CN117235800A - Data query protection method based on secret specification personalized privacy protection mechanism - Google Patents

Abstract

The invention provides a data query protection method based on a personalized privacy protection mechanism based on secret specifications, which includes: the access device sends a query instruction to the data storage device; the data storage device executes: parses the query instruction to obtain the query function and query attributes; and extracts the query attribute data Set; divide the query attribute data set into sensitive subsets and non-sensitive subsets based on the user secret specification set; obtain the mean query result of the query attribute data set according to the pre-built Laplacian mechanism based on the secret specification; according to the pre-built An exponential mechanism based on secret specifications obtains the median query result of the query attribute data set; publishes the mean query result and/or the median query result. Secret specifications help to accurately define the scope of privacy protection and protected entities, avoid strict constraints that treat all attribute records of data as sensitive, provide less data distortion and more accurate data query results, and achieve a balance between privacy protection and data utility.

Description

Data query protection method based on personalized privacy protection mechanism of secret specification

Technical Field

The present invention relates to the field of data security technology, and in particular to a data query protection method based on a personalized privacy protection mechanism of a secret specification.

Background Art

With the advent of the big data era, a large amount of sensitive data, including personal identity information, medical records, financial transactions, etc., is stored in databases. In order to support various research, business decisions and government policy making, the demand for statistical queries on these data is increasing rapidly. Statistical queries such as mean and median are important tools for understanding data distribution and trends. They provide key insights into data for all walks of life. For example, researchers may need to calculate the average age of patients in medical research, or financial institutions may need to find the median credit score of customers, or obtain the average age, median annual income, etc. from the census data set. These queries usually involve sensitive information, so effective privacy protection is required.

Differential Privacy (DP) is becoming the gold standard for privacy protection due to its theoretical provability and robustness against adversaries with prior knowledge. It can protect individual privacy while meeting data analysis needs. It can be applied to common data analysis operations such as mean and median queries to ensure that sensitive data is properly protected. Legal frameworks such as the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, the Family Educational Rights and Privacy Act (FERPA), and the EU's General Data Protection Regulation (GDPR) are committed to ensuring that organizations and individuals adhere to the principles of transparency, fairness, and security when collecting, processing, and sharing personal information. In addition, recent privacy protection regulations in California, including the California Consumer Privacy Act and the California Privacy Rights Act, also strengthen individuals' control over their personal information and provide for transparency in the collection and use of data by organizations. The common goal of these privacy laws and standards is to protect individual privacy, give individuals the right to understand how their data is used, and the ability to regulate and limit the sharing and processing of their data. From a legislative and policy perspective, users have the right to control their privacy and show personalized privacy needs. This concept of personalization is rooted in each person's unique cultural background, personal privacy preferences or social factors, and reflects the differences in privacy expectations among different users.

However, when it comes to individuals’ control over the sensitivity of their own data, traditional differential privacy is often too strict. It usually regards all data related to individuals in a dataset as inherently sensitive, while in reality, not all information related to individuals is considered sensitive and requires the same level of protection due to different personal privacy preferences and attitudes. Consider a scenario like a smart building management system, which processes a large amount of sensor data and personal information, including users’ location details and health indicators. It is worth noting that individuals may hold different views on the sensitivity of these attributes. Some users may consider their location information sensitive and health data insensitive. Conversely, others may consider health data sensitive and location information non-sensitive. In addition, some people consider both attributes to be either sensitive or insensitive. It can be seen that users of traditional differential privacy data protection methods cannot independently define their own secret specifications and cannot accurately define the scope of data protection. The query results obtained when querying data are highly distorted and have low utility.

Census data sets usually contain information such as age, gender, annual income, telephone number, and health status. However, information such as annual income, health status, and age involves personal privacy of users, and different users have different privacy setting requirements. For example, some individuals may not want to disclose their specific annual income, and some users may not want to disclose their age or health status to prevent information leakage from being used by criminals or invalid marketing. If traditional differential privacy data protection methods are used, users cannot independently define their own secret specifications, and cannot accurately define the scope of data protection. The query results obtained during data query are highly distorted, resulting in lower utility.

Summary of the invention

The present invention aims to solve the technical problems existing in the prior art and provide a data query protection method based on a personalized privacy protection mechanism of secret specifications and a population census data set query protection method.

In order to achieve the above-mentioned purpose of the present invention, according to the first aspect of the present invention, the present invention provides a data query protection method of a personalized privacy protection mechanism based on a secret specification, including: an access device sends a query instruction to a data storage device; the data storage device executes: receiving and parsing the query instruction to obtain a query function and a query attribute; extracting a query attribute data set from a set data set; obtaining a user secret specification set, and dividing the query attribute data set into a sensitive subset and a non-sensitive subset based on the user secret specification set; when the query function is a mean query function, obtaining a mean query result of the query attribute data set according to a pre-built Laplace mechanism based on the secret specification; when the query function is a median query function, obtaining a median query result of the query attribute data set according to a pre-built exponential mechanism based on the secret specification; and publishing the mean query result and/or median query result of the query attribute data set to the access device.

The above technical solution allows individual users to set which attribute records are sensitive and which are not sensitive based on secret specifications, which helps to accurately define the scope of privacy protection and the protected entities, avoids the strict constraint of traditional differential privacy methods that regard all attribute records of data as sensitive, and makes privacy protection more flexible and personalized, while providing less data distortion and more accurate data query results; proposes a Laplace mechanism SSLM based on secret specifications and applies it to mean queries, and proposes an exponential mechanism SSEM based on secret specifications and applies it to median queries, which improves the accuracy of data analysis while minimizing data distortion, especially when a large part of the data is non-sensitive, achieving a balance between privacy protection and data utility. Compared with the most advanced differential privacy framework mechanism, SSLM improves the utility by about 14 times for mean queries by utilizing non-sensitive data, and SSEM improves the utility by about 6 times for median queries by utilizing non-sensitive data.

