Query system and method with KMIN privacy

Abstract

A system receives a raw SQL query and transforms it into a KMIN private SQL query. The system operates such that changes to the raw query are both minimal and readable by the user. The system uses just the standard SQL "HAVING" clauses. The logic that injects the "HAVING" clauses is restricted by two rules. The first rule is a "point-of-use-KMIN" rule, whereby the KMIN policy is enforced at every select that uses any of the KMIN tables directly. The second is a "point-of-aggregation-KMIN" rule, which requires a relevant "HAVING" clause only when aggregating over multiple entity key values. The resulting SQL query is human readable and understandable, allowing sophisticated users to see / edit the transformed SQL query.

Description

Docket No. RAMP-00311-WQQUERY SYSTEM AND METHOD WITH KMIN PRIVACYCROSS-REFERENCE TO RELATED APPLICATIONS

[0001] This application claims priority to US provisional patent application number 63 / 683,059, filed on August 14, 2024. Such application is incorporated by reference as if fully set forth herein.BACKGROUN D OF TH E INVENTION

[0002] KMIN privacy, also known as K-Minimum privacy, is a privacy-preserving technique used in data investigation and analysis. It is an implementation of the well-known K-anonymity concept. KMIN privacy aims to achieve K-anonymity for SQL-based analytical queries in an efficient and readable way.

[0003] K-anonymity is a property of a dataset where each record is indistinguishable from at least k-1 other records with respect to certain identifying attributes. KMIN is an implementation of the K-anonymity process optimized for SQL-based analytical queries.

[0004] Ensuring k-anonymity property for an arbitrary analytical query can be computationally intensive, especially for large datasets and complex SQL queries. Thus it is commonly used in scenarios where sensitive data needs to be shared or published while strictly protecting individual privacy, such as in healthcare, personal financial data, or customer databases.

[0005] SQL, or Structured Query Language, is a standardized programming language designed for managing and manipulating relational databases. It provides a set of commands that allow users to create, read, update, and delete data within database tables. Its primary strength lies in its ability to efficiently handle structured data and perform complex queries across multiple tables. SQL's syntax is relatively intuitive, using English-like statements that describe the desired operations on the data. This makes it accessible to both beginner programmers and experienced database administrators. While there are several dialects of SQL used by different database management systems, the core principles and most common commands remain consistent across platforms.

[0006] The inventors have recognized that using SQL for KMIN private queries has the potential to combine the power of relational database querying with privacy-preserving techniques. This would allow organizations to extract valuable insights from sensitive data while protectingDocket No. RAMP-00311-WQ individual privacy. One of the potential challenges, however, is SQL expressiveness, which makes it impossible to turn every correct SQL query into one that meets the limitations of KM IN privacy.

[0007] To implement KMIN private SQL queries, one could use specialized database systems or privacy-enhancing layers that sit between the analyst and the raw data. Such systems would modify standard SQL queries to by KMIN private by transforming the original SQL query to include privacy-preserving operations. A method and system that automatically transforms traditional user-generated SQL queries into KMIN private SQL queries would be desirable as it would expand the potential use of KMIN privacy to non-experts. Essentially anyone familiar with SQL could perform these types of queries while maintaining privacy with respect to sensitive data. Likewise, a method and system that would allow more sophisticated users to see and edit a transformation of a SQL query to a KMIN private form, or that would suggest to such a user the correct query components, would improve the performance of KMIN private searches for such sophisticated users as well.SUMMARY OF THE INVENTION

[0008] The present invention is directed to a system and method that receives a raw SQL query and automatically transforms it into a KMIN private SQL query. The system and method may also, in certain embodiments, highlight what must be changed in the proposed SQL query in order for it to be transformed into a KMIN private SQL query.

[0009] In certain embodiments, the invention has two driving principles. The first principle is that the changes to SQL should be both minimal and readable by the user. The second principle is that the system should use just the standard SQL "HAVING" clauses, which allows various SQL processors to execute the query with high efficiency. The logic that injects the "HAVING" clauses is in turn restricted by two rules. The first rule is a "point-of-use-KMIN" rule, whereby the KMIN policy is enforced at every select that uses any of the KMIN tables directly. The second is a "point-of-aggregation-KMIN" rule, which requires a relevant "HAVING" clause only when aggregating over multiple entity key values.

