Privacy protection method and device, computer device and storage medium

Abstract

The application discloses a privacy protection method and device, computer equipment and a storage medium. The method comprises the following steps: identifying the use instruction of to-be-de-sensitized data; determining the data security level and the data security coefficient corresponding to the to-be-de-sensitized data according to the use instruction; obtaining a reference de-sensitization index parameter; adjusting the reference de-sensitization index parameter according to the data security level and the data security coefficient to obtain a real de-sensitization index parameter; and de-sensitizing the to-be-de-sensitized data based on the real de-sensitization index parameter until the de-sensitization result meets the real de-sensitization index parameter, and returning the de-sensitization result. According to the privacy protection requirements of different users and different data use modes, the data security level and the data security coefficient are configured based on the identity information of the user and the data use, the reference de-sensitization index parameter is automatically adjusted according to the data security coefficient, and the data privacy protection of multiple users and multiple uses is met.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a privacy protection method, apparatus, computer device, and storage medium. Background Technology

[0002] In the field of data trading and data sharing, how to provide data to requesters without compromising privacy has become a thorny issue. To address this problem, the industry has proposed many technologies to protect data publishing privacy. Common privacy protection technologies can be broadly categorized based on their implementation methods as follows: data transformation methods, data anonymization methods, secure multi-party computation methods, and hybrid methods. Among these, anonymization methods have gained wider application due to their significant security and effectiveness. Anonymization methods include the K-Anonymity algorithm, the L-Diversity algorithm, and the T-Closeness algorithm.

[0003] Each of the three anonymization methods mentioned above has its own advantages and limitations, and the privacy parameters of each method also affect the effectiveness of data privacy protection and data quality. In real-world environments, users have different privacy protection requirements depending on their data usage purposes, and the sensitivity of different data types also varies. Therefore, how to scientifically and rationally select the most appropriate method for different privacy protection needs, and how to automatically adjust parameters to ensure effective data privacy protection, is a major challenge that needs to be addressed. Summary of the Invention

[0004] The purpose of this invention is to provide a privacy protection method, apparatus, computer device, and storage medium to address the problems existing in the prior art.

[0005] To achieve the above objectives, the present invention provides a privacy protection method, comprising:

[0006] Explanation of the purpose of identifying data to be de-identified;

[0007] Determine the data security level and data security coefficient corresponding to the data to be de-identified based on the aforementioned usage description;

[0008] Obtain baseline anonymization index parameters, which include K value, L value, and T value. The K value is used to characterize the privacy parameter value corresponding to the K-anonymity processing scheme, the L value is used to characterize the privacy parameter value corresponding to the L-diversity processing scheme, and the T value is used to characterize the privacy parameter value corresponding to the T-closeness processing scheme.

[0009] Based on the data security level and data security coefficient, the baseline desensitization index parameters are adjusted to obtain the actual desensitization index parameters;

[0010] The data to be desensitized is desensitized based on the actual desensitization index parameters until the desensitization result meets the actual desensitization index parameters, and then the desensitization result is returned.

[0011] More preferably, prior to the description of the intended use of the data to be anonymized, the following is included:

[0012] Intercept user data requests and extract the data to be de-identified from the data requests;

[0013] Identify the user's identity information and obtain a description of the purpose of the data to be de-identified based on the identity information.

[0014] More preferably, determining the data security level and data security coefficient corresponding to the data to be de-identified according to the usage description includes:

[0015] The data security level and data security coefficient corresponding to the usage description are retrieved from the preset level configuration area; wherein, the level configuration area pre-stores the correspondence between each usage description and the corresponding data security level and data security coefficient.

[0016] More preferably, the benchmark desensitization index parameters are obtained through the following steps:

[0017] Obtain the dataset of de-identified samples, which includes multiple subsets of de-identified data with different field types;

[0018] A predetermined number of desensitized data subsets are extracted from the desensitized sample dataset using a decreasing method to generate a first particle swarm, and a first desensitization index parameter of the first particle swarm is calculated.

