Patent Grant
7853545
This application is related to the inventor's application “Preserving Privacy Of One-Dimensional Data Streams Using Dynamic Autocorrelation”, Ser. No. 11/678,808, which was filed on the same day as the present application and commonly assigned herewith to International Business Machines Corporation. This related application is incorporated herein by reference in its entirety.
The present invention generally relates to the field of data stream publishing, and more particularly relates to preserving privacy in data streams.
Recently, there has been an increasing concern regarding privacy breaches, especially those involving sensitive personal data of individuals as discussed in A. Evfimevski, J. Gehrke, and R. Srikant. Limiting privacy breaches in privacy preserving data mining. In PODS, 2003, which is hereby incorporated by reference in its entirety. As a result, restrictions and regulations in publishing sensitive personal data have been tightened as discussed in K. Thearling. Data mining and privacy: A conflict in making. In DS*, 1998; which is hereby incorporated by reference in its entirety; these address data owned by government organizations as well as corporations. It is therefore not surprising that the data management community has become increasingly focused on ways to guarantee the privacy of sensitive data.
Meanwhile, unprecedented massive data from various sources provide a great opportunity for data mining and information integration. Unfortunately, the privacy requirement and data mining applications pose exactly opposite expectations from data publishing as discussed in A. Evfimevski, J. Gehrke, and R. Srikant. Limiting privacy breaches in privacy preserving data mining. In PODS, 2003, K. Thearling. Data mining and privacy: A conflict in making. In DS*, 1998, which are hereby incorporated by reference in their entirety. The utility of the published data with respect to the mining application decreases with increasing levels of privacy guarantees as discussed in D. Kifer, and J. Gehrke. Injecting utility into anonymized datasets. In SIGMOD, 2006, which is hereby incorporated by reference in its entirety. Previous work has noticed this important tradeoff between privacy and utility and various techniques have been proposed to achieve a desired balance between the two as discussed in R. Agrawal and R. Srikant. Privacy preserving data mining. In SIGMOD, 2000, H. Kargupta, S. Datta, Q. Wang, and K. Sivakumar. On the privacy preserving properties of random data perturbation techniques. In ICDM, 2003, K. Liu, H. Kargupta, and J. Ryan. Random Projection-Based Multiplicative Data Perturbation for Privacy Preserving Distributed Data Mining. IEEE TKDE, 18(1), 2006, K. Chen and L. Liu. Privacy preserving data classification with rotation perturbation. In ICDM, 2005, W. Du and Z. Zhan. Using randomized response techniques for privacy-preserving data mining. In SIGKDD, 2003, A. Machanavajjhala, J. Gehrke, D. Kifer, and M. Venkitasubramaniam. I-diversity: Privacy beyond k-anonymity. In ICDE, 2006, L. Sweeney. k-anonymity: a model for protecting privacy. Int. J Uncertain. Fuzziness Knowl.-Based Syst., 10(5), 2002, A. Evfimevski, R. Srikant, R. Agarwal, and J. Gehrke. Privacy preserving mining of association rules. In SIGKDD, 2002, which are hereby incorporated by reference in their entirety.
Prior related work such as that described in R. Agrawal and R. Srikant. Privacy preserving data mining. In SIGMOD, 2000, D. Agrawal and C. C. Aggarwal. On the design and quantification of privacy preserving data mining algorithms. In PODS, 2001, H. Kargupta, S. Datta, Q. Wang, and K. Sivakumar. On the privacy preserving properties of random data perturbation techniques. In ICDM, 2003, Z. Huang, W. Du, and B. Chen. Deriving private information from randomized data. In SIGMOD, 2005, which are hereby incorporated by reference in their entirety, includes additive random perturbation for the offline, conventional relational data model, where the noise is distributed along the principal components of the original data in order to achieve maximum privacy, given a fixed utility. These offline algorithms are not optimal when applied to numerical, non-stationary (or, time-evolving) data streams. The dynamic correlations and autocorrelations, if not carefully considered, may allow for the reconstruction of the original streams. Other problems are that in random perturbation systems, analysis of the data has to be performed incrementally, using limited processing time and buffer space, making batch approaches unsuitable. Second, the characteristics of streams evolve over time. Consequently, approaches based on global analysis of the data are not adequate.
Therefore a need exists to overcome the problems with the prior art as discussed above.
