way the components are interconnected, as such details are not closely related to this disclosure. It should also be understood that other types of systems with fewer or more components than those illustrated may also be used in conjunction with this disclosure.

[0157] As shown in the figure, computing system 1200 may include a bus 1205 that may be coupled to processor 1210, ROM (read-only memory) 1220, RAM (or volatile memory) 1225, and storage device (or non-volatile memory) 1230. Processor 1210 may retrieve stored instructions from one or more of the memories 1220, 1225, and 1230 and execute the instructions to perform the processes, operations, or methods described herein. These memories represent non-transitory machine-readable media (or computer-readable media) or storage devices containing instructions that, when executed by the computing system (or processor), cause the computing system (or processor) to perform the operations, processes, or methods described herein. RAM 1225 may be implemented as, for example, dynamic RAM (DRAM) or other types of memory that require continuous power to refresh or retain data within the memory. Storage device 1230 may include, for example, magnetic storage devices, semiconductor storage devices, magnetic tape storage devices, optical storage devices, removable storage devices, non-removable storage devices, and other types of storage devices that retain data even after power to the system is removed. It should be understood that the storage device 1230 may be located remotely relative to the system (e.g., accessible via a network).

[0158] Display controller 1250 may be coupled to bus 1205 to receive display data to be displayed on display device 1255, which may display user interface features or any of the embodiments described herein, and may be a local or remote display device. Computing system 1200 may also include one or more input / output (I / O) components 1265, including a mouse, keyboard, touchscreen, network interface, printer, speaker, and other devices. Typically, input / output components 1265 are coupled to the system via input / output controller 1260.

[0159] Module 1270 (or component, unit, function, or logic) may represent any of the functions or engines described above, such as differential privacy engine 228. Module 1270 may reside wholly or at least partially in the memory described above, or reside in the processor during execution by the computing system. Furthermore, module 1270 may be implemented as software, firmware, or functional circuitry within the computing system, or a combination thereof.

[0160] In some implementations, the hash function described herein (e.g., SHA256) may utilize dedicated hardware circuitry (or firmware) of the system (client device or server). For example, the function may be a hardware-accelerated function. Furthermore, in some implementations, the system may use a function as part of a dedicated instruction set. For example, an instruction set may be used that is an extension of the instruction set architecture for a specific type of microprocessor. Thus, in one implementation, the system may provide a hardware acceleration mechanism for performing SHA operations. Therefore, the system may use these instruction sets to improve the speed of performing the functions described herein.

[0161] Furthermore, the hardware acceleration engine / function is envisioned to include any implementation of hardware, firmware, or a combination thereof, including various configurations that may include hardware / firmware integrated into the SoC as a separate processor, or included as a dedicated CPU (or core), or integrated into a coprocessor on a board, or contained on a chip on an expansion board, etc.

[0162] Therefore, while such acceleration features are not necessarily required to achieve differential privacy, some implementations described herein can potentially improve the overall efficiency of the implementation by leveraging the prevalence of specialized support for such features (e.g., cryptographic features).

[0163] It should be noted that the terms “about” or “generally” may be used herein and can be interpreted as “almost as far as possible”, “under technical limitations”, etc. Additionally, unless otherwise stated, the use of the term “or” indicates an inclusive or (e.g., and / or).

[0164] Exemplary embodiments of this disclosure have been described in the foregoing description. It will be apparent that various modifications may be made thereto without departing from the broader spirit and scope of this disclosure. Accordingly, the specification and drawings are to be regarded as illustrative rather than limiting. Specific details in the descriptions and examples provided can be used anywhere in one or more embodiments. Various features of different embodiments or examples may be combined differently with some of the included features and others excluded features to suit a variety of different applications. Examples may include subjects such as methods, means for performing the actions of the method, at least one machine-readable medium including instructions that, when executed by a machine, cause the machine to perform the actions of the method, or actions of means or systems according to the embodiments and examples described herein. Additionally, the various components described herein may be means for performing the operations or functions described herein.

[0165] In one aspect of this disclosure, a system (and method) is described that ensures differential privacy when transmitting data to a server that estimates the frequency of such data across a set of client devices. Differential privacy reduces resource requirements while still providing provable guarantees about privacy and utility. For example, the mechanism can provide the ability to tailor utility (e.g., the accuracy of the estimate) based on resource requirements (e.g., transmission bandwidth and computational complexity). To account for the reduced resource requirements (e.g., reduced bit length of the encoding), the mechanism can estimate the frequency of the data using a count mean sketch, as further described herein.