[0019] A predetermined number of desensitized data subsets are extracted from the desensitized sample dataset and combined with the first particle swarm to generate a second particle swarm. The second desensitization index parameter of the second particle swarm is calculated. The calculation is iterated until the calculation of all desensitized data subsets in the dataset to be desensitized is completed, so as to obtain the baseline desensitization index parameter of the dataset to be desensitized.

[0020] More preferably, the calculation of the first desensitization index parameter of the first particle swarm includes:

[0021] Obtain the preset minimum privacy leakage desensitization strategy and maximum privacy leakage desensitization strategy of the first particle swarm;

[0022] The first particle swarm is desensitized according to the minimum privacy leakage desensitization strategy and the maximum privacy leakage desensitization strategy respectively, so as to obtain the minimum desensitization index parameter and the maximum desensitization index parameter of the first particle swarm.

[0023] The first desensitization index parameter of the first particle swarm is obtained based on the minimum and maximum desensitization index parameters.

[0024] More preferably, the step of adjusting the baseline de-identification index parameters according to the data security level and data security coefficient to obtain the actual de-identification index parameters includes:

[0025] The baseline de-identification index parameters are determined based on the data security level.

[0026] Obtain the preset weight value of the data security coefficient;

[0027] The baseline desensitization index parameters are adjusted according to the weight values ​​to obtain the actual desensitization index parameters.

[0028] More preferably, the step of desensitizing the data to be desensitized based on the actual desensitization index parameters until the desensitization result meets the actual desensitization index parameters, and then returning the desensitization result, includes:

[0029] The desensitization results include multiple desensitization strategies, and each of the desensitization strategies conforms to the actual desensitization index parameters;

[0030] The desensitization strategies are scored and ranked, and then sorted in descending order based on the scores and returned.

[0031] To achieve the above objectives, the present invention also provides a privacy protection device, comprising:

[0032] The purpose of the identification module is to identify the data to be de-identified.

[0033] The determination module is used to determine the data security level and data security coefficient corresponding to the data to be de-identified according to the above-described purpose.

[0034] The acquisition module is used to acquire benchmark anonymization index parameters, which include K value, L value and T value. The K value is used to characterize the privacy parameter value corresponding to the K-anonymity processing scheme, the L value is used to characterize the privacy parameter value corresponding to the L-diversity processing scheme, and the T value is used to characterize the privacy parameter value corresponding to the T-closeness processing scheme.

[0035] The adjustment module is used to adjust the baseline de-identification index parameters according to the data security level and data security coefficient to obtain the actual de-identification index parameters;

[0036] The desensitization module is used to desensitize the data to be desensitized based on the actual desensitization index parameters until the desensitization result meets the actual desensitization index parameters, and then return the desensitization result.

[0037] To achieve the above objectives, the present invention also provides a computer device, comprising:

[0038] Memory, storing at least computer programs; and

[0039] The processor executes a computer program stored in the memory to implement any of the privacy protection methods described above.

[0040] To achieve the above objectives, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the privacy protection method described in any one of the above claims.

[0041] The beneficial effects of the above technical solution are as follows:

[0042] The privacy protection method, apparatus, computer equipment, and storage medium provided by this invention use benchmark de-identification index parameters as indicators of the de-identification result. This ensures that the de-identification degree is not too high, resulting in insufficient data disclosure and hindering data analysis, or that the de-identification degree is not too low, resulting in excessive data disclosure and leakage of data privacy information. This achieves a balance between the degree of de-identification and the analytical value of the de-identification result. For the privacy protection needs of different users and different data usage methods, data security levels and data security coefficients are configured based on user identity information and data usage. The benchmark de-identification index parameters are automatically adjusted according to the data security coefficient, satisfying data privacy protection for multiple users and multiple uses. Attached Figure Description

[0043] Figure 1 This is a schematic flowchart of a privacy protection method according to Embodiment 1 of the present invention;

[0044] Figure 2 This is another schematic flowchart of the privacy protection method according to Embodiment 1 of the present invention;

[0045] Figure 3 This is a functional block diagram of the privacy protection device according to Embodiment 2 of the present invention;

[0046] Figure 4 This is a schematic diagram of the computer device used in the privacy protection method of Embodiment 3 of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the embodiments described herein are merely illustrative and not intended to limit the invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without inventive effort are within the scope of protection of this invention.