In order to achieve the above-mentioned purpose of the present invention, according to the second aspect of the present invention, the present invention provides a method for querying and protecting a population census data set, comprising: an access device sends a query instruction to a data storage device storing a population census data set; the data storage device executes: receiving and parsing the query instruction to obtain a query function and a query attribute, wherein the query attribute includes age and annual income; extracting a query attribute data set from the population census data set; obtaining a user secret specification set, and dividing the query attribute data set into a sensitive subset and a non-sensitive subset based on the user secret specification set; when the query function is a mean query function, obtaining a mean query result of the query attribute data set according to a pre-built Laplace mechanism based on the secret specification; when the query function is a median query function, obtaining a median query result of the query attribute data set according to a pre-built exponential mechanism based on the secret specification; and publishing the mean query result and/or median query result of the query attribute data set to the access device.

The above technical solution: allows individual users to set which attribute records in the census dataset are sensitive and which are not sensitive based on secret specifications, which helps to accurately define the scope of privacy protection and the protected entities, avoids the strict constraint of traditional differential privacy methods that regard all attribute records of the census dataset as sensitive, makes privacy protection more flexible and personalized, and provides less data distortion and more accurate data query results; proposes a Laplace mechanism (SSLM) based on secret specifications and applies it to mean queries of census datasets, and proposes an exponential mechanism (SSEM) based on secret specifications and applies it to median queries of census datasets, improves data query accuracy while minimizing data distortion, especially when a large part of the data is non-sensitive, achieving a balance between privacy protection and data utility. Compared with the most advanced differential privacy framework mechanism, SSLM improves the utility by about 14 times for mean queries by utilizing non-sensitive data, and SSEM improves the utility by about 6 times for median queries by utilizing non-sensitive data.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of a data query protection method based on a personalized privacy protection mechanism of a secret specification in a preferred embodiment of the present invention;

FIG2 is a first example of a score function value for calculating a median value according to the present invention;

FIG3 is a second example of the score function value for calculating the median value of the present invention;

FIG4 is a flow chart of a method for querying and protecting a population census data set in another preferred embodiment of the present invention;

FIG5 is a diagram showing changes in RMSE of mean query results of SSLM as the proportion of non-sensitive attributes changes in another preferred embodiment of the present invention;

FIG6 is a diagram showing changes in RMSE of mean query results of SSLM as the degree of privacy protection changes in another preferred embodiment of the present invention;

FIG7 is a diagram showing changes in RMSE of SSEM in median query results as the proportion of non-sensitive attributes changes in another preferred embodiment of the present invention;

FIG8 shows the change of RMSE of SSEM in median query results as the degree of privacy protection changes in another preferred embodiment of the present invention.

DETAILED DESCRIPTION

Embodiments of the present invention are described in detail below, examples of which are shown in the accompanying drawings, wherein the same or similar reference numerals throughout represent the same or similar elements or elements having the same or similar functions. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and cannot be understood as limiting the present invention.

In the description of the present invention, it is necessary to understand that the terms "longitudinal", "lateral", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inside", "outside", etc., indicating the orientation or position relationship, are based on the orientation or position relationship shown in the accompanying drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, and therefore cannot be understood as a limitation on the present invention.

In the description of the present invention, unless otherwise specified and limited, it should be noted that the terms "installation", "connection" and "connection" should be understood in a broad sense. For example, it can be a mechanical connection or an electrical connection, or it can be the internal connection between two components. It can be a direct connection or an indirect connection through an intermediate medium. For ordinary technicians in this field, the specific meanings of the above terms can be understood according to the specific circumstances.

From the perspective of legislation and policy, users have the right to control their own privacy and show personalized privacy needs. This concept of personalization is rooted in each person's unique cultural background, personal privacy preferences or social factors, and reflects the differences in privacy expectations of different users. Existing research on the personalization of differential privacy is mainly reflected in the personalization of privacy budgets within the differential privacy (DP) framework, that is, individuals specify the privacy protection strength of their own data. Individuals cannot set which data is sensitive and needs to be protected according to privacy needs, and which data is not sensitive and does not need to be protected. When it comes to the control of the sensitivity of individuals' own data, traditional differential privacy is often too strict. It usually regards all data related to individuals in the data set as inherently sensitive, which causes large data distortion during access, increased computational overhead, and low accuracy when querying access data for later analysis. Based on this, this application seamlessly integrates secret specifications into the differential privacy framework and introduces differential privacy based on secret specifications (SSDP).

The following is an explanation and description of the relevant definitions and mechanisms of the secret specification-based differential privacy (SSDP) proposed in this application.

Set the data set to be protected, and represent the set data set as D ₀ =(r ₁ ,…, _ri …, _rn ), where n represents the number of users, user index i∈[1,n], and _ri represents the record of user _ui . represents a user set, _ri represents a k-dimensional variable, k represents the attribute dimension, _ri comes from the domain Represents the attribute _Aj record of user u _i , with attribute index j∈[1,k]; Represents an attribute record. According to the user's personal privacy specification settings, the attribute record can be set as a sensitive record or an insensitive record. Sensitive records, insensitive records and sexual records are all variables and can have different record values. The set data set can be a census data set.

Definition 1 (Secret Specification): The secret specification of user u _i is formally defined as a binary function S _i : r _i →{0, 1} ^k , where is a single k-dimensional attribute record associated with user u _i . Function S _i determines the sensitivity classification of each attribute (such as A _j (1≤j≤k)) in record r _i . If the secret specification function value S _i (A _j ) of attribute j = 1, the attribute A _j record is considered to be a sensitive record. If the secret specification function value S _i (A _j ) of attribute j = 0, the attribute A _j record is considered to be an insensitive record.

According to Definition 1, each user-specified secret specification divides its record (containing k attributes) into two sub-records. Specifically, function _Si divides the attribute values in record r _i into two sub-records: sensitive sub-record and non-sensitive sub-records In particular, when k=1, that is, one record is associated with only one attribute, the user's secret specification set S divides the set data set D ₀ into two subsets, namely, the sensitive data subset D _s and the non-sensitive data subset D _ns .

Definition 2 - adjacent records): let Representation and User Set The set of related secret specifications. Records for user _ui With a record yes -adjacent, satisfying that for any j, when

Definition 3 - adjacent datasets): dataset D and dataset D′ are -adjacent if and only if there is a record in D that is different from D′ and the different record is - adjacent.

