WO2023045504A1 - 查询处理方法及装置 - Google Patents

查询处理方法及装置 Download PDF

Info

Publication number
WO2023045504A1
WO2023045504A1 PCT/CN2022/105053 CN2022105053W WO2023045504A1 WO 2023045504 A1 WO2023045504 A1 WO 2023045504A1 CN 2022105053 W CN2022105053 W CN 2022105053W WO 2023045504 A1 WO2023045504 A1 WO 2023045504A1
Authority
WO
WIPO (PCT)
Prior art keywords
query
data set
target
sensitivity
target data
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2022/105053
Other languages
English (en)
French (fr)
Inventor
杜健
张本宇
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Alipay Hangzhou Information Technology Co Ltd
Original Assignee
Alipay Hangzhou Information Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Alipay Hangzhou Information Technology Co Ltd filed Critical Alipay Hangzhou Information Technology Co Ltd
Publication of WO2023045504A1 publication Critical patent/WO2023045504A1/zh
Priority to US18/395,080 priority Critical patent/US20240135025A1/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6227—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database where protection concerns the structure of data, e.g. records, types, queries
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
    • G06F16/2462—Approximate or statistical queries
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
    • G06F16/24—Querying
    • G06F16/245—Query processing
    • G06F16/2458—Special types of queries, e.g. statistical queries, fuzzy queries or distributed queries
    • G06F16/2465—Query processing support for facilitating data mining operations in structured databases
    • G—PHYSICS
    • G06—COMPUTING OR CALCULATING; COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60—Protecting data
    • G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
    • G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
    • G06F21/6245—Protecting personal data, e.g. for financial or medical purposes