Briefly, in accordance with the present invention, disclosed are a method, information processing system, and a computer readable medium for preserving privacy of nonstationary data streams. The method comprises receiving at least one nonstationary data stream with time dependent data. Calculating, for a given instant of sub-space of time, A set of first-moment statistical values is calculated, for a given instant of sub-space of time, for the data. The first moment statistical values include a principal component for the sub-space of time. The data is perturbed with noise along the principal component in proportion to the first-moment of statistical values so that at least part of a set of second-moment statistical values for the data is perturbed by the noise only within a predetermined variance.
In another embodiment, an information processing system for preserving privacy of nonstationary data streams is disclosed. The information processing system includes a memory and a processor that is communicatively coupled to the memory. The information processing system also includes a privacy preserving module. The privacy preserving module is adapted to receiving at least one nonstationary data stream with time dependent data. Calculating, for a given instant of sub-space of time, A set of first-moment statistical values is calculated, for a given instant of sub-space of time, for the data. The first moment statistical values include a principal component for the sub-space of time. The data is perturbed with noise along the principal component in proportion to the first-moment of statistical values so that at least part of a set of second-moment statistical values for the data is perturbed by the noise only within a predetermined variance.
In yet another embodiment, a computer readable medium for preserving privacy of nonstationary data streams is disclosed. The computer readable medium comprises instructions for receiving at least one nonstationary data stream with time dependent data. Calculating, for a given instant of sub-space of time, A set of first-moment statistical values is calculated, for a given instant of sub-space of time, for the data. The first moment statistical values include a principal component for the sub-space of time. The data is perturbed with noise along the principal component in proportion to the first-moment of statistical values so that at least part of a set of second-moment statistical values for the data is perturbed by the noise only within a predetermined variance.
One advantage of the present invention is that privacy within data streams is provided. The present invention efficiently and effectively tracks the correlation and autocorrelation structures of multivariate streams and leverages it to add noise, which maximally preserves privacy. The present invention provides efficient online streaming algorithms that guarantee the privacy of single or multiple non-stationary data streams. Random perturbations can be inserted in the data stream that “mirror” the streams' statistical properties, in an online fashion. A number of important mining operations can still be performed, by controlling perturbation magnitude. However, the original data streams cannot be reconstructed with high confidence. In other words, the present invention provides a privacy preserving method under the additive random perturbation framework that maximally preserves the privacy of data streams given a fixed utility while, additionally, better preserving the statistical properties of the data.
The accompanying figures where like reference numerals refer to identical or functionally similar elements throughout the separate views, and which together with the detailed description below are incorporated in and form part of the specification, serve to further illustrate various embodiments and to explain various principles and advantages all in accordance with the present invention.
The present invention as would be known to one of ordinary skill in the art could be produced in hardware or software, or in a combination of hardware and software. However in one embodiment the invention is implemented in software. The system, or method, according to the inventive principles as disclosed in connection with the preferred embodiment, may be produced in a single computer system having separate elements or means for performing the individual functions or steps described or claimed or one or more elements or means combining the performance of any of the functions or steps disclosed or claimed, or may be arranged in a distributed computer system, interconnected by any suitable means as would be known by one of ordinary skill in the art.
According to the inventive principles as disclosed in connection with the preferred embodiment, the invention and the inventive principles are not limited to any particular kind of computer system but may be used with any general purpose computer, as would be known to one of ordinary skill in the art, arranged to perform the functions described and the method steps described. The operations of such a computer, as described above, may be according to a computer program contained on a medium for use in the operation or control of the computer, as would be known to one of ordinary skill in the art. The computer medium, which may be used to hold or contain the computer program product, may be a fixture of the computer such as an embedded memory or may be on a transportable medium such as a disk, as would be known to one of ordinary skill in the art.
The invention is not limited to any particular computer program or logic or language, or instruction but may be practiced with any such suitable program, logic or language, or instructions as would be known to one of ordinary skill in the art. Without limiting the principles of the disclosed invention any such computing system can include, inter alia, at least a computer readable medium allowing a computer to read data, instructions, messages or message packets, and other computer readable information from the computer readable medium. The computer readable medium may include non-volatile memory, such as ROM, Flash memory, floppy disk, Disk drive memory, CD-ROM, and other permanent storage. Additionally, a computer readable medium may include, for example, volatile storage such as RAM, buffers, cache memory, and network circuits.