Definition 4 -sensitivity): For any pair - adjacent datasets D and D′, the global sensitivity of the query function f is denoted as _Δfs and measured by the _L1 norm:

This application starts from the user's privacy right, realizes the personalization of personal privacy needs by allowing users to independently specify the sensitivity of self-set records, and proposes Secret Specification-based Differential Privacy (SSDP).

Definition 5 (Differentially Private SSDP Based on Secret Specification): In the context of If for any - adjacent data sets D and D′ and any subset o in Range(M), algorithm satisfy:

Range(M) indicates random algorithm The output space of Indicates that in randomized algorithms Act on data set D to obtain results The probability of Indicates the result obtained when the random algorithm M acts on the data set D′ ∈ represents the preset privacy protection level, ∈＞0.

The main goal of the secret specification-based differential privacy SSDP proposed in this application is to protect sensitive records in a set of data sets. Its notable feature is that the sensitivity of record attributes is determined by the user himself and is independent of the record values of these attributes. This means that changing the value of a sensitive record will not affect its sensitivity, thus forming a symmetric neighborhood relationship. As explained in Definition 5, for the sensitive attributes of the record, the secret specification-based differential privacy SSDP ensures the same level of privacy protection as the traditional differential privacy DP, thereby resisting powerful attacks.

This application proposes a secret specification-based Laplace mechanism (SSLM) as a basic mechanism for implementing a secret specification-based differential privacy SSDP scheme, and applies it to mean queries of databases or set data sets.

The Laplace mechanism SSLM based on secret specification has the following theorem:

Theorem 1 (Secret Specification-based Laplace Mechanism SSLM): Given a function f:D→R and a user's secret specification Expressed as The SSLM meets in Indicates f -sensitivity, R represents the range of function f, when function f is a median query function or a mean query function, R represents the real number domain. Lap(·) represents the lapalce distribution probability density function.

Theorem 2 (Secret Specification-Based Laplace Mechanism SSLM): When the query function f is denoted as a mean function, SSLM, i.e. satisfy

This application also proposes a secret specification-based exponential mechanism (SSEM) as a basic mechanism for implementing the SSDP mechanism, and applies it to median queries of databases and set data sets.

Consider a query function f: D→O, where the query function can be a median query function. The real value score function for the output space O of function f can be expressed as Wherein, D* represents a data set formed by changing the record values of any number of sensitive records in the data set D and satisfying f(D ^* )=o; represents the set of different sensitive records in D and D*; Representing a collection The cardinality, that is, the number of sensitive records in the set, is also the number of sensitive records whose record values change during the transformation from data set D to D*; the value of the real value score function s(D, o) is a negative number, and its calculation formula means that When the number of sensitive records in is the smallest (corresponding to the largest s(D, o)), The number of sensitive records is inverted to obtain the score function value; is the global sensitivity of the scoring function s. For basic statistical functions such as the median query function, Δs=1.

Definition 6 (Exponential Mechanism EM): Let O represent a random algorithm The set of all possible outputs is the output space. For the score function if The probability of producing output o in O is Proportional, then Satisfies ∈-DP. Among them, D and D′ are - Neighboring datasets. Represents the field of real numbers.

According to the confidentiality regulations This application modifies the score function s(D, o) of the original exponential mechanism and expresses it in another way, namely Among them, r represents sensitive records associated with a one-dimensional attribute in In the process of obtaining D ^* from data set D, the data set D ^* is obtained when the minimum number of sensitive records is changed to reach f(D ^* )=o. At this time, the number of sensitive records changed multiplied by -∈ is the maximum. value.

Definition 7 (Secret Specification-based Exponential Mechanism SSEM): Given a function f: D→O and a user's secret specification set SSEM By probability Output o,z,o∈O, It indicates the median query result of outputting o according to the above probability. exp(·) indicates the exponential probability distribution density function.

Privacy Analysis:

Theorem 2 (Secret Specification-Based Laplace Mechanism SSLM): When the query function f is denoted as a mean function, SSLM, i.e. satisfy Meet privacy requirements.

Theorem 3: When the query function f is recorded as the median function, SSEM, that is satisfy -SSDP, which meets privacy requirements.

The present application provides a data query protection method based on a personalized privacy protection mechanism of a secret specification, as shown in FIG1 , in a preferred implementation, including:

Step S101, the access device sends a query instruction to the data storage device. The access device is preferably but not limited to a mobile terminal or a PC or a laptop. The data storage device is preferably but not limited to a data server or a cloud server. The access device and the data storage device communicate via the Internet connection.

Data storage devices perform:

Step S102, receiving and parsing the query instruction to obtain the query function and query attribute. The query instruction contains the query function and query attribute. Since the record of each user in the set data set includes multi-dimensional attributes, such as the need to obtain the average age or annual income from the census data set, the age attribute or annual income attribute data set needs to be processed.

Step S103, extracting a query attribute data set from a set data set, includes:

Assume that the data set is represented as D ₀ =(r ₁ ,…, _ri …, _rn ), where n represents the number of users, _ri represents the record of user _ui , and user index i∈[1,n], k represents the attribute dimension, _ri comes from the domain represents the attribute _Aj record of user u _i , and the attribute index j∈[1, k]; let the query attribute be attribute _Aj , then the query attribute dataset

Step S104, obtaining a user secret specification set, and dividing the query attribute data set into a sensitive subset and a non-sensitive subset based on the user secret specification set. The user secret specification set includes the user's binary function of all attributes. After parsing the query attribute, the secret specification set of the query attribute is extracted from the user secret specification set, and the query attribute data set is divided into a sensitive subset and a non-sensitive subset based on the extracted secret specification set. Specifically, step S104 includes:

Step S1041, user secret specification set Including setting the secret specifications of all users corresponding to the data set, the secret specification of user u _i is defined as a binary function: S _i : r _i →{0, 1} ^k . If user u _i defines attribute A _j record as a sensitive record, then the secret specification of user u _i is the value S _i (A _j ) = 1 of attribute A _j . If user u _i defines attribute A _j record as an insensitive record, then the secret specification of user u _i is the value S _i (A _j ) = 0 of attribute A _j .