Definitions

  • One or more embodiments of this specification relate to the technical field of data processing, and in particular, to a query processing method and device.
  • Differential Privacy (DP) technology is used in statistical query scenarios to deal with privacy leakage.
  • the difficulty of this technology lies in how to balance the privacy security of data and the accuracy of query results, because the improvement of the former often leads to the decrease of the latter. Therefore, there is an urgent need for an improved differential privacy scheme that can minimize the privacy leakage risk of sensitive data while maximizing the accuracy of query results.
  • One or more embodiments of this specification describe a query processing method and device. For each query in a batch of queries, it is allocated the lowest noise power that ensures data privacy will not be leaked, thereby maximizing the accuracy of query results. sex.
  • a query processing method for protecting data privacy including: determining the respective query types of the L queries to be queried against the target data set, the target data set recording the data of the business object; determining each query type For the query sensitivity of the target data set; based on the query sensitivity corresponding to each query and the preset privacy budget parameters for the total set of L queries, determine the noise power allocated to each query.
  • determining the respective query types of the L queries to be queried on the target data set includes: receiving L query requests for the target data set, wherein each query request indicates its respective query type.
  • determining the respective query types of the L queries to be queried on the target data set includes: obtaining the pre-configured number of queries L and the query types of each query for the target data set.
  • the query type is any of the following: count, maximum, minimum, mean and variance.
  • the business object is any one of the following: user, commodity, business event.
  • the business event is any one of the following: registration, access, login, payment.
  • the business object is a user
  • the private data is any of the following: age, gender, income, hobbies, physiological indicators, and operational indicators.
  • determining the query sensitivity of each query type with respect to the target data set includes: for each query type, obtaining the query type according to the maximum absolute difference between the first result and the second result Corresponding query sensitivity; wherein, the first result is the result obtained by performing this type of query on the target data set, and the second result is obtained by performing this type of query on the adjacent data sets of the target data set result.
  • the query type includes a count query; wherein, determining the query sensitivity of each query type with respect to the target data set includes: determining the query sensitivity of the count query as a value 1.
  • the query type includes maximum value query/minimum value query; wherein, determining the query sensitivity of each query type for the target data set includes: determining the maximum value and the minimum value in the target data set ; Determining the result of subtracting the minimum value from the maximum value as the query sensitivity of the maximum value query/minimum value query.
  • the query type includes mean value query; wherein, determining the query sensitivity of each query type with respect to the target data set includes: determining the maximum value in the target data set; calculating the absolute value of the maximum value The ratio between the value and the number of data in the target data set plus 1 is determined as the query sensitivity of the mean query.
  • the query type includes a variance query; wherein, determining the query sensitivity of each query type with respect to the target data set includes: determining the maximum and minimum values in the target data set; The query sensitivity of a query is determined as the product of the square of the difference between the maximum and minimum values, the number of data in the target dataset, and the reciprocal of the square of the number of data plus 1 .
  • determining the noise power allocated to each query includes: based on each query The query sensitivity of the query determines the query sensitivity and value of the L queries; for any query, according to the query sensitivity of the query, the query sensitivity and value, and the privacy budget parameter, determine the The noise power obtained by query allocation.
  • determining the noise power allocated to the query includes: obtaining the variable value of the mean variable , the variable value is determined based on the parameter value of the privacy budget parameter and the constraint relationship between the privacy budget parameter and the mean variable under the Gaussian mechanism of differential privacy; the noise power of the query is determined as the product of the following factors: the The query sensitivity of the query, the sum of the query sensitivity, and the reciprocal of the squared value of the variable value.
  • the privacy budget parameters include budget item parameters and slack item parameters.
  • the method further includes: for any target query in the L queries, determining its actual return result as its original query result superimposed from the difference
  • the target noise is sampled by the private target noise distribution, wherein the target noise distribution is determined based on the noise power assigned by the target query.
  • the target noise distribution is a Gaussian noise distribution
  • the Gaussian noise distribution takes the noise power of the target query as a variance and 0 as a mean.
  • the method further includes: receiving a current query request for the target data set, which corresponds to the current query type; judging whether the number of processed requests corresponding to the current query type is less than a predetermined threshold , the query request corresponding to the number of processed requests is for the target data set; if it is determined that the number is less than, the current query request is used as the target query.
  • a query processing device for protecting data privacy, comprising: a query type determination unit configured to determine the respective query types of L queries to be queried against a target data set, the target data set recording business objects The data of the sensitivity determination unit, configured to determine the query sensitivity of each query type for the target data set; the noise power determination unit, configured to be based on the query sensitivity corresponding to each query, and for the L queries The total set of preset privacy budget parameters determines the noise power allocated to each query.
  • the query type determination unit is specifically configured to: receive L query requests for the target data set, where each query request indicates a respective query type.
  • the query type determination unit is specifically configured to: obtain the pre-configured query times L for the target data set and the query types of each query therein.
  • the business object is any one of the following: user, commodity, business event.
  • the sensitivity determination unit is specifically configured to: for each query type, obtain the query sensitivity corresponding to the query type according to the maximum absolute difference between the first result and the second result; wherein , the first result is a result obtained by performing this type of query on the target data set, and the second result is a result obtained by performing this type of query on adjacent data sets of the target data set.
  • it also includes an actual result determination unit, configured to determine the actual returned result of any target query in the L queries as its original query result superimposed with the target noise sampled from the target noise distribution of differential privacy , wherein the target noise distribution is determined based on the noise power assigned by the target query.
  • it also includes a target query determination unit configured to: receive a current query request for the target data set, which corresponds to the current query type; determine whether the number of processed requests corresponding to the current query type is less than A predetermined threshold, the query request corresponding to the number of processed requests is for the target data set; if it is judged to be less than the threshold, the current query request is used as the target query.
  • a target query determination unit configured to: receive a current query request for the target data set, which corresponds to the current query type; determine whether the number of processed requests corresponding to the current query type is less than A predetermined threshold, the query request corresponding to the number of processed requests is for the target data set; if it is judged to be less than the threshold, the current query request is used as the target query.
  • a computer-readable storage medium on which a computer program is stored, and when the computer program is executed in a computer, the computer is caused to execute the method provided in the above-mentioned first aspect.
  • a computing device including a memory and a processor, where executable codes are stored in the memory, and when the processor executes the executable codes, the method provided by the above-mentioned first aspect is implemented.
  • FIG. 1 shows a schematic diagram of an implementation architecture of a query processing solution according to an embodiment
  • Fig. 2 shows a schematic flowchart of a query processing method according to an embodiment
  • FIG. 3 shows a schematic diagram of an implementation architecture of a query processing solution according to another embodiment
  • FIG. 4 shows a schematic diagram of an implementation architecture of a query processing solution according to yet another embodiment
  • FIG. 5 shows a schematic diagram of an implementation architecture of a query processing solution according to yet another embodiment
  • Fig. 6 shows a schematic structural diagram of a query processing device according to an embodiment.
  • differential privacy DP technology is used in statistical query scenarios to deal with privacy leakage.
  • random noise is added to the original query results to prevent the actual returned query results from leaking the original data privacy.
  • the existing solutions are difficult to achieve a balance between data security and the accuracy of returned results.
  • the embodiment of this specification discloses a query processing scheme based on differential privacy. For a batch of queries, the optimal noise power can be allocated to each query (or each query), so that even if the attacker Even if the returned results of this batch of queries are obtained, the original data being queried cannot be deciphered. At the same time, the accuracy and usability of the returned results of each query can be maximized.
  • Fig. 1 shows a schematic diagram of an implementation architecture of a query processing solution according to an embodiment.
  • the service platform provides query services.
  • the service platform receives L query requests from the terminal, the first query Q1 and the L query Q L are shown in Figure 1; then, the service platform according to the query type of each request in the L query requests, Determine the query sensitivity of each query request for the target data set; then, based on the query sensitivity corresponding to each query request and the total privacy budget parameters preset for L queries, determine the allocation of each query request to get noise power, the noise power P Q1 and noise power P QL obtained by query request Q 1 and query request Q L are shown in Fig.
  • any target query request (such as query request Q 1 ) Determine the target noise distribution (such as noise distribution D Q1 ) of differential privacy based on the noise power (such as noise power P Q1 ) allocated by the target query request, and sample the target noise (such as noise N Q1 ) from it, and in the target
  • the target noise is added to the original query result of the query (eg, the original query result R 1 ), as the actual returned result of the target query (eg, the actual returned result R 1 ′).
  • Fig. 2 shows a schematic flow diagram of a query processing method according to an embodiment, and the subject of execution of the method may be any server, device, platform or device cluster with computing and processing capabilities, for example, the query processing method shown in Fig. 1 may be A service platform, or a user terminal, etc.
  • the method includes the following steps:
  • Step S210 determine the respective query types of the L queries to be queried against the target data set, and the target data set records the data of the business object;
  • Step S220 determine the query sensitivity of each query type for the target data set;
  • step S230 Based on the query sensitivities corresponding to the respective queries and the preset privacy budget parameters for the total set of the L queries, determine the noise power allocated to each query.
  • the respective query types of the L queries to be queried on the target data set are determined.
  • the target data set includes multiple data records (or called multiple data samples), corresponding to the data of the business object (or called private data).
  • the business objects corresponding to any two data records may be the same (for example, corresponding to the same user) or different (for example, corresponding to different commodities), and multiple data records correspond to the same feature item for the business object (for example, , user age).
  • the storage environment of the above-mentioned multiple data records is not limited. In a possible storage situation, the above-mentioned multiple data records are stored in the database.
  • the service platform collects the personal information authorized by the user in advance and stores it in the In the database; in another possible storage situation, the above-mentioned multiple data records are stored in the user terminal, for example, the user terminal (such as a smart phone, etc.) collects the user's terminal operation data (behavior data for inputting emoticons), and Store this.
  • the user terminal such as a smart phone, etc.
  • the user's terminal operation data behavior data for inputting emoticons
  • the above business object may be a user. In a specific embodiment, it may be an individual user.
  • the above-mentioned multiple data samples correspond to individual user feature items, such as the individual user's name, age, gender, income, ID number, mobile phone number, mailbox, hobbies, Physiological indicators, or operational indicators, etc.
  • the physiological index is used to measure the health status of the human body, and may specifically be blood pressure, blood lipid, cholesterol, or blood oxygen concentration.
  • the operation index corresponds to a specific operation behavior, such as payment, click, or browsing, and is used to measure the duration or frequency of the user's specific operation behavior.
  • the business object can also be an enterprise user.
  • the above-mentioned multiple data samples correspond to the characteristic items of the enterprise user, such as tax data, suppliers, book liquidity, or annual revenue of the enterprise user.
  • the above business object may be a commodity.
  • the commodity can be a physical commodity, such as a figure, or a paper book, etc.; or, it can be an experiential service, such as travel products, massage services, video membership services, online courses or payment membership services, etc.; or , and can also be virtual products, such as game skins, e-books, content information, video resources, cloud disk space, or traffic.
  • the above-mentioned multiple data samples correspond to commodity feature items, such as commodity cost, inventory, sales volume, or gross profit.
  • the above-mentioned business object may be a business event, such as a registration event, an access event, a login event, or a payment event; Network environment, geographic location or duration, etc.
  • the network environment may be an IP address, or a network type, and the like. It should be understood that the network type may include Wifi, 4G network, 5G network, etc.
  • the target data set is introduced by taking the business objects as users, commodities, and business events as examples. It should be understood that the business objects are not limited to these types.
  • the above query for the target data set usually refers to a statistical query, querying the statistical information of the target data set, or aggregated information, for example, if the target data set records multiple user names, you can query the number of users whose surname is Huang.
  • L is a positive integer, and its value can be 1, but usually greater than 1; when L>1, any two of the queries correspond to the same or different query types .
  • several (that is, one or more) query types involved in the L queries may include: count, maximum value, minimum value, mean value, and variance.
  • the above L queries correspond to pre-configured query information for future query requests, including the query times L and the query types of each query; in another implementation scenario, the above L queries Depending on the received L query requests, where each query request indicates its respective query type.
  • step S220 among the several query types involved in the L queries, the query sensitivity of each query type to the above-mentioned target data set is determined.
  • a certain type of query sensitivity is intended to reflect the first result of this type of query based on the target dataset, and the second result of this type of query based on the adjacent datasets of the target dataset. the largest difference between.
  • the adjacent data set refers to the data set that can be obtained after adding or deleting any piece of data on the basis of the target data set.
  • the measurement standard can be set according to actual needs, for example, quantified as the maximum value of the absolute value of the difference between the above-mentioned first query result and the second query result (in the text or referred to as the maximum absolute difference) ; But in fact, not all the maximum differences corresponding to all query types, such as the maximum absolute difference, etc., can be solved accurately. At this time, the approximate value or estimated value of the maximum difference can be calculated as the query sensitivity.
  • the aforementioned several query types include counting queries.
  • the count query it needs to be explained that multiple data samples in the target data set correspond to the feature items of the business object, and the value space of the feature item contains multiple possible values.
  • the possible values of user gender include male and female , correspondingly, the multiple values can be used as multiple data categories, so that a count query can be performed for a certain data category, that is, to query the number of data samples corresponding to the certain data category, for example, to query female users in the user data set the number of .
