Abstract: A computer system contains a module configured to receive a query, to request rows and columns from a data store, to add or remove rows in such a way that combinations of queries cannot be used to infer information about individuals in the data store. The module executes a statistical computation over the adjusted rows and columns to produce a perturbed answer so that neither the perturbed answer alone, nor repeats of the perturbed answer can be used to infer information about individuals in the data store.

Abstract: An anonymizing method for a database system is provided. The method includes receiving a query, identifying one or more attack components in the query, computing one or more noise elements from the one or more attack components, and computing fixed noise or fixed thresholds from the one or more noise elements.

Abstract: An anonymizing method for a database system is provided. The method includes receiving a query, identifying one or more attack components in the query, computing one or more noise elements from the one or more attack components, and computing fixed noise or fixed thresholds from the one or more noise elements.

Abstract: A computer system contains a module configured to receive a query, to request rows and columns from a data store, to add or remove rows in such a way that combinations of queries cannot be used to infer information about individuals in the data store. The module executes a statistical computation over the adjusted rows and columns to produce a perturbed answer so that neither the perturbed answer alone, nor repeats of the perturbed answer can be used to infer information about individuals in the data store.

Abstract: A modifiable server is utilized to reliably seal and unseal data according to a measurement of the server, by structuring the server to have a modifiable sandbox component for sealing, unsealing the data, and a non-modifiable checker component for enabling or disabling said sandbox component. The checker component determines whether the sandbox component complies with pre-determined standards. If the sandbox component is compliant, the checker component enables the sandbox component to seal and unseal the data using a measurement of the checker component. Otherwise, the checker component disables the sandbox component.

Abstract: A cloak server is used to analyze and control disclosure of user data by authenticating at least one of a user, an at least one client associated with the user, a source, a sink, and a third party. The cloak server receives user data transmitted by at least one of the at least one client and a source and associates the received user data with the user. The cloak server stores, seals, and unseals the received user data and is hardened such that the stored user data is not readable from outside the cloak server. The cloak server further generates, based at least in part on a first permissions indicator, a result by executing a computation on the stored user data, and transmits, based at least in part on a second permissions indicator, the result to at least one of the at least one client, and a sink.

Abstract: A computer system includes a database configured to receive a query and to produce a list of User IDs and an anonymization module. The anonymization module is configured to receive a list of user IDs in response to a query, the list of user IDs defining a true user count, generate a noisy user count of the list of user IDs, compare the true user count to a first threshold value stored in memory, compare the noisy user count to a second threshold value stored in memory, and output the noisy user count only if the true user count is greater than the first threshold value and the noisy user count is greater then the second threshold.

Abstract: A modifiable server is utilized to reliably seal and unseal data according to a measurement of the server, by structuring the server to have a modifiable sandbox component for sealing, unsealing the data, and a non-modifiable checker component for enabling or disabling said sandbox component. The checker component determines whether the sandbox component complies with pre-determined standards. If the sandbox component is compliant, the checker component enables the sandbox component to seal and unseal the data using a measurement of the checker component. Otherwise, the checker component disables the sandbox component.