Step S1042, set attribute A _j as the query attribute, and execute for all users: if the secret specification of user u _i is in the value S _i (A _j ) of attribute A _j = 1, then record attribute A _j of user u _i The recorded value of is classified into the sensitive subset D _s . If the secret specification of user u _i is in the value of attribute A _j S _i (A _j ) = 0, then the attribute A _j of user u _i is recorded The recorded values are classified into the non-sensitive subset D _ns .

Step S104 divides the query attribute data set into sensitive subsets and non-sensitive subsets. In mean query or median query, the sensitive subset is protected, while the non-sensitive subset is not protected. While protecting sensitive data, the distortion of query data can be reduced and the utility of query data can be improved.

Step S105, when the query function is a mean query function, obtaining a mean query result of the query attribute data set according to a pre-built Laplace mechanism based on a secret specification;

When the query function is a median query function, a median query result of the query attribute data set is obtained according to a pre-built secret specification-based exponential mechanism.

Step S106: publishing the mean query result and/or median query result of the query attribute data set to the access device.

In this embodiment, preferably, in step S105, when the query function is a mean query function, obtaining a mean query result of the query attribute data set according to a pre-built Laplace mechanism based on a secret specification includes:

Step A1, calculate the mean f _mean (D) of the query attribute data set based on the sensitive subset D _s and the non-sensitive subset D _ns :

Among them, |·| means to find the cardinality of the data set, that is, to find the number of data in the data set; f _mean (·) represents the mean query function, f _mean (D _s ) represents the mean of the sensitive subset D _s , and f _mean (D _ns ) represents the mean of the non-sensitive subset D _ns .

Step A2: Construct the query attribute dataset - Adjacent dataset D′, specifically, constructed according to the above definition 3 - Adjacent dataset D′, to obtain the global sensitivity of the mean query function

Where f _mean (D′) represents - the mean of the adjacent dataset D′, || || ₁ represents the _L1 norm.

Step A3: add noise that satisfies the Laplace distribution to the mean f _mean (D) of the query attribute data set. Get the mean query result

Wherein, Lap(·) represents the probability density function of lapalce distribution, ∈ represents the preset privacy protection degree, ∈＞0.

It can be seen that using the non-sensitive subset D _ns can improve the mean query result. The utility of the proposed method is to minimize data distortion and protect the privacy of the mean of the sensitive subset _Ds by satisfying the Laplace distribution of noise, thus achieving personalized privacy protection and facilitating effective data analysis.

In a simplified application scenario of this implementation, the specific process of mean query is as follows:

Step 101: Input dataset D, the user's secret specification set Privacy budget ∈, mean query function f _mean .

Step 102: For mean query, consider the case where each record is associated with only one attribute, i.e. k = 1. In this case, the sensitivity of the user record is consistent with the sensitivity of the record attribute. The user's secret specification set S divides the data set D = (r ₁ , ..., r _n ) into two subsets, i.e., the sensitive data subset D _s and the non-sensitive data subset D _ns . Based on this, we initialize the sensitive subset of the data set and non-sensitive subsets

Step 103: User-based secret specification set We can get the sensitive subset D _s and the non-sensitive subset D _ns . Without loss of generality, assume that D _s = (r ₁ , r ₂ , … r _m ), D _ns = (r _m+1 , r ₂ , … r _n ), and each record is associated with a numerical attribute. Based on the obtained D _s and D _ns , we can get the mean query result for the data set D as Among them, |·| represents the cardinality of the data set.

Step 104: Assume that the data sets D = D _s ∪ D _ns and D′ = D′ _s ∪ D′ _ns are -adjacent, we can get |D _s |＝|D′ _s |, and D _ns ＝D′ _ns . First, calculate the mean query function -Sensitivity, since non-sensitive records do not exist in dataset D - adjacent records, so It is worth emphasizing that compared with the global sensitivity Δf of the mean query, Then, add the Laplace distribution to the mean query result f(D _s ) calculated based on the sensitive subset D _s The noise, that is

Step 105: Return the noise mean query result

In this embodiment, preferably, in step S105, when the query function is a median query function, obtaining a median query result of the query attribute data set according to a pre-built secret specification-based index mechanism includes:

Step B1, query attribute records in the query attribute data set D (i.e. ) are sorted from small to large, that is, the sorted query attribute data set D satisfies r _i ≤r _i+1 .

Step B2, set the cardinality of the sorted query attribute data set D |D| = 2m + 1, the first intermediate parameter Let O represent the median output space of the query attribute data set D. The median query function returns the record value in the query data set D as the median query result, so _ri∈O , that is, the record value belongs to the median space O.

Constructing a query attribute dataset - Adjacent dataset D′, specifically, constructed according to the above definition 3 - adjacent dataset D′, since the datasets D = D _s ∪ D _ns and D′ = D′ _s ∪ D′ _ns are -adjacent, we can get |D _s |＝|D′ _s |, and D _ns ＝D′ _ns . D′ _s means - The sensitive subset of the adjacent dataset D′, D′ _ns represents A non-sensitive subset of a neighboring dataset D′. It must be emphasized that according to the secret specification S, non-sensitive records in dataset D do not exist. - adjacent records, so changes to non-sensitive records are not considered.

Step B3: For any output median o, o∈O, calculate the score function value of the median o according to the following formula:

Wherein, D* represents a data set satisfying f _med (D ^* ) = o formed by changing the record values of any number of sensitive records in the query attribute data set D, and in this process, the values of insensitive records are not changed; represents the set of different sensitive records in D and D*; r represents the set of sensitive records belonging to sensitive records; Indicated in When the number of sensitive records in is the smallest, that is, when the number of sensitive records changed by D* is the smallest, The product of the number of sensitive records multiplied by -∈ is the score function value of the median o, f _med (·) represents the median query function, ∈ represents the preset privacy protection degree, and ∈＞0.

Further preferably, to quickly obtain the score function value of the median o right The reasoning is carried out and the score function value can be quickly obtained as follows: for any record _ri ∈ D and _ri ∈ O, calculate There are three situations:

(1) If i≤m, it means that mi sensitive records to the right of record _ri are changed.

(2) If i = m, it means no sensitive records have been changed.