[0166] Relative to resource requirements, this mechanism implements a hash function that provides the ability to reduce computational demands by using only a portion of the generated hash value. To avoid hash collisions and use only a portion of the hash value, the mechanism can use variants when hashing user data. The use of variants allows the mechanism to implement shared hashes, reducing the amount of computation required by both the client and server. Relative to utility, the mechanism provides frequency estimates within a predictable range of biases, including lower and upper bounds.

[0167] In another aspect of this disclosure, systems and methods for collecting crowdsourced data using the privacy mechanisms described herein to enhance user experience are described. For example, user experience can be enhanced by inferring potential user preferences from analyzing crowdsourced user interaction data. Based on statistical analysis of user interactions related to various characteristics or events, development efforts can be refined or enhanced relative to application behavior. Privatization techniques for privatizing crowdsourced user data are not limited to differential privacy techniques. For example, secure multi-party computation and / or homomorphic encryption can be used to privatize crowdsourced data.

[0168] In one implementation, user interactions related to the display of content, such as content from online sources, can be analyzed. For example, display settings or preferences can be defined based on crowdsourced user interaction data.

[0169] In one implementation, display settings may include autoplay settings for media content, thereby enabling the analysis of crowdsourced data related to the autoplay of media content. For example, the system may determine or infer a crowdsourced preference for enabling or disabling autoplay for media content relative to a specific website. User interactions, including immediately stopping or muting autoplaying media items upon visiting a website, can be considered as inferring a preference to disable autoplay. Conversely, when a user visits a webpage where autoplay for media content is disabled (e.g., through default system settings or preferences), and chooses to play media content with autoplay disabled, it can be inferred that the user prefers to enable autoplay on such websites. Therefore, collecting such user interaction data from various devices and analyzing the data on a server (e.g., via local differential privacy mechanisms) allows developers potentially valuable insights into specific websites. For example, websites with a high estimated user frequency that provides an inference of an autoplay-enabled preference can be added to a “whitelist” (e.g., a list of websites that allow or enable autoplay).

[0170] In addition, other settings related to content display can be analyzed. For example, the differential privacy mechanism described herein can also be used to analyze additional display settings such as content display settings (e.g., reader mode settings) or content blocking settings.

[0171] On the other hand, user experience can also be enhanced by identifying specific websites that exhibit particular characteristics. In one implementation, websites associated with high resource consumption can be identified. For example, high resource consumption can be identified based on thresholds for resources such as CPU, memory, and power usage. By identifying such websites, developers can determine which websites may be problematic, or potential candidate websites for analysis, to identify the causes of high resource consumption.

[0172] Privacy technologies have been described in the foregoing specification. However, it will be apparent that various modifications and alterations can be made thereto without departing from the broader spirit and scope of the invention. Accordingly, the specification and drawings should be considered illustrative rather than restrictive. Specific details in the descriptions and examples provided can be used anywhere in one or more embodiments. Various features of different embodiments or examples can be combined differently with some of the included features and others excluded features to suit a variety of different applications. Examples may include subjects such as methods, means for performing the actions of the method, at least one machine-readable medium including instructions that, when executed by a machine, cause the machine to perform the actions of the method, or actions of a means or system according to the embodiments and examples described herein. Furthermore, the various components described herein may be means for performing the operations or functions described according to the embodiments. Therefore, the true scope of these embodiments will be apparent to those skilled in the art upon studying the drawings, specification, and appended claims.

Claims

1. A non-transitory machine-readable medium storing instructions, which, when executed by one or more processors of a computing device, cause the computing device to perform operations including: Detect interactions related to the application, which are executed in response to instructions within a webpage displayed by the application; The private encoding of the representation of the webpage is received, wherein each webpage is selected to be transmitted in response to exceeding a resource consumption threshold, wherein the private encoding includes a vector comprising at least one value for the webpage at a position corresponding to a hash value created using a hash function, and the vector is changed at the position corresponding to the created hash value with a predefined probability. Accumulated private coding; Estimating the frequency of selected web pages that exceed the resource consumption threshold, wherein estimating the frequency of the selected web pages includes determining a count based on the accumulated privatization encoding; Based on the estimation of the frequency of the selected webpage, a record of the frequency of the selected webpage exceeding the resource consumption threshold is generated; as well as The records are transmitted to at least one server to accumulate multiple records in order to estimate the frequency at which the webpage is selected by multiple devices.

