CN115292364A - Data query method and device, database system, electronic equipment and storage medium - Google Patents

Abstract

The embodiment of the application provides a data query method and device, a database system, electronic equipment and a storage medium. In the embodiment of the application, firstly, aggregate query operation is executed for a data table associated with a data set to obtain a first query result of a numerical value type, and then, differential privacy processing is executed according to whether user data meeting query conditions exist in the data table to obtain a target differential privacy result; finally, a numerical type second query result is determined based on the target differential privacy result and the first query result. Therefore, errors between the second query result subjected to the differential privacy processing and the real first query result can be effectively reduced, and data usability and privacy protection degree can be effectively balanced.

Description

Data query method and device, database system, electronic equipment and storage medium

Technical Field

The present application relates to the field of computer technologies, and in particular, to a data query method and apparatus, a database system, an electronic device, and a storage medium.

Background

A DataSet (DataSet) is a collection comprising a large amount of data, and open sharing of datasets is advantageous to facilitate maximization of the value of the data, e.g., training a machine learning model on a large number of high quality datasets. In datasets involving personal data, datasets typically include private data for many individuals, including, for example, but not limited to: age, wages, medical diagnostic records, personal consumption habits and usage preferences, etc., which are susceptible to exposure to the outside with open sharing of data sets.

In practical applications, to effectively protect Privacy, differential Privacy (Differential Privacy) processing is performed on a data set. Generally, a Laplace-based mechanism (Laplace Machanism) is adopted to implement differential privacy processing. However, in the case of the differential privacy processing based on the laplacian mechanism, in the face of more complicated data query scenarios such as summation, averaging, minimum or maximum, it is difficult to achieve a small error between the noisy query result and the non-noisy query result, and it is difficult to effectively balance data usage and privacy protection.

Disclosure of Invention

Aspects of the present application provide a data query method and apparatus, a database system, an electronic device, and a storage medium, which are used to effectively balance data usage and privacy protection.

The embodiment of the application provides a data query method, which comprises the following steps: acquiring a data query request, wherein the data query request comprises a query condition and an aggregation function; querying at least one piece of user data meeting query conditions from a data table, wherein the data table records a plurality of pieces of user data in a data set; performing aggregation processing on at least one user data by using an aggregation function to obtain a first query result of a numerical type; executing differential privacy processing according to the existence of the user data meeting the query conditions corresponding to each data record in the data table to obtain a target differential privacy result; and obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

An embodiment of the present application further provides a data query device, including: the acquisition module is used for acquiring a data query request, and the data query request comprises a query condition and an aggregation function; the query module is used for querying at least one piece of user data meeting query conditions from a data table, and the data table records a plurality of pieces of user data in a data set; the aggregation module is used for carrying out aggregation processing on at least one user data by using an aggregation function to obtain a first query result of a numerical type; the differential privacy processing module is used for executing differential privacy processing according to the existence of the user data which are corresponding to each data record in the data table and meet the query condition to obtain a target differential privacy result; and the determining module is used for obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

An embodiment of the present application further provides a database system, including: the system comprises a client, a database server and a database, wherein the database stores one or more data tables for recording data in a data set; the client is used for sending a data query request to the database server, and the data query request comprises a query condition and an aggregation function; receiving a second query result of the numerical type returned by the database server; the database server is used for inquiring at least one user data meeting the inquiry condition from the data table according to the data inquiry request, and the data table records a plurality of user data in a data set; performing aggregation processing on at least one user data by using an aggregation function to obtain a first query result of a numerical type; executing differential privacy processing according to the existence of the user data meeting the query conditions corresponding to each data record in the data table to obtain a target differential privacy result; and obtaining a second query result of the numerical type according to the target differential privacy result and the first query result, and returning the second query result to the client.

An embodiment of the present application further provides an electronic device, including: a memory and a processor; a memory for storing a computer program; the processor is coupled to the memory for executing the computer program for performing the steps in the data query method.

Embodiments of the present application also provide a computer storage medium storing a computer program, which, when executed by a processor, causes the processor to implement the steps in the data query method.

In the embodiment of the application, firstly, aggregate query operation is executed for a data table associated with a data set to obtain a first query result of a numerical value type, and then, differential privacy processing is executed according to whether user data meeting query conditions exist in the data table to obtain a target differential privacy result; finally, a numerical type second query result is determined based on the target differential privacy result and the first query result. Therefore, errors between the second query result subjected to the differential privacy processing and the real first query result can be effectively reduced, and data usability and privacy protection degree can be effectively balanced.

Drawings

The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the application and together with the description serve to explain the application and not to limit the application. In the drawings:

fig. 1 is a schematic structural diagram of a database system according to an embodiment of the present application;

FIG. 2 is a flowchart of a data query method provided in an embodiment of the present application;

FIG. 3 is a flow chart of another data query method provided in the embodiments of the present application;

FIG. 4 is a schematic structural diagram of a data query device according to an embodiment of the present application;

fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the technical solutions of the present application will be described in detail and completely with reference to the following specific embodiments of the present application and the accompanying drawings. It should be apparent that the described embodiments are only a few embodiments of the present application, and not all embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments in the present application without making any creative effort belong to the protection scope of the present application.