[0010] The resulting SQL query in certain embodiments is human readable and understandable, allowing sophisticated users to see / edit the transformed SQL query in certain embodiments. In certain implementations the invention uses an iterative approach, where the author gets feedback on their regular SQL query from the validator with hints on how to write the query toDocket No. RAMP-00311-WQ benefit from automatic translation to a KMIN private query. With this guidance, the user authoring a query will acquire skill at formulating SQL queries that can be made KMIN private. Once such a user understands the applicable rules, they will in time be able to create SQL queries that are KMIN private with no warnings from the validator.

[0011] In certain embodiments, the system may also guide a sophisticated user by suggesting the correct query components for such users to insert on their own.

[0012] In certain embodiments, the system may also allow for easy but practical analytics using SQL within a rigorous privacy framework applied automatically in the background.

[0013] It may be seen that, according to certain embodiments of the invention, automatic transformation of any SQL query to one with KMIN privacy applied allows for privacy-compliant data analysis by analysts not familiar with the concepts of privacy (and in particular KMIN privacy). This opens up many datasets to analysis, which otherwise would have been unavailable due to privacy compliance concerns. Thus the invention in such embodiments allows for seamless, privacy-first data collaboration.

[0014] These and other features, objects and advantages of the present invention will become better understood from a consideration of the following detailed description of the preferred embodiments and appended claims in conjunction with the drawings as described following:BRIEF DESCRIPTION OF DRAWINGS

[0015] Fig. 1 is an architectural overview of an automatic KMIN private query system according to an embodiment of the present invention.

[0016] Fig. 2 is a detailed view of the KMIN-SQL-ENGINE component of the system of Fig. 1 according to an embodiment of the present invention.

[0017] Fig. 3 is a diagram of particular equipment used to implement portions of the compute environment to implement the system of Fig. 1 according to an embodiment of the present invention.

[0018] Fig. 4 is a diagram illustrating the iterative SQL authoring flow according to an embodiment of the present invention.DETAILED DESCRIPTION OF THE INVENTION

[0019] Before the present invention is described in further detail, it should be understood that the invention is not limited to the particular embodiments described, and that the terms used in describing the particular embodiments are for the purpose of describing those particularDocket No. RAMP-00311-WQ embodiments only, and are not intended to be limiting, since the scope of the present invention will be limited only by the claims.

[0020] Referring now to Fig. 1, an overview of a system according to an embodiment of the present invention may be described. There are two actors that engage with the system. The first is the privacy policy administrator 10, who is the person who decides what the privacy policies will be for a particular use case. The second actor is the query author 12, who is the person performing queries against the data in order to generate results.

[0021] Before any query is performed, the privacy policy administrator creates a set of metadata 34 comprising privacy policies for the data. This system writes the privacy policy metadata to a data catalog 20. This metadata 34 may include privacy subject(s), KMIN limits per column, dimensions for searches, and applicable aggregation functions.

[0022] The query author then presents system 16 with a query 22, which in certain embodiments is composed as a standard SQL query. This query 22 is presented to the KMIN- SQL-ENGINE 24, the function of which is to apply KMIN privacy to the SQL query 22. Its internal processing will be described in more detail below with respect to Fig. 2. The result of KMIN-SQL- ENGINE 24 processing is a SQL query with KMIN privacy having been applied 28.

[0023] The now KMIN private SQL query 28 is then fed to the SQL processor 32 in order for the query to actually be run against a data set of interest. Another set of input to the SQL processor includes the various parameters to be used in the search itself. The results 30 are either a set of validation errors or an edited SQL query with the readable, KMIN-compliant version of the original query.

[0024] Referring now to Fig. 2, the operation of the KMIN-SQL-ENGINE 24 component of the system may be more specifically described in a particular embodiment of the present invention. The raw SQL query 22 is passed to two processing components, the parser 36 and the validator 42.