  • the query sensitivity sens c corresponding to the counting query can be determined.
  • the aforementioned several query types include a maximum value query.
  • the results of ordering the samples from small to large are recorded as x (1) ⁇ x (2) ⁇ ... ⁇ x (N) , it can be understood that x (1) and x (N) respectively represent the smallest of the N data samples value and maximum.
  • the staff can set the upper bounds and lower bounds for the feature items, as well
  • the upper bound and the lower bound of the value are denoted as l and u respectively, thus it can be obtained that l ⁇ x (1) ⁇ x (2) ⁇ ... ⁇ x (N) ⁇ u.
  • the query sensitivity corresponding to the maximum value query can be determined as:
  • the query sensitivity corresponding to the maximum query can be determined as:
  • the query sensitivity sens max corresponding to the maximum value query can be determined.
  • the above-mentioned several query types include a minimum value query value, similar to the above-mentioned determination of the query sensitivity sens max corresponding to the maximum value query, in an example, the query sensitivity corresponding to the minimum value query can be determined as :
  • the query sensitivity corresponding to the minimum query can be determined as:
  • the query sensitivity sens min corresponding to the minimum value query can be determined.
  • the above-mentioned several query types include mean value query.
  • the calculation of the mean over the target dataset can be written as:
  • the query sensitivity corresponding to the mean query can be calculated by the following formula:
  • the query sensitivity corresponding to the mean query can be written as:
  • the query sensitivity sens mean corresponding to the mean query can be determined.
  • the aforementioned several query types include variance queries.
  • the query sensitivity corresponding to the variance query can be calculated by the following formula:
  • the query sensitivity corresponding to the variance query can be written as:
  • the query sensitivity sens var corresponding to the variance query can be determined.
  • the calculation of the query sensitivity is introduced by taking the query types as count, maximum value, minimum value, mean value and variance as examples.
  • the query types involved in the above L queries are not limited to these types, and may also include other types, such as quantile query and weight of evidence query.
  • the calculation may be performed in combination with the definitions of the two, and it is not exhaustive here.
  • the query sensitivity corresponding to each query type involved in the above L queries can be determined. It should be understood that each query has a corresponding query type, and each query type has a corresponding query sensitivity, thus, the query sensitivity corresponding to each query can be obtained.
  • step S230 based on the query sensitivities corresponding to each query and the preset privacy budget parameters for the total set of L queries, the noise power allocated to each query is determined.
  • this step may include: for any of the L queries query, according to the query sensitivity of the query.
  • the variable value of the mean variable among them is determined.
  • the constraint relationship is existing in the Gaussian mechanism of differential privacy, which can be expressed as the following formula:
  • ⁇ and ⁇ represent the budget item parameter and the slack item parameter in the above-mentioned privacy budget parameters respectively, and the parameter values of the two can be artificially set by the staff according to actual needs;
  • ⁇ represents the above-mentioned mean value variable;
  • ⁇ ( t) represents the probability distribution function of the standard Gaussian distribution,
  • noise power is determined as the product of the following factors: Query Sensitivity The above query sensitivity sum value, and the reciprocal of the squared variable value of the above mean variable. Accordingly, the calculation formula of noise power can be expressed as:
  • S k represents the query sensitivity of the kth query
  • ⁇ represents the above mean variable
  • the Lagrangian multiplier ⁇ is introduced to construct the following Lagrangian Associate the constraint function with the original function:
  • the noise power allocated to each query under the Gaussian noise mechanism of differential privacy can be determined. It should be noted that in practice, the noise power of each query under other noise mechanisms, such as Laplace mechanism and exponential mechanism, can also be determined.
  • the above method may further include: in step S240, for any target query in the above L queries, determine its actual returned result as its original query result superimposed from differential privacy Target Noise The target noise sampled by the target noise distribution.
  • the target noise distribution is determined based on the noise power assigned by the target query.
  • the above-mentioned target noise distribution may be a Gaussian noise distribution, correspondingly, the noise power of the target query is used as the variance of the Gaussian distribution, and the corresponding Gaussian noise distribution is generated with 0 as the mean.
  • the target query is denoted as No. query, and record its noise power as Therefore, the Gaussian noise distribution corresponding to the target query can be written as
  • the target noise z can be sampled from it, superimposed on the original query result of the target query , so as to obtain the corresponding actual return result, the calculation formula is as follows:
  • the actual returned count query result can be calculated based on the following formula:
  • the actual returned result corresponding to the counting query type can be determined.
  • noise sampling will be performed based on the corresponding Gaussian noise distribution. For example, for two queries of the same type, random sampling will be performed twice based on the same Gaussian noise distribution corresponding to the two, and then superimposed on the original query results corresponding to the query types, so as to obtain two actual returned results.
  • the actual returned maximum value query result can be calculated based on the following formula:
  • z represents the noise randomly sampled from the Gaussian noise distribution corresponding to the maximum value query
  • x (N) represents the original query result of the maximum value query, that is, the maximum value in the target data set; Indicates the actual returned result corresponding to the maximum value query.
  • the actual returned minimum value query result can be calculated based on the following formula:
  • z represents the noise randomly sampled from the Gaussian noise distribution corresponding to the minimum value query
  • x (1) represents the original query result of the minimum value query, that is, the minimum value in the target data set
  • the actual returned average value query result can be calculated based on the following formula:
  • z represents the noise randomly sampled from the Gaussian noise distribution corresponding to the mean query, represents the mean of the target dataset, Indicates the actual returned result corresponding to the mean query.
  • the actual returned variance query result can be calculated based on the following formula:
  • z represents the noise sampled from the Gaussian noise distribution corresponding to the variance query, represents the variance of the target dataset, Indicates the actual returned result corresponding to the variance query.
  • the Gaussian mechanism of differential privacy is taken as an example to introduce the sampling and addition of target noise.
  • the determination of the target noise power is based on the Laplacian mechanism of differential privacy.
  • the noise power of the target query can be used as the scale parameter of the Laplacian distribution, and 0 is used as the position parameter to generate The corresponding Laplacian noise distribution, so as to realize the sampling and addition of the target noise, and obtain the actual return result.
  • the target noise can be sampled and added based on the exponential mechanism of differential privacy, and then the actual return result can be obtained.
  • the actual returned result corresponding to any target query in the L queries can be determined.
  • a batch of query requests to be processed is first received, then, in step S210, the number L of queries to be processed and the query type of each query are based on the batch
  • multiple query requests received within a preset period of time can be obtained, the number of which is recorded as L, and each query request is determined Indicates the query type.
  • the L query requests are respectively used as target queries, so that noise sampling and noise superposition based on the original query results are performed correspondingly, and then the actual returned results of each query request are obtained. In this way, differential privacy processing for a batch of query requests can be completed.
  • the query times L and the query types of each query may be pre-configured for query requests that may be received in the future, so that the pre-configured information may be directly obtained in step S210.
  • the configuration of the number of queries and query types can be determined by staff based on the analysis of historical query data corresponding to the target data set.
  • the noise power allocated to each query is determined by performing the above steps S210 , S220 and S230 in the preparatory stage. Then, in the online processing stage, step S240 is performed based on the current query request Q j received, specifically, the current query request Q j is used as the target query, which corresponds to the current query type C i ;
  • the current query request Q j is taken as the target query, so as to determine the original query result F Ci corresponding to the query type C i based on the target data set, and Obtain the noise power P Ci corresponding to the current query type C i determined in the preparatory stage, and then superimpose the noise N j sampled from the noise distribution determined based on the noise power P Ci on the original query result F Ci to obtain the actual returned result F j ; otherwise, if it is judged that the number of processed requests is equal to the queryable
  • the noise power allocated to each query is determined by performing the above steps S210, S220, and S230 in the preparatory stage, and each query type is also determined based on the target data set Corresponding original query results; then in the online processing stage, execute step S240 based on the current query request Q j received, specifically, take the current query request Q j as the target query, which corresponds to the current query type C i ; after judging that this type corresponds to When the number of processed requests for the target data set is less than the preset number of queries L Ci , take the current query request Q j as the target query, so as to obtain the original query result F corresponding to the current query type C i determined in the preparatory stage Ci and noise power P Ci , and then superimpose the noise N j sampled from the noise distribution determined based on the noise power P Ci on the original query result F Ci to obtain the actual returned result F j ; otherwise, discard the current query request Q j .
  • the actual returned results corresponding to each of the L queries are determined by performing the above steps S210 to S240 in the preparatory stage.
  • the current query request Q i is received, which corresponds to the current query type C i ; when it is judged that the number of processed requests for the target data set corresponding to this type is less than the preset number of queryable times, from Among the L actual return results determined in the preparatory stage, obtain an actual return result that corresponds to the current query type C i and has not been used as the actual return result R i ′ of the current query request Q i ; otherwise, discard the current query request Q i .
  • Fig. 6 shows a schematic structural diagram of a query processing device according to an embodiment.
  • the device can be implemented as any computing unit, platform, server, device cluster, etc. with computing and processing capabilities, for example, a user terminal or the query shown in Fig. 1 service platform.
  • the device 600 includes the following units:
  • the query type determination unit 610 is configured to determine the respective query types of the L queries to be queried against the target data set, and the target data set records the data of the business object; the sensitivity determination unit 620 is configured to determine that each query type is applicable to the The query sensitivity of the target data set; the noise power determination unit 630 is configured to determine each query based on the query sensitivity corresponding to each query and the privacy budget parameter preset for the total set of L queries Assign the resulting noise power.
  • the query type determining unit 610 is specifically configured to: receive L query requests for the target data set, where each query request indicates a respective query type.
  • the query type determination unit 610 is specifically configured to: acquire the preconfigured query times L and the query types of each query in the target data set.
  • the query type is any of the following: count, maximum, minimum, mean and variance.
  • the business object is any one of the following: user, commodity, business event.
  • the business event is any one of the following: registration, access, login, payment.
  • the business object is a user
  • the private data is any of the following: age, gender, income, hobbies, physiological indicators, and operational indicators.
  • the sensitivity determining unit 620 is specifically configured to: for each query type, obtain the query sensitivity corresponding to the query type according to the maximum absolute difference between the first result and the second result; wherein, The first result is a result obtained by performing this type of query on the target data set, and the second result is a result obtained by performing this type of query on adjacent data sets of the target data set.
  • the query type includes a count query; the sensitivity determining unit 620 is specifically configured to: determine the query sensitivity of the count query as a value of 1.
  • the query type includes maximum value query/minimum value query; the sensitivity determining unit 620 is specifically configured to: determine the maximum value and minimum value in the target data set; subtract the maximum value from the The minimum result determines the query sensitivity for the maximum query/min query.
  • the query type includes average value query; the sensitivity determination unit 620 is specifically configured to: determine the maximum value in the target data set; The ratio between the number plus 1 is determined as the query sensitivity of the mean query.
  • the query type includes a variance query
  • the sensitivity determination unit 620 is specifically configured to: determine the maximum and minimum values in the target data set; determine the query sensitivity of the variance query as the following factors Product: the square of the difference between the maximum value and the minimum value, the number of data in the target data set, and the reciprocal of the square operation after adding 1 to the number of data.
  • the noise power determining unit 630 is specifically configured to: determine the query sensitivities and values of the L queries based on the query sensitivities of each query; for any query, according to the query sensitivity of the query , the query sensitivity and value, and the privacy budget parameter determine the noise power allocated to the query.
  • the noise power determination unit 630 is further configured to: obtain the variable value of the mean variable, the variable value is based on the parameter value of the privacy budget parameter, and the privacy budget parameter and The noise power of the query is determined as the product of the following factors: the query sensitivity of the query, the sum of the query sensitivity, and the reciprocal of the variable value after square operation.
  • the privacy budget parameters include budget item parameters and slack item parameters.
  • the apparatus 600 further includes an actual result determination unit 640 configured to determine the actual returned result of any target query in the L queries as its original query result superimposed with target noise from differential privacy Distributionally sampled target noise, where the target noise distribution is determined based on the noise power assigned by the target query
  • the target noise distribution is a Gaussian noise distribution
  • the Gaussian noise distribution takes the noise power of the target query as a variance and 0 as a mean.
  • the device further includes a target query determination unit 650 configured to: receive a current query request for the target data set, which corresponds to the current query type; Whether the number of processed requests of the type is less than a predetermined threshold, the query request corresponding to the number of processed requests is for the target data set; if it is judged to be less than, the current query request is used as the target query.
  • a target query determination unit 650 configured to: receive a current query request for the target data set, which corresponds to the current query type; Whether the number of processed requests of the type is less than a predetermined threshold, the query request corresponding to the number of processed requests is for the target data set; if it is judged to be less than, the current query request is used as the target query.
  • a computer-readable storage medium on which a computer program is stored.
  • the computer program is executed in a computer, the computer is instructed to execute the method described in conjunction with FIG. 2 .
  • a computing device including a memory and a processor, where executable code is stored in the memory, and when the processor executes the executable code, the method described in conjunction with FIG. 2 is implemented. .
  • the functions described in the present invention may be implemented by hardware, software, firmware or any combination thereof.
  • the functions may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Databases & Information Systems (AREA)
  • General Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • Bioethics (AREA)
  • General Health & Medical Sciences (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computer Security & Cryptography (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Linguistics (AREA)
  • Probability & Statistics with Applications (AREA)
  • Fuzzy Systems (AREA)
  • Mathematical Physics (AREA)
  • Medical Informatics (AREA)
  • Information Retrieval, Db Structures And Fs Structures Therefor (AREA)

