Differentially private processing and database storage

A method for implementing differential privacy, comprising:

• receiving a database query requesting a differentially private response to the query;
• determining a privacy parameter ε associated with the query, wherein describes a degree of information to release about a set of data stored by a database system that is responsive to the query;
• identifying a privacy budget associated with the query, the privacy budget specified in terms of ε and representing a degree of information available to be released about data by the database system;
• decrementing the privacy budget by a first ε spend determined responsive to the query;
• and
• applying the query to the database system by performing a differentially private set of operations on the set of data stored by the database system that is responsive to the query to produce a differentially private result set that releases the degree of information about the set of data described by the privacy parameter ε, wherein the set of operations comprises a count operation on a subset of the set of data, and wherein the set of operations comprises perturbing results of the count operation on the subset by a factor defined by a Gaussian random variable G( ) to produce the differentially private result set.

A non-transitory computer-readable storage medium storing computer program instructions executable by a processor to perform actions for implementing differential privacy comprising:

• receiving a database query requesting a differentially private response to the query;
• determining a privacy parameter ε associated with the query, wherein describes a degree of information to release about a set of data stored by a database system that is responsive to the query;
• identifying a privacy budget associated with the query, the privacy budget specified in terms of ε and representing a degree of information available to be released about data by the database system;
• decrementing the privacy budget by a first ε spend determined responsive to the query;
• and
• applying the query to the database system by performing a differentially private set of operations on the set of data stored by the database system that is responsive to the query to produce a differentially private result set that releases the degree of information about the set of data described by the privacy parameter ε, wherein the set of operations comprises a count operation on a subset of the set of data, and wherein the set of operations comprises perturbing results of the count operation on the subset by a factor defined by a Gaussian random variable G( ) to produce the differentially private result set.