[0025] The purpose of the validator 42 is to validate that the query 22 is a valid query against the relevant data set and which may be transformed into a KMIN private SQL query 28. If the SQL query 22 is not validated, then the system provides guidance on how to change the input query 22 for it to be eligible for KMIN privacy processing, as more fully described below with reference to Fig. 4. The processing then ends after this information is returned from the validator 42. Depending upon the particular configuration, the validator may also allowDocket No. RAMP-00311-WQ permissioned persons (e.g., sophisticated users) to override its warnings and allow for the transformation to proceed, at the actor's responsibility.

[0026] The parser component parses the SQL query into its constituent components for application of KMIN privacy, and passes those components to the KM IN-REWRITE-RULES component 38.

[0027] The KM IN-REWRITE-RULES component 38 is used by the generator component 40 to produce a new query 28 from the raw SQL query 22. This new SQL query 28 produces results with the same schema as the original input query 22, but with every aggregated analytical value being derived from at least K rows representing distinct entity keys, as defined in the meta data 34.

[0028] The solution being applied by the KMIN-REWRITE-RULES component 38 uses only standard SQL HAVING clauses injected into all of the required query positions. In addition to providing KMIN privacy, this approach also makes processing of the query 22 execution more efficient, and thereby saves compute resources, because only standard, built-in SQL components are injected into the places where needed. This approach also supports a wider range of SQL queries 22 with guaranteed KMIN properties.

[0029] To help users author KMIN-compliant queries, the system guides them when such a query is being constructed. For some cases, the system is able to confirm that the given query 22 is KMIN compliant. In other cases, it can produce a list of warnings with hints and explanations of where the problem lies. When there are warnings present, then, depending upon the system configuration, the system might either just log them for auditing purposes (e.g., if it is the data-owner authoring the question on its own data) or block the query from running (e.g., if it is just a data-user rather than the data-owner).

[0030] In the case where a KMIN compliant SQL query 28 can be constructed, the system can either show that to the user for acceptance, or simply run the query on the user's behalf.

[0031] The approach of either demonstrating or running a compliant query 28 ensures that, with the right system configuration, the data-owner may have its policies enforced where needed while the data-user is able to write queries of the required complexity. In the case of overriding validation warnings, they can both fall back onto the contractual terms with auditing to help motivate data-users to rewrite queries if needed. The data-user or data-owner might choose to accept / ignore the warning and continue, with the decision being appropriately logged and audited.Docket No. RAMP-00311-WO

[0032] With reference now to Fig. 4, the iterative process for assisting a user with SQL authoring may be described in more detail. In the initial step of this process, a raw SQL query 22 is entered by a query author 12. The system then validates whether the SQL query 22 may be one that can be modified into a KMIN private query 28, as explained above. This process takes place at the validator 42 portion of the KMIN-SQL-ENGINE 24.

[0033] If the SQL query 22 cannot be transformed into one that is KMIN private, then an error is returned, optionally with hints provided to the human user about ways in which the raw SQL query 22 may be modified so that it is one that may be made KMIN compatible. This step not only results in SQL queries that may be run in a system requiring KMIN privacy, but also provides an educational element to the user so that the user may better understand how to formulate KMIN queries in the future.

[0034] Once an SQL query 22 is entered that can be transformed into one that is KMIN private, that query is modified to provide KMIN privacy as explained more fully above, resulting in KMIN private SQL query 28.

[0035] The following is an example of how the KMIN-SQL-ENGINE could operate on a given dataset. In this example, the dataset will carry metadata marking the KMIN policy for a given column (e.g., KMIN = 75 for memberlD for exposures dataset). The following query will be used, where EXPOSURES table has ID_COL KMIN policy of 100 and TXN table has no KMIN policy:1 SELECT E.CAMPAIGN, COUNTfDISTINCT E.ID_COL) AS unique_conversions2 FROM TXN T INNER JOIN EXPOSURES E ON T.ID_COL = E.ID_COL3 GROUP BY 1

[0036] The example query given just above is not KMIN compliant, so the system will issue a warning as follows:KMIN policy breach. HINT: Please add a HAVING count(distinct e,ID_COL) >= 100 to your query.

