← Back
Home › Systems › Data processing and pipelines

data-clean-room

cross-company data sharing with privacy

Delta Sharing, clean rooms

SystemTechniques · 5Primitives · 18 data-clean-room Differential privacysecurity · medium: Calibrated noise (Laplace/Gaussian) and privacy budgets for aggregate releasesEnvelope encryptionsecurity · medium: Encrypt each object with its own data key and wrap that key under a KMS-held key, so rotation re-wraps 60 bytes and deleting a key shreds data.›Private set intersectionsecurity · medium: Compute the overlap of two parties' sets without revealing the rest (ECDH-PSI, OPRF)Secure multiparty computationsecurity · medium: Secret sharing and garbled circuits to compute joint functions without revealing inputsPrivacy budget accountingsecurity · medium: Tracking cumulative epsilon/delta under composition (basic, advanced, Renyi/moments accountant)AEAD (AES-GCM, ChaCha20-Poly1305)security · low: Authenticated encryption that encrypts and detects tampering in one call; the only kind of symmetric encryption you should use.›Recursive-descent parsingcompilers · low: Hand-written top-down parser with one function per grammar rule; simple, fast, with full control over error messages and recovery.›Authorization models (RBAC, ABAC, R…security · low: How to decide who may do what to which object; roles for coarse rules, relationships for sharing, and checks on every object.›Cryptographic hashes (SHA-2, BLAKE3)security · low: Collision-resistant fingerprints of data; SHA-256 for interoperability, BLAKE3 for speed, HMAC/HKDF for keyed uses.›Hmac request signingsecurity · low: HMAC canonical-request signatures and presigned URLs (SigV4 style) with expiryK anonymitysecurity · low: Minimum group-size thresholds and suppression so aggregates cannot single out a personTrusted execution environmentssecurity · low: Enclaves/confidential VMs with remote attestation for computing on sealed dataFloating-point errornumerics · low: How IEEE 754 rounding error accumulates and how to contain it: compensated (Kahan/Neumaier) and pairwise summation, error-free transformations with FMA, ULP comparisons.›Csprngsecurity · low: OS-backed cryptographically secure random numbers (getrandom), and when a fast PRNG is not enoughAes key wrapsecurity · low: AES Key Wrap (RFC 3394/5649) and AES-GCM-SIV for deterministic, authenticated wrapping of key materialCuckoo hashingdata-structures · low: Every key lives in one of two candidate buckets, so lookups read at most two cache lines; inserts evict residents to their alternate bucket.›ECDH key exchange (X25519, P-256)security · low: Each side multiplies the other's public curve point by its own scalar and both get the same point; always validate the peer key and run the result through a KDF.›Arithmetic circuitshardware-os · low: Adder and multiplier circuits: carry-lookahead, prefix adders, Booth encoding, Wallace and Dadda treesCommitment schemessecurity · low: Hash and Pedersen commitments: hide a value now, bind to it, reveal laterShamir secret sharing (k-of-n)security · low: Split a secret into n shares so any k reconstruct it and any k-1 reveal nothing at all, using a random polynomial over a finite field.›Conditional writesdistributed · low: Put-if-absent / if-match compare-and-swap on objects or keys as a commit primitive+ 2 more primitives

Similar systems

Share the most building blocks with this one.

object-storage 17 %cold-archive 16 %identity-graph 15 %