(3) If i ≥ m, it means that the im sensitive records to the left of record _ri have been changed.

Step B4, calculate the output probability of all medians in the median output space O, and set the output probability of median o for:

Step B5: The median of all median output probabilities in the median output space O is used as the median query result.

In a simplified application scenario of this implementation, the specific process of median query is as follows:

Step 101: Input dataset D, the user's secret specification set Privacy budget ∈, mean query function f _med .

Step 102: For median query, consider the case where each record is associated with only one attribute, i.e. k = 1. In this case, the sensitivity of the user record is consistent with the sensitivity of the record attribute. The user's secret specification set S divides the data set D = (r ₁ , ..., r _n ) into two subsets, i.e., the sensitive data subset D _s and the non-sensitive data subset D _ns . Based on this, we initialize the sensitive subset of the data set and non-sensitive subsets

Step 103: User-based secret specification set We can get the sensitive subset D _s and the non-sensitive subset D _ns . Without loss of generality, we assume |D| = 2m+1, and _ri ≤ri ₊₁ , where |·| represents the cardinality of the data set. The median function f _med returns the record ranked m in the data set D, so we can get the true median of the data set D as f _med (D) = r _m .

Step 104: Since the assumed data sets D = D _s ∪ D _ns and D′ = D′ _s ∪ D′ _ns are -adjacent, we can get |D _s |=|D′ _s |, and D _ns =D′ _ns . It must be emphasized that according to the secret specification S, non-sensitive records in the dataset D do not exist. - adjacent records, so we do not consider changes to non-sensitive records.

For any record r _i ∈ D, compute There are three situations:

(1) If i≤m, it means that mi sensitive records to the right of record _ri are changed.

(2) If i = m, it means no record has been changed.

(3) If i ≥ m, it means that the im sensitive records to the left of record _ri have been changed.

Step 105: Return the noise median query result

To facilitate the detailed description of the score function value of the median o in the process of obtaining the median query result The calculation process of is shown in Figure 2, and two calculation examples are shown.

Example 1: D = (1, 2, 3, 4, 5, 6, 7), D _s = (1, 3, 5, 6), D _ns = (2, 4, 7), ∈ = 1 D = (1, 2, 3, 4, 5, 6, 7), O = (1, 2, 3, 4, 5, 6, 7), Figure 2 shows the score function value of the median of each possible output, as well as the probability of each median.

Example 2: D = (1, 2, 3, 4, 5, 6, 7), D _s = (1, 3, 5), D _ns = (2, 4, 6, 7), ∈ = 1, O = (1, 2, 3, 4, 5, 6, 7), Figure 3 shows the score function value of the median of each possible output and the probability of each median.

The tables in Figures 2 and 3 are Specific example of the calculation process. The difference between the two tables is that the secret specifications for the query data set D are different, resulting in different proportions of sensitive records (sensitive attribute records) in the query data set D. It can be clearly seen from the results in the tables in Figures 2 and 3 that when the proportion of sensitive records is relatively reduced (or less than 50%), some records in D cannot be regarded as median output. This phenomenon is illustrated in Figure 3, where This will increase the output probability of other recorded values (possibly the median), thereby enhancing the data utility.

The present invention also discloses a method for querying and protecting a population census data set. In a preferred implementation, as shown in FIG4 , the method comprises:

Step S201: The access device sends a query command to a data storage device storing a population census data set. The access device is preferably, but not limited to, a mobile terminal, a PC, or a laptop. The data storage device is preferably, but not limited to, a data server or a cloud server used in government affairs or public security systems. The access device and the data storage device communicate via an Internet connection.

Data storage devices perform:

Step S202, receiving and parsing the query instruction to obtain the query function and query attributes, the query attributes include age and annual income; the query attributes may also include health status, education level, ID number, etc.

Step S203, extracting a query attribute data set from the population census data set, including:

Assume that the data set is represented as D ₀ =(r ₁ ,…, _ri …, _rn ), where n represents the number of users, _ri represents the record of user _ui , and user index i∈[1,n], k represents the attribute dimension, _ri comes from the domain represents the attribute _Aj record of user u _i , and the attribute index j∈[1, k]; let the query attribute be attribute _Aj , then the query attribute dataset

Step S204, obtaining a user secret specification set, and dividing the query attribute data set into a sensitive subset and a non-sensitive subset based on the user secret specification set. The user secret specification set includes the user's binary function of all attributes. After parsing the query attribute, the secret specification set of the query attribute is extracted from the user secret specification set, and the query attribute data set is divided into a sensitive subset and a non-sensitive subset based on the extracted secret specification set. Specifically, step S204 includes:

Step S2041, user secret specification set Including setting the secret specifications of all users corresponding to the data set, the secret specification of user u _i is defined as a binary function: S _i : r _i →{0, 1} ^k . If user u _i defines attribute A _j record as a sensitive record, then the secret specification of user u _i is the value S _i (A _j ) = 1 of attribute A _j . If user u _i defines attribute A _j record as an insensitive record, then the secret specification of user u _i is the value S _i (A _j ) = 0 of attribute A _j .

Step S2042, set attribute A _j as the query attribute, and execute for all users: if the secret specification of user u _i is in the value S _i (A _j ) of attribute A _j = 1, then record attribute A _j of user u _i The recorded value of is classified into the sensitive subset D _s . If the secret specification of user u _i is in the value of attribute A _j S _i (A _j ) = 0, then the attribute A _j of user u _i is recorded The recorded values are classified into the non-sensitive subset D _ns .

Step S204 divides the query attribute data set into sensitive subsets and non-sensitive subsets. In mean query or median query, the sensitive subset is protected, while the non-sensitive subset is not protected. While protecting sensitive data, the distortion of query data can be reduced and the utility of query data can be improved.

Step S205, when the query function is a mean query function, obtaining a mean query result of the query attribute data set according to a pre-built Laplace mechanism based on a secret specification;

When the query function is a median query function, a median query result of the query attribute data set is obtained according to a pre-built secret specification-based exponential mechanism;

Step S206: publishing the mean query result and/or median query result of the query attribute data set to the access device.