[0048] Example 1

[0049] like Figure 1 The diagram shown is a flowchart of a privacy protection method according to Embodiment 1. As can be seen from the diagram, it includes steps S100-500, as follows:

[0050] S100: Identify the intended use of the data to be anonymized. S100 includes steps S001 and S002.

[0051] S001: Intercept the user's data request and extract the data to be de-identified from the data request.

[0052] In an exemplary embodiment, a user can send a data request to a database through a third-party system to obtain data for use. Data use can be one or more of the following methods: data processing / scientific computing, statistical analysis / data mining, data trading / data disclosure, etc. Internally, the third-party system can be the data developers or testers; externally, it can be other external systems that share or use the data.

[0053] The data obtained by users typically includes both sensitive and non-sensitive information. Sensitive information includes, but is not limited to, privacy data such as names, ID card numbers, license plate numbers, mobile phone numbers, and bank card numbers. To ensure the security of privacy data, any data request must be anonymized through an anonymization system before it can be viewed and used. Therefore, when the anonymization system detects a user sending a data request to the database, it intercepts the request and identifies sensitive information within it as data to be anonymized. The anonymization system can use methods such as natural language processing, image processing, rule matching, and feature analysis to identify sensitive information from the user-obtained data. For example, when the obtained data is image data, OCR (Optical Character Recognition) can be used to identify field data in the image data, and the field data can be matched with sensitive tags to obtain the corresponding anonymized data; when the obtained data is text data, field data can be directly extracted from the text data and matched with sensitive tags to obtain the corresponding anonymized data.

[0054] S002: Identify the user's identity information and obtain a description of the purpose of the data to be de-identified based on the identity information.

[0055] In an exemplary embodiment, the usage description of the data to be anonymized is used to characterize the way the data is used, such as: data processing / scientific computing, statistical analysis / data mining, data trading / data disclosure, etc. The user's identity information is used to characterize the user's organization or job function, such as: professional and technical personnel / related technical departments, research institutions / service organizations, commercial organizations / public organizations, etc. Different user identity information corresponds to different usage descriptions of the data.

[0056] Before users can send data requests to the database through a third-party system to obtain and use the data, they must first log in to their user accounts on the third-party system. The data anonymization system can identify the user's identity information through the username used during login. Preferably, the mapping relationship between usernames and identity information, and the mapping relationship between identity information and usage descriptions, can be pre-stored in the data configuration area. When intercepting a user's data request, the system can search for the identity information corresponding to the username in the data configuration area and then find the corresponding usage description based on the identity information. For example, the first two digits of the username of professional and technical personnel / related technical departments are 01, the first two digits of the username of research institutions / service institutions are 02, and the first two digits of the username of commercial institutions / public institutions are 03. The usage description for the data corresponding to the identity information of professional and technical personnel / related technical departments can be data processing / scientific computing, the usage description for the data corresponding to the identity information of research institutions / service institutions can be statistical analysis / data mining, and the usage description for the data corresponding to the identity information of commercial institutions / public institutions can be data trading / data disclosure. When the data masking system detects a user sending a data request to the database, it intercepts the request and extracts the user's login username. By identifying the first two characters of the username and searching for the corresponding identity information in the data configuration area, the system obtains the user's identity information. Then, by searching for the data purpose corresponding to that identity information in the data configuration area, the system determines the data's intended use. For example, when a user whose username starts with 01 logs into a third-party system and sends a data request to the database, the system can identify the user as a technical professional / related technical department, with the intended use described as data processing / scientific computing.

[0057] S200: Determine the data security level and data security coefficient corresponding to the data to be de-identified based on the identity information and usage description.