Abstract

本说明书实施例提供一种查询处理方法及装置。该方法包括：首先，确定有待针对目标数据集进行查询的L条查询各自的查询类型，所述目标数据集记录业务对象的数据；接着，确定各个查询类型针对所述目标数据集的查询敏感度；然后，基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。据此，针对所述L条查询中任意的目标查询，可以将其实际返回结果确定为其原始查询结果叠加从差分隐私的目标噪声分布采样的目标噪声，其中目标噪声分布基于所述目标查询分配得到的噪声功率而确定。如此，可以实现对目标数据集的隐私保护。

Description

查询处理方法及装置
本申请要求于2021年09月23日提交中国国家知识产权局、申请号为202111110468.2、申请名称为“查询处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本说明书一个或多个实施例涉及数据处理技术领域，尤其涉及一种查询处理方法及装置。
背景技术
随着大数据时代的到来，如何挖掘数据价值已成为当下的研究热点。在一种挖掘方式中，通过对大量数据进行统计处理，向外界提供统计查询服务。然而，此种查询服务存在泄露单条数据记录的风险，例如，张三查询到前500行数据的均值为20，之后又查询到前501行数据的均值为20.1，此时，其可以得到第501行数据的数值为70.1。
差分隐私(Differential Privacy，简称DP)技术被用于统计查询场景，以应对隐私泄露问题。此项技术的难点在于，如何平衡数据的隐私安全性和查询结果的准确性，因为前者的提高往往会导致后者的降低。因此，迫切需要一种改进的差分隐私方案，可以最小化敏感数据的隐私泄露风险，同时最大化查询结果的准确性。
发明内容
本说明书一个或多个实施例描述了一种查询处理方法及装置，针对一批次查询中的每个查询，为其分配确保不会泄露数据隐私的最低噪声功率，从而最大化查询结果的准确性。
根据第一方面，提供一种保护数据隐私的查询处理方法，包括：确定有待针对目标数据集进行查询的L条查询各自的查询类型，所述目标数据集记录业务对象的数据；确定各个查询类型针对所述目标数据集的查询敏感度；基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。
在一个实施例中，确定有待针对目标数据集进行查询的L条查询各自的查询类型，包括：接收针对所述目标数据集的L条查询请求，其中各条查询请求指示各自的查询类型。
在一个实施例中，确定有待针对目标数据集进行查询的L条查询各自的查询类型，包括：获取针对所述目标数据集预先配置的可查询次数L及其中各次查询的查询类型。
在一个实施例中，所述查询类型为以下中的任一种：计数、最大值、最小值、均值和方差。
在一个实施例中，所述业务对象为以下中的任一种：用户、商品、业务事件。
在一个具体的实施例中，所述业务事件为以下中的任一种：注册、访问、登录、支付。
在一个实施例中，所述业务对象为用户，所述隐私数据为以下中的任一种：年龄、性别、收入、兴趣爱好、生理指标、操作指标。
在一个实施例中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：针对所述各个查询类型，根据第一结果和第二结果之间的最大绝对差值，得到该查询类型对应的查询敏感度；其中，所述第一结果是针对所述目标数据集进行该类型查询得到的结果，所述第二结果是针对所述目标数据集的邻近数据集进行该类型查询得到的结果。
在一个实施例中，所述查询类型包括计数查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：将所述计数查询的查询敏感度确定为数值1。
在一个实施例中，所述查询类型包括最大值查询/最小值查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：确定所述目标数据集中的最大值和最小值；将所述最大值减去所述最小值的结果，确定为所述最大值查询/最小值查询的查询敏感度。
在一个实施例中，所述查询类型包括均值查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：确定所述目标数据集中的最大值；将所述最大值的绝对值与所述目标数据集的数据个数加1之间的比值，确定为所述均值查询的查询敏感度。
在一个实施例中，所述查询类型包括方差查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：确定所述目标数据集中的最大值和最小值；将所述方差查询的查询敏感度确定为以下因子的乘积：所述最大值和最小值之间差值的平方，所述目标数据集的数据个数，以及所述数据个数加1后进行平方运算的倒数。
在一个实施例中，基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率，包括：基于各条查询的查询敏感度，确定所述L条查询的查询敏感度和值；针对任意一条查询，根据该条查询的查询敏感度，所述查询敏感度和值，以及所述隐私预算参数，确定该条查询分配得到的噪声功率。
在一个具体的实施例中，根据该条查询的查询敏感度，所述查询敏感度和值，以及所述隐私预算参数，确定该条查询分配得到的噪声功率，包括：获取均值变量的变量值，该变量值基于所述隐私预算参数的参数值，以及差分隐私的高斯机制下所述隐私预算参数和均值变量的约束关系而确定；将该条查询的噪声功率确定为以下因子的乘积：该条查询的查询敏感度，所述查询敏感度和值，以及所述变量值进行平方运算后的倒数。
在一个实施例中，所述隐私预算参数包括预算项参数和松弛项参数。
在一个实施例中，在确定各条查询分配得到的噪声功率之后，所述方法还包括：针对所述L条查询中任意的目标查询，将其实际返回结果确定为其原始查询结果叠加从差分隐私的目标噪声分布采样的目标噪声，其中目标噪声分布基于所述目标查询分配得到的噪声 功率而确定。
在一个具体的实施例中，所述目标噪声分布为高斯噪声分布，所述高斯噪声分布以所述目标查询的噪声功率为方差，以0为均值。
在一个具体的实施例中，所述的方法，还包括：接收针对所述目标数据集的当前查询请求，其对应当前查询类型；判断对应所述当前查询类型的已处理请求数量是否小于预定阈值，所述已处理请求数量对应的查询请求针对所述目标数据集；在判断出小于的情况下，将所述当前查询请求作为所述目标查询。
根据第二方面，提供一种保护数据隐私的查询处理装置，包括：查询类型确定单元，配置为确定有待针对目标数据集进行查询的L条查询各自的查询类型，所述目标数据集记录业务对象的数据；敏感度确定单元，配置为确定各个查询类型针对所述目标数据集的查询敏感度；噪声功率确定单元，配置为基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。
在一个实施例中，所述查询类型确定单元具体配置为：接收针对所述目标数据集的L条查询请求，其中各条查询请求指示各自的查询类型。
在一个实施例中，所述查询类型确定单元具体配置为：获取针对所述目标数据集预先配置的可查询次数L及其中各次查询的查询类型。
在一个实施例中，所述业务对象为以下中的任一种：用户、商品、业务事件。
在一个实施例中，所述敏感度确定单元具体配置为：针对所述各个查询类型，根据第一结果和第二结果之间的最大绝对差值，得到该查询类型对应的查询敏感度；其中，所述第一结果是针对所述目标数据集进行该类型查询得到的结果，所述第二结果是针对所述目标数据集的邻近数据集进行该类型查询得到的结果。
在一个实施例中，还包括实际结果确定单元，配置为针对所述L条查询中任意的目标查询，将其实际返回结果确定为其原始查询结果叠加从差分隐私的目标噪声分布采样的目标噪声，其中目标噪声分布基于所述目标查询分配得到的噪声功率而确定。
在一个具体的实施例中，还包括目标查询确定单元，配置为：接收针对所述目标数据集的当前查询请求，其对应当前查询类型；判断对应所述当前查询类型的已处理请求数量是否小于预定阈值，所述已处理请求数量对应的查询请求针对所述目标数据集；在判断出小于的情况下，将所述当前查询请求作为所述目标查询。
根据第三方面，提供了一种计算机可读存储介质，其上存储有计算机程序，当该计算机程序在计算机中执行时，令计算机执行上述第一方面提供的方法。
根据第四方面，提供了一种计算设备，包括存储器和处理器，存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现上述第一方面提供的方法。
采用本说明书实施例提供的方法和装置，采用本说明书实施例披露的保护数据隐私的查询处理方法，可以实现针对一批次查询中的每个查询，为其分配确保不会泄露数据隐私 的最低噪声功率，从而最大化查询结果的准确性。
附图说明
为了更清楚地说明本发明实施例的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其它的附图。
图1示出根据一个实施例的查询处理方案的实施架构示意图；
图2示出根据一个实施例的查询处理方法的流程示意图；
图3示出根据另一个实施例的查询处理方案的实施架构示意图；
图4示出根据又一个实施例的查询处理方案的实施架构示意图；
图5示出根据还一个实施例的查询处理方案的实施架构示意图；
图6示出根据一个实施例的查询处理装置的结构示意图。
具体实施方式
下面结合附图，对本说明书提供的方案进行描述。
如前所述，差分隐私DP技术被用于统计查询场景，以应对隐私泄露问题。通常，在原始查询结果上添加随机噪声，以防止实际返回的查询结果泄露原始数据隐私。然而，已有的方案难以实现数据安全性和返回结果准确性的平衡。
基于此，本说明书实施例披露一种基于差分隐私实现的查询处理方案，针对一批次查询，可以为其中各条查询(或称各次查询)分配最优的噪声功率，从而实现即使攻击者获取到这一批次查询的返回结果，也无法破解被查询的原始数据，同时，最大化各条查询返回结果的准确性和可用性。
图1示出根据一个实施例的查询处理方案的实施架构示意图。如图1所示，服务平台提供查询服务。首先，服务平台从终端接收L条查询请求，图1中示出第1条查询请求Q 1和第L条查询请求Q L；然后，服务平台根据L条查询请求中各条请求的查询类型，确定各条查询请求针对目标数据集的查询敏感度；之后，基于各条查询请求分别对应的查询敏感度，以及针对L次查询预先设定的总的隐私预算参数，确定各条查询请求分配得到的噪声功率，图1中示出查询请求Q 1和查询请求Q L分配得到的噪声功率P Q1和噪声功率P QL；接着，针对L条查询请求中任一的目标查询请求(如查询请求Q 1)，基于该目标查询请求分配得到的噪声功率(如噪声功率P Q1)确定差分隐私的目标噪声分布(如噪声分布D Q1)，从中采样目标噪声(如噪声N Q1)，并在该目标查询的原始查询结果(如原始查询结果R 1)上添加该目标噪声，作为该目标查询的实际返回结果(如实际返回结果R 1′)。
下面，结合具体的实施例，描述上述查询处理方案的具体实施步骤。
图2示出根据一个实施例的查询处理方法的流程示意图，所述方法的执行主体可以为任何具有计算、处理能力的服务器、装置、平台或设备集群，例如，可以为图1中示出的服务平台，或者，用户终端等。如图2所示，所述方法包括以下步骤：
步骤S210，确定有待针对目标数据集进行查询的L条查询各自的查询类型，所述目标数据集记录业务对象的数据；步骤S220，确定各个查询类型针对所述目标数据集的查询敏感度；步骤S230，基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。
对以上步骤的展开介绍如下：
首先，在步骤S210，确定有待针对目标数据集进行查询的L条查询各自的查询类型。其中，目标数据集中包含多条数据记录(或称多个数据样本)，对应业务对象的数据(或称隐私数据)。需说明，其中任意两条数据记录对应的业务对象可能相同(例如，对应同一用户)，也可能不同(例如，对应不同商品)，并且，多条数据记录对应针对业务对象的同一特征项(例如，用户年龄)。此外，对上述多条数据记录的存储环境不作限定，在一种可能的存储情况中，上述多条数据记录存储在数据库中，例如，服务平台预先采集用户授权的个人信息，并将之存储在数据库中；在另一种可能的存储情况中，上述多条数据记录存储在用户终端中，例如，用户终端(如智能手机等)采集用户的终端操作数据(输入表情符号的行为数据)，并对此进行存储。