In practical applications, in order to effectively protect Privacy, differential Privacy (Differential Privacy) processing is performed on a data set. Generally, a Laplace-based mechanism (Laplace Machanism) is adopted to implement differential privacy processing. Specifically, the laplacian mechanism implements differential privacy processing by adding random noise that obeys a laplacian distribution to the query result. However, in a counting query scene with a counted number, the difference privacy processing based on the laplacian mechanism can realize that the error between a query result after noise addition and a query result without noise addition is small, and can well balance data usability and privacy protection degree; however, in the case of more complicated data query scenarios such as summing, averaging, minimum or maximum, it is difficult to achieve a smaller error between the noisy query result and the non-noisy query result, and it is difficult to effectively balance data usage and privacy protection. Therefore, the embodiment of the application provides a data query method and device, a database system, an electronic device and a storage medium. In the embodiment of the application, firstly, aggregate query operation is executed for a data table associated with a data set to obtain a first query result of a numerical value type, and then, differential privacy processing is executed according to whether user data meeting query conditions exist in the data table to obtain a target differential privacy result; finally, a numerical type second query result is determined based on the target differential privacy result and the first query result. Therefore, errors between the second query result subjected to the differential privacy processing and the real first query result can be effectively reduced, and data usability and privacy protection degree can be effectively balanced.

The technical solutions provided by the embodiments of the present application are described in detail below with reference to the accompanying drawings.

Fig. 1 is a schematic structural diagram of a database system according to an embodiment of the present disclosure. As shown in fig. 1, the Database System (DBS) includes a client, a Database server, and a Database. The database system provides data query service for the client to query data. In general, a database server generally undertakes tasks such as database management, database query, and database maintenance. The database is a warehouse for storing data, and in the embodiment of the present application, data in the data set is recorded into one or more data tables, and the one or more data tables are stored into the database. Wherein the data table comprises a plurality of data records, each data record comprising one or more data. Optionally, the data table is a set of a series of two-dimensional arrays, and is composed of vertical columns and horizontal rows. In this case, one data record is data described in one row in the data table.

When a data query party has a data query requirement, referring to (1) in fig. 1, the data query party sends a data query request to a database server through a client, the data query request comprises a query condition and an aggregation function, the database server responds to the data query request, referring to (2) in fig. 1, at least one user data meeting the query condition is queried from a data table, and the data table records at least one user data of a data set; referring to (3) in fig. 1, the database server performs aggregation processing on at least one user data by using an aggregation function, to obtain a first query result of a numeric type. Referring to (4) in fig. 1, the database server performs differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record in the data table, so as to obtain a target differential privacy result. Referring to (5) in fig. 1, the database server obtains a second query result of a numeric type according to the target differential privacy result and the first query result. Referring to (6) in fig. 1, the database server returns the second query result to the client, so that the data query task is completed.

It should be noted that the query condition in the data query request is used to screen data from the data table, and only data in the data table that satisfies the query condition is screened to perform the subsequent operation.

It should be noted that, in the present embodiment, the query using the aggregation function may be understood as an aggregated query that performs statistics on at least one user data that satisfies the query condition and is queried from the data table. Aggregation functions include, for example, but are not limited to: a COUNT () function for querying a number of rows in the data table, a SUM () function for querying a SUM of data in a data column of the data table, an AUG () function for querying an average number of data in a data column of the data table, a MAX () function for querying a maximum value of data in an arbitrary column of the data table, and a MIN () function for querying a minimum value of data in an arbitrary column of the data table.

Fig. 2 is a flowchart of a data query method according to an embodiment of the present application. The method may be performed by a data query apparatus, which may be implemented by software and/or hardware, and may be generally integrated in an electronic device, such as a terminal device or a server. Referring to fig. 2, the method may include the steps of:

201. and acquiring a data query request, wherein the data query request comprises a query condition and an aggregation function.

202. And querying at least one piece of user data meeting the query condition from a data table, wherein the data table records at least one piece of user data in the data set.

203. And performing aggregation processing on at least one user data by using an aggregation function to obtain a first query result of the numerical type.

204. And executing differential privacy processing according to the existence of the user data meeting the query conditions corresponding to each data record in the data table to obtain a target differential privacy result.

205. And obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

In this embodiment, the data query request sent by the data query party through the client is obtained, and the query condition and the aggregation function are parsed from the data query request, where the query condition can indicate a data table associated with a data set to be queried and user data in the data table.

In the present embodiment, the data sets differ in different application scenarios. Data sets include, for example, but are not limited to: a shopping data set comprising shopping behavior data of a user, a file data set comprising a commodity description file, and a medical information data set comprising various information of medical personnel.

In this embodiment, after parsing out the query condition and the aggregation function from the data query request, the aggregation query is performed in the data table associated with the data set based on the query condition and the aggregation function. Specifically, when the aggregate query operation is executed, at least one piece of user data meeting query conditions is queried from each data record of a data table, and the data table records at least one piece of user data of a data set; and then, carrying out aggregation processing on at least one user data by using an aggregation function to obtain a first query result of the numerical type. Notably, the first query result from the aggregated query is the true query result that has not been subject to differential privacy processing. If the real query result is directly returned to the data query party, the data query party can easily acquire the user privacy information from the real query result through attack modes such as differential attack and the like, and the risk of revealing the user privacy information is increased. In addition, a plurality of data records (records) is included in the data table, each data record in the data table including one or more user data. In some application scenarios, a data record may be referred to as a line record. The user data satisfying the query condition refers to user data participating in the aggregation process.

In this embodiment, in addition to performing aggregation processing on at least one piece of user data queried from the data table, differential privacy processing is also performed according to the existence of user data satisfying query conditions corresponding to each data record in the data table. Differential Privacy (Differential Privacy) is a means in cryptography that aims to provide a way to maximize the accuracy of data queries while minimizing the chances of identifying their records when querying from statistical databases, and to remove individual features while preserving statistical features to preserve user Privacy.