In this embodiment, preferably, in step S205, when the query function is a mean query function, obtaining a mean query result of the query attribute data set according to a pre-constructed Laplace mechanism based on a secret specification includes:

Step C1, calculate the mean f _mean (D) of the query attribute data set based on the sensitive subset D _s and the non-sensitive subset D _ns :

In which, |·| represents the cardinality of the data set, f _mean (·) represents the mean query function, f _mean (D _s ) represents the mean of the sensitive subset D _s , and f _mean (D _ns ) represents the mean of the non-sensitive subset D _ns .

Step C2: Construct the query attribute dataset - Adjacent dataset D′, specifically, constructed according to the above definition 3 - Adjacent dataset D′, to obtain the global sensitivity of the mean query function

Where f _mean (D′) represents - the mean of the adjacent dataset D′, || || ₁ represents the _L1 norm.

Step C3: add noise that satisfies the Laplace distribution to the mean f _mean (D) of the query attribute data set. Get the final mean query result

Wherein, Lap(·) represents the probability density function of lapalce distribution, ∈ represents the preset privacy protection degree, and ∈＞0.

It can be seen that using the non-sensitive subset D _ns can improve the mean query result. The utility of the proposed method is to minimize data distortion and protect the privacy of the mean of the sensitive subset _Ds by satisfying the Laplace distribution of noise, thus achieving personalized privacy protection and facilitating effective data analysis.

In this embodiment, preferably, in step S205, when the query function is a median query function, obtaining a median query result of the query attribute data set according to a pre-built secret specification-based index mechanism includes:

Step D1, query attribute records in the query attribute data set D (i.e. ) are sorted from small to large, that is, the sorted query attribute data set D satisfies r _i ≤r _i+1 .

Step D2, set the cardinality of the sorted query attribute data set D |D| = 2m + 1, the first intermediate parameter Let O represent the median output space of the query attribute data set D. The median query function returns the record value in the query data set D as the median query result, so _ri∈O , that is, the record value belongs to the median space O.

Constructing a query attribute dataset - Adjacent dataset D′, specifically, constructed according to the above definition 3 - adjacent dataset D′, since the datasets D = D _s ∪ D _ns and D′ = D′ _s ∪ D′ _ns are -adjacent, we can get |D _s |＝|D′ _s |, and D _ns ＝D′ _ns . D′ _s means - The sensitive subset of the adjacent dataset D′, D′ _ns represents - a non-sensitive subset of the adjacent dataset D′. It must be emphasized that according to the secret specification S, non-sensitive records in dataset D do not exist - adjacent records, so changes to non-sensitive records are not considered.

Step D3, for any output median o, o∈O, calculate the score function value of the median o according to the following formula

Wherein, D* represents a data set satisfying f _med (D ^* ) = o formed by changing the record values of any number of sensitive records in the query attribute data set D, and in this process, the values of insensitive records are not changed; represents the set of different sensitive records in D and D*; r represents the set of sensitive records belonging to sensitive records; Indicated in When the number of sensitive records in is the smallest, that is, when the number of sensitive records changed by D* is the smallest, The product of the number of sensitive records multiplied by -∈ is the score function value of the median o, f _med (·) represents the median query function, ∈ represents the preset privacy protection degree, and ∈＞0.

Further preferably, to quickly obtain the score function value of the median o right The reasoning is carried out and the score function value can be quickly obtained as follows: for any record _ri ∈ D and _ri ∈ O, calculate There are three situations:

(1) If i≤m, it means that mi sensitive records to the right of record _ri are changed.

(2) If i = m, it means no sensitive records have been changed.

(3) If i ≥ m, it means that the im sensitive records to the left of record _ri have been changed.

Step D4, calculate the output probability of all medians in the median output space O, and set the output probability of median o for:

Step D5: The median of all median output probabilities in the median output space O is used as the median query result.

The following is an experimental analysis of the effectiveness of the population census dataset query protection method provided in this application.

Experimental background: The experimental verification was conducted on the 2012 U.S. Census dataset. Specifically, 1000 and 10000 records were randomly selected from the 2012 U.S. Census dataset, and the mean query was evaluated with the record attribute Age. In addition, 1001 and 10001 records were randomly selected from the 2012 U.S. Census dataset, and the median query was evaluated with the record attribute Annual Income. The parameter δ represents the proportion of non-sensitive records in the dataset (the default δ = 0.8), and the parameter ∈ represents the degree of privacy protection.

The root mean square error (RMSE) is used as an evaluation index to evaluate the data utility of SSLM. FIG5 and FIG6 respectively show the corresponding change trend of RMSE of SSLM (mean query scenario) proposed in the present invention on the 2012 US Census data subsets of different scales as the parameters δ and ∈ change, wherein the data size of sub-graph (a) in FIG5 and sub-graph (a) in FIG6 is 1000, and the data size of sub-graph (b) in FIG5 and sub-graph (b) in FIG6 is 10000. FIG7 and FIG8 respectively show the corresponding change trend of RMSE of SSEM (median query scenario) proposed in the present invention on the 2012 US Census data subsets of different scales as the parameters δ and ∈ change, wherein the data size of sub-graph (a) in FIG7 and sub-graph (a) in FIG8 is 1001, and the data size of sub-graph (b) in FIG7 and sub-graph (b) in FIG8 is 10001.

Figure 5 shows how the proportion of insensitive attribute values δ affects the data utility of our proposed SSLM. As can be seen from Figures 5(a) and 5(b), as the parameter δ increases from 0 to 0.9, the RMSE of SSLM on datasets of different scales shows a consistent downward trend. In other words, the RMSE of SSLM gradually decreases and increasingly outperforms the baseline method (classical LaplaceMechanism, LM). Specifically, when δ = 0, that is, all attribute values in the dataset are sensitive, SSLM is equivalent to LM and exhibits the same RMSE as LM. On the contrary, when δ = 1, indicating that all attribute values are insensitive, the RMSE of SSLM is reduced to 0. In addition, as shown in Figures 5(a) and 5(b), when δ = 0.8, the utility of SSLM on the 2012 US Census dataset subsets with data volumes of 1000 and 10000 is improved by about 6 times and 5 times, respectively, compared with LM. When δ = 0.9, SSLM performs about 14 times and 10 times better than LM on the 2012 US Census dataset subsets with 1,000 and 10,000 data points, respectively. The significant improvement in utility is due to the fact that in SSLM, non-sensitive attribute values remain unchanged when responding to mean queries, which improves the accuracy of the mean across the board.