Furthermore, the computer readable medium may include computer readable information in a transitory state medium such as a network link and/or a network interface, including a wired network or a wireless network that allows a computer to read such computer readable information. The present invention, according to an embodiment, overcomes problems with the prior art by providing a more efficient mechanism for memory copy operations. The present invention allows the processor to continue executing subsequent instructions during a memory copy operation thereby avoiding unnecessary processor downtime.
Exemplary Computing Environment
In the illustrated embodiment, the computing environment 100 is a distributed system in a symmetric multiprocessing (“SMP”) computing environment. The computing environment 100 includes processing nodes 102 and 104 coupled to one another via network adapters 106 and 108. Each processing node 102 and 104 is an independent computer with its own operating system image 110 and 112, channel controller 114 and 116, memory 118 and 120, and processor(s) 122 and 124 on a system memory bus 126 and 128. A system input/output bus 120 and 122 couples I/O adapters 134 and 136 and network adapter 106 and 108. Although only one processor 122 and 124 is shown in each processing node 102 and 104, each processing node 102 and 104 is capable of having more than one processor. Each network adapter is linked together via a network switch 132. In some embodiments, the various processing nodes 102 and 104 are part of a processing cluster.
Stream Processing System
Each entity 202, 204, 206 provides one or more data streams 212, 214, 216 to the stream processing system 208. Data stream processing components 218 within the stream processing system 208 perform the requested functions such as analytical services, identification of trends, clusters, patterns, aggregations', and the like. The results of the stream processing system 208 can then be published. However, the data in the data streams 212, 214, 216 can be private or sensitive. Therefore, publishing the results the stream processing system associated with private or sensitive information can be problematic. Many businesses and corporations do not want to publish their original data streams. Therefore, the stream processing system 208 includes a privacy preserving module 220, which allows results to be published while maintaining the privacy of the data. The privacy preserving functions of the privacy preserving module 220 are discussed in greater detail in the following sections.
In one embodiment, the stream processing system 208 receives multiple continuous streams as discussed above. A stream is a time ordered sequence of tuples. Without loss of generality, it can be assumed that each tuple comprises of a single attribute. However, a tuple is only referred as having a single attribute for clarity and multi-attribute tuples can be handled in a manner similar to the case of multiple streams. Furthermore, it can be assumed that all streams are resampled to a common rate, which is between the arrival rate of the fastest and the slowest stream. The common sampling rate can be chosen based on arrival rate, data characteristics, and available processing capacity. Subsequently, any standard resampling technique such as those discussed in A. V. Oppenheim and A. S. Wilsky. Signals and Systems. Prentice-Hall, 1983, S. Haykin. Adaptive Filter Theory. Prentice-Hall, 4th edition, 2002 can be applied such as, for example, linear interpolation (for up-sampling) or decimated moving average (e.g., tumbling average, for down-sampling). In one embodiment, a time granularity is assumed such that, during each time interval, there is exactly one recorded incoming value from each stream.
Therefore, in one embodiment and without loss of generality, the data streams comprise of N data streams, denoted as A1, . . . , AN. For any i-th data stream Ai, its value at time t is Aij. The stream collection is written as A=[Ai for 1≦i≦N]. Formally, the stream collection A can be considered as a T×N matrix where N is the number of streams and T is the current timestamp, which grows indefinitely. The values from all streams at time t are AtεRN, i.e., t-th row of A.
Privacy Preservation Through Correlation Tracking
To ensure privacy of streaming data, the privacy preservation module 220 modifies the values of incoming tuples by adding noise. The random noise can be denoted as EεRT×N, where each entry Eti is the noise added to the i-th stream at time t. Therefore, the perturbed streams are A*=A+E. Without loss of generality, in one embodiment, the noise is assumed to have zero mean. to facilitate the discussion on utility and privacy the concept of decrepancy D between two versions of the data A and B is defined as the normalized squared Frobenius norm
where A, BεRT×N. The squared Frobenius norm is defined as ∥A∥F2:=Σi,j(Aij)2.
With respect to utility, considering the perturbed versus the original data, the larger the amplitude of the perturbation (i.e., the variance of the added noise), the larger the distortion of the original values. However, as the distortion increases, the usefulness of the data decreases: a larger distortion hides the original values better but it also hides more information about their relationships. The discrepancy D(A,A*) between original and perturbed data measures precisely the squared distortion. The utility can be defined as the inverse of this discrepancy. However, throughout the discussion, discrepancy is typically used, since the two are essentially interchangeable.