2. The non-transitory machine-readable medium of claim 1, wherein the webpage displayed by the application is used for displaying media items, and the interaction is provided in response to the initiation, attempt to initiate, or permission of autoplay of the media items displayed by the webpage or a web application associated with the webpage.

3. The non-transitory machine-readable medium of claim 1, wherein the representation of the webpage includes a website associated with the webpage, and the operation further includes estimating the frequency of the website based on the frequency of selected webpages associated with the website.

4. The non-transitory machine-readable medium according to claim 1, wherein the operation further comprises: The resource consumption threshold is adjusted based on the analysis of resource consumption and usage patterns.

5. The non-transitory machine-readable medium of claim 3, wherein the record is a privately encoded sketch received from a set of client devices.

6. The non-transient machine-readable medium according to claim 4, wherein the privatization encoding is differential privatization encoding.

7. The non-transient machine-readable medium of claim 5, wherein estimating the frequency of the selected webpage comprises determining the count using a count mean sketch operation.

8. The non-transitory machine-readable medium of claim 1, wherein resource consumption corresponds to the use of the processor or memory of the computing device.

9. The non-transient machine-readable medium of claim 1, wherein resource consumption corresponds to power usage or data transmission bandwidth.

10. A method of configuring a computing device to perform operations, the operations comprising: Detect interactions related to the application, which are executed in response to instructions within a webpage displayed by the application; The private encoding of the representation of the webpage is received, wherein each webpage is selected to be transmitted in response to exceeding a resource consumption threshold, wherein the private encoding includes a vector comprising at least one value for the webpage at a position corresponding to a hash value created using a hash function, and the vector is changed at the position corresponding to the created hash value with a predefined probability. Accumulated private coding; Estimating the frequency of selected web pages that exceed the resource consumption threshold, wherein estimating the frequency of the selected web pages includes determining a count based on the accumulated privatization encoding; Based on the estimation of the frequency of the selected webpage, a record of the frequency of the selected webpage exceeding the resource consumption threshold is generated; as well as The records are transmitted to at least one server to accumulate multiple records in order to estimate the frequency at which the webpage is selected by multiple devices.

11. The method of claim 10, wherein the webpage displayed by the application is used for displaying media items, and the interaction is provided in response to the initiation, attempt to initiate, or permission of autoplay of the media items displayed by the webpage or a web application associated with the webpage.

12. The method of claim 10, wherein the representation of the webpage includes a website associated with the webpage, and the operation further includes estimating the frequency of the website based on the frequency of selected webpages associated with the website.

13. The method of claim 10, further comprising: The resource consumption threshold is adjusted based on the analysis of the frequency of resource consumption and usage patterns.

14. The method of claim 12, wherein the record is a privately encoded sketch received from a set of client devices.

15. The method of claim 13, wherein the privatization encoding is differential privatization encoding.

16. The method of claim 14, wherein estimating the frequency of the selected webpage comprises determining the count using a count mean sketch operation.

17. The method of claim 10, wherein the resource consumption corresponds to the use of the processor or memory of the computing device.

18. The method of claim 10, wherein resource consumption corresponds to power usage or data transmission bandwidth.

19. An electronic device comprising: One or more processors; and A memory coupled to the one or more processors, the memory storing instructions that, when executed by the one or more processors, cause the electronic device to: Detect interactions related to the application, which are executed in response to instructions within a webpage displayed by the application; The private encoding of the representation of the webpage is received, wherein each webpage is selected to be transmitted in response to exceeding a resource consumption threshold, wherein the private encoding includes a vector comprising at least one value for the webpage at a position corresponding to a hash value created using a hash function, and the vector is changed at the position corresponding to the created hash value with a predefined probability. Accumulated private coding; Estimating the frequency of selected web pages that exceed the resource consumption threshold, wherein estimating the frequency of the selected web pages includes determining a count based on the accumulated privatization encoding; Based on the estimation of the frequency of the selected webpage, a record of the frequency of the selected webpage exceeding the resource consumption threshold is generated; as well as The records are transmitted to at least one server to accumulate multiple records in order to estimate the frequency at which the webpage is selected by multiple devices.

20. The electronic device of claim 19, wherein the webpage displayed by the application is used for displaying media items, and the interaction is provided in response to the initiation, attempt to initiate, or permission of autoplay of the media items displayed by the webpage or a web application associated with the webpage.

Images