[0037] The system can construct the HAVING clause by analyzing the query and retrieving EXPOSURE KMIN policy details (ID_COL on exposures should have at least 100 unique subjects in any aggregation) from the dataset's metadata. Alternatively, the system could simply add that in the editor as a suggestion. In either case, once added, the query will be validated properly:1 SELECT E.CAMPAIGN, COUNT(DISTINCT E.ID_COL) AS unique_conversionsDocket No. RAMP-00311-WO2 FROM TXN T INNER JOIN EXPOSURES E ON T.ID_COL = E.ID_COL3 GROUP BY 14 HAVING count(distinct e,ID_COL) >= 100

[0038] This approach will work for other query filtering clauses as well:1 SELECT E. CAMPAIGN, COUNT(DISTINCT E.ID_COL) AS unique_conversions2 FROM TXN T INNER JOIN EXPOSURES E ON T.ID_COL = E.ID_COL3 WHERE E. EMAIL == 'XYZ@ABC.COM'4 GROUP BY 15 HAVING count(distinct e,ID_COL) >= 100

[0039] This approach can also support two policies at the same time. So if TXN dataset had KMIN policy for the same ID_COL of 200, then updating the HAVING clause would give:1 HAVING count(distinct e,ID_COL) >= MAX(100, 200)

[0040] This approach will completely guide users on what they should do in certain paths like the above query, and for more complex queries the system may simply provide a warning with an explanation of the problem and leave it to the user to solve it. An example of where the system cannot provide a constructive HINT would be when the user is using a CASE WHEN expression; in that case, the system could simply produce a warning (or an error depending on who is authoring the question):CASE WHEN might break the KMIN guarantees, consider the following KMIN breach example when rewriting your query... (CASE WHEN attack example follows)

[0041] The KMIN models to be applied by the system can now be explained in greater detail. In general, the system seeks to balance the utility and complexity of the solution. Ideally, the approach should cover all of the representative real-life queries from customers, while being simple enough to just guide users to construct the KMIN compatible queries themselves. Or, indeed, make only simple changes to the raw query to turn it into a KMIN one.

[0042] In the Point-of-Use KMIN rule model, the KMIN policy is enforced at the very select that uses any of the KMIN tables directly. Assume, for example, the KMIN constraint is on exposures. id_col with a threshold of 100. The following query shows a correctly enforced KMIN policy in only two of three selects (lines 6 and 11). This is because once the policy has beenDocket No. RAMP-00311-WO enforced at a lower (subquery) level, it does not need to be repeated at the higher level, which does not use the exposures table.1 SELECT TXN_DATE, COUNT(*) exposure_counts, yt_counts, fb_counts2 FROM3 (SELECT T.TXN_DATE, COUNT(*) yt_counts4 FROM TXN T INNER JOIN EXPOSURES E ON T.ID_COL = E.ID_COL5 WHERE E. CHANNEL = 'youtube'6 GROUP BY 17 HAVING COUNT(DISTINCT E.ID_COL >= 100)) QI - kmin enforced here8 JOIN9 (SELECT T.TXN DATE, COUNT(*) fb_counts10 FROM TXN T INNER JOIN EXPOSURES E ON T.ID_COL = E.ID_COL11 WHERE E. CHANNEL = 'facebook'12 GROUP BY 113 HAVING COUNT( DISTINCT E.ID_COL >= 100)) Q2 - kmin enforced here14 ON Q1.TXN_DATE = Q2.TXN_DATE

[0043] If, however, the outer select used the exposures table, then the policy would have to be applied there as well as in the subqueries:1 ...(AS ABOVE)...2 JOIN EXPOSURES E ON Q1.TXN_DATE == E.EXPOSURE_DATE3 HAVING (COUNT DISTINCT E.ID_COL >= 100) - kmin enforced hereThis is a simple and easily explainable way of enforcing privacy by enforcing it at the point of use. The downside is that it might be overly strict in some cases.

[0044] For an example where point-of-use is too strict, consider the following query, where all_counts will not add up the exp_counts for TXN_DATE buckets below the 100 threshold, but it should have because it is outputting just one measure that takes into account all of the rows in the datasets with at least 100 distinct id_cols:1 WITH2 CTE1 AS (SELECT TXN_DATE, COUNT(*) exp_countsDocket No. RAMP-00311-WO3 FROM EXPOSURES4 GROUP BY 15 HAVING (COUNT DISTINCT E.ID_COL >= 100)) - kmin enforced here6 SELECT sum(exp_counts) all_counts FROM CTE1To summarize, the point-of-use KMIN model offers a strict but simple and explainable KMIN enforcement.