在一个实施例中，上述业务对象可以是用户。在一个具体的实施例中，可以是个人用户，相应，上述多个数据样本对应个人用户特征项，如个人用户的姓名、年龄、性别、收入、身份证号、手机号、邮箱、兴趣爱好、生理指标、或操作指标等。在一个示例中，生理指标用于衡量人体健康状况，具体可以是血压、血脂、胆固醇、或血氧浓度等。在一个示例中，操作指标对应特定操作行为，如支付、点击、或浏览等，用于衡量用户做出特定操作行为的时长或频次等。在另一个具体的实施例中，业务对象还可以是企业用户，相应，上述多个数据样本对应企业用户特征项，如企业用户的税务数据、供应商、账面流动资金、或年度营收等。
在另一个实施例中，上述业务对象可以是商品。示例性地，商品具体可以是实体商品，如手办、或纸质书籍等；或者，可以是体验性服务，如旅游产品、按摩服务、视频会员服务、网络课程或支付会员服务等；又或者，还可以是虚拟产品，如游戏皮肤、电子书籍、内容资讯、视频资源、云盘空间、或流量等。相应地，上述多个数据样本对应商品特征项，如商品的成本、库存、销量、或毛利等。
在又一个实施例中，上述业务对象可以是业务事件，如，注册事件、访问事件、登录事件或支付事件等；相应地，上述多个数据样本对应事件特征项，如业务事件的发生时刻、网络环境、地理位置或持续时长等。在一个示例中，其中网络环境可以是IP地址、或网络类型等。需理解，网络类型可以包括Wifi、4G网络、5G网络等。
以上，以业务对象是用户、商品、业务事件为示例，对目标数据集进行介绍。需理解，业务对象并不限于这几种。上述针对目标数据集的查询通常是指统计查询，查询目标数据集的统计信息，或者说聚合信息，例如，目标数据集中记录多个用户姓名，则可以查询其中姓黄的用户的个数。
对于上述L条查询及其查询类型，需说明，L为正整数，取值可以为1，但通常大于1；当L＞1时，其中任意两条查询对应的查询类型可能相同，也可能不同。示例性地，L条查询涉及的若干(即一个或多个)查询类型可以包括：计数、最大值、最小值、均值和方差。此外，在一种实施场景中，上述L条查询对应针对未来查询请求预先配置的查询信息，包括可查询次数L以及其中各次查询的查询类型；在另一种实施场景中，上述L条查询依赖接收到的L条查询请求，其中各条查询请求指示各自的查询类型。对于这两种实施场景的具体介绍，请参见后文。
由上，可以确定上述L条查询各自的查询类型。接着，在步骤S220，确定该L条查询涉及的若干查询类型中，各个查询类型针对上述目标数据集的查询敏感度。
需说明，某个类型的查询敏感度旨在反映，基于目标数据集进行该类型查询得到的第一结果，以及基于目标数据集的邻近数据集(adjacent datasets)进行该类型查询得到的第二结果之间的最大差异。其中邻近数据集是指，在目标数据集的基础上增加或删除任意的一条数据后可以得到的数据集。对于上述最大差异的度量，其度量标准可以根据实际需求设定，例如，量化为上述第一查询结果和第二查询结果之间的差值绝对值的最大值(文中或简称最大绝对差值)；但实际上，并非所有查询类型对应的最大差异，如最大绝对差值等，都可以被精确求解，此时，可以求解最大差异的近似值或估计值，作为查询敏感度。
下面结合查询类型的具体示例，对查询敏感度的计算进行介绍。
根据一个实施例，上述若干查询类型包括计数查询(counting query)。对于计数查询，需说明，目标数据集中的多个数据样本对应业务对象的特征项，该特征项的取值空间中包含可能的多个取值，例如，用户性别的可能取值包含男和女，相应，可以将该多个取值作为多个数据类别，使得可以针对其中某个数据类别进行计数查询，即查询该某个数据类别对应的数据样本个数，例如，查询用户数据集中女性用户的个数。
基于上述对计数查询的介绍可知，在针对某个数据类别进行计数查询的情况下，因目标数据集和其邻近数据集之间的数据条数相差为1，而相差的这条数据要么属于该某个数据类别，要么不属于，所以，两个查询结果之间差值的绝对值要么为1，要么为0，据此，可以将1确定为计数查询的查询敏感度，记作：
sens c＝1      (1)
如此，可以确定计数查询对应的查询敏感度sens c。
根据另一个实施例，上述若干查询类型包括最大值查询。为清楚描述，文中将上述目标数据集记作x＝(x 1，...，x N)，其中N表示数据样本的总数，x i表示第i个数据样本； 并且，将把N个数据样本由小到大进行顺序排列的结果记作x (1)≤x (2)≤…≤x (N)，可以理解，x (1)和x (N)分别表示N个数据样本中的最小值和最大值。对于目标数据集，其所对应的特征项的取值空间中，存在天然的取值上界和取值下界，或者，工作人员可以针对该特征项设定取值上界和取值下界，不妨将取值上界和取值下界分别记作l和u，由此可以得到l≤x (1)≤x (2)≤…≤x (N)≤u。
基于最大值查询类型和查询敏感度的定义，在一个示例中，可以将最大值查询对应的查询敏感度确定为：
sens max＝u-l     (2)
在另一个示例中，可以将最大值查询对应的查询敏感度确定为：
sens max＝x (N)-x (1)     (3)
如此，可以确定出最大值查询对应的查询敏感度sens max。
根据又一个实施例，上述若干查询类型包括最小值查询值，与上述确定最大值查询对应的查询敏感度sens max相类似地，在一个示例中，可以将最小值查询对应的查询敏感度确定为：
sens min＝u-l    (4)
在另一个示例中，可以将最小值查询对应的查询敏感度确定为：
sens min＝x (N)-x (1)     (5)
如此，可以确定出最小值查询对应的查询敏感度sens min。
根据再一个实施例，上述若干查询类型包括均值查询。可以将针对目标数据集进行的均值计算记作：
Figure PCTCN2022105053-appb-000001
(6)
假定邻近数据集x′相较于目标数据集x增加了一条数据y，并且，x (1)≤y≤x (N)，也即，x′＝(x 1，...，x N，y)。由此，在一个示例中，可以通过下式计算均值查询对应的查询敏感度：
Figure PCTCN2022105053-appb-000002
据此，可以将均值查询对应的查询敏感度记作：
Figure PCTCN2022105053-appb-000003
如此，可以确定出均值查询对应的查询敏感度sens mean。
根据还一个实施例，上述若干查询类型包括方差查询。将目标数据集x中数据样本的均值记作μ，由此，可以将针对目标数据集x进行的方差计算记作：
Figure PCTCN2022105053-appb-000004
假定邻近数据集x′相较于目标数据集x增加了一条数据y，并且，x (1)≤y≤x (N)，也即，x′=(x 1，...，x N，y)。由此，可以通过下式计算方差查询对应的查询敏感度：
Figure PCTCN2022105053-appb-000005
据此，可以将方差查询对应的查询敏感度记作：
Figure PCTCN2022105053-appb-000006
如此，可以确定出方差查询对应的查询敏感度sens var。
以上，以查询类型为计数、最大值、最小值、均值和方差作为示例，对查询敏感度的计算进行介绍。实际上，上述L条查询涉及的查询类型不限于这几种，还可以包括其他类型，如分位数查询(quantile query)和证据权重查询(weight of evidence query)等。对于其他查询类型所对应的查询敏感度的计算，可以结合二者的定义进行计算，在此不作穷举。
由上，可以确定出上述L条查询涉及的各个查询类型所对应的查询敏感度。需理解，各条查询具有对应的查询类型，而各个查询类型具有对应的查询敏感度，由此，可以得到各条查询对应的查询敏感度。
然后，在步骤S230，基于各条查询分别对应的查询敏感度，以及针对上述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。
在一个实施例中，本步骤可以包括：针对L条查询中任意的第
Figure PCTCN2022105053-appb-000007
条查询，根据该条查 询的查询敏感度
Figure PCTCN2022105053-appb-000008
L条查询的查询敏感度和值，以及上述隐私预算参数，确定该条查询分配得到的噪声功率。需说明，查询敏感度和值是基于L条查询中各条查询的查询敏感度进行求和而得到。
在一个具体的实施例中，先根据上述隐私预算参数的参数值，以及差分隐私的高斯机制下该隐私预算参数和均值变量μ的约束关系，确定其中均值变量的变量值。其中约束关系是差分隐私的高斯机制中已有的，可以表示为下式：
Figure PCTCN2022105053-appb-000009
在上式中，ε和γ分别表示上述隐私预算参数中的预算项参数和松弛项参数，二者的参数值可以是由工作人员根据实际需要人为设定的；μ表示上述均值变量；Φ(t)表示标准高斯分布的概率分布函数，
Figure PCTCN2022105053-appb-000010
进一步，针对任意的第
Figure PCTCN2022105053-appb-000011
条查询，将其噪声功率确定为以下因子的乘积：查询敏感度
Figure PCTCN2022105053-appb-000012
上述查询敏感度和值，以及上述均值变量的变量值进行平方运算后的倒数。据此，可以将噪声功率的计算式表示为：
Figure PCTCN2022105053-appb-000013
在上式中，
Figure PCTCN2022105053-appb-000014
表示第
Figure PCTCN2022105053-appb-000015
条查询的噪声功率，
Figure PCTCN2022105053-appb-000016
表示第
Figure PCTCN2022105053-appb-000017
条查询的查询敏感度，μ表示上述均值变量，
Figure PCTCN2022105053-appb-000018
表示L条查询的查询敏感度和值。
需说明，公式(13)的推导过程如下：
在隐私约束下，最小化L条查询的总的噪声功率，等同于以下优化问题：
约束条件函数：
Figure PCTCN2022105053-appb-000019
需求解的原函数：
Figure PCTCN2022105053-appb-000020
在公式(14)和(15)中，S k表示第k条查询的查询敏感度，μ表示上述均值变量，
Figure PCTCN2022105053-appb-000021
表示第k条查询的噪声功率。
注意到上述优化问题是凸优化问题并且符合Slater's条件，因此，具有强对偶性(strongduality)。针对此优化问题，引入拉格朗日乘子λ，构建如下的拉格朗日(Lagrangian)
Figure PCTCN2022105053-appb-000022
将约束条件函数与原函数联系到一起：
Figure PCTCN2022105053-appb-000023
公式(16)的可行解
Figure PCTCN2022105053-appb-000024
需要满足KKT(The Karush-Kuhn-Tucker)条件
Figure PCTCN2022105053-appb-000025
由此，在满足KKT的条件下极小化拉格朗日
Figure PCTCN2022105053-appb-000026
可以得到如下的最优噪声功率分配策略：
Figure PCTCN2022105053-appb-000027
需理解，公式(18)等价于公式(13)，仅是数学符号的记法略有不同。
由上，可以确定出差分隐私的高斯噪声机制下各条查询分配得到的噪声功率。需说明，实际还可以确定出其他噪声机制下各条查询的噪声功率，如拉普拉斯机制、指数机制等。
根据另一方面的实施例，在步骤S230之后，上述方法还可以包括：在步骤S240，针对上述L条查询中任意的目标查询，将其实际返回结果确定为其原始查询结果叠加从差分隐私的目标噪声分布采样的目标噪声。其中目标噪声分布基于目标查询分配得到的噪声功率而确定。
在一个实施例中，上述目标噪声分布可以为高斯噪声分布，相应，将目标查询的噪声功率作为高斯分布的方差，并以0为均值，生成对应的高斯噪声分布。为清楚描述，以下将目标查询记作第
Figure PCTCN2022105053-appb-000028
条查询，将其噪声功率记作
Figure PCTCN2022105053-appb-000029
由此可以将目标查询对应的高斯噪声分布记作
Figure PCTCN2022105053-appb-000030
基于确定出的高斯噪声分布
