US 11,755,769 B2
Differentially private query budget refunding
Christopher Hockenbrocht, Berkeley, CA (US); Ishaan Nerurkar, Berkeley, CA (US); Alexander Rozenshteyn, Berkeley, CA (US); Liam Damewood, Walnut Creek, CA (US); David Spies, Berkeley, CA (US); and Mihai Maruseac, Berkeley, CA (US)
Assigned to Snowflake Inc., Bozeman, MT (US)
Filed by Snowflake Inc., Bozeman, MT (US)
Filed on Feb. 1, 2019, as Appl. No. 16/265,936.
Prior Publication US 2020/0250335 A1, Aug. 6, 2020
Int. Cl. G06F 21/62 (2013.01); G06F 16/245 (2019.01)
CPC G06F 21/6245 (2013.01) [G06F 16/245 (2019.01)] 18 Claims
OG exemplary drawing
 
1. A method for refunding privacy spend to a client based on a query by the client to a database storing restricted data, the method comprising:
receiving a database query from the client, the database query including a relation specifying a set of data in the database upon which to perform the query and privacy parameters;
determining a worst-case privacy spend for the query based on the privacy parameters and the relation;
performing the query upon the set of data specified by the relation;
decrementing the determined worst-case privacy spend from a privacy budget associated with the client;
recording the worst-case privacy spend and the performed query at a log;
determining a privacy budget refund after performing the query based on the worst-case privacy spend of the performed query and privacy spends of one or more additional queries recorded in the log; and
applying the determined privacy budget refund to the privacy budget associated with the client,
wherein determining the privacy budget refund comprises:
analyzing relationships among the performed query and the one or more additional queries recorded in the log,
wherein analyzing the relationships comprises analyzing a measure of disjointness generated based on the performed query and one of the one or more additional queries in the log; and
determining the privacy budget refund based on the analysis of the relationships and the worst-case privacy spend of the performed query and of the privacy spends of the one or more additional queries.