CoChat
Sign Up
Cited by 378Privacy-Preserving Technologies in DataInternet Traffic Analysis and Secure E-votingPrivacy, Security, and Data Protection

The DOI matches its Crossref record; 43 of the 50 references it cites were found in a registry or an index.

Prochlo: Strong Privacy for Analytics in the Crowd

Open access
Bittau, Andrea, Erlingsson, Úlfar, Maniatis, Petros, Mironov, Ilya, Raghunathan, Ananth, Lie, David, Rudominer, Mitch, Kode, Ushasree, Tinnes, Julien, Seefeld, Bernhard·2017·Proceedings of the 26th Symposium on Operating Systems Principles
DOI 10.1145/3132747.3132769
Open this paper in CoChat — free accountOpen PDF

Abstract

The large-scale monitoring of computer users' software activities has become commonplace, e.g., for application telemetry, error reporting, or demographic profiling. This paper describes a principled systems architecture---Encode, Shuffle, Analyze (ESA)---for performing such monitoring with high utility while also protecting user privacy. The ESA design, and its Prochlo implementation, are informed by our practical experiences with an existing, large deployment of privacy-preserving software monitoring.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1145/3132747.3132769

Cites

43 of 43 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

  • How to share a secret

    Shamir, A. (1979) · Communications of the ACM · doi:10.1145/359168.359176 · Cited by 13,756 · cited 1×

    “First, recall the basic idea behind Shamir secret sharing [68]: t-secret sharing splits a secret s in a field F into arbitrary shares s1, s2, .”
    Background

  • Calibrating Noise to Sensitivity in Private Data Analysis

    Dwork, C., McSherry, F., Nissim, K., & Smith, A. (2006) · Lecture Notes in Computer Science · doi:10.1007/11681878_14 · Cited by 7,272

  • Deep Learning with Differential Privacy

    Abadi, M., Chu, A., Goodfellow, I., McMahan, H. B., Mironov, I., Talwar, K., & Zhang, L. (2016) · Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/2976749.2978318 · Cited by 6,578 · cited 2×

    “These settings are at least as strong as in recent industrial deployments and in literature [4, 28, 70].”
    BackgroundSelf-citation

  • The Algorithmic Foundations of Differential Privacy

    Dwork, C., & Roth, A. (2014) · Foundations and Trends® in Theoretical Computer Science · doi:10.1561/0400000042 · Cited by 5,557 · cited 5×

    “The analyzer, which has the most complete view of the reported data, may choose from a wide variety of differentially private mechanisms and data processing systems [27,31,38, 53, 63].”
    BackgroundMethodInfluential

  • The Sybil Attack

    Douceur, J. R. (2002) · Lecture Notes in Computer Science · doi:10.1007/3-540-45748-8_24 · Cited by 4,419

  • Practical Secure Aggregation for Privacy-Preserving Machine Learning

    Bonawitz, K., Ivanov, V., Kreuter, B., Marcedone, A., McMahan, H. B., Patel, S., Ramage, D., Segal, A., & Seth, K. (2017) · Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3133956.3133982 · Cited by 3,956 · cited 1×

    “Other cryptography-based privacy-protection systems, such as PDDP, Prio, and Secure Aggregation [11, 15, 18], mostly share ESA’s goals but differ greatly in their approach.”
    Background

  • L -diversity: Privacy beyond k -anonymity

    Machanavajjhala, A., Kifer, D., Gehrke, J., & Venkitasubramaniam, M. (2007) · ACM Transactions on Knowledge Discovery from Data · doi:10.1145/1217299.1217302 · Cited by 3,617 · cited 3×

    “iduals [65,66]. However, since k-anonymity does not limit statistical inferences drawn indirectly, from subgroup intersections or differences, it cannot offer mathematically-strong privacy guarantees [32,48]. In the last decade, the definitions of differential privacy have become the accepted standard for strong privac…”
    BackgroundMethodInfluential

  • Sorting networks and their applications

    Batcher, K. E. (1968) · doi:10.1145/1468075.1468121 · Cited by 2,442 · cited 1×

    “Batcher’s sort is one such algorithm [8].”