Figure PCTCN2022105053-appb-000031
可以从中采样目标噪声z，叠加在目标查询的原始查询结果
Figure PCTCN2022105053-appb-000032
上，从而得到对应的实际返回结果，计算式如下：
Figure PCTCN2022105053-appb-000033
下面，结合查询类型的示例，对公式(19)进行具象描述。
根据一个实施例，若目标查询的查询类型是计数查询，则可以基于下式计算实际返回的计数查询结果：
Figure PCTCN2022105053-appb-000034
在上式中，N表示目标数据集的数据样本总数；c表示第c个数据类别；C表示数据类别总数；z c表示从计数查询所对应的高斯噪声分布中随机采样的噪声；Count c，N表示针对第c个类别进行计数查询的原始查询结果，
Figure PCTCN2022105053-appb-000035
表示添加噪声后的实际返回结果；运算符
Figure PCTCN2022105053-appb-000036
表示四舍五入后进行取整。
如此，可以确定计数查询类型对应的实际返回结果。需理解，在确定每条查询对应的实际返回结果时，都会基于对应的高斯噪声分布进行噪声采样。比如说，对于两条具有相 同类型的查询，会基于二者对应的同一高斯噪声分布进行两次随机抽样，再分别叠加到查询类型对应的原始查询结果中，从而对应得到两个实际返回结果。
根据另一个实施例，若目标查询的查询类型是最大值查询，则可以基于下式计算实际返回的最大值查询结果：
Figure PCTCN2022105053-appb-000037
在上式中，z表示从最大值查询所对应的高斯噪声分布中随机采样的噪声；x (N)表示最大值查询的原始查询结果，也即目标数据集中的最大值；
Figure PCTCN2022105053-appb-000038
表示对最大值查询对应的实际返回结果。
根据又一个实施例，若目标查询的查询类型是最小值查询，则可以基于下式计算实际返回的最小值查询结果：
Figure PCTCN2022105053-appb-000039
在上式中，z表示从最小值查询所对应的高斯噪声分布中随机采样的噪声；x (1)表示最小值查询的原始查询结果，也即目标数据集中的最小值；
Figure PCTCN2022105053-appb-000040
表示最小值查询对应的实际返回结果。
根据还一个实施例，若目标查询的查询类型是均值查询，则可以基于下式计算实际返回的均值查询结果：
Figure PCTCN2022105053-appb-000041
在上式中，z表示从均值查询所对应的高斯噪声分布中随机采样的噪声，
Figure PCTCN2022105053-appb-000042
表示目标数据集的均值，
Figure PCTCN2022105053-appb-000043
表示均值查询对应的实际返回结果。
根据再一个实施例，若目标查询的查询类型是方差查询，则可以基于下式计算实际返回的方差查询结果：
Figure PCTCN2022105053-appb-000044
在上式中，z表示从方差查询所对应的高斯噪声分布中采样的噪声，
Figure PCTCN2022105053-appb-000045
表示目标数据集的方差，
Figure PCTCN2022105053-appb-000046
表示方差查询对应的实际返回结果。
以上，以差分隐私的高斯机制为示例，对目标噪声的采样和添加进行介绍。在另一个实施例中，上述目标噪声功率的确定基于差分隐私的拉普拉斯机制，相应，可以将目标查询的噪声功率作为拉普拉斯分布的尺度参数，并以0为位置参数，生成对应的拉普拉斯噪声分布，从而实现目标噪声的采样和添加，得到实际返回结果。在还一个实施例中，可以基于差分隐私的指数机制进行目标噪声的采样和添加，进而得到实际返回结果。
由上，可以确定L条查询中任意目标查询对应的实际返回结果。
需说明，本说明书实施例披露的上述查询处理方法，可以应用于多种实施场景。在一种典型的场景中，如图1所示，先接收一批次待处理的查询请求，于是，在步骤S210中， 待处理的查询条数L以及其中各条查询的查询类型基于这批次查询请求而确定，在一个实施例中，可以获取在预设时段内(如前一天内或最近10min内)接收到的多条查询请求，将其数量记作L，并确定各条查询请求指示的查询类型。之后在步骤S240中，将L条查询请求分别作为目标查询，从而对应进行噪声采样和基于原始查询结果的噪声叠加，进而得到各条查询请求的实际返回结果。如此，可以完成对一批次查询请求的差分隐私处理。
在另一种实施场景中，可以针对未来可能接收到的查询请求，预先配置可查询次数L以及其中各次查询的查询类型，由此，在步骤S210中可以直接获取预先配置的这部分信息。需说明，查询次数和查询类型的配置，可以由工作人员基于目标数据集对应的历史查询数据进行分析而确定。
进一步，在一个细化的实施场景中，如图3所示，在预备阶段通过执行上述步骤S210、S220和S230，确定各条查询分配得到的噪声功率。然后，在在线处理阶段，基于接收的当前查询请求Q j执行步骤S240，具体，将当前查询请求Q j作为目标查询，其对应当前查询类型C i；在判断出当前查询类型C i对应的针对目标数据集的已处理请求数量小于预置的可查询次数L Ci的情况下，将当前查询请求Q j作为目标查询，从而基于目标数据集确定查询类型C i对应的原始查询结果F Ci，并获取预备阶段中确定的对应当前查询类型C i的噪声功率P Ci，进而将从基于噪声功率P Ci确定的噪声分布中采样的噪声N j叠加在原始查询结果F Ci上，得到实际返回结果F j；否则，在判断出上述已处理请求数量等于可查询次数L Ci的情况下，抛弃当前查询请求Q j。
在另一个细化的实施场景中，如图4所示，在预备阶段通过执行上述步骤S210、S220和S230，确定各条查询分配得到的噪声功率，并且，还基于目标数据集确定各个查询类型对应的原始查询结果；然后在在线处理阶段，基于接收的当前查询请求Q j执行步骤S240，具体，将当前查询请求Q j作为目标查询，其对应当前查询类型C i；在判断出此类型对应的针对目标数据集的已处理请求数量小于预置的可查询次数L Ci的情况下，将当前查询请求Q j作为目标查询，从而获取预备阶段确定的对应当前查询类型C i的原始查询结果F Ci和噪声功率P Ci，进而将从基于噪声功率P Ci确定的噪声分布中采样的噪声N j叠加在原始查询结果F Ci上，得到实际返回结果F j；否则，抛弃当前查询请求Q j。
在又一个细化的实施场景中，如图5所示，在预备阶段通过执行上述步骤S210至步骤S240，确定L条查询中各条查询对应的实际返回结果。之后，在在线处理阶段，接收当前查询请求Q i，其对应当前查询类型C i；在判断出此类型对应的针对目标数据集的已处理请求数量小于预置的可查询次数的情况下，从预备阶段确定出的L个实际返回结果中，获取对应当前查询类型C i且尚未被使用的某个实际返回结果，作为当前查询请求Q i的实际返回结果R i′；否则，抛弃当前查询请求Q i。
以上，对本说明书实施例披露的查询处理方法的实施场景进行介绍。
综上，采用本说明书实施例披露的保护数据隐私的查询处理方法，可以实现针对一批 次查询中的每个查询，为其分配确保不会泄露数据隐私的最低噪声功率，从而最大化查询结果的准确性。
与上述查询处理方法相对应的，本说明书实施例还披露查询处理装置。图6示出根据一个实施例的查询处理装置的结构示意图，所述装置可以实现为任何具有计算、处理能力的计算单元、平台、服务器、设备集群等，例如，用户终端或图1中示出的服务平台。如图6所示，所述装置600包括以下单元：
查询类型确定单元610，配置为确定有待针对目标数据集进行查询的L条查询各自的查询类型，所述目标数据集记录业务对象的数据；敏感度确定单元620，配置为确定各个查询类型针对所述目标数据集的查询敏感度；噪声功率确定单元630，配置为基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。
在一个实施例中，所述查询类型确定单元610具体配置为：接收针对所述目标数据集的L条查询请求，其中各条查询请求指示各自的查询类型。
在一个实施例中，所述查询类型确定单元610具体配置为：获取针对所述目标数据集预先配置的可查询次数L及其中各次查询的查询类型。
在一个实施例中，所述查询类型为以下中的任一种：计数、最大值、最小值、均值和方差。
在一个实施例中，所述业务对象为以下中的任一种：用户、商品、业务事件。
在一个实施例中，所述业务事件为以下中的任一种：注册、访问、登录、支付。
在一个实施例中，所述业务对象为用户，所述隐私数据为以下中的任一种：年龄、性别、收入、兴趣爱好、生理指标、操作指标。
在一个实施例中，敏感度确定单元620具体配置为：针对所述各个查询类型，根据第一结果和第二结果之间的最大绝对差值，得到该查询类型对应的查询敏感度；其中，所述第一结果是针对所述目标数据集进行该类型查询得到的结果，所述第二结果是针对所述目标数据集的邻近数据集进行该类型查询得到的结果。
在一个实施例中，所述查询类型包括计数查询；敏感度确定单元620具体配置为：将所述计数查询的查询敏感度确定为数值1。
在一个实施例中，所述查询类型包括最大值查询/最小值查询；敏感度确定单元620具体配置为：确定所述目标数据集中的最大值和最小值；将所述最大值减去所述最小值的结果，确定为所述最大值查询/最小值查询的查询敏感度。
在一个实施例中，所述查询类型包括均值查询；敏感度确定单元620具体配置为：确定所述目标数据集中的最大值；将所述最大值的绝对值与所述目标数据集的数据个数加1之间的比值，确定为所述均值查询的查询敏感度。
在一个实施例中，所述查询类型包括方差查询；敏感度确定单元620具体配置为：确定所述目标数据集中的最大值和最小值；将所述方差查询的查询敏感度确定为以下因子的乘积：所述最大值和最小值之间差值的平方，所述目标数据集的数据个数，以及所述数据个数加1后进行平方运算的倒数。
在一个实施例中，噪声功率确定单元630具体配置为：基于各条查询的查询敏感度，确定所述L条查询的查询敏感度和值；针对任意一条查询，根据该条查询的查询敏感度，所述查询敏感度和值，以及所述隐私预算参数，确定该条查询分配得到的噪声功率。
在一个具体的实施例中，噪声功率确定单元630进一步配置为：获取均值变量的变量值，该变量值基于所述隐私预算参数的参数值，以及差分隐私的高斯机制下所述隐私预算参数和均值变量的约束关系而确定；将该条查询的噪声功率确定为以下因子的乘积：该条查询的查询敏感度，所述查询敏感度和值，以及所述变量值进行平方运算后的倒数。
在一个实施例中，所述隐私预算参数包括预算项参数和松弛项参数。
在一个实施例中，所述装置600还包括实际结果确定单元640，配置为针对所述L条查询中任意的目标查询，将其实际返回结果确定为其原始查询结果叠加从差分隐私的目标噪声分布采样的目标噪声，其中目标噪声分布基于目标查询分配得到的噪声功率而确定
在一个具体的实施例中，所述目标噪声分布为高斯噪声分布，所述高斯噪声分布以所述目标查询的噪声功率为方差，以0为均值。
另一方面，在一个具体的实施例中，所述装置还包括目标查询确定单元650，配置为：接收针对所述目标数据集的当前查询请求，其对应当前查询类型；判断对应所述当前查询类型的已处理请求数量是否小于预定阈值，所述已处理请求数量对应的查询请求针对所述目标数据集；在判断出小于的情况下，将所述当前查询请求作为所述目标查询。
根据另一方面的实施例，还提供一种计算机可读存储介质，其上存储有计算机程序，当所述计算机程序在计算机中执行时，令计算机执行结合图2所描述的方法。
根据再一方面的实施例，还提供一种计算设备，包括存储器和处理器，该存储器中存储有可执行代码，所述处理器执行所述可执行代码时，实现结合图2所描述的方法。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的功能可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些功能存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。
以上所述的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上所述仅为本发明的具体实施方式而已，并不用于限定本发明的保护范围，凡在本发明的技术方案的基础之上，所做的任何修改、等同替换、改进等，均应包括在本发明的保护范围之内。