[0058] In exemplary embodiments, data with different intended uses has different data security levels. For example, data intended for data processing / scientific computing has a lower risk of data privacy leakage and can be set to a lower data security level. Data intended for data trading / public disclosure, however, has a higher risk of data privacy leakage due to the need for public disclosure or trading, and can therefore be set to a higher data security level. Furthermore, the data security coefficient also differs for users with different identities. For example, users whose identities belong to professionals / senior managers in relevant technical departments, who have higher management authority within the company and more complete access to and control over data, can have a lower data security coefficient. Conversely, users whose identities belong to professionals / internship staff in relevant technical departments, who have no management authority within the company and limited access to and control over data, can have a higher data security coefficient.

[0059] A higher data security level and a higher data security coefficient indicate a greater risk of data privacy leakage or a smaller amount of data disclosure, meaning a higher degree of data anonymization or a lower analyzable value. Conversely, a lower data security level and a lower data security coefficient indicate a lower risk of data privacy leakage or a larger amount of data disclosure, meaning a lower degree of data anonymization or a higher analyzable value. Preferably, the correspondence between identity information and usage description, the correspondence between usage description and data security level, and the correspondence between identity information and data security coefficient can be pre-stored in the data configuration area. When a user's data request is intercepted, after identifying the user's identity information, the corresponding usage description, data security level, and data security coefficient can be found in the data configuration area.

[0060] For example, the user information of professional and technical personnel / related technical departments corresponds to the data usage description of data processing / scientific computing; the user information of research institutions / service institutions corresponds to the data usage description of data analysis / data mining; and the user information of commercial institutions / public institutions corresponds to the data usage description of data trading / data disclosure. Arranged in descending order of data security level: data trading / data disclosure (Level 3, highest data security level), statistical analysis / data mining (Level 2, medium data security level), data processing / scientific computing (Level 1, lowest data security level); and arranged in descending order of data security coefficient (taking data processing / scientific computing as an example): senior supervisors (Level A, lowest data security coefficient), ordinary employees (Level B, medium data security coefficient), and interns (Level C, highest data security coefficient).

[0061] S300: Obtain the baseline de-identification index parameters, which include K value, L value, and T value. The K value is used to characterize the privacy parameter value corresponding to the K-anonymity processing scheme, the L value is used to characterize the privacy parameter value corresponding to the L-diversity processing scheme, and the T value is used to characterize the privacy parameter value corresponding to the T-closeness processing scheme.

[0062] In exemplary embodiments, since different identity information and different usage descriptions result in different degrees of data anonymization during data acquisition, it is preferable to use the K-Anonymity, L-Diversity, and T-Closeness privacy risk leakage models to evaluate the security of the anonymized data. K-Anonymity is defined as follows: for any row of records, the number of records in its equality set is not less than K, meaning at least K-1 records have the same semi-identifier column attribute value as that record. L-Diversity is defined as follows: if the set of sensitive data corresponding to all records in any equality set contains L "suitable" values, then the equality set is said to satisfy L-Diversity; if all equality sets in the dataset satisfy L-Diversity, then the dataset satisfies L-Diversity. T-Closeness is defined as follows: if the distance between the distribution of sensitive data in an equality class and the global distribution of sensitive data is less than T, then the equality class satisfies the T-Closeness constraint; if all equality classes in the dataset satisfy T-Closeness, then the dataset satisfies T-Closeness. The above privacy risk leakage model is common technical knowledge to those skilled in the art, so it will not be elaborated further.

[0063] It should be noted that the privacy protection levels are ranked in descending order as follows: T-CLosenes processing scheme, L-Diversity processing scheme, and K-Anonymity processing scheme. Preferably, when the identity information pertains to professional and technical personnel / related technical departments or the intended use is data processing / scientific computing, the K-Anonymity processing scheme can be used due to its lower data security level. When the identity information pertains to research institutions / service organizations or the intended use is statistical analysis / data mining, the L-Diversity processing scheme can be used due to its medium data security level. When the identity information pertains to commercial organizations / public institutions or the intended use is data trading / data disclosure, the T-CLosenes processing scheme can be used due to its high data security level. There are no restrictions on the specific identity information and intended use scheme; adjustments can be made according to the business needs of the personnel.

