International Business Machines Corporation

Microsoft Technology Licensing, LLC

Cynthia Dwork

Frank David McSherry

Joseph Y Halpern

Moni Naor

Florian Pestoni

Jeffrey Bruce Lotspiech

Shanmugasundaram Ravikumar

Joshua T Goodman

Robert L Rounthwaite

Robert George Atkinson

James M Lyon

Roy Williams

Khaja Ehteshamuddin Ahmed

Andrew V Goldberg

Hovey Ramond Strong, Jr

Simeon Naor

Harry Simon Katz

Yaacov Nissim Kobliner

Alexander G Gounares

Nir Nice

Ying Li

Melissa Wood Dunn

Michael Joseph Toutonghi

Hovey Raymond Strong

Dandapani Sivakumar

Ching-Tien Ho

Uri Barash

Teresa Mah

Danny Dolev

Boaz Feldbaum

Darrell J Cannon

Sefy Ophir

Vu Anh Ha

Eric Picard

Amit Sahai

Amit Shaked

Eric Don Van Valkenburg

Friedman Arie

Avrim L Blum

Methods, systems, and computer-readable media for facilitating personalization of web content is provided, while protecting the privacy of the user data utilized to personalize the user's experience. A privacy vault may collect user data including user activity data, demographic data, and user interests submitted by a user. In one embodiment, the privacy vault operates on a user client device. The privacy vault sends the user data to a community vault that collects user data from multiple users. The community vault generates segment rules that whether a user belongs to a user segment, which expresses a user's interest. The segment rules are then communicated back to the privacy vault, which assigns one or more user segments to the user based on the user data available to the privacy vault and the segment rules. The privacy vault may communicate user segments to one or more content providers that supply personalized content that is selected based on the user segments provided.

Privacy vault for maintaining the privacy of user profiles

Systems and methods for injecting noise into secure function evaluation to protect the privacy of the participants and for computing a collective noisy result by combining results and noise generated based on input from the participants. When implemented using distributed computing devices, each device may have access to a subset of data. A query may be distributed to the devices, and each device applies the query to its own subset of data to obtain a subset result. Each device then divides its subset result into one or more shares, and the shares are combined to form a collective result. The devices may also generate random bits. The random bits may be combined and used to generate noise. The collective result can be combined with the noise to obtain a collective noisy result.

Noise in secure function evaluation

The present invention provides for generating inputs that can be provided to a message classification module to facilitate more reliable classification of electronic messages, such as, for example, as unwanted and/or unsolicited. In one embodiment, a sending messaging server provides an appropriate response to address verification data thereby indicating a reduced likelihood of the sending messaging server using a forged network address. In another embodiment, it is determined if a messaging server is authorized to send electronic messages for a domain. In yet another embodiment, electronic message transmission policies adhered to by a domain are identified. In yet a further embodiment, a sending computer system expends computational resources to solve a computational puzzle and includes an answer document in an electronic message. A receiving computer system receives the electronic message and verifies the answer document.

Reducing unwanted and unsolicited electronic messages by exchanging electronic message transmission policies and solving and verifying solutions to computational puzzles

Systems and methods are provided for selectively determining privacy guarantees. For example, a first class of data may be guaranteed a first level of privacy, while other data classes are only guaranteed some lesser level of privacy. An amount of privacy is guaranteed by adding noise values to database query outputs. Noise distributions can be tailored to be appropriate for the particular data in a given database by calculating a 'diameter' of the data. When the distribution is based on the diameter of a first class of data, and the diameter measurement does not account for additional data in the database, the result is that query outputs leak information about the additional data.

Selective privacy guarantees

Privacy of data can be preserved while utility of the output is maximized by selecting from an appropriately calculated distribution of noise values to add to an output. A distribution that includes a high likelihood of large noise values may lead to less useful output data. Conversely, a distribution that includes very low likelihood of large noise values may lead to less privacy. A distribution should be calculated to provide an appropriate level of output utility and privacy based on the query that is performed and the desired privacy level.

Data diameter privacy policies

Systems and methods are provided for controlling privacy loss associated with database participation. In general, privacy loss can be evaluated based on information available to a hypothetical adversary with access to a database under two scenarios: a first scenario in which the database does not contain data about a particular privacy principal, and a second scenario in which the database does contain data about the privacy principal. Such evaluation can be made for example by a mechanism for determining sensitivity of at least one database query output to addition to the database of data associated with a privacy principal. An appropriate noise distribution can be calculated based on the sensitivity measurement and optionally a privacy parameter. A noise value is selected from the distribution and added to query outputs.