The parameter ∈ represents the user's privacy budget associated with sensitive record attributes. A higher value of ∈ means a lower level of privacy protection, thereby improving the utility. As shown in Figures 6(a) and 6(b), as ∈ increases from 0.01 to 0.5, the RMSE of LM and SSLM (default δ = 0.8) on datasets of different scales decreases. The main point conveyed by Figure 6 is that SSLM significantly outperforms the baseline mechanism LM under any ∈ condition. In addition, compared with LM, when ∈＞0.2, the utility of SSLM on the 2012 US Census data subset with a data size of 1000 is improved by about 2 times, and by 3 times when the data size is 10000.

Similar to the effect of parameter δ on the average query volume, as shown in Figure 7, when δ increases from 0 to 0.9, the data utility of SSEM significantly exceeds the baseline method EM. Considering the boundary case, we can see that when δ = 0, SSEM is equivalent to EM. In addition, as shown in Figures 7(a) and 7(b), for median queries, when the parameter δ∈(0, 0.5], the RMSE of SSEM is comparable to that of EM. However, when the parameter δ∈(0.5, 0.9], SSEM shows a significant improvement in data utility compared to EM. This improvement is due to the fact that the proportion of non-sensitive record attribute values affects the output space of SSEM. Consistent with the conclusions in Figures 2 and 3, when δ∈(0, 0.5], the output space of SSEM is the entire space (equivalent to the output space of EM), resulting in comparable data utility between SSEM and EM. On the contrary, when δ∈(0.5, 0.9], the larger the proportion of non-sensitive record attributes, the smaller the output space of SSEM, thereby improving data utility. In addition, as shown in Figure 7(b), when δ is 0.8 and 0.9, the utility of SSEM is improved by about 3 times and 6 times, respectively, compared to EM.

In Figure 8, the effect of parameter ∈ on median query is similar to that on mean query shown in Figure 5. As expected, as ∈ increases, the RMSE of SSEM and EM decreases on datasets of different sizes. It is worth noting that SSEM shows significant utility improvement compared to EM in Figure 8(a) and Figure 8(b). Specifically, when ∈＞0.2, as shown in Figure 8(a), SSEM achieves about 2 times utility improvement compared to EM on the 2012 US Census data subset with a data size of 1001.

It can be seen that the data query protection method provided by this application has the following technical effects:

1. We introduced a new privacy definition, SSDP, which gives individuals more control over their private information, ensuring that only data that users mark as sensitive is protected.

2. By allowing individuals to independently define secret specifications about their own data, SSDP achieves personalized privacy protection and facilitates effective data analysis.

3. We provide a specific SSDP mechanism for mean queries, which improves the accuracy of data analysis while minimizing data distortion, especially when a large portion of the data is non-sensitive and better explores the privacy and utility trade-offs.

4. We evaluate the performance of SSLM and SSEM through comparative experiments on real datasets. Experimental results show that compared with the most advanced DP mechanism, SSLM improves the utility by about 14 times for mean query by utilizing non-sensitive data. SSEM improves the utility by about 6 times for median query by utilizing non-sensitive data.

Although the embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the claims and their equivalents.

Claims (10)