[0064] Combination Figure 2The diagram shows another flowchart of the privacy protection method in this embodiment. As can be seen from the diagram, the baseline de-identification index parameters are obtained through steps S301-S303, as follows:

[0065] S301: Obtain the dataset of de-identified samples, which includes multiple subsets of de-identified data with different field types.

[0066] In an exemplary embodiment, a de-identified sample dataset can be generated from historical data. The de-identified data itself includes, but is not limited to, fields such as name, ID number, license plate number, mobile phone number, and bank card number. Each field type can be classified according to its field format (text, letters, numbers, etc.) and the number of fields.

[0067] S302: Extract a preset number of desensitized data subsets from the desensitized sample dataset using a decreasing method to generate a first particle swarm, and calculate the first desensitization index parameter of the first particle swarm.

[0068] In an exemplary embodiment, the first desensitization index parameter is used to characterize the state of the first particle swarm at a medium data security level during desensitization. Calculating the first desensitization index parameter of the first particle swarm includes the following steps, wherein S302 includes steps S3021-S3023, specifically as follows:

[0069] S3021: Obtain the preset minimum privacy leakage desensitization strategy and maximum privacy leakage desensitization strategy of the first particle swarm.

[0070] In an exemplary embodiment, the minimum privacy leakage de-identification strategy characterizes the strategy that maximizes the degree of de-identification, corresponding to the lowest analyzable value of the data; the maximum privacy leakage de-identification strategy characterizes the strategy that minimizes the degree of de-identification, corresponding to the highest analyzable value of the data. The minimum and maximum privacy leakage de-identification strategies can be provided by the data provider, set according to relevant privacy laws and policies, or set according to the business needs of business personnel, without specific limitations. For example, the minimum privacy leakage de-identification strategy for ID card numbers requires de-identification of the first 6 digits, while the 9th, 11th, 13th, and last 4 digits, resulting in a high degree of de-identification, low analyzable value, and high data security; while the maximum privacy leakage de-identification strategy requires de-identification of the 3rd, 6th, and last 4 digits, resulting in a low degree of de-identification, high analyzable value, but low data security.

[0071] S3022: Desensitize the first particle swarm according to the minimum privacy leakage desensitization strategy and the maximum privacy leakage desensitization strategy respectively, and obtain the minimum desensitization index parameter and the maximum desensitization index parameter of the first particle swarm.

[0072] In an exemplary embodiment, data in the first particle swarm is anonymized according to a minimum privacy disclosure anonymization strategy. Minimum anonymization index parameters (K value, L value, T value) are calculated based on the anonymization results. These minimum anonymization index parameters characterize the privacy security of the anonymized result of the first particle swarm. Since the minimum privacy disclosure anonymization strategy is a method with a high degree of anonymization, the minimum anonymization index parameters are used to characterize the privacy security of the anonymized result of the first particle swarm. Conversely, data in the first particle swarm is anonymized according to a maximum privacy disclosure anonymization strategy. Maximum anonymization index parameters (K value, L value, T value) are calculated based on the anonymization results. These maximum anonymization index parameters characterize the privacy security of the anonymized result of the first particle swarm. Since the maximum privacy disclosure anonymization strategy is a method with a low degree of anonymization, the minimum anonymization index parameters are used to characterize the privacy security of the anonymized result of the first particle swarm.

[0073] S3023: Based on the minimum desensitization index parameter and the maximum desensitization index parameter, the first desensitization index parameter of the first particle group is obtained.

[0074] In an exemplary embodiment, the intermediate value between the minimum and maximum desensitization index parameters is selected as the first desensitization index parameter. For example, if the K value in the minimum desensitization index parameter is 1 and the K value in the maximum desensitization index parameter is 100, then the K value in the first desensitization index parameter is preferably 50.