With respect to privacy, distorting the original values is only part of the function performed by the privacy preserving module 220. The privacy preserving module 220 also ensures that that this distortion cannot be filtered out. Thus, to measure the privacy, the requirements to reconstruct the original data are considered. Specifically, suppose that à are the reconstructed data streams obtained by an entity trying to reconstruct the original data. Then the privacy is the discrepancy between the original and the reconstructed streams, i.e., D(A,Ã).
Because an entity would obtain original data from the perturbed data, two problems are formulated, data reconstruction and data perturbation. Therefore, the privacy preserving module 220, given the perturbed streams A*, computes the reconstruction stream à so that D(A,Ã) is minimized. This process is discussed in greater detail below. In one embodiment, linear reconstruction methods such as those described in H. Kargupta, S. Datta, Q. Wang, and K. Sivakumar. On the privacy preserving properties of random data perturbation techniques. In ICDM, 2003, Z. Huang, W. Du, and B. Chen. Deriving private information from randomized data. In SIGMOD, 2005, K. Liu, H. Kargupta, and J. Ryan. Random Projection-Based Multiplicative Data Perturbation for Privacy Preserving Distributed Data Mining. IEEE TKDE, 18(1), 2006, K. Chen and L. Liu. Privacy preserving data classification with rotation perturbation. In ICDM, 2005, are focused on by the present invention. Intuitively, an entity trying to obtain the original data can only user linear transformations on the perturbed data, such as projections and rotations, in the reconstruction step.
Linear construction can be defined as follows, given the perturbed streams A*, the linear reconstruction is Ã=A*R such that D(A,Ã) is minimized. If both the perturbed streams A* and the original streams A are available, the solution à can be easily identified using linear regression. However, A is not available. Therefore, in order to estimate Ã, some additional constraints or assumptions can be imposed to make the problem solvable. A widely adopted assumption described in 21 is that the data lie in a static low dimensional subspace (i.e., global correlation exists). This is reasonable, since if no correlations are present, then independent, identically distributed (“i.i.d.”) perturbations are already sufficient to effectively hide the data. However, real data typically exhibit such correlations. In one embodiment, dynamic (rather than static) correlations among streams are relied upon, as well as on dynamic autocorrelations. This is discussed in greater detail below.
The privacy preservation module 220, given the original streams A and a desirable discrepancy threshold σ2, also creates perturbed streams A* such that 1.) D(A,Ã)=σ2 and 2.) for any linear reconstruction Ã,D(A,Ã)>σ2. Perturbation has exactly the opposite goal from the reconstruction. However, the correlation and autocorrelation properties of the streams are still the keys in the solution to both problems as discussed in greater detail below.
One type of privacy preservation performed by the privacy preserving module 220 is privacy with dynamic correlation. With respect to the perturbation process, the privacy preserving module 220 maps the stream measurements At at time t represented as an N-dimensional point to the perturbed measurements At* with discrepancy σ2. For any reconstruction effort, the goal is to transform the perturbed measurements, At* onto At so that, D(At,Ãt) is small. A principled way of reconstruction is to project the data onto the principal component subspace Z. Huang, W. Du, and B. Chen. Deriving private information from randomized data. In SIGMOD, 2005. such that most noise is removed, while the original data are maximally preserved, i.e., not much additional error is included. This illustrated in
When the noise is added exactly along the principal direction, removed noise becomes zero. However, additional projection error is included. In this case, the perturbation is robust towards this reconstruction attempt, in the sense that D(A,Ã)=D(A,A*). In one embodiment, correlated noise is added following the trends present in the streams. Consider the example shown in
The privacy preserving module 220 dynamically inserts noise using online correlating tracking. Once type of online correlating tracking is Streaming Correlated Additive Noise (“SCAN”). Table 2 shows one example of a SCAN algorithm.