  • Robust De-anonymization of Large Sparse Datasets

    Narayanan, A., & Shmatikov, V. (2008) · 2008 IEEE Symposium on Security and Privacy (sp 2008) · doi:10.1109/sp.2008.33 · Cited by 2,372 · cited 1×

    “Famously, Narayanan and Shmatikov [54] managed to deanonymize users in the challenge’s large corpus of training data by exploiting auxiliary data and the linkability of users’ movie preferences.”
    Background

  • Protecting respondents identities in microdata release

    Samarati, P. (2001) · IEEE Transactions on Knowledge and Data Engineering · doi:10.1109/69.971193 · Cited by 2,339 · cited 1×

    “For example, the well-known property of k-anonymity prevents direct release of information about subgroups with fewer than k individuals [65, 66].”
    Background

Show all 50 references

Research works printed but not linked: 34

  1. Abadi , M. , Barham , P. , Chen , J. , Chen , Z. , Davis , A. , Dean , J. , Devin , M. , Ghemawat , S. , Irving , G. , Isard , M. , Kudlur , M. , Levenberg , J. , Monga , R. , Moore , S. , Murray , D. G. , Steiner , B. , Tucker , P. , Vasudevan , V. , Warden , P. , Wicke , M. , Yu , Y. , and Zheng , X . Tensorflow: A system for large-scale machine learning . In Proc. of 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI) ( 2016 ), pp. 265 -- 283 . Abadi, M., Barham, P., Chen, J., Chen, Z., Davis, A., Dean, J., Devin, M., Ghemawat, S., Irving, G., Isard, M., Kudlur, M., Levenberg, J., Monga, R., Moore, S., Murray, D. G., Steiner, B., Tucker, P., Vasudevan, V., Warden, P., Wicke, M., Yu, Y., and Zheng, X. Tensorflow: A system for large-scale machine learning. In Proc. of 12th USENIX Symposium on Operating Systems Design and Implementation (OSDI) (2016), pp. 265--283.
  2. Abadi , M. , Boneh , D. , Mironov , I. , Raghunathan , A. , and Segev , G . Message-Locked Encryption for Lock-Dependent Messages. In Advances in Cryptology--CRYPTO ( 2013 ), pp. 374 -- 391 . Abadi, M., Boneh, D., Mironov, I., Raghunathan, A., and Segev, G. Message-Locked Encryption for Lock-Dependent Messages. In Advances in Cryptology--CRYPTO (2013), pp. 374--391.
  3. Abadi , M. , Erlingsson , Ú., Goodfellow , I. , McMahan , H. B. , Papernot , N. , Mironov , I. , Talwar , K. , and Zhang , L . On the Protection of Private Information in Machine Learning Systems: Two Recent Approaches. In Proc. of IEEE 30th Computer Security Foundations Symposium (CSF) ( 2017 ), pp. 1 -- 6 . Abadi, M., Erlingsson, Ú., Goodfellow, I., McMahan, H. B., Papernot, N., Mironov, I., Talwar, K., and Zhang, L. On the Protection of Private Information in Machine Learning Systems: Two Recent Approaches. In Proc. of IEEE 30th Computer Security Foundations Symposium (CSF) (2017), pp. 1--6.
  4. Avent , B. , Korolova , A. , Zeber , D. , Hovden , T. , and Livshits , B . BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model . In Proc. of the 26th USENIX Security Symposium ( 2017 ), pp. 747 -- 764 . Avent, B., Korolova, A., Zeber, D., Hovden, T., and Livshits, B. BLENDER: Enabling Local Search with a Hybrid Differential Privacy Model. In Proc. of the 26th USENIX Security Symposium (2017), pp. 747--764.
  5. Bassily , R. , Nissim , K. , Stemmer , U. , and Thakurta , A . Practical Locally Private Heavy Hitters. CoRR abs/1707.0498 ( 2017 ). http://arxiv.org/abs/1707.04982. Bassily, R., Nissim, K., Stemmer, U., and Thakurta, A. Practical Locally Private Heavy Hitters. CoRR abs/1707.0498 (2017). http://arxiv.org/abs/1707.04982. · arXiv
  6. Bellare , M. , Keelveedhi , S. , and Ristenpart , T . Message-Locked Encryption and Secure Deduplication. In Advances in Cryptology---EUROCRYPT ( 2013 ), pp. 296 -- 312 . Bellare, M., Keelveedhi, S., and Ristenpart, T. Message-Locked Encryption and Secure Deduplication. In Advances in Cryptology---EUROCRYPT (2013), pp. 296--312.
  7. Bulck , J. V. , Weichbrodt , N. , Kapitza , R. , Piessens , F. , and Strackx , R . Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution . In Proc. of 26th USENIX Security Symposium ( 2017 ), pp. 1041 -- 1056 . Bulck, J. V., Weichbrodt, N., Kapitza, R., Piessens, F., and Strackx, R. Telling Your Secrets without Page Faults: Stealthy Page Table-Based Attacks on Enclaved Execution. In Proc. of 26th USENIX Security Symposium (2017), pp. 1041--1056.
  8. Buse , R. P. L. , and Zimmermann , T . Information Needs for Software Development Analytics. In Proc. of the 34th International Conference on Software Engineering (ICSE) ( 2012 ), pp. 987 -- 996 . Buse, R. P. L., and Zimmermann, T. Information Needs for Software Development Analytics. In Proc. of the 34th International Conference on Software Engineering (ICSE) (2012), pp. 987--996.