Claims (25)

  1. 一种查询处理方法，包括：
    确定有待针对目标数据集进行查询的L条查询各自的查询类型，所述目标数据集记录业务对象的数据；
    确定各个查询类型针对所述目标数据集的查询敏感度；
    基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。
  2. 根据权利要求1所述的方法，其中，确定有待针对目标数据集进行查询的L条查询各自的查询类型，包括：
    接收针对所述目标数据集的L条查询请求，其中各条查询请求指示各自的查询类型。
  3. 根据权利要求1所述的方法，其中，确定有待针对目标数据集进行查询的L条查询各自的查询类型，包括：
    获取针对所述目标数据集预先配置的可查询次数L及其中各次查询的查询类型。
  4. 根据权利要求1所述的方法，其中，所述查询类型为以下中的任一种：计数、最大值、最小值、均值和方差。
  5. 根据权利要求1所述的方法，其中，所述业务对象为以下中的任一种：用户、商品、业务事件。
  6. 根据权利要求5所述的方法，其中，所述业务事件为以下中的任一种：注册、访问、登录、支付。
  7. 根据权利要求1所述的方法，其中，所述业务对象为用户，所述业务对象的数据为以下中的任一种：年龄、性别、收入、兴趣爱好、生理指标、操作指标。
  8. 根据权利要求1所述的方法，其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：
    针对所述各个查询类型，根据第一结果和第二结果之间的最大绝对差值，得到该查询类型对应的查询敏感度；其中，所述第一结果是针对所述目标数据集进行该类型查询得到的结果，所述第二结果是针对所述目标数据集的邻近数据集进行该类型查询得到的结果。
  9. 根据权利要求1或8所述的方法，其中，所述查询类型包括计数查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：
    将所述计数查询的查询敏感度确定为数值1。
  10. 根据权利要求1或8所述的方法，其中，所述查询类型包括最大值查询/最小值查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：
    确定所述目标数据集中的最大值和最小值；
    将所述最大值减去所述最小值的结果，确定为所述最大值查询/最小值查询的查询敏感 度。
  11. 根据权利要求1或8所述的方法，其中，所述查询类型包括均值查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：
    确定所述目标数据集中的最大值；
    将所述最大值的绝对值与所述目标数据集的数据个数加1之间的比值，确定为所述均值查询的查询敏感度。
  12. 根据权利要求1或8所述的方法，其中，所述查询类型包括方差查询；其中，确定各个查询类型针对所述目标数据集的查询敏感度，包括：
    确定所述目标数据集中的最大值和最小值；
    将所述方差查询的查询敏感度确定为以下因子的乘积：所述最大值和最小值之间差值的平方，所述目标数据集的数据个数，以及所述数据个数加1后进行平方运算的倒数。
  13. 根据权利要求1所述的方法，其中，基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率，包括：
    基于各条查询的查询敏感度，确定所述L条查询的查询敏感度和值；
    针对任意一条查询，根据该条查询的查询敏感度，所述查询敏感度和值，以及所述隐私预算参数，确定该条查询分配得到的噪声功率。
  14. 根据权利要求13所述的方法，其中，根据该条查询的查询敏感度，所述查询敏感度和值，以及所述隐私预算参数，确定该条查询分配得到的噪声功率，包括：
    获取均值变量的变量值，该变量值基于所述隐私预算参数的参数值，以及差分隐私的高斯机制下所述隐私预算参数和均值变量的约束关系而确定；
    将该条查询的噪声功率确定为以下因子的乘积：该条查询的查询敏感度，所述查询敏感度和值，以及所述变量值进行平方运算后的倒数。
  15. 根据权利要求1或14所述的方法，其中，所述隐私预算参数包括预算项参数和松弛项参数。
  16. 根据权利要求1所述的方法，其中，在确定各条查询分配得到的噪声功率之后，所述方法还包括：
    针对所述L条查询中任意的目标查询，将其实际返回结果确定为其原始查询结果叠加从差分隐私的目标噪声分布采样的目标噪声，其中目标噪声分布基于所述目标查询分配得到的噪声功率而确定。
  17. 根据权利要求16所述的方法，其中，所述目标噪声分布为高斯噪声分布，该高斯噪声分布以所述目标查询的噪声功率为方差，以0为均值。
  18. 根据权利要求16所述的方法，还包括：
    接收针对所述目标数据集的当前查询请求，其对应当前查询类型；
    判断对应所述当前查询类型的已处理请求数量是否小于预定阈值，所述已处理请求数量对应的查询请求针对所述目标数据集；
    在判断出小于的情况下，将所述当前查询请求作为所述目标查询。
  19. 一种查询处理装置，包括：
    查询类型确定单元，配置为确定有待针对目标数据集进行查询的L条查询各自的查询类型，所述目标数据集记录业务对象的数据；
    敏感度确定单元，配置为确定各个查询类型针对所述目标数据集的查询敏感度；
    噪声功率确定单元，配置为基于各条查询分别对应的查询敏感度，以及针对所述L条查询的总集预先设定的隐私预算参数，确定各条查询分配得到的噪声功率。
  20. 根据权利要求19所述的装置，其中，所述查询类型确定单元具体配置为：
    接收针对所述目标数据集的L条查询请求，其中各条查询请求指示各自的查询类型。
  21. 根据权利要求19所述的装置，其中，所述查询类型确定单元具体配置为：
    获取针对所述目标数据集预先配置的可查询次数L及其中各次查询的查询类型。
  22. 根据权利要求19所述的装置，其中，所述敏感度确定单元具体配置为：
    针对所述各个查询类型，根据第一结果和第二结果之间的最大绝对差值，得到该查询类型对应的查询敏感度；其中，所述第一结果是针对所述目标数据集进行该类型查询得到的结果，所述第二结果是针对所述目标数据集的邻近数据集进行该类型查询得到的结果。
  23. 根据权利要求19所述的装置，还包括：
    实际结果确定单元，配置为针对所述L条查询中任意的目标查询，将其实际返回结果确定为其原始查询结果叠加从差分隐私的目标噪声分布采样的目标噪声，其中目标噪声分布基于所述目标查询分配得到的噪声功率而确定。
  24. 根据权利要求23所述的装置，还包括目标查询确定单元，配置为：
    接收针对所述目标数据集的当前查询请求，其对应当前查询类型；
    判断对应所述当前查询类型的已处理请求数量是否小于预定阈值，所述已处理请求数量对应的查询请求针对所述目标数据集；
    在判断出小于的情况下，将所述当前查询请求作为所述目标查询。
  25. 一种计算机可读存储介质，其上存储有计算机程序，其中，当所述计算机程序在计算机中执行时，令计算机执行权利要求1-18中任一项所述的方法。
PCT/CN2022/105053 2021-09-23 2022-07-12 查询处理方法及装置 Ceased WO2023045504A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
US18/395,080 US20240135025A1 (en) 2021-09-23 2023-12-22 Query processing method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111110468.2 2021-09-23
CN202111110468.2A CN113553363B (zh) 2021-09-23 2021-09-23 查询处理方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/395,080 Continuation US20240135025A1 (en) 2021-09-23 2023-12-22 Query processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2023045504A1 true WO2023045504A1 (zh) 2023-03-30