Differential data privacy

A database has a plurality of entries and a plurality of attributes common to each entry, where each entry corresponds to an individual. A query is received from a querying entity query and is passed to the database, and an answer is received in response. An amount of noise is generated and added to the answer to result in an obscured answer, and the obscured answer is returned to the querying entity. The noise is normally distributed around zero with a particular variance. The variance R may be determined in accordance with R&#x3e;8 T log(T/&#x3b4;)/&#x3b5;, where T is the permitted number of queries T, &#x3b4; is the utter failure probability, and &#x3b5; is the largest admissible increase in confidence. Thus, a level of protection of privacy is provided to each individual represented within the database. Example noise generation techniques, systems, and methods may be used for privacy preservation in such areas as k means, principal component analysis, statistical query learning models, and perceptron algorithms.

Private clustering and statistical queries while analyzing a large database

A database has a plurality of entries and a plurality of attributes common to each entry, where each entry corresponds to an individual. A query q is received from a querying entity query q and is passed to the database, and an answer a is received in response. An amount of noise e is generated and added to the answer a to result in an obscured answer o, and the obscured answer o is returned to the querying entity. Thus, a level of protection of privacy is provided to each individual represented within the database.

Preserving privacy when statistically analyzing a large database

An amount of noise to add to a query output may be selected to preserve privacy of inputs while maximizing utility of the released output. Noise values can be distributed according to a substantially symmetric exponential density function ('exponential distribution'). That is, the most likely noise value can be zero, and noise values of increasing absolute value can decrease in probability according to the exponential function.

Exponential noise distribution to optimize database privacy and output utility

A histogram can be generated and displayed with noisy category values, where the noise values are selected from a noise distribution that is calculated using a histogram diameter. The noise values are combined with histogram category values, thereby producing noisy histogram category values that do not reveal information about the contributors.

Noisy histograms

A sender computer maps a randomized concatenation of a message &#x3bc; to a point 'x' in space using a function that renders it infeasible that a second message can be mapped nearby the message &#x3bc;. The function can be a collision intractable or non-collision intractable function that maps the message to a point 'x' on a widely-spaced grid, or the function can map the message to a point &#x201c;x&#x201d; of an auxiliary lattice. In either case, the sender computer, using a short basis (essentially, the private key) of a key latticefinds a lattice point &#x201c;y&#x201d; that is nearby the message point &#x201c;x&#x201d;, and then at least the points &#x201c;x&#x201d;, &#x201c;y&#x201d;, and message are sent to a receiver computer. To verity the signature, the receiver computer simply verifies that &#x201c;y&#x201d; is part of the lattice using a long basis (essentially, the public key), and that the distance between &#x201c;x&#x201d; and &#x201c;y&#x201d; is less than a predetermined distance, without being able or having to know how the lattice point &#x201c;y&#x201d; was obtained by the sender computer.

Digital signature system and method based on hard lattice problem

A system and method for aggregating rankings from a plurality of ranking sources to generate a maximally consistent ranking by minimizing a distance measure. The ranking sources may be search engines executing queries on web pages that have been deliberately modified to cause an incorrect estimate of their relevance. The invention supports combining partial rankings.

System and method for aggregating ranking results from various sources to improve the results of web searching

A machine-readable check comprising a check and a machine-readable image block printed on the check. Preferably, the image block is a two-dimensional print code.

Machine-readable checks

A system and method are provided for producing verified signatures on documents such as checks and affidavits. Initially, a customer who is to obtain a verified signature, at some point in time, registers with a signatory authority, and a secret key, having public and private components, is established uniquely for that customer. When a document requires a verified signature, the customer presents the document and proof of his/her identity, such as a preprogrammed computer-interfacable card, to a signature system. Typically, such a system is to be available at an institution, such as an office, bank, or post office, where such services will routinely be used. The system accesses the archive of the private portion of the customer's key, and generates an encoded signature based, in part, on the content of the document. Accordingly, when a recipient of the document later wishes to verify the signature, the recipient uses the customer's public key to decode the signature. It is then straightforward to verify the signature against the content of the document.

Growing community of inventors

San Francisco, CA, United States of America

Cynthia Dwork