[0075] S303: Extract a preset number of desensitized data subsets from the desensitized sample dataset, combine them with the first particle swarm to generate a second particle swarm, and calculate the second desensitization index parameter of the second particle swarm. Iterate the calculation until all desensitized data subsets in the dataset to be desensitized are calculated to obtain the baseline desensitization index parameter of the dataset to be desensitized.

[0076] In an exemplary embodiment, the baseline de-identification index parameters (K value, L value, T value) are used to characterize the privacy and security parameters of the de-identification result obtained after de-identifying the sample dataset. Since the baseline de-identification index parameters are the median values ​​of the maximum and minimum de-identification index parameters of the sample dataset, it can be seen that using the baseline de-identification index parameters as the privacy and security parameter values ​​of the de-identification result of the sample dataset ensures that the degree of de-identification and the analyzable value of the de-identification result are in a middle balance state. That is, the degree of de-identification will not be too high, resulting in insufficient data disclosure and inability to conduct data analysis, or the degree of de-identification will not be too low, resulting in excessive data disclosure and leakage of data privacy information.

[0077] S400: Based on the data security level and data security coefficient, adjust the baseline desensitization index parameters to obtain the actual desensitization index parameters.

[0078] In an exemplary embodiment, the corresponding baseline de-identification index parameter is found according to the data security level. For example, when the identity information is that of a professional or technical personnel / related technical department or the purpose description is data processing / scientific computing, the K value of the K-Anonymity processing scheme is used because the data security level is low; when the identity information is that of a research institution / service institution or the purpose description is statistical analysis / data mining, the L value of the L-Diversity processing scheme is used because the data security level is medium; when the identity information is that of a commercial institution / public institution or the purpose description is data transaction / data disclosure, the T value of the T-CLosenes processing scheme is used because the data security level is high.

[0079] Simultaneously, the baseline anonymization index parameters are adjusted based on the data security coefficient, and weight values ​​are assigned to different data security coefficients. For example, the weight value for senior managers (Level A, lowest data security coefficient) is 0.5, for ordinary employees (Level B, medium data security coefficient) it is 1, and for interns (Level C, highest data security coefficient) it is 1.5. If the K value in the baseline anonymization index parameter is 50, then the K value in the baseline anonymization index parameter for senior managers is 25, for ordinary employees it is 50, and for interns it is 75. According to the characteristics of the K-Anonymity processing scheme, the higher the K value, the lower the probability of privacy leakage, i.e., the higher the degree of data anonymization; the lower the K value, the higher the probability of privacy leakage, i.e., the lower the degree of data anonymization. Since interns usually have lower management or data viewing permissions than senior managers, the K value in the baseline anonymization index parameter for interns is greater than the K value in the baseline anonymization index parameter for senior managers.

[0080] S500: Desensitize the data to be desensitized based on the actual desensitization index parameters until the desensitization result meets the actual desensitization index parameters, and then return the desensitization result.

[0081] In an exemplary embodiment, after obtaining the actual desensitization index parameters, the data to be desensitized can be desensitized according to a preset desensitization strategy until the desensitization result meets the actual desensitization index parameters. Then, the desensitization process stops and the result is returned to the user. For example, for text data, desensitization strategies such as masking, mapping, truncation, rearrangement, deformation, hashing, and encryption can be used. For images and videos, desensitization strategies such as key area masking, mosaic, feathering, fogging, Gaussian blur, mean blur, and bilateral filtering can be used. The specific desensitization strategy used is not limited and can be randomly generated or preset by the user according to business needs.

[0082] This can be understood as follows: the actual anonymization index parameter is the result value, and the specific anonymization strategy is the solution. Given the result value, we need to determine the solution that matches it. It's important to note that the same result value can have multiple solutions; that is, the same actual anonymization index parameter can have multiple anonymization strategies. The anonymization result obtained by applying each strategy to the data to be anonymized will match the actual anonymization index parameter. For example, taking the masking of mobile phone numbers as an example, the anonymization strategy of masking the 4th to 7th digits of the mobile phone number is the same as the anonymization index parameter obtained by masking the 4th, 5th, 8th, and 9th digits of the mobile phone number.