  9. Chen , R. , Reznichenko , A. , Francis , P. , and Gehrke , J . Towards Statistical Queries over Distributed Private User Data . In Proc. of the 9th USENIX Conference on Networked Systems Design and Implementation (NSDI) ( 2012 ), pp. 169 -- 182 . Chen, R., Reznichenko, A., Francis, P., and Gehrke, J. Towards Statistical Queries over Distributed Private User Data. In Proc. of the 9th USENIX Conference on Networked Systems Design and Implementation (NSDI) (2012), pp. 169--182.
  10. Chromium Projects . RAPPOR (Randomized Aggregatable Privacy Preserving Ordinal Responses). https://www.chromium.org/developers/design-documents/rappor , 2017 . Chromium Projects. RAPPOR (Randomized Aggregatable Privacy Preserving Ordinal Responses). https://www.chromium.org/developers/design-documents/rappor, 2017.
  11. Corrigan-Gibbs , H. , and Boneh , D . Prio: Private, Robust, and Scalable Computation of Aggregate Statistics . In Proc. of the 14th USENIX Symposium on Networked Systems Design and Implementation (NDSI) ( 2017 ), pp. 259 -- 282 . Corrigan-Gibbs, H., and Boneh, D. Prio: Private, Robust, and Scalable Computation of Aggregate Statistics. In Proc. of the 14th USENIX Symposium on Networked Systems Design and Implementation (NDSI) (2017), pp. 259--282.
  12. Dang , H. , Dinh , T. T. A. , Chang , E.-C. , and Ooi , B. C. Privacy-Preserving Computation with Trusted Computing via Scramble-then-Compute. Proceedings on Privacy Enhancing Technologies , 3 ( 2017 ), 18 -- 35 . Dang, H., Dinh, T. T. A., Chang, E.-C., and Ooi, B. C. Privacy-Preserving Computation with Trusted Computing via Scramble-then-Compute. Proceedings on Privacy Enhancing Technologies, 3 (2017), 18--35.
  13. Denning , D. E. R. Cryptography and Data Security . Addison-Wesley , Boston, MA, USA , 1982 . Denning, D. E. R. Cryptography and Data Security. Addison-Wesley, Boston, MA, USA, 1982.
  14. Dinh , T. T. A. , Saxena , P. , Chang , E.-C. , Ooi , B. C. , and Zhang , C . M2R: Enabling Stronger Privacy in MapReduce Computation . In Proc. of the 24th USENIX Security Symposium ( 2015 ), pp. 447 -- 462 . Dinh, T. T. A., Saxena, P., Chang, E.-C., Ooi, B. C., and Zhang, C. M2R: Enabling Stronger Privacy in MapReduce Computation. In Proc. of the 24th USENIX Security Symposium (2015), pp. 447--462.
  15. 10.5555/646334.687813 · DOI
  16. Dwork , C. Differential Privacy: A Survey of Results. In International Conference on Theory and Applications of Models of Computation (TAMC) ( 2008 ), pp. 1 -- 19 . Dwork, C. Differential Privacy: A Survey of Results. In International Conference on Theory and Applications of Models of Computation (TAMC) (2008), pp. 1--19.
  17. Gaboardi , M. , Honaker , J. , King , G. , Nissim , K. , Ullman , J. , and Vadhan , S. P . PSI (Ψ): A Private data Sharing Interface. CoRR abs/1609.04340 ( 2016 ). http://arxiv.org/abs/1609.04340. Gaboardi, M., Honaker, J., King, G., Nissim, K., Ullman, J., and Vadhan, S. P. PSI (Ψ): A Private data Sharing Interface. CoRR abs/1609.04340 (2016). http://arxiv.org/abs/1609.04340. · arXiv
  18. Intel® Software Guard Extensions Programming Reference. https://software.intel.com/sites/default/files/managed/48/88/329298-002.pdf , Oct. 2014 . Intel® Software Guard Extensions Programming Reference. https://software.intel.com/sites/default/files/managed/48/88/329298-002.pdf, Oct. 2014.
  19. Intel® Software Guard Extensions (Intel® SGX) SDK . https://software.intel.com/en-us/sgx-sdk , 2017 . Intel® Software Guard Extensions (Intel® SGX) SDK. https://software.intel.com/en-us/sgx-sdk, 2017.
  20. Johnson , N. , Near , J. P. , and Song , D . Towards Practical Differential Privacy for SQL Queries. CoRR abs/1706.09479 ( 2017 ). https://arxiv.org/abs/1706.09479. Johnson, N., Near, J. P., and Song, D. Towards Practical Differential Privacy for SQL Queries. CoRR abs/1706.09479 (2017). https://arxiv.org/abs/1706.09479. · arXiv
  21. Lee , S. , Shih , M.-W. , Gera , P. , Kim , T. , Kim , H. , and Peinado , M . Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing. In Proc. of the 26th USENIX Security Symposium ( 2017 ), pp. 557 -- 574 . Lee, S., Shih, M.-W., Gera, P., Kim, T., Kim, H., and Peinado, M. Inferring Fine-grained Control Flow Inside SGX Enclaves with Branch Shadowing. In Proc. of the 26th USENIX Security Symposium (2017), pp. 557--574.
  22. Maniatis , P. , and Baker , M . Secure History Preservation Through Timeline Entanglement. In Proc. of the 11th USENIX Security Symposium ( 2002 ), pp. 297 -- 312 . Maniatis, P., and Baker, M. Secure History Preservation Through Timeline Entanglement. In Proc. of the 11th USENIX Security Symposium (2002), pp. 297--312.