In this embodiment, in order to maximize the accuracy of the data query and effectively balance the data usage and the privacy protection degree, an optional implementation manner of step 204 includes: determining a difference privacy parameter of each data record according to the existence of the user data meeting the query condition corresponding to each data record; obtaining a current differential privacy result, and determining a count value according to the differential privacy parameters recorded by each data and the current differential privacy result, wherein the count value represents the number of the differential privacy parameters meeting the current differential privacy result; and if the total number of the data records in the data table is not matched with the count value, updating the current differential privacy result, and continuing to execute the step of determining the count value according to the differential privacy parameters corresponding to the data records and the current differential privacy result until the total number of the data records in the data table is matched with the count value, and taking the current differential privacy result as the target differential privacy result.

It is noted that the target differential privacy result obtained through multiple iterations has a high probability of satisfying the following property:

(1)

(2) Is greater than

The number of the elements of (A) is at most

Wherein the content of the first and second substances,

i.e. the target differential privacy result, delta, obtained by querying in the data set D _w (D) The real first query result obtained by querying the data set D is obtained; delta _w (D) And with

With an error therebetween of at most

n is the size of the data set (i.e., the amount of data in the data set). The epsilon is a privacy protection budget, and the smaller the epsilon is, the higher the privacy protection level is.

In this embodiment, when determining the differential privacy parameter corresponding to each data record according to the existence of the user data meeting the query condition corresponding to each data record, for each data record, if the user data meeting the query condition exists in the data record, the user data meeting the query condition in the data record is used as the differential privacy parameter corresponding to the data record; and if the data record does not contain the user data meeting the query condition, taking the designated numerical value as the differential privacy parameter corresponding to the data record. Wherein the designated value is set according to actual conditions, for example, 0.

In this embodiment, the current differential privacy result is updated iteratively until the number of the differential privacy parameters satisfying the current differential privacy result matches the total number of data records in the data table. In this embodiment, the manner of updating the current differential privacy result is not limited, and several optional implementation manners are illustrated below:

mode 1: the current differential privacy result is updated in a monotonically increasing manner as the number of iterations increases. Specifically, in the first iteration, the current differential privacy result is a numerical value with the minimum numerical value; as the number of iterations increases, the current differential privacy result increases.

Mode 2: the current differential privacy result is updated in a monotonically decreasing manner as the number of iterations increases. Specifically, in the first iteration, the current differential privacy result is a numerical value with the largest numerical value; as the number of iterations increases, the current differential privacy result decreases.

Mode 3: in order to better maximize the accuracy of data query and effectively balance data usage and privacy protection degree, the current differential privacy result is updated in an exponential growth mode along with the increase of iteration times. For example, in the case that the current differential privacy result is the n-th power of m, the n + 1-th power of m is taken as the new current differential privacy result; wherein m is a positive integer, and n is a natural number. Taking m as 2 as an example, the current differential privacy result is sequentially updated to 1, 2, 4, 8, 16, and the like as the number of iterations increases.

In this embodiment, the manner of determining the count value according to the difference privacy parameter of each data record and the current difference privacy result is not limited, and several optional implementation manners are exemplified below:

mode 1: counting the number of the differential privacy parameters which are greater than or equal to the current differential privacy result, and recording the number of the differential privacy parameters which are greater than or equal to the current differential privacy result as a first number for facilitating understanding; and subtracting the first number from the total number of the data records in the data table to obtain a difference value as a counting value.

Mode 2: removing user data which is greater than or equal to the current differential privacy result in the at least one differential privacy parameter; counting the number of the residual differential privacy parameters; the number of the remaining differential privacy parameters is used as a count value.

Mode 3: initializing a count value; for each differential privacy parameter, comparing the value of the differential privacy parameter with the value of the current differential privacy result; and if the differential privacy parameter is smaller than the current differential privacy result, adding one to the count value. The count value may be flexibly initialized according to application requirements, for example, the count value is initialized to 0.

In this embodiment, when the differential privacy processing is performed, if the total number of data records of the data table does not match the count value indicating the number of differential privacy parameters satisfying the current differential privacy result, the current differential privacy result is updated and the subsequent steps are performed; if the total number of data records in the data table matches the count value representing the number of differential privacy parameters satisfying the current differential privacy result, the entire differential privacy processing task ends.

In this embodiment, the manner of the total number of data records in the data table and the count value indicating the number of differential privacy parameters satisfying the current differential privacy result is not limited. For example, if the total number of data records of the data table is equal to the count value, it is determined that the total number of data records of the data table matches the count value. For another example, if the difference between the total number of data records of the data table and the count value falls within the allowable range of values, it is determined that the total number of data records of the data table matches the count value.

In this embodiment, after obtaining the first query result based on the aggregated query and obtaining the target differential privacy result based on the differential privacy processing, the second query result of the numerical type is obtained based on the target differential privacy result and the first query result. Several alternative ways of determining the second query result are exemplified below:

mode 1: and carrying out weighted summation on the target differential privacy result and the first query result to obtain a second query result.

Mode 2: and averaging the target differential privacy result and the first query result to obtain a second query result.

Mode 3: and taking the smaller value of the target differential privacy result and the first query result as a second query result.