[0045] The point-of-use model can be made less strict and thus more useful while increasing the complexity only slightly. The logic change would be to require a relevant HAVING clause only where aggregating over multiple entity key values. This is the point-of-aggregation KMIN model.

[0046] If the query in the point-of-use model above is modified to include an ID_COL in the aggregation, then the exp_counts aggregated measure in CTE1 only contains a single ID_COL, and thus carries all the information needed to apply the KMIN policy in the enclosing, main SELECT. This is what happens in line 6 below. This approach solves the main problem with the point-of-use KMIN model:1 WITH2 CTE1 AS (SELECT ID_COL, TXN_DATE, COUNT(*) exp_counts3 FROM EXPOSURES4 GROUP BY 1, 2)5 SELECT sum(exp_counts) all_counts from CTE16 HAVING (COUNT DISTINCT E.ID_COL >= 100) - kmin enforced here

[0047] The point-of-aggregation KMIN is still easily explainable (the HAVING is applied in all places that aggregate multiple entity-keys) and still relatively simple to implement, as shown with the following example with HAVING applied within a UNION:1 with2 ctel as (SELECT id, sum(value) max_value FROM tablel),3 cte2 as (SELECT id, sum(value) max_value FROM table2),4 cte3 as (5 select id, max_value from ctel having count(distinct id) >= 5 -- tablel kmin enforced hereDocket No. RAMP-00311-WO6 union all7 select id, max_value from cte2 having count(distinct id) >= 5 - table2 kmin enforced here )8 select * from cte3It might seem tempting to insert a HAVING clause at the very end of the main query (line 9), but that would mean that the system enforces a single policy on two distinct tables. Thus, the HAVING clause must be applied in lines 5 and 6.

[0048] The methods described herein may in various embodiments be implemented by any combination of hardware and software. For example, in one embodiment, the methods may be implemented by a computer system (e.g., a computer system as in Fig. 3) or a collection of computer systems, each of which includes one or more hardware processors executing program instructions stored on a computer-readable physical storage medium coupled to the hardware processors, within the provider environment 10 and the customer environment 14.

[0049] The program instructions may implement the functionality described herein (e.g., the functionality of various hardware servers and other components that implement the networkbased cloud and non-cloud computing resources described herein). The various methods as illustrated in the figures and described herein represent example implementations. The order of any method may be changed, and various elements may be added, modified, or omitted.

[0050] Fig. 3 is a block diagram illustrating an example computer hardware system, according to various embodiments. Computer system 140 may implement a hardware portion of a cloud computing system as forming parts of the various implementations of the present invention. Computer system 140 may be any of various types of hardware devices, including, but not limited to, a commodity server, personal computer system, desktop computer, laptop or notebook computer, mainframe computer system, handheld computer, workstation, network computer, a consumer device, application server, physical storage device, telephone, mobile telephone, or in general any type of computing node, compute node, compute device, and / or hardware computing device.

[0051] Computer system 140 includes one or more hardware processors 140a, 141b...141n (any of which may include multiple processing cores, which may be single or multi-threaded) coupled to a physical system memory 142 via an input / output (I / O) interface 144. Computer system 140 further may include a network interface 146 coupled to I / O interface 144. In variousDocket No. RAMP-00311-WO embodiments, computer system 140 may be a single processor system including one hardware processor 141a, or a multiprocessor system including multiple hardware processors 141a, 141b... Mln as illustrated in Fig. 3.

[0052] Processors 141a, etc. may be any suitable processors capable of executing computing instructions. For example, in various embodiments, processors 141a, etc. may be general- purpose or embedded processors implementing any of a variety of instruction set architectures. In multiprocessor systems, each of processors 141a, etc. may commonly, but not necessarily, implement the same instruction set.

[0053] The computer system 140 also includes one or more hardware network communication devices (e.g., network interface 146) for communicating with other systems and / or components over a communications network, such as a local area network, wide area network, or the Internet. For example, a client application executing on system 140 may use network interface 146 to communicate with a server application executing on a single hardware server or on a cluster of hardware servers that implement one or more of the components of the systems described herein in a cloud computing environment as implemented in various sub-systems. In another example, an instance of a server application executing on computer system 140 may use network interface 146 to communicate with other instances of an application that may be implemented on other computer systems.

