Alternative Multi-dimensional Rappor

components/rappor/reports.cc

Index: components/rappor/reports.cc
diff --git a/components/rappor/reports.cc b/components/rappor/reports.cc
new file mode 100644
index 0000000000000000000000000000000000000000..82889eb4dc7f99c388cc743d16209ede98e61706
--- /dev/null
+++ b/components/rappor/reports.cc
@@ -0,0 +1,52 @@
+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/rappor/reports.h"
+
+#include "base/logging.h"
+#include "base/rand_util.h"
+#include "components/rappor/byte_vector_utils.h"
+#include "components/rappor/rappor_parameters.h"
+
+namespace rappor {
+
+namespace internal {
+
+ByteVector GenerateReport(const std::string& secret,
+                          const RapporParameters& parameters,
+                          const ByteVector& value) {
+  // Generate a deterministically random mask of fake data using the
+  // client's secret key + real data as a seed.  The inclusion of the secret
+  // in the seed avoids correlations between real and fake data.
+  // The seed isn't a human-readable string.
+  const std::string personalization_string =
+      std::string(value.begin(), value.end());
+  HmacByteVectorGenerator hmac_generator(value.size(), secret,
+                                         personalization_string);

[Alexei Svitkine (slow), 2015/04/16 15:09:43]

Any way this can share code with the other place we're doing this? (I notice
you're adding the new function without removing anything...)

[Steven Holte, 2015/04/22 19:24:28]

Done.  There is a slight change here to the existing code, where we stop using
metric_name as part of the personalization_string, but this should not cause any
issues, and I was intending to fix that anyway, since there is better privacy
with related metrics that way.

+  const ByteVector fake_mask =
+      hmac_generator.GetWeightedRandomByteVector(parameters.fake_prob);
+  ByteVector fake_bits =
+      hmac_generator.GetWeightedRandomByteVector(parameters.fake_one_prob);
+
+  // Redact most of the real data by replacing it with the fake data, hiding
+  // and limiting the amount of information an individual client reports on.
+  const ByteVector* fake_and_redacted_bits =
+      ByteVectorMerge(fake_mask, value, &fake_bits);
+
+  // Generate biased coin flips for each bit.
+  ByteVectorGenerator coin_generator(value.size());
+  const ByteVector zero_coins =
+      coin_generator.GetWeightedRandomByteVector(parameters.zero_coin_prob);
+  ByteVector one_coins =
+      coin_generator.GetWeightedRandomByteVector(parameters.one_coin_prob);
+
+  // Create a randomized response report on the fake and redacted data, sending
+  // the outcome of flipping a zero coin for the zero bits in that data, and of
+  // flipping a one coin for the one bits in that data, as the final report.
+  return *ByteVectorMerge(*fake_and_redacted_bits, zero_coins, &one_coins);
+}
+
+}  // namespace internal
+
+}  // namespace rappor