It is worth noting that the mode 3 can effectively reduce the leakage probability of the user privacy data in a truncation query mode. Intercepting the query can be understood as that if the target differential privacy result is greater than the first query result, the first query result is returned to the data querying party as a second query result; and if the target differential privacy result is smaller than the first query result, the target differential privacy result is used as a second query result and returned to the data query party.

For convenience of understanding, table 1 is described as an example, and table 1 is an employee information table in which various kinds of information of employees are recorded.

TABLE 1

Serial number	Name (I)	Sex	Age group	Payroll
					1	Li Mou	For male	28	8500
2	Root of Bai Dynasty	Woman	30	6500
					3	Wooden furniture	Woman	26	7500
4	Zhang-a	Woman	25	10000
					5	Du Mou	For male	26	8500
6	Horse's horn	For male	25	6500
					7	At a certain river	Woman	22	7500
8	Zhou Mou	Woman	23	10000
					9	Liu Mou	Woman	24	10000
10	Apply a certain	Female	30	10000

WHEN a data query request of 'SELECT SUM (CASE where age <23THEN payroll 0 END) From employee information table' submitted by a client is received, the data query request indicates to query the SUM of the payrolls of employees under 23 years old, the query condition is to query the payrolls of the employees under 23 years old, and the payrolls (user data) of the employees meeting the query condition are summed. Firstly, initializing a count value to be 0, setting a current differential privacy result to be 1, sequentially traversing each data record in an employee information table, inquiring whether wages of employees under 23 years old exist in the data record, and if yes, setting a differential privacy parameter corresponding to the data record to be a corresponding wage; if not, the differential privacy parameter corresponding to the data record is 0; comparing the differential privacy parameter of the data record with the current differential privacy result, and if the differential privacy parameter of the data record is greater than or equal to the current differential privacy result, not updating the count value; and if the difference privacy parameter of the data record is smaller than the current difference privacy result, adding one to the count value. Then, in the case where the current differential privacy result is 1, after all the data records in the employee information table are traversed, the count value is updated to 9. Since the count value (9) is equivalent to the number of rows (10 rows) of the employee data table, at this time, the current differential privacy result 1 is the maximum approximate value matched with the real query result 7500, and since the maximum approximate value is smaller than the real query result, the smaller maximum approximate value is selected and returned to the client.

WHEN a data query request of 'SELECT SUM (CASE where age <28 THEN payroll 0 END) From employee information table' submitted by a client is received, the data query request indicates to query the SUM of the payrolls of employees under 28 years, the query condition is to query the payrolls of employees under 28 years, and the payrolls (user data) of the employees meeting the query condition are summed. Firstly, setting a current differential privacy result to be 1, initializing a count value to be 0, sequentially traversing each data record in an employee information table, inquiring whether the wages of employees under 28 years old exist in the data record, and if yes, setting differential privacy parameters corresponding to the data record to be corresponding wages; if not, the differential privacy parameter corresponding to the data record is 0; comparing the differential privacy parameter of the data record with the current differential privacy result, and if the differential privacy parameter of the data record is greater than or equal to the current differential privacy result, not updating the count value; and if the difference privacy parameter of the data record is smaller than the current difference privacy result, adding one to the count value. Then, in the case where the current differential privacy result is 1, after all the data records in the employee information table are traversed, the count value is updated to 3. Because the difference between the count value (3) and the number of rows (10 rows) of the employee data table is a little great, at this time, the current differential privacy result is updated to be 2, and the step of initializing the count value to be 0 and the subsequent steps are executed again, and under the condition that the current differential privacy result is 2, after all data records in the employee information table are traversed, the count value is updated to be 3. Because the difference between the count value (3) and the line number (10 lines) of the employee data table is a little great, at this time, the current differential privacy result is updated to be 4, and by analogy, the current differential privacy result is continuously updated in an exponential increasing mode until the count value is equivalent to the total number of data records of the employee data table, and the current differential privacy result when the count value is equivalent to the total number of data records of the employee data table is used as a maximum approximate value, and the maximum approximate value and a real query result are selected to be returned to the client side by a smaller maximum approximate value. Wherein, the real inquiry result is the sum of wages of the employees under 28 years old.

According to the technical scheme provided by the embodiment of the application, firstly, aggregation query operation is executed for a data table associated with a data set to obtain a first query result of a numerical value type, and then, differential privacy processing is executed according to whether user data meeting query conditions exist in each data record in the data table to obtain a target differential privacy result; finally, a numerical type second query result is determined based on the target differential privacy result and the first query result. Therefore, errors between the second query result subjected to the differential privacy processing and the real first query result can be effectively reduced, and data usability and privacy protection degree can be effectively balanced.

In practical applications, the user data queried by the data querying party may or may not include the user privacy data. If the user data to be queried by the data querying party does not include the user privacy data, the differential privacy processing is not necessary, and if the differential privacy processing is still performed in the data querying process, the querying efficiency is low. If the user data to be queried by the data querying party includes the user privacy data, the differential privacy processing needs to be executed in the data querying process so as to reduce the leakage of the user privacy data. Therefore, further optionally, before performing the differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record, it may be further identified whether at least one user data meeting the query condition includes the user privacy data, and if so, the step of performing the differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record and subsequent steps are performed. If not, the first query result obtained by the aggregation query can be returned to the data querying party, and the whole query operation is ended.