[0054] In the illustrated embodiment, computer system 140 also includes one or more physical persistent storage devices 148 and / or one or more I / O devices 150. In various embodiments, persistent storage devices 148 may correspond to disk drives, tape drives, solid-state memory or drives, other mass storage devices, or any other persistent storage devices.

[0055] Computer system 140 (or a distributed application or operating system operating thereon) may store instructions and / or data in persistent storage devices 148, as desired, and may retrieve the stored instructions and / or data as needed. For example, in some embodiments, computer system 140 may implement one or more nodes of a control plane or control system, and persistent storage 148 may include the solid-state drives (SSDs) attached to that server node. Multiple computer systems 140 may share the same persistent storage devices 148 or may share a pool of persistent storage devices, with the devices in the pool representing the same or different storage technologies, including such technologies as described above.Docket No. RAMP-00311-WO

[0056] Computer system 140 includes one or more physical system memories 142 that may store code / instructions 143 and data 145 accessible by processor(s) 141a, etc. The system memories 142 may include multiple levels of memory and memory caches in a system designed to swap information in memories based on access speed, for example. The interleaving and swapping may extend to persistent storage devices 148 in a virtual memory implementation, where memory space is mapped onto the persistent storage devices 148.

[0057] The technologies used to implement the system memories 142 may include, by way of example, static random-access memory (RAM), dynamic RAM, read-only memory (ROM), nonvolatile memory, solid-state memory, or flash-type memory. As with persistent storage devices 148, multiple computer systems 140 may share the same system memory systems 142 or may share a pool of system memories 142. System memory or memory systems 142 may contain program instructions 143 that are executable by processor(s) 141a, etc. to implement the routines described herein.

[0058] In various embodiments, program instructions 143 may be encoded in binary, Assembly language, any interpreted language such as Java, compiled languages such as C / C++, or in any combination thereof; the particular languages given here are only examples. In some embodiments, program instructions 143 may implement multiple separate clients, server nodes, and / or other components.

[0059] In some implementations, program instructions 143 may include instructions executable to implement an operating system (not shown), which may be any of various operating systems, such as UNIX, LINUX, Solaris™, MacOS™, or Microsoft Windows™.

[0060] Any or all of program instructions 143 may be provided as a computer program product, or software, that may include a non-transitory computer-readable storage medium having stored thereon instructions, which may be used to program a computer system (or other electronic devices) to perform a process according to various implementations. A non-transitory computer-readable storage medium may include any mechanism for storing information in a form (e.g., software or processing application) readable by a machine (e.g., a physical computer). Generally speaking, a non-transitory computer-accessible medium may include computer-readable storage media or memory media such as magnetic or optical media, e.g., disk or DVD / CD-ROM, coupled to or in communication with computer system 140 via I / O interface 144. A non-transitory computer-readable storage medium may also include anyDocket No. RAMP-00311-WO volatile or non-volatile media such as RAM or ROM that may be included in some embodiments of computer system 140 as system memory 142 or another type of memory.

[0061] In other implementations, program instructions may be communicated using optical, acoustical or other form of propagated signals (e.g., carrier waves, infrared signals, digital signals, etc.) conveyed via a communication medium such as a network and / or a wired or wireless link, such as may be implemented via network interface 606. Network interface 146 may be used to interface with other devices 142, which may include other computer systems or any type of external electronic device.

[0062] In some embodiments, system memory 142 may include data store 145, as described herein. In general, system memory 142 and persistent storage 148 may be accessible on other devices 142 through a network and may store data blocks, replicas of data blocks, metadata associated with data blocks, and / or their state, database configuration information, and / or any other information usable in implementing the routines described herein.

[0063] In one embodiment, I / O interface 144 may coordinate I / O traffic between processors 141a, etc., system memory 142, and any peripheral devices in the system, including through network interface 146 or other peripheral interfaces. In some embodiments, I / O interface 144 may perform any necessary protocol, timing or other data transformations to convert data signals from one component (e.g., system memory 142) into a format suitable for use by another component (e.g., processors 141a, etc.). In some embodiments, I / O interface 144 may include support for devices attached through various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard, as examples. Also, in some embodiments, some or all of the functionality of I / O interface 144, such as an interface to system memory 142, may be incorporated directly into processor(s) 141a, etc.

