We present Chorus, a system with a novel architecture for providing differential privacy for statistical SQL queries. The key to our approach is to embed a differential privacy mechanism into the query before execution so the query automatically enforces differential privacy on its output. Chorus is compatible with any SQL database that supports standard math functions, requires no user modifications to the database or queries, and simultaneously supports many differential privacy mechanisms. To the best of our knowledge, no existing system provides these capabilities. We demonstrate our approach using four general-purpose differential privacy mechanisms. In the first evaluation of its kind, we use Chorus to evaluate these four mechanisms on real-world queries and data. The results demonstrate that our approach supports 93.9 of statistical queries in our corpus, integrates with a production DBMS without any modifications, and scales to hundreds of millions of records. Chorus is currently being deployed at Uber for its internal analytics tasks. Chorus represents a significant part of the company's GDPR compliance efforts, and can provide both differential privacy and access control enforcement. In this capacity, Chorus processes more than 10,000 queries per day.
To the best of our knowledge, ours is the first work on using query transformations to implement differential privacy mechanisms. However, this approach has been used in previous work to implement access control. Stonebreaker and Wong @cite_5 presented the first approach. Barker and Rosenthal @cite_57 extended the approach to role-based access control by first constructing a view that encodes the access control policy, then rewriting input queries to add |WHERE| clauses that query the view. Byun and Li @cite_32 use a similar approach to enforce purpose-based access control: purposes are attached to data in the database, then queries are modified to enforce purpose restrictions drawn from a policy.
@cite_57 @cite_5 @cite_32
1967221886 2099259603 1508622259 1930868980
In this article, we present a comprehensive approach for privacy preserving access control based on the notion of purpose. In our model, purpose information associated with a given data element specifies the intended use of the data element. A key feature of our model is that it allows multiple purposes to be associated with each data element and also supports explicit prohibitions, thus allowing privacy officers to specify that some data should not be used for certain purposes. An important issue addressed in this article is the granularity of data labeling, i.e., the units of data with which purposes can be associated. We address this issue in the context of relational databases and propose four different labeling schemes, each providing a different granularity. We also propose an approach to represent purpose information, which results in low storage overhead, and we exploit query modification techniques to support access control based on purpose information. Another contribution of our work is that we address the problem of how to determine the purpose for which certain data are accessed by a given user. Our proposed solution relies on role-based access control (RBAC) models as well as the notion of conditional role which is based on the notions of role attribute and system attribute. Differential privacy is a robust privacy standard that has been successfully applied to a range of data analysis tasks. But despite much recent work, optimal strategies for answering a collection of related queries are not known. We propose the matrix mechanism, a new algorithm for answering a workload of predicate counting queries. Given a workload, the mechanism requests answers to a different set of queries, called a query strategy, which are answered using the standard Laplace mechanism. Noisy answers to the workload queries are then derived from the noisy answers to the strategy queries. This two stage process can result in a more complex correlated noise distribution that preserves differential privacy but increases accuracy. We provide a formal analysis of the error of query answers produced by the mechanism and investigate the problem of computing the optimal query strategy in support of a given workload. We show this problem can be formulated as a rank-constrained semidefinite program. Finally, we analyze two seemingly distinct techniques, whose similar behavior is explained by viewing them as instances of the matrix mechanism. A recent proposal for database access control consists of defining “authorization views” that specify the accessible data, and declaring a query valid if it can be completely rewritten using the views. Unlike traditional work in query rewriting using views, the rewritten query needs to be equivalent to the original query only over the set of database states that agree with a given set of materializations for the authorization views. With this motivation, we study conditional query containment, i.e. , containment over states that agree on a set of materialized views. We give an algorithm to test conditional containment of conjunctive queries with respect to a set of materialized conjunctive views. We show the problem is @math -complete. Based on the algorithm, we give a test for a query to be conditionally authorized given a set of materialized authorization views. We show how a wide variety of role-based access control policies may be formally specified in the stratified subset of clause form logic. We then show how these formal specifications may be automatically translated into a small subset of SQL to be used to seamlessly protect an SQL database from unauthorized read and update requests made by authenticated users. We demonstrate the power of our approach by showing how a variety of access control policies can be represented.