In some application scenarios, in order to effectively protect user privacy data and reduce leakage of the user privacy data, whether a data inquiring party initiating a data inquiring request has the use permission of the user privacy data is verified, and if the data inquiring party has the use permission of the user privacy data, the probability that the data inquiring party leaks the user privacy data is low; if the data inquirer does not have the use authority of the user privacy data, the probability that the data inquirer reveals the user privacy data is high, and differential privacy processing needs to be executed. Therefore, it is further optional that, before performing the differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record, it is determined that at least one user data includes the user privacy data, and it is determined that the data querying party initiating the data query request does not have the usage right of the user privacy data. And outputting a second query result to the data query party after obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

It should be noted that, if the at least one user data does not include the user privacy data, or the data querying party has the usage right of the user privacy data, the first query result may be output to the data querying party.

In practical application, the second query result can be directly output to the data query party aiming at the situation that the data query party does not have the use authority of the user private data and the user data queried by the data query party relates to the situation. Further optionally, the implementation manner of outputting the second query result to the data querying party may be: determining error information between the first query result and the second query result; and outputting the second query result and the error information to the data query party.

It is worth noting that the second query result and the error information are output to the data query party at the same time, so that the data query party can intuitively confirm whether the second query result can be used for subsequent data processing, and the reliability of a data processing task is ensured.

In practical application, a data querying party without the use authority of the user private data may not accept error information between the first query result and the second query result, and there is a need to obtain a real first query result. Further optionally, in order to meet the requirement of the data querying party, after the second query result and the error information are output to the data querying party, an authority application request sent by the data querying party may also be received; and after the permission application request is approved, the data inquiry party is granted the use permission of the user privacy data, and a first inquiry result is output to the data inquiry party.

In this embodiment, a data querying party without the usage right of the user private data may initiate a right application request, where the right application request carries application information required for applying the usage right of the user private data, and the right application request is used to request the usage right of the user private data. And checking the application information in the received permission application request, if the application information passes the checking, granting the data inquiring party the use permission of the user privacy data, and outputting a first inquiry result to the data inquiring party. If the authorization request is not approved, the data inquirer is not granted the use authorization of the user private data, and the notification information that the authorization request is not approved is returned to the data inquirer, so that the data inquirer can know the authorization request auditing state.

Fig. 3 is a flowchart of another data query method according to an embodiment of the present application. Referring to fig. 3, the data query method may include the steps of:

301. and acquiring a data query request, wherein the data query request comprises a query condition and an aggregation function.

302. And querying at least one piece of user data meeting the query condition from a data table, wherein the data table records at least one piece of user data in the data set.

303. And performing aggregation processing on at least one user data by using an aggregation function to obtain a first query result of the numerical type.

304. Identifying whether the at least one user data satisfying the query condition includes user privacy data, if so, performing step 305, and if not, performing step 309.

305. And verifying whether the data inquiry party initiating the data inquiry request has the use authority of the user privacy data, if so, executing step 309, and if not, executing step 306.

306. And executing differential privacy processing according to the existence of the user data meeting the query conditions corresponding to each data record in the data table to obtain a target differential privacy result.

307. And obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

308. And outputting the second query result to the data query party.

309. And outputting the first query result to the data query party.

For specific implementation manners of each step in this embodiment, reference may be made to related descriptions of the foregoing embodiments, and details are not described herein again.

According to the technical scheme provided by the embodiment of the application, under the condition that the user data requested to be inquired by the data inquirer initiating the data inquiry request relates to the user privacy data and the data inquirer does not have the use permission of the user privacy data, differential privacy processing is integrated in the data inquiry process, and further the data usability and the privacy protection degree can be effectively balanced. Under the condition that the user data requested to be inquired by the data inquiring party initiating the data inquiring request does not relate to the user privacy data or the data inquiring party has the using authority of the user privacy data, the aggregated inquiring result can be directly returned to the data inquiring party, and the data inquiring efficiency is improved.

Fig. 4 is a schematic structural diagram of a data query device according to an embodiment of the present application. Referring to fig. 4, the apparatus may include the steps of:

an obtaining module 41, configured to obtain a data query request, where the data query request includes a query condition and an aggregation function;

a query module 42, configured to query at least one user data that meets a query condition from a data table, where the data table records a plurality of user data in a data set;

an aggregation module 43, configured to perform aggregation processing on at least one piece of user data by using an aggregation function to obtain a first query result of a numerical type;

the differential privacy processing module 44 is configured to execute differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record in the data table, so as to obtain a target differential privacy result;

and the determining module 45 is configured to obtain a second query result of the numerical type according to the target differential privacy result and the first query result.

Further optionally, the differential privacy processing module 44 is configured to, when a target differential privacy result is obtained by performing differential privacy processing according to the existence of the user data meeting the query condition and corresponding to each data record in the data table, specifically: determining a difference privacy parameter of each data record according to the existence of the user data meeting the query condition corresponding to each data record; obtaining a current differential privacy result, and determining a count value according to the differential privacy parameters recorded by each data and the current differential privacy result, wherein the count value represents the number of the differential privacy parameters meeting the current differential privacy result; and if the total number of the data records in the data table is not matched with the counting value, updating the current differential privacy result, and continuing to execute the step of determining the counting value according to the differential privacy parameters corresponding to the data records and the current differential privacy result until the total number of the data records in the data table is matched with the counting value, and taking the current differential privacy result as the target differential privacy result.

Further optionally, when the differential privacy processing module 44 determines, according to the existence of the user data meeting the query condition and corresponding to each data record, the differential privacy parameters corresponding to each data record are specifically configured to: for each data record, if the user data meeting the query condition exists in the data record, taking the user data meeting the query condition in the data record as a differential privacy parameter corresponding to the data record; and if the data record does not contain the user data meeting the query condition, taking the designated numerical value as the differential privacy parameter corresponding to the data record.