N×k, Λ ∈
k × k
Data streams often present strong correlations and these correlations change dynamically Y. Zhu and D. Shasha. Statstream: Statistical monitoring of thousands of data streams in real time. In VLDB, 2002, S. Papadimitriou and P. Yu. Optimal multi-scale patterns in time series streams. In SIGMOD, 2006, S. Papadimitriou, J. Sun, and C. Faloutsos. Streaming pattern discovery in multiple time-series. In VLDB, 2005. Consider the examples in
An important property of the SCAN algorithm is that when the noise is rotated back to the data space (line 6 of Table 2), its variance is equal to the specified discrepancy threshold σ2. Intuitively, SCAN tracks the covariance matrix and adds noise with essentially the same covariance as the data streams. At any time instant T, the perturbed data streams A* from SCAN satisfy D(A,A*)=σ2. Additionally, SCAN preserves the eigenvectors of the (uncentered) covariance matrix of A. Therefore, the SCAN perturbation does not affect any mining algorithms that rely on the second moments of the data (i.e., linear correlations).
The privacy preserving module 220 can use Streaming Correlation Online Reconstruction (“SCOR”). Table 3 shows one example of a SCOR algorithm.
N×k, Λ ∈
k × k
The privacy achieved by SCAN is determined by the best linear reconstruction an adversary (an entity trying to obtain the original data from the perturbed data) could perform on A*. For evolving data streams as illustrated in
Intuitively, SCOR reconstruction removes all the noise orthogonal to the local principal components and inserts little additional projection error, since local PCA can usually track the data accurately. In other words, i.i.d. noise can usually be successfully removed, provided that the streams are correlated. However, the perturbation from SCAN cannot be removed at all since the noise is distributed along the “instantaneous” correlation in the streams. The reconstruction error of SCOR on the perturbation from SCAN is ≈σ2. Formally, given a linear reconstruction Ã=A*R, the privacy can be decomposed as
where R is a projection matrix, meaning that R=UUT with UεRN×k orthonormal. Since the subspaces tracked by both SCOR and SCAN are the same, the remaining noise is σ2, i.e., no noise is removed. Therefore, D(A,Ã)≧σ2 by the triangle inequality. Note that the projection error for SCOR is small, provided that the data are locally correlated. Therefore, the reconstruction error (i.e., privacy, as defined above) of SCOR is approximately σ2, i.e., equal to the original discrepancy. Moreover, when σ2 is small compared to the original data, other reconstruction methods result in higher error due to the large projection error.
Another type of privacy preservation performed by the privacy preserving module 220 is privacy with dynamic autocorrelation. The privacy preserving method discussed above was based on correlation across many streams. Dynamic autocorrelation is performed on a single stream. The noise added using dynamic autocorrelation mirrors the dominant trends in the series. Table 4 shows one example of a Streaming Autocorrelation Additive Noise Algorithm (SACAN) and Table 4 shows one example of a Streaming Auto-Correlation Online Reconstruction (“SACOR”) algorithm.
h ×k , A ε
k x k
N×κ, Λ ∈
κ × κ
Consider the following simple examples: If the stream always has a constant value, the right way to hide this value is to add the same noise throughout time. Any other noise can be easily filtered out by simple averaging. The situation is similar for a linear trend (this is also an example that cannot be captured by Fourier). If the stream is a sine wave, the right way to hide it is by adding noise with the same frequency (but potentially a different phase); anything else can be filtered out. Dynamic autocorrelation is the generalization, in a principled manner, of these notions.
For example, the light and dark curves in
The discussion above showed how to track the local statistical properties of the N-dimensional sequence of the vectors At, indexed over time t. More specifically, the principal subspace of this matrix is tracked, thereby focusing on the most dominant (in a least-squares sense) of these relationships. Noise that “mirrors” those relationships is subsequently added, making it indistinguishable from the original data.
The following discussion shows that the same principles used to capture relationships across many attributes can be used to capture relationships of one attribute across time. In fact, there is a natural way to move between the original time domain and a high-dimensional sequence space. The t-th window of the time series stream a(t) is an h-dimensional point, Wt:=[a(t),a(t+1), . . . , a(t+h−1)]TεRh. The window matrix W has the windows Wt as rows. Thus, Wij=a((i−1)h+j) by construction. The space spanned by the sequence of windows Wt is known as the h-th order phase space of the series a(t) M. G Ghil, M. Allen, M. Dettinger, K. Ide, D. Kondrashov, M. Mann, A. Robertson, A. Saunders, Y. Tian, F. Varadi, and P. Yiou. Advanced spectral methods for climatic time series. Rev. Geophys., 40(1), 2002. Subsequently, the same technique as before can be applied using W in place of A. The discussion above discussion with respect to the dynamic correlation method can be directly transferred to the autocorrelation case.
