IMR:MM-1B: New directions in Privacy-Preserving Telemetry

几乎所有的现代设备都连接到了互联网。家用电器、智能手表、手机、汽车、工业工具，甚至体重秤都连接在一起。例如，三星智能电视向三星报告消费者的每一次选择和每次点击，以及消费者观看任何节目的时长。互联网浏览器收集用户浏览数据。互联网服务提供商收集用户IP访问数据。收集的大量数据通常用于改善用户体验、服务和定向广告。然而，收集关于每个个人消费者或组织的更具侵入性的数据是以颤抖地侵犯隐私为代价的，并增加了收集的数据可能被用于其他(意外)目的的风险，例如反情报、政治运动以及身份盗窃和其他犯罪活动。如何允许组织在不侵犯个人消费者隐私的情况下收集有关流数据的汇总统计数据？本研究旨在探索以保护隐私的方式计算有关流数据的汇总统计数据的新方法，扩展了PRIO、PRIO+和Pplar等系统。该框架是，用户或设备以秘密共享的方式将他们的数据发送到两个服务器，这两个服务器然后相互通信以计算遥测数据，同时不泄露(彼此或任何其他人)用户的个人数据。例如，Firefox浏览器在名为“原始遥测”的Mozilla项目中采用了这种方法。本研究的目标是通过探索如何将Alon、Matias和Szegedy开创的(无隐私)流传输算法推广到有隐私的流传输算法，从而探索在这种情况下私密计算遥测数据的更有效的方法。更具体地说，我们可以通过两台服务器接收(秘密共享的)流，以保护隐私和高效的方式计算频率矩吗？虽然这看起来是一个非常特殊的问题，但实际上，它是可以推广的，正如PI在题为“零-一频率定律”的论文中所展示的那样。这给我们带来了一个更有趣的问题：如何对所有可以在一次传输秘密共享数据和使用多对数内存的情况下进行私人计算的函数进行分类。我们的目标是为大容量数据流的隐私保护分析问题提供新的工具，这在NSF互联网测量研究征求建议书的MM-1B部分特别提到。如果成功，我们的方法将允许大规模和高效地计算所有聚集统计数据，这些统计数据可以在小内存中以保护隐私的方式计算。该项目还将把MPC对流数据的最先进性能提升到互联网大小的流计算。最后，我们的建议呼吁对研究生和本科生进行强有力的培训，包括积极寻找少数族裔和女性学生进入密码学研究。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Almost all modern-day devices are connected to the internet. Home appliances, smart watches, phones, cars, industrial tools, and even body weight scales are connected. For example, Samsung Smart TV reports back to Samsung every choice and every click that a consumer makes as well as the duration that a consumer watches any program. Internet browsers collect user browsing data. Internet Service Providers collect user IP access data. The torrent of data collected is typically used to improve user experience, service, and target advertisements. However, collection of ever more intrusive data regarding each individual consumer or organization comes at the price of tremulous invasion of privacy, and increases the risk that the data collected can be harvested for other (unintended) purposes, such as counter-intelligence, political campaigns, as well as identity theft and other criminal activity. How do we allow organizations to collect aggregate statistics regarding streaming data without violating individual consumer privacy?This research aims to explore novel ways to compute aggregate statistics on streaming data in a privacy-preserving way, extending systems such as PRIO, PRIO+, and Poplar. The framework is that users or devices send their data in a secret-shared way to two servers which then communicate with each other to compute telemetry data while not revealing (to each other or anyone else) users’ individual data. This approach was adopted, for example, by the Firefox browser in a Mozilla project titled “Origin Telemetry”. The goals of this research are to explore even more efficient methods to privately compute telemetry data in this setting by exploring how to generalize streaming algorithms (without privacy) that were pioneered by Alon, Matias, and Szegedy to streaming algorithms with privacy. More specifically, can we compute frequency moments in a privacy-preserving and efficient manner by two servers receiving a (secret-shared) stream? While this seems like a very specialized question, it is, in fact, generalizable, as shown by the PI in the paper titled “Zero-One Frequency Laws”. This brings us to the even more interesting question: how to classify all functions that can be privately computed over streaming secret-shared data in one pass and with poly-logarithmic memory. Our goal is to provide new tools for the questions of privacy-preserving analysis of streaming large volume data, specifically called out in section MM-1B of the NSF Internet Measurement Research call for proposals. If successful, our methods will allow large-scale and efficient computation of all aggregate statistics that can be computed in small memory in a privacy-preserving way. This project will also advance the state-of-the-art performance of MPC on streaming data to Internet-size streaming computations. Lastly, our proposal calls for robust training of graduate and undergraduate students, including actively seeking minorities and female students to enter cryptographic research.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.