Further optionally, when the differential privacy processing module 44 determines the count value according to the differential privacy parameter corresponding to each data record and the current differential privacy result, the differential privacy processing module is specifically configured to: initializing a count value; comparing the difference privacy parameters with the current difference privacy result according to the difference privacy parameters corresponding to each data record; and if the differential privacy parameter is smaller than the current differential privacy result, adding one to the count value.

Further optionally, when the differential privacy processing module 44 updates the current differential privacy result, the differential privacy processing module is specifically configured to: taking the n +1 power of m as a new current differential privacy result under the condition that the current differential privacy result is the n power of m; wherein m and n are positive integers.

Further optionally, when the determining module 45 obtains the second query result of the numerical type according to the target differential privacy result and the first query result, the determining module is specifically configured to: taking the smaller value of the target differential privacy result and the first query result as a second query result; or, performing weighted summation on the target differential privacy result and the first query result to obtain a second query result; or, averaging the target differential privacy result and the first query result to obtain a second query result.

Further optionally, the apparatus further comprises: the device comprises an identification module and an output module;

the identification module is configured to determine that the at least one piece of user data includes user privacy data, determine that a data querying party initiating the data querying request does not have a usage right of the user privacy data, and trigger the differential privacy processing module 44 to perform differential privacy processing;

after the determining module 45 obtains the second query result, the output module is triggered;

the output module is used for outputting the second query result to the data query party.

Further optionally, if it is determined that the at least one piece of user data does not include the user private data, or the data querying party has the usage right of the user private data, the identification module triggers the output module to output the first query result to the data querying party.

Further optionally, when the output module outputs the second query result to the data querying party, the output module is specifically configured to:

determining error information between the first query result and the second query result;

and outputting the second query result and the error information to the data query party.

Further optionally, after the output module outputs the second query result and the error information to the data querying party, the obtaining module 41 is further configured to receive an authority application request sent by the data querying party; after the permission application request is passed, granting the data inquiring party the use permission of the user private data; and triggering an output module to output a first query result to the data query party.

The data query apparatus shown in fig. 4 may execute the data query method of the embodiment shown in fig. 2 or fig. 3, and details of implementation principles and technical effects thereof are not repeated. The specific manner in which each module and unit of the data query apparatus shown in fig. 4 in the above-described embodiment perform operations has been described in detail in the embodiment related to the method, and will not be described in detail here.

It should be noted that the execution subjects of the steps of the methods provided in the above embodiments may be the same device, or different devices may be used as the execution subjects of the methods. For example, the execution subjects of steps 401 to 403 may be device a; for another example, the execution subject of steps 401 and 402 may be device a, and the execution subject of step 403 may be device B; and so on.

In addition, in some of the flows described in the above embodiments and the drawings, a plurality of operations are included in a specific order, but it should be clearly understood that the operations may be executed out of the order presented herein or in parallel, and the sequence numbers of the operations, such as 401, 402, etc., are merely used to distinguish various operations, and the sequence numbers themselves do not represent any execution order. Additionally, the flows may include more or fewer operations, and the operations may be performed sequentially or in parallel. It should be noted that, the descriptions of "first", "second", etc. in this document are used for distinguishing different messages, devices, modules, etc., and do not represent a sequential order, nor limit the types of "first" and "second" to be different.

Fig. 5 is a schematic structural diagram of an electronic device according to an embodiment of the present application. As shown in fig. 5, the electronic apparatus includes: a memory 51 and a processor 52;

the memory 51 is used to store computer programs and may be configured to store various other data to support operations on the computing platform. Examples of such data include instructions for any application or method operating on the computing platform, contact data, phonebook data, messages, pictures, videos, and so forth.

The memory 51 may be implemented by any type or combination of volatile or non-volatile memory devices, such as Static Random Access Memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic or optical disks.

A processor 52 coupled to the memory 51 for executing the computer program in the memory 51 for: acquiring a data query request, wherein the data query request comprises a query condition and an aggregation function; inquiring at least one piece of user data meeting the inquiry condition from a data table, wherein the data table records a plurality of pieces of user data in a data set; performing aggregation processing on at least one user data by using an aggregation function to obtain a first query result of a numerical type; executing differential privacy processing according to the existence of the user data meeting the query conditions corresponding to each data record in the data table to obtain a target differential privacy result; and obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

Further optionally, the processor 52 executes the differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record in the data table, and when the target differential privacy result is obtained, the processor is specifically configured to: determining a difference privacy parameter of each data record according to the existence of the user data meeting the query condition corresponding to each data record; obtaining a current differential privacy result, and determining a count value according to the differential privacy parameters recorded by each data and the current differential privacy result, wherein the count value represents the number of the differential privacy parameters meeting the current differential privacy result; and if the total number of the data records in the data table is not matched with the count value, updating the current differential privacy result, and continuing to execute the step of determining the count value according to the differential privacy parameters corresponding to the data records and the current differential privacy result until the total number of the data records in the data table is matched with the count value, and taking the current differential privacy result as the target differential privacy result.

Further optionally, when determining, by the processor 52, the differential privacy parameter corresponding to each data record according to the existence of the user data meeting the query condition corresponding to each data record, specifically: for each data record, if the user data meeting the query condition exists in the data record, taking the user data meeting the query condition in the data record as a differential privacy parameter corresponding to the data record; and if the data record does not contain the user data meeting the query condition, taking the designated numerical value as the differential privacy parameter corresponding to the data record.