An example is shown in
The following discussion address the issues that arise from the fact that W is a Hankel matrix. Similarly, the noise matrix E, in one embodiment, is a Hankel matrix as shown in
Formally stated, the residual Et−UUTEt must be zero, or (I−UUT)Et≡QEt=0 (1) where P=UUT is the projection operator onto the subspace of U and Q=I−P=I−UUT is the projector onto the orthogonal complement. Assume that the noise values up to time t-k have been chosen. Based on these and on the current estimate of U, the next k noise values (where k is the principal subspace dimension) is determined. Let
concatenation (for example, [1,2|3,4] results into two row vectors [12] and [34]. The first block elεRh-k comprises of h−k known values, whereas the second block erεRk comprises of k unknown noise values that are to be determined. Similarly, decomposing Q≡[Ql|Qr] into blocks QlεRh×(h-k) and QrεRh×k equation (1) can be rewritten as Qlel+Qrer=0 or Qrer=−Qlel (2). This is a linear equation system with k variables and k unknowns. Since the principal subspace has dimension k by construction, the linear system is full-rank and can always be solved. The bottom right of
In one embodiment, the above equation cannot be applied for initial values of the noise; i.i.d. noise is used for those. Initially, nothing is known about the patterns present in the signal, therefore i.i.d. noise is the best choice, since there are no correlations yet. However, the entity trying to obtain the original data form the perturbed data also has not observed any correlations that can be leveraged to remove that noise. The important point is that, as soon as correlations become present, the privacy preserving module 220 learns them and uses them to intelligently add the noise, before the entity can exploit this information.
If both correlations are desired to be captured as well as autocorrelations on multi-dimensional streams, the problem can be decomposed in a fashion very similar to S. Papadimitriou, J. Sun, and C. Faloutsos. Streaming pattern discovery in multiple time-series. In VLDB, 2005. In this case, the present invention tracks the Eigen space of the covariance matrix. However, instead of using it only for adding noise, PCA is performed on the stream collection, to obtain kN streams of “hidden variables”. Subsequently, the autocorrelation tracking scheme discussed above can be applied independently on each of these uncorrelated (across dimension) streams. SPIRIT performs precisely the same decomposition of the problem (while controlling the PCA approximation error) S. Papadimitriou, J. Sun, and C. Faloutsos. Streaming pattern discovery in multiple time-series. In VLDB, 2005, except it does so for multi-dimensional auto regression, rather than autocorrelation tracking.
As can be seen from the above discussion, data streams in the real world typically exhibit both significant correlations as well as autocorrelation, thereby providing ample opportunities for entities to breach privacy. The present invention provides a method for maintaining the privacy of numerical streams. In particular, the present invention provides privacy using correlation across multiple streams and of autocorrelation within one stream. The present invention dynamically tracks both and subsequently added noise that “mirrors” these statistical properties, making it indistinguishable from the original data. Therefore, the present invention prevent entities from leveraging these properties to remove the noise and thereby breach privacy.]
Exemplary Information Processing System
The mass storage interface 1108 is used to connect mass storage devices, such as data storage device 1116, to the information processing system 1100. One specific type of data storage device is a computer readable medium such as a floppy disk drive, which may be used to store data to and read data from a CD 1118 or a floppy diskette (not shown). Another type of data storage device is a data storage device configured to support, for example, NTFS type file system operations.
The main memory 1106 comprises the privacy preserving module 220, which has been discussed above in greater detail. Although illustrated as concurrently resident in the main memory 1106, it is clear that respective component(s) of the main memory 1106 are not required to be completely resident in the main memory 1106 at all times or even at the same time. In one embodiment, the information processing system 1100 utilizes conventional virtual addressing mechanisms to allow programs to behave as if they have access to a large, single storage entity, referred to herein as a computer system memory, instead of access to multiple, smaller storage entities such as the main memory 1106 and data storage device 1116. Note that the term “computer system memory” is used herein to generically refer to the entire virtual memory of the information processing system 1100.