[0083] Preferably, multiple de-identification strategies that meet the true de-identification index parameters can be scored and ranked based on the number of times the strategies have been used in history. For example, one point is awarded for each use. The de-identification strategies are then sorted in descending order based on the scores and returned, allowing users to select from multiple de-identification results according to the ranking. For example, for text data, de-identification strategies that meet the true de-identification index parameters include masking, mapping, truncation, rearrangement, transformation, hashing, and encryption. Each de-identification strategy is scored based on the number of times it has been used by the user after being returned in history, with one point awarded for each use. The multiple de-identification strategies are then sorted in descending order according to the scores and returned. As another example, for text data, the de-identification strategy with the highest score is masking, and there are two masking strategies that meet the true de-identification index parameters. If one or both of the masking strategies have been used in the history of masking strategies, the two masking strategies can be sorted in descending order of their scores and returned. If neither of the two masking strategies has been used in the history of masking strategies, the two masking strategies will be returned to the user in parallel.

[0084] Example 2

[0085] like Figure 3 The diagram shown is a functional block diagram of the privacy protection device in this embodiment 2.

[0086] The privacy protection device 3 includes an identification module 31, a determination module 32, an acquisition module 33, an adjustment module 34, and a desensitization module 35. The module referred to in this invention is a series of computer program segments that can be executed by a processor and perform a fixed function, and which are stored in memory. In this embodiment, the functions of each module will be described in detail in subsequent embodiments.

[0087] Identification module 31 is used to identify the data to be de-identified.

[0088] In an exemplary embodiment, a user's data request is intercepted, and the data to be de-identified in the data request is extracted; the user's identity information is identified, and a description of the purpose of the data to be de-identified is obtained based on the identity information.

[0089] The determination module is used to determine the data security level and data security coefficient corresponding to the data to be de-identified according to the usage description.

[0090] In an exemplary embodiment, the data security level and data security coefficient corresponding to the usage description are retrieved from a preset level configuration area; wherein, the level configuration area pre-stores the correspondence between each usage description and the data security level and data security coefficient corresponding to the usage description.

[0091] The acquisition module is used to acquire baseline anonymization index parameters, which include K value, L value, and T value. The K value is used to characterize the privacy parameter value corresponding to the K-anonymity processing scheme, the L value is used to characterize the privacy parameter value corresponding to the L-diversity processing scheme, and the T value is used to characterize the privacy parameter value corresponding to the T-closeness processing scheme.

[0092] In an exemplary embodiment, a dataset of de-identified samples is obtained, which includes multiple de-identified data subsets of different field types. A predetermined number of the de-identified data subsets are extracted from the dataset in a decreasing manner to generate a first particle swarm, and a first de-identification index parameter of the first particle swarm is calculated. A predetermined number of the de-identified data subsets are then extracted from the dataset and combined with the first particle swarm to generate a second particle swarm, and a second de-identification index parameter of the second particle swarm is calculated. This process is iterated until the calculation of all the de-identified data subsets in the dataset is completed, thereby obtaining the baseline de-identification index parameter of the dataset.

[0093] The adjustment module is used to adjust the baseline desensitization index parameters according to the data security level and data security coefficient to obtain the actual desensitization index parameters.

[0094] In an exemplary embodiment, the baseline de-identification index parameters are determined based on the data security level; a preset weight value for the data security coefficient is obtained; and the baseline de-identification index parameters are adjusted based on the weight value to obtain the actual de-identification index parameters.

[0095] The desensitization module is used to desensitize the data to be desensitized based on the actual desensitization index parameters until the desensitization result meets the actual desensitization index parameters, and then return the desensitization result.

[0096] In an exemplary embodiment, the desensitization result includes multiple desensitization strategies, each of which conforms to the true desensitization index parameters; the multiple desensitization strategies are scored and ranked, and then sorted in descending order based on the scores and returned.

[0097] Example 3

[0098] like Figure 4 The diagram shown is a structural schematic of the computer device used in the privacy protection method of this embodiment three.

[0099] In exemplary embodiments, the computer