[0064] Network interface 146 may allow data to be exchanged between computer system 140 and other devices attached to a network, such as other computer systems (which may implement one or more storage system server nodes, primary nodes, read-only node nodes, and / or clients of the database systems described herein), for example. In addition, I / O interface 144 may allow communication between computer system 140 and various I / O devices 150 and / or remote storage 148. Input / output devices 150 may, in some embodiments, include one or more display terminals, keyboards, keypads, touchpads, scanning devices, voice or optical recognition devices, or any other devices suitable for entering or retrieving data by one or moreDocket No. RAMP-00311-WO computer systems 140. These may connect directly to a particular computer system 140 or generally connect to multiple computer systems 140 in a cloud computing environment, grid computing environment, or other system involving multiple computer systems 140. Multiple input / output devices 150 may be present in communication with computer system 140 or may be distributed on various nodes of a distributed system that includes computer system 140.

[0065] In some embodiments, similar input / output devices may be separate from computer system 140 and may interact with one or more nodes of a distributed system that includes computer system 140 through a wired or wireless connection, such as over network interface 146. Network interface 146 may commonly support one or more wireless networking protocols (e.g., Wi-Fi / I EEE 802.11, or another wireless networking standard). Network interface 146 may support communication via any suitable wired or wireless general data networks, such as other types of Ethernet networks, for example. Additionally, network interface 146 may support communication via telecommunications / telephony networks such as analog voice networks or digital fiber communications networks, via storage area networks such as Fibre Channel SANs, or via any other suitable type of network and / or protocol. In various embodiments, computer system 140 may include more, fewer, or different components than those illustrated in Fig. 3 (e.g., displays, video cards, audio cards, peripheral devices, or an Ethernet interface).

[0066] Any of the distributed system embodiments described herein, or any of their components, may be implemented as one or more network-based services in the cloud computing environment. For example, a read-write node and / or read-only nodes within the database tier of a hardware database system may present database services and / or other types of physical data storage services that employ the distributed storage systems described herein to clients as network-based services. In some embodiments, a network-based service may be implemented by a software and / or hardware system designed to support interoperable machine-to-machine interaction over a network. A web service may have an interface described in a machine-processable format.

[0067] Other systems may interact with the network-based service in a manner prescribed by the description of the network-based service's interface. For example, the network-based service may define various operations that other systems may invoke, and may define a particular application programming interface (API) to which other systems may be expected to conform when requesting the various operations.Docket No. RAMP-00311-WO

[0068] In various embodiments, a network-based service may be requested or invoked through the use of a message that includes parameters and / or data associated with the network-based services request. Such a message may be formatted according to a particular markup language such as Extensible Markup Language (XML), and / or may be encapsulated using a protocol. To perform a network-based services request, a network-based services client may assemble a message including the request and convey the message to an addressable endpoint (e.g., a Uniform Resource Locator (URL)) corresponding to the web service, using an Internet-based application layer transfer protocol such as Hypertext Transfer Protocol (HTTP).

[0069] Unless otherwise stated, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs. Although any methods and materials similar or equivalent to those described herein can also be used in the practice or testing of the present invention, a limited number of the exemplary methods and materials are described herein. It will be apparent to those skilled in the art that many more modifications are possible without departing from the inventive concepts herein.

[0070] All terms used herein should be interpreted in the broadest possible manner consistent with the context. When a grouping is used herein, all individual members of the group and all combinations and sub-combinations possible of the group are intended to be individually included. When a range is stated herein, the range is intended to include all sub-ranges within the range, as well as all individual points within the range. When "about," "approximately," or like terms are used herein, they are intended to include amounts, measurements, or the like that do not depart significantly from the expressly stated amount, measurement, or the like, such that the stated purpose of the apparatus or process is not lost. All references cited herein are hereby incorporated by reference to the extent that there is no inconsistency with the disclosure of this specification.