1. A data query protection method based on a personalized privacy protection mechanism of secret specifications, characterized by comprising: The access device sends a query instruction to the data storage device; Data storage devices perform: Receive and parse the query instruction to obtain the query function and query attributes; Extracting a query attribute dataset from a set dataset; Obtain a user secret specification set, and divide the query attribute data set into a sensitive subset and a non-sensitive subset based on the user secret specification set; When the query function is a mean query function, the mean query result of the query attribute data set is obtained according to the pre-built Laplace mechanism based on the secret specification; When the query function is a median query function, a median query result of the query attribute data set is obtained according to a pre-built secret specification-based exponential mechanism; The mean query result and/or the median query result of the query attribute data set are published to the access device. 2. The data query protection method based on the personalized privacy protection mechanism of secret specification according to claim 1, characterized in that the step of extracting the query attribute data set from the set data set comprises: Assume that the data set is represented as D ₀ =(r ₁ ,…, _ri …, _rn ), where n represents the number of users, _ri represents the record of user _ui , and user index i∈[1,n], k represents the attribute dimension, _ri comes from the domain Represents the attribute _Aj record of user u _i , with attribute index j∈[1,k]; Assume the query attribute is attribute A _j , then query the attribute data set 3. The data query protection method of the personalized privacy protection mechanism based on secret specification as claimed in claim 2, characterized in that the query attribute data set is divided into a sensitive subset and a non-sensitive subset based on the user secret specification set, comprising: User Secret Specification Set Including setting the secret specifications of all users corresponding to the data set. The secret specification of user u _i is defined as a binary function: S _i : r _i →{0, 1} ^k . If user u _i defines attribute A _j as a sensitive record, the secret specification of user u _i is at the value of attribute A _j S _i (A _j )＝1. If user u _i defines attribute A _j as a non-sensitive record, the secret specification of user u _i is at the value of attribute A _j S _i (A _j )＝0. Let attribute A _j be the query attribute, and execute for all users: if the secret specification of user u _i is in the value of attribute A _j S _i (A _j ) = 1, then record attribute A _j of user u _i The recorded value of is classified into the sensitive subset D _s . If the secret specification of user u _i is in the value of attribute A _j S _i (A _j ) = 0, then the attribute A _j of user u _i is recorded The recorded values are classified into the non-sensitive subset D _ns . 4. The data query protection method based on the personalized privacy protection mechanism of secret specification according to claim 3, characterized in that the method of obtaining the mean query result of the query attribute data set according to the pre-constructed Laplace mechanism based on secret specification comprises: Step A1, calculate the mean f _mean (D) of the query attribute data set based on the sensitive subset D _s and the non-sensitive subset D _ns : Wherein, |·| represents the cardinality of the data set, f _mean (·) represents the mean query function, f _mean (D _s ) represents the mean of the sensitive subset D _s , and f _mean (D _ns ) represents the mean of the non-sensitive subset D _ns ; Step A2: Construct the query attribute dataset - Adjacent dataset D′, to obtain the global sensitivity of the mean query function Where f _mean (D′) represents the mean of the S-neighboring data set D′, and || || ₁ represents the L ₁ norm; Step A3: add noise that satisfies the Laplace distribution to the mean f _mean (D) of the query attribute data set. Get the mean query result Wherein, Lap(·) represents the probability density function of lapalce distribution, ∈ represents the preset privacy protection degree, ∈＞0. 5. The data query protection method of the personalized privacy protection mechanism based on secret specification according to claim 3 or 4, characterized in that the median query result of the query attribute data set is obtained according to the pre-constructed secret specification-based index mechanism, comprising: Step B1, sorting the record values of the query attribute records in the query attribute data set D from small to large; Step B2, set the cardinality of the sorted query attribute data set D |D| = 2m + 1, the first intermediate parameter Let O represent the median output space of the query attribute dataset D; Step B3: For any output median o∈O, calculate the score function value of the median o according to the following formula: Wherein, D* represents a data set that satisfies f _med (D ^* ) = o and is formed by changing the record values of any number of sensitive records in the query attribute data set D; represents the set of different sensitive records in D and D*; r represents the set of sensitive records belonging to sensitive records; Indicated in When the number of sensitive records is the smallest, The product of the number of sensitive records multiplied by -∈ is the score function value of the median o, f _med (·) represents the median query function, ∈ represents the preset privacy protection level, ∈＞0; Step B4, calculate the output probability of all medians in the median output space O, and set the output probability of median o for: Step B5: The median of all median output probabilities in the median output space O is used as the median query result. 6. A method for querying and protecting a population census data set, comprising: The access device sends a query command to a data storage device storing a census data set; Data storage devices perform: Receiving and parsing a query instruction to obtain a query function and a query attribute, wherein the query attribute includes age and annual income; Extract query attribute dataset from census dataset; Obtain a user secret specification set, and divide the query attribute data set into a sensitive subset and a non-sensitive subset based on the user secret specification set; When the query function is a mean query function, the mean query result of the query attribute data set is obtained according to the pre-built Laplace mechanism based on the secret specification; When the query function is a median query function, a median query result of the query attribute data set is obtained according to a pre-built secret specification-based exponential mechanism; The mean query result and/or the median query result of the query attribute data set are published to the access device. 7. The method for querying and protecting a population census dataset according to claim 1, wherein extracting a query attribute dataset from the population census dataset comprises: The population census data set is recorded as the set data set, and the set data set is expressed as D ₀ = (r ₁ , ..., _ri ..., r _n ), where n represents the number of users, _ri represents the record of user _ui , and user index i∈[1, n], k represents the attribute dimension, _ri comes from the domain Represents the attribute _Aj record of user u _i , with attribute index j∈[1,k]; Assume the query attribute is attribute A _j , then query the attribute data set 8. The method for protecting the query of a population census dataset according to claim 7, wherein the step of dividing the query attribute dataset into a sensitive subset and a non-sensitive subset based on the user secret specification set comprises: The user secret specification set S includes the secret specifications of all users corresponding to the census data set. The secret specification of user u _i is defined as a binary function: S _i : r _i →{0, 1} ^k . If user u _i defines attribute A _j as a sensitive record, then the secret specification of user u _i is the value of attribute A _j S _i (A _j ) = 1. If user u _i defines attribute A _j as an insensitive record, then the secret specification of user u _i is the value of attribute A _j S _i (A _j ) = 0. Let attribute A _j be the query attribute, and execute for all users: if the secret specification of user u _i is in the value of attribute A _j S _i (A _j ) = 1, then record attribute A _j of user u _i The recorded value of is classified into the sensitive subset D _s . If the secret specification of user u _i is in the value of attribute A _j S _i (A _j ) = 0, then the attribute A _j of user u _i is recorded The average recorded value is classified into the non-sensitive subset D _ns . 9. The method for protecting the query of a population census dataset according to claim 8, wherein the step of obtaining the mean query result of the query attribute dataset according to the pre-constructed Laplace mechanism based on the secret specification comprises: Step C1, calculate the mean f _mean (D) of the query attribute data set based on the sensitive subset D _s and the non-sensitive subset D _ns : Wherein, |·| represents the cardinality of the data set, f _mean (·) represents the mean query function, f _mean (D _s ) represents the mean of the sensitive subset D _s , and f _mean (D _ns ) represents the mean of the non-sensitive subset D _ns ; Step C2: Construct the query attribute dataset - Adjacent dataset D′, to obtain the global sensitivity of the mean query function Where f _mean (D′) represents - the mean of the adjacent data set D′, || || ₁ represents the _L1 norm; Step C3: add noise that satisfies the Laplace distribution to the mean f _mean (D) of the query attribute data set. Get the final mean query result Wherein, Lap(·) represents the probability density function of lapalce distribution, ∈ represents the preset privacy protection degree, ∈＞0. 10. The method for protecting the query of a population census dataset according to claim 8 or 9, wherein obtaining the median query result of the query attribute dataset according to the pre-constructed secret specification-based index mechanism comprises: Step D1, sorting the record values of the query attribute records in the query attribute data set D from small to large; Step D2, set the cardinality of the sorted query attribute data set D |D| = 2m + 1, the first intermediate parameter Let O represent the median output space of the query attribute dataset D; Step D3, for any output median o∈O, calculate the score function value of the median o according to the following formula Wherein, D* represents a data set that satisfies f _med (D ^* ) = o and is formed by changing the record values of any number of sensitive records in the query attribute data set D; represents the set of different sensitive records in D and D*; r represents the set of sensitive records belonging to sensitive records; Indicated in When the number of sensitive records is the smallest, The product of the number of sensitive records multiplied by -∈ is the score function value of the median o, f _med (·) represents the median query function, ∈ represents the preset privacy protection level, ∈＞0; Step D4, calculate the output probability of all medians in the median output space O, and set the output probability of median o for: Step D5: The median of all median output probabilities in the median output space O is used as the median query result.