Further optionally, when the processor 52 determines the count value according to the difference privacy parameter corresponding to each data record and the current difference privacy result, it is specifically configured to: initializing a count value; comparing the difference privacy parameters with the current difference privacy result according to the difference privacy parameters corresponding to each data record; and if the differential privacy parameter is smaller than the current differential privacy result, adding one to the count value.

Further optionally, when the processor 52 updates the current differential privacy result, it is specifically configured to: taking the n +1 power of m as a new current differential privacy result under the condition that the current differential privacy result is the n power of m; wherein m and n are positive integers.

Further optionally, when the processor 52 obtains the second query result of the numerical type according to the target differential privacy result and the first query result, the processor is specifically configured to: taking the smaller value of the target differential privacy result and the first query result as a second query result; or, performing weighted summation on the target differential privacy result and the first query result to obtain a second query result; or, averaging the target differential privacy result and the first query result to obtain a second query result.

Further optionally, before performing the differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record, the processor 52 is further configured to: determining that at least one user data comprises user privacy data, and determining that a data inquiry party initiating a data inquiry request does not have the use authority of the user privacy data; the processor 52, after obtaining a second query result of numeric type based on the target differential privacy result and the first query result, is further configured to: and outputting the second query result to the data query party.

Further optionally, processor 52 is further configured to: and if the at least one piece of user data does not comprise the user privacy data, or the data inquiry party has the use permission of the user privacy data, outputting a first inquiry result to the data inquiry party.

Further optionally, when the processor 52 outputs the second query result to the data querying party, the following steps are specifically performed: determining error information between the first query result and the second query result; and outputting the second query result and the error information to the data query party.

Further optionally, after the processor 52 outputs the second query result and the error information to the data querying party, the processor is further configured to: receiving an authority application request sent by a data inquiry party; and after the permission application request is approved, the data inquiry party is granted the use permission of the user privacy data, and a first inquiry result is output to the data inquiry party.

Further, as shown in fig. 5, the electronic device further includes: communication components 53, display 54, power components 55, audio components 56, and the like. Only some of the components are schematically shown in fig. 5, and the electronic device is not meant to include only the components shown in fig. 5. In addition, the components within the dashed line in fig. 5 are optional components, not necessary components, and may be determined according to the product form of the electronic device. The electronic device of this embodiment may be implemented as a terminal device such as a desktop computer, a notebook computer, a smart phone, or an IOT device, or may be a server device such as a conventional server, a cloud server, or a server array. If the electronic device of this embodiment is implemented as a terminal device such as a desktop computer, a notebook computer, a smart phone, etc., the electronic device may include components within a dashed line frame in fig. 5; if the electronic device of this embodiment is implemented as a server device such as a conventional server, a cloud server, or a server array, the components in the dashed box in fig. 5 may not be included.

For details of the implementation process of each action performed by the processor, reference may be made to the foregoing method embodiment or the related description in the device embodiment, and details are not described herein again.

Accordingly, the present application further provides a computer-readable storage medium storing a computer program, where the computer program is capable of implementing the steps that can be executed by the electronic device in the foregoing method embodiments when executed.

Accordingly, the present application also provides a computer program product, which includes a computer program/instruction, when the computer program/instruction is executed by a processor, the processor is enabled to implement the steps that can be executed by an electronic device in the above method embodiments.

The communication component is configured to facilitate wired or wireless communication between the device in which the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as a WiFi, a 2G, 3G, 4G/LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast related information from an external broadcast management system via a broadcast channel. In one exemplary embodiment, the communication component further includes a Near Field Communication (NFC) module to facilitate short-range communications. For example, the NFC module may be implemented based on Radio Frequency Identification (RFID) technology, infrared data association (IrDA) technology, ultra Wideband (UWB) technology, bluetooth (BT) technology, and other technologies.

The display includes a screen, which may include a Liquid Crystal Display (LCD) and a Touch Panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive an input signal from a user. The touch panel includes one or more touch sensors to sense touch, slide, and gestures on the touch panel. The touch sensor may not only sense the boundary of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

The power supply assembly provides power for various components of the equipment where the power supply assembly is located. The power components may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power for the device in which the power component is located.

The audio component may be configured to output and/or input an audio signal. For example, the audio component includes a Microphone (MIC) configured to receive an external audio signal when the device in which the audio component is located is in an operational mode, such as a call mode, a recording mode, and a voice recognition mode. The received audio signal may further be stored in a memory or transmitted via a communication component. In some embodiments, the audio assembly further comprises a speaker for outputting audio signals.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

In a typical configuration, a computing device includes one or more processors (CPUs), input/output interfaces, network interfaces, and memory.

The memory may include forms of volatile memory in a computer readable medium, random Access Memory (RAM) and/or non-volatile memory, such as Read Only Memory (ROM) or flash memory (flash RAM). Memory is an example of a computer-readable medium.

Computer-readable media, including both permanent and non-permanent, removable and non-removable media, may implement the information storage by any method or technology. The information may be computer readable instructions, data structures, modules of a program, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static Random Access Memory (SRAM), dynamic Random Access Memory (DRAM), other types of Random Access Memory (RAM), read Only Memory (ROM), electrically Erasable Programmable Read Only Memory (EEPROM), flash memory or other memory technology, compact disc read only memory (CD-ROM), digital Versatile Discs (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined herein, a computer readable medium does not include a transitory computer readable medium such as a modulated data signal and a carrier wave.