  23. Maniatis , P. , Mironov , I. , and Talwar , K . Oblivious Stash Shuffle. CoRR abs/1709.07553 ( 2017 ). https://arxiv.org/abs/1709.07553. Maniatis, P., Mironov, I., and Talwar, K. Oblivious Stash Shuffle. CoRR abs/1709.07553 (2017). https://arxiv.org/abs/1709.07553. · arXiv
  24. Ohrimenko , O. , Goodrich , M. T. , Tamassia , R. , and Upfal , E . The Melbourne Shuffle: Improving Oblivious Storage in the Cloud. In Automata, Languages, and Programming : 41st International Colloquium, ICALP 2014 , Part II ( 2014 ), pp. 556 -- 567 . Ohrimenko, O., Goodrich, M. T., Tamassia, R., and Upfal, E. The Melbourne Shuffle: Improving Oblivious Storage in the Cloud. In Automata, Languages, and Programming: 41st International Colloquium, ICALP 2014, Part II (2014), pp. 556--567.
  25. Ravindranath , L. , Padhye , J. , Agarwal , S. , Mahajan , R. , Obermiller , I. , and Shayandeh , S . AppInsight: Mobile App Performance Monitoring in the Wild. In Proc. of the 10th USENIX Conference on Operating Systems Design and Implementation (OSDI) ( 2012 ), pp. 107 -- 120 . Ravindranath, L., Padhye, J., Agarwal, S., Mahajan, R., Obermiller, I., and Shayandeh, S. AppInsight: Mobile App Performance Monitoring in the Wild. In Proc. of the 10th USENIX Conference on Operating Systems Design and Implementation (OSDI) (2012), pp. 107--120.
  26. Roy , I. , Setty , S. T. V. , Kilzer , A. , Shmatikov , V. , and Witchel , E . Airavat: Security and Privacy for MapReduce. In Proc. of the 7th USENIX Symposium on Networked Systems Design and Implementation (NSDI) ( 2010 ), pp. 297 -- 312 . Roy, I., Setty, S. T. V., Kilzer, A., Shmatikov, V., and Witchel, E. Airavat: Security and Privacy for MapReduce. In Proc. of the 7th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2010), pp. 297--312.
  27. Saltzer , J. H. , and Schroeder , M. D. The Protection of Information in Computer Systems. Proc. of the IEEE 63 , 9 ( 1975 ), 1278--1308. Saltzer, J. H., and Schroeder, M. D. The Protection of Information in Computer Systems. Proc. of the IEEE 63, 9 (1975), 1278--1308.
  28. Tang , J. , Korolova , A. , Bai , X. , Wang , X. , and Wang , X . Privacy Loss in Apple's Implementation of Differential Privacy on macOS 10.12. arXiv:1709.02753 ( 2017 ). https://arxiv.org/abs/1709.02753. Tang, J., Korolova, A., Bai, X., Wang, X., and Wang, X. Privacy Loss in Apple's Implementation of Differential Privacy on macOS 10.12. arXiv:1709.02753 (2017). https://arxiv.org/abs/1709.02753. · arXiv
  29. Vallina-Rodriguez , N. , Sundaresan , S. , Razaghpanah , A. , Nithyanand , R. , Allman , M. , Kreibich , C. , and Gill , P . Tracking the Trackers: Towards Understanding the Mobile Advertising and Tracking Ecosystem. CoRR abs/1609.07190 ( 2016 ). http://arxiv.org/abs/1609.07190. Vallina-Rodriguez, N., Sundaresan, S., Razaghpanah, A., Nithyanand, R., Allman, M., Kreibich, C., and Gill, P. Tracking the Trackers: Towards Understanding the Mobile Advertising and Tracking Ecosystem. CoRR abs/1609.07190 (2016). http://arxiv.org/abs/1609.07190. · arXiv
  30. Viega , J. , Chandra , P. , and Messier , M . Network Security with OpenSSL , 1 st ed. O'Reilly & Associates, Inc. , Sebastopol, CA, USA , 2002 . Viega, J., Chandra, P., and Messier, M. Network Security with OpenSSL, 1st ed. O'Reilly & Associates, Inc., Sebastopol, CA, USA, 2002.
  31. Wang , T. , Blocki , J. , Li , N. , and Jha , S . Locally Differentially Private Protocols for Frequency Estimation. In Proc. of the 26th USENIX Security Symposium ( 2017 ), pp. 729 -- 745 . Wang, T., Blocki, J., Li, N., and Jha, S. Locally Differentially Private Protocols for Frequency Estimation. In Proc. of the 26th USENIX Security Symposium (2017), pp. 729--745.
  32. Warner , S. L. Randomized Response: A Survey Technique for Eliminating Evasive Answer Bias. J. of the American Statistical Association 60 , 309 ( 1965 ), 63--69. Warner, S. L. Randomized Response: A Survey Technique for Eliminating Evasive Answer Bias. J. of the American Statistical Association 60, 309 (1965), 63--69.
  33. 10.5555/2555692.2555725 · DOI
  34. Zheng , W. , Dave , A. , Beekman , J. G. , Popa , R. A. , Gonzalez , J. E. , and Stoica , I . Opaque: An Oblivious and Encrypted Distributed Analytics Platform. In Proc. of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI) ( 2017 ), pp. 283 -- 298 . Zheng, W., Dave, A., Beekman, J. G., Popa, R. A., Gonzalez, J. E., and Stoica, I. Opaque: An Oblivious and Encrypted Distributed Analytics Platform. In Proc. of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI) (2017), pp. 283--298.