Family

ID=78106503

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/105053 Ceased WO2023045504A1 (zh) 2021-09-23 2022-07-12 查询处理方法及装置

Country Status (3)

Country Link
US (1) US20240135025A1 (zh)
CN (1) CN113553363B (zh)
WO (1) WO2023045504A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117910046A (zh) * 2024-03-18 2024-04-19 青岛他坦科技服务有限公司 基于差分隐私保护的电力大数据发布方法

Families Citing this family (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113553363B (zh) * 2021-09-23 2021-12-14 支付宝(杭州)信息技术有限公司 查询处理方法及装置
CN114547688B (zh) * 2022-02-24 2024-05-17 余姚市亿盛金属制品有限公司 窗帘智能生产车间数据的差分隐私保护方法和装置
US12541619B2 (en) * 2023-05-15 2026-02-03 Lemon Inc. Dynamic calibration of noise parameters for data security
WO2025222346A1 (en) * 2024-04-22 2025-10-30 Lemon Inc. Subsampling in privacy parameter recycling differential privacy
CN118821205B (zh) * 2024-06-18 2025-03-04 南京邮电大学 一种基于混合差分隐私的区域计数查询方法及系统
US20260023874A1 (en) * 2024-07-18 2026-01-22 Jpmorgan Chase Bank, N.A. System and method for enhanced summary statistic privacy for data sharing

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105989161A (zh) * 2015-03-04 2016-10-05 华为技术有限公司 一种处理大数据的方法和装置
CN108363928A (zh) * 2018-02-08 2018-08-03 广西师范大学 关联医疗数据中的自适应差分隐私保护方法
CN108537055A (zh) * 2018-03-06 2018-09-14 南京邮电大学 一种数据查询隐私保护的隐私预算分配和数据发布方法及其系统
US20190065775A1 (en) * 2017-08-25 2019-02-28 Immuta, Inc. Calculating differentially private queries using local sensitivity on time variant databases
CN112162998A (zh) * 2020-09-27 2021-01-01 徐州医科大学 隐私保护查询语言pql及其系统
CN113553363A (zh) * 2021-09-23 2021-10-26 支付宝(杭州)信息技术有限公司 查询处理方法及装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105989161A (zh) * 2015-03-04 2016-10-05 华为技术有限公司 一种处理大数据的方法和装置
US20190065775A1 (en) * 2017-08-25 2019-02-28 Immuta, Inc. Calculating differentially private queries using local sensitivity on time variant databases
CN108363928A (zh) * 2018-02-08 2018-08-03 广西师范大学 关联医疗数据中的自适应差分隐私保护方法
CN108537055A (zh) * 2018-03-06 2018-09-14 南京邮电大学 一种数据查询隐私保护的隐私预算分配和数据发布方法及其系统
CN112162998A (zh) * 2020-09-27 2021-01-01 徐州医科大学 隐私保护查询语言pql及其系统
CN113553363A (zh) * 2021-09-23 2021-10-26 支付宝(杭州)信息技术有限公司 查询处理方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117910046A (zh) * 2024-03-18 2024-04-19 青岛他坦科技服务有限公司 基于差分隐私保护的电力大数据发布方法
CN117910046B (zh) * 2024-03-18 2024-06-07 国网河南省电力公司经济技术研究院 基于差分隐私保护的电力大数据发布方法

Also Published As

Publication number Publication date
CN113553363A (zh) 2021-10-26
CN113553363B (zh) 2021-12-14
US20240135025A1 (en) 2024-04-25

Similar Documents

Publication Publication Date Title
WO2023045504A1 (zh) 查询处理方法及装置
US11968105B2 (en) Systems and methods for social graph data analytics to determine connectivity within a community
JP7183388B2 (ja) 個人情報の調査結果の信頼性レベルを特定するための機械学習システムおよび方法
US11113413B2 (en) Calculating differentially private queries using local sensitivity on time variant databases
US11670415B2 (en) Data driven analysis, modeling, and semi-supervised machine learning for qualitative and quantitative determinations
US9922134B2 (en) Assessing and scoring people, businesses, places, things, and brands
US20140358829A1 (en) System and method for sharing record linkage information
US9275125B1 (en) System for organizing data from a plurality of users to create individual user profiles
CN109993627B (zh) 推荐方法、推荐模型的训练方法、装置和存储介质
US9846746B2 (en) Querying groups of users based on user attributes for social analytics
US11645344B2 (en) Entity mapping based on incongruent entity data
CN116467525A (zh) 业务产品的推荐方法、装置、设备和存储介质
US11763025B2 (en) Personal information analysis system and personal information analysis method
US11704392B2 (en) Fraud estimation system, fraud estimation method and program
CN116451074A (zh) 目标对象的画像生成方法、装置、计算机设备、存储介质
US20220327634A1 (en) Generating relevant attribute data for benchmark comparison
US12026275B2 (en) Systems and methods for semantic context enrichment and data masking
US11295325B2 (en) Benefit surrender prediction
US12437017B1 (en) Systems and methods for sharing user data
Uddin et al. Evaluating whether the proportional odds models to analyse ordinal outcomes in COVID-19 clinical trials is providing clinically interpretable treatment effects: A systematic review
US10108650B2 (en) Information processing device and information processing method
CN115292364A (zh) 数据查询方法及装置、数据库系统、电子设备及存储介质
CN113344147A (zh) 一种特征共享建模方法、装置、设备及其存储介质
US12579518B2 (en) Systems and methods for providing cross-sectional scaling
JP2020052943A (ja) データクレンジング・名寄せに関する情報処理システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22871563

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 11202309990T

Country of ref document: SG

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 22871563

Country of ref document: EP

Kind code of ref document: A1