It should also be noted that the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising a … …" does not exclude the presence of another identical element in a process, method, article, or apparatus that comprises the element.

The above are merely examples of the present application and are not intended to limit the present application. Various modifications and changes may occur to those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims (14)

1. A method of data query, comprising:

acquiring a data query request, wherein the data query request comprises a query condition and an aggregation function;

inquiring at least one piece of user data meeting the inquiry condition from a data table, wherein the data table records a plurality of pieces of user data in a data set;

performing aggregation processing on the at least one user data by using the aggregation function to obtain a first query result of a numerical type;

executing differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record in the data table to obtain a target differential privacy result;

and obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

2. The method of claim 1, wherein performing differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record in the data table to obtain a target differential privacy result, comprises:

determining a difference privacy parameter of each data record according to the existence of the user data which corresponds to each data record and meets the query condition;

obtaining a current differential privacy result, and determining a count value according to a differential privacy parameter recorded by each data and the current differential privacy result, wherein the count value represents the number of the differential privacy parameters meeting the current differential privacy result;

and if the total number of the data records of the data table is not matched with the counting value, updating the current differential privacy result, and continuing to execute the step of determining the counting value according to the differential privacy parameters corresponding to the data records and the current differential privacy result until the total number of the data records of the data table is matched with the counting value, and taking the current differential privacy result as a target differential privacy result.

3. The method of claim 2, wherein determining the differential privacy parameter corresponding to each data record according to the existence of the user data meeting the query condition corresponding to each data record comprises:

for each data record, if the user data meeting the query condition exists in the data record, taking the user data meeting the query condition in the data record as a differential privacy parameter corresponding to the data record;

and if the data record does not contain the user data meeting the query condition, taking the designated numerical value as the differential privacy parameter corresponding to the data record.

4. The method of claim 2, wherein determining a count value based on the differential privacy parameter corresponding to each data record and the current differential privacy result comprises:

initializing a count value;

comparing the difference privacy parameters with the current difference privacy result according to the difference privacy parameters corresponding to each data record;

and if the differential privacy parameter is smaller than the current differential privacy result, adding one to the count value.

5. The method of claim 2, updating the current differential privacy result, comprising:

taking the n +1 th power of m as a new current differential privacy result under the condition that the current differential privacy result is the n th power of m; wherein m and n are positive integers.

6. The method of any of claims 1 to 5, deriving a numeric type of second query result from the target differential privacy result and the first query result, comprising:

taking the smaller value of the target differential privacy result and the first query result as the second query result; alternatively, the first and second electrodes may be,

carrying out weighted summation on the target differential privacy result and the first query result to obtain a second query result; alternatively, the first and second electrodes may be,

and averaging the target differential privacy result and the first query result to obtain the second query result.

7. The method according to any one of claims 1 to 5, further comprising, before performing differential privacy processing according to the presence of user data satisfying the query condition corresponding to each data record, the following:

determining that the at least one user data includes user privacy data, and determining that a data querying party initiating the data querying request does not have a usage right of the user privacy data;

after obtaining a second query result of a numerical type according to the target differential privacy result and the first query result, the method further includes:

and outputting the second query result to the data query party.

8. The method of claim 7, further comprising:

and if the at least one piece of user data does not comprise the user privacy data, or the data inquiry party has the use permission of the user privacy data, outputting the first inquiry result to the data inquiry party.

9. The method of claim 7, outputting the second query result to the data querier comprises:

determining error information between the first query result and the second query result;

and outputting the second query result and the error information to the data query party.

10. The method of claim 9, after outputting the second query result and the error information to the data querier, further comprising:

receiving an authority application request sent by the data inquiry party;

and after the permission application request is approved, the data inquiry party is granted the use permission of the user privacy data, and the first inquiry result is output to the data inquiry party.

11. A data query apparatus, comprising:

the system comprises an acquisition module, a processing module and a processing module, wherein the acquisition module is used for acquiring a data query request, and the data query request comprises a query condition and an aggregation function;

the query module is used for querying at least one piece of user data meeting the query condition from a data table, and the data table records a plurality of pieces of user data in a data set;

the aggregation module is used for carrying out aggregation processing on the at least one user data by using the aggregation function to obtain a first query result of a numerical type;

the differential privacy processing module is used for executing differential privacy processing according to the existence of the user data which is corresponding to each data record in the data table and meets the query condition to obtain a target differential privacy result;

and the determining module is used for obtaining a second query result of the numerical type according to the target differential privacy result and the first query result.

12. A database system, comprising: the system comprises a client, a database server and a database, wherein the database stores one or more data tables for recording data in a data set;

the client is used for sending a data query request to the database server, wherein the data query request comprises a query condition and an aggregation function; receiving a second query result of the numerical type returned by the database server;

the database server is used for inquiring at least one user data meeting the inquiry condition from a data table according to a data inquiry request, and the data table records a plurality of user data in a data set; performing aggregation processing on the at least one user data by using the aggregation function to obtain a first query result of a numerical type; executing differential privacy processing according to the existence of the user data meeting the query condition corresponding to each data record in the data table to obtain a target differential privacy result; and obtaining a second query result of the numerical type according to the target differential privacy result and the first query result, and returning the second query result to the client.

13. An electronic device, comprising: a memory and a processor; the memory for storing a computer program; the processor is coupled to the memory for executing the computer program for performing the steps of the method of any of claims 1-10.

14. A computer storage medium storing a computer program which, when executed by a processor, causes the processor to implement the steps in the method of any one of claims 1 to 10.

Images