Cited by

Sorted by citations

See all 378

Related

Metadata

Authors
Bittau, A., Erlingsson, Ú., Maniatis, P., Mironov, I., Raghunathan, A., Lie, D., Rudominer, M., Kode, U., Tinnes, J., & Seefeld, B.
Affiliations
  • Google (United States) (US)
  • University of Toronto (CA)
ORCID
Venue
Proceedings of the 26th Symposium on Operating Systems Principles
Publisher
ACM
Published
2017-10-14
Pages
441-459
DOI
10.1145/3132747.3132769
OpenAlex
W2761138375
Cited by
378
References
50
Citations by year
2026: 22 · 2025: 37 · 2024: 55 · 2023: 46 · 2022: 50 · 2021: 70 · 2020: 46 · 2019: 36 · 2018: 12 · 2017: 4
FWCI
11.96
Type
conference paper
Language
en
Open access
Licence
www.acm.org/publications/policies/copyright_policy#Background (vor)
Locations
  • ACM SIGOPS Symposium on Operating Systems Principles (SOSP) (publishedVersion)
  • arXiv (Cornell University) (submittedVersion)
  • TSpace (University of Toronto) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Privacy-Preserving Technologies in Data
  • Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
Keywords
user privacy, privacy-preserving monitoring, telemetry, error reporting, demographic profiling, system architecture

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review