Although only one CPU 1104 is illustrated for computer 1102, computer systems with multiple CPUs can be used equally effectively. Embodiments of the present invention further incorporate interfaces that each includes separate, fully programmed microprocessors that are used to off-load processing from the CPU 1104. Terminal interface 1110 is used to directly connect one or more terminals 1120 to computer 1102 to provide a user interface to the computer 1102. These terminals 1120, which are able to be non-intelligent or fully programmable workstations, are used to allow system administrators and users to communicate with the information processing system 1100. The terminal 1120 is also able to consist of user interface and peripheral devices that are connected to computer 1102 and controlled by terminal interface hardware included in the terminal I/F 1110 that includes video adapters and interfaces for keyboards, pointing devices, and the like.
An operating system (not shown) included in the main memory is a suitable multitasking operating system such as the Linux, UNIX, Windows XP, and Windows Server 2001 operating system. Embodiments of the present invention are able to use any other suitable operating system. Some embodiments of the present invention utilize architectures, such as an object oriented framework mechanism, that allows instructions of the components of operating system (not shown) to be executed on any processor located within the information processing system 1100. The network adapter hardware 1112 is used to provide an interface to the network 210. Embodiments of the present invention are able to be adapted to work with any data communications connections including present day analog and/or digital techniques or via a future networking mechanism.
Although the exemplary embodiments of the present invention are described in the context of a fully functional computer system, those skilled in the art will appreciate that embodiments are capable of being distributed as a program product via CD or DVD, e.g. CD 1118, CD ROM, or other form of recordable media, or via any type of electronic transmission mechanism.
Process of Preserving Privacy in Data Streams Using Dynamic Correlation
Process of Preserving Privacy in a Single Data Stream Using Dynamic Autocorrelation
For example, if the stream always has a constant value, the right this value is hiding be adding the same noise throughout time. Any other noise can be easily filtered out by simple averaging. The situation is similar for a linear trend. If the stream is a sine wave, the wave can be hidden by adding noise with the same frequency (but potentially a different phase); anything else can be filtered out. The control flow exits at step 1312.
Non-Limiting Examples
The present invention can be realized in hardware, software, or a combination of hardware and software. A system according to a preferred embodiment of the present invention can be realized in a centralized fashion in one computer system or in a distributed fashion where different elements are spread across several interconnected computer systems. Any kind of computer system—or other apparatus adapted for carrying out the methods described herein—is suited. A typical combination of hardware and software could be a general purpose computer system with a computer program that, when being loaded and executed, controls the computer system such that it carries out the methods described herein.
In general, the routines executed to implement the embodiments of the present invention, whether implemented as part of an operating system or a specific application, component, program, module, object or sequence of instructions may be referred to herein as a “program.” The computer program typically is comprised of a multitude of instructions that will be translated by the native computer into a machine-readable format and hence executable instructions. Also, programs are comprised of variables and data structures that either reside locally to the program or are found in memory or on storage devices. In addition, various programs described herein may be identified based upon the application for which they are implemented in a specific embodiment of the invention. However, it should be appreciated that any particular program nomenclature that follows is used merely for convenience, and thus the invention should not be limited to use solely in any specific application identified and/or implied by such nomenclature.
Although specific embodiments of the invention have been disclosed, those having ordinary skill in the art will understand that changes can be made to the specific embodiments without departing from the spirit and scope of the invention. The scope of the invention is not to be restricted, therefore, to the specific embodiments, and it is intended that the appended claims cover any and all such applications, modifications, and embodiments within the scope of the present invention.
| Number | Name | Date | Kind |
|---|---|---|---|
| 6327574 | Kramer et al. | Dec 2001 | B1 |
| 6546389 | Agrawal et al. | Apr 2003 | B1 |
| 6694303 | Agrawal et al. | Feb 2004 | B1 |
| 6834272 | Naor et al. | Dec 2004 | B1 |
| 6931403 | Agrawal et al. | Aug 2005 | B1 |
| 7024409 | Iyengar | Apr 2006 | B2 |
| 7107269 | Arlein et al. | Sep 2006 | B2 |
| 7302420 | Aggarwal et al. | Nov 2007 | B2 |
| 20050049991 | Aggarwal et al. | Mar 2005 | A1 |
| 20080025511 | Fuse et al. | Jan 2008 | A1 |
| 20080140425 | Shimada | Jun 2008 | A1 |
| 20100033305 | Korgaonkar et al. | Feb 2010 | A1 |
| Number | Date | Country | |
|---|---|---|---|
| 20080209568 A1 | Aug 2008 | US |