[0071] The present invention has been described with reference to certain preferred and alternative embodiments that are intended to be exemplary only and not limiting to the full scope of the present invention, as may set forth in the claims.

Claims

Docket No. RAMP-00311-WQClaims1. A system for transforming SQL queries into KMIN private SQL queries, comprising: a processor; a memory coupled to the processor, the memory storing instructions that, when executed by the processor, cause the system to: receive a raw SQL query; validate the raw SQL query to determine if it can be transformed into a KMIN private SQL query; parse the raw SQL query into constituent components; apply KMIN rewrite rules to the parsed components; and generate a KMIN private SQL query based on the applied rewrite rules, wherein the KMIN private SQL query produces results with the same schema as the raw SQL query, but with every aggregated analytical value being derived from at least K rows representing distinct entity keys.

2. The system of claim 1, wherein the instructions further cause the system to, if the raw SQL query cannot be transformed into a KMIN private SQL query, provide guidance on how to modify the raw SQL query to make it eligible for KMIN privacy processing.

3. The system of claim 1, wherein the KMIN rewrite rules include a point-of-use-KMIN rule that enforces KMIN policy at every select statement that uses any KMIN tables directly.

4. The system of claim 1, wherein the KMIN rewrite rules include a point-of-aggregation-KMIN rule that requires a relevant HAVING clause only when aggregating over multiple entity key values.

5. The system of claim 1, wherein the generated KMIN private SQL query uses standard SQL HAVING clauses to implement KMIN privacy.

6. The system of claim 1, wherein the instructions further cause the system to: receive privacy policy metadata from a privacy policy administrator; and use the privacy policy metadata in the validation and transformation of the raw SQL query.Docket No. RAMP-00311-WQ7. The system of claim 6, wherein the privacy policy metadata includes at least one of: privacy subjects, KMIN limits per column, dimensions for searches, and applicable aggregation functions.

8. The system of claim 1, wherein the generated KMIN private SQL query is human-readable and allows for editing by sophisticated users.

9. The system of claim 1, wherein the instructions further cause the system to execute the generated KMIN private SQL query against a database to produce privacy-compliant results.

10. The system of claim 1, wherein the validation of the raw SQL query includes checking the query against a set of predefined rules that determine whether the query can be made KMIN private without altering its intended functionality.

11. A method for transforming SQL queries into KMIN private SQL queries, comprising: receiving a raw SQL query; validating the raw SQL query to determine if it can be transformed into a KMIN private SQL query; parsing the raw SQL query into constituent components; applying KMIN rewrite rules to the parsed components; and generating a KMIN private SQL query based on the applied rewrite rules, wherein the KMIN private SQL query produces results with the same schema as the raw SQL query, but with every aggregated analytical value being derived from at least K rows representing distinct entity keys.

12. The method of claim 11, further comprising the step of, if the raw SQL query cannot be transformed into a KMIN private SQL query, providing guidance on how to modify the raw SQL query to make it eligible for KMIN privacy processing.

13. The method of claim 11, wherein the KMIN rewrite rules include a point-of-use-KMIN rule that enforces KMIN policy at every select statement that uses any KMIN tables directly.

14. The method of claim 11, wherein the KMIN rewrite rules include a point-of-aggregation-KMIN rule that requires a relevant HAVING clause only when aggregating over multiple entity key values.

15. The method of claim 11, wherein the generated KMIN private SQL query uses standard SQL HAVING clauses to implement KMIN privacy.

16. The method of claim 11, further comprising:Docket No. RAMP-00311-WQ receiving privacy policy metadata from a privacy policy administrator; and using the privacy policy metadata in the validation and transformation of the raw SQL query.

17. The method of claim 16, wherein the privacy policy metadata includes at least one of: privacy subjects, KMIN limits per column, dimensions for searches, and applicable aggregation functions.

18. The method of claim 11, wherein the generated KMIN private SQL query is human-readable and allows for editing by sophisticated users.

19. The method of claim 11, further comprising the step of executing the generated KMIN private SQL query against a database to produce privacy-compliant results.

20. The method of claim 11, wherein the validation of the raw SQL query includes checking the query against a set of predefined rules that determine whether the query can be made KMIN private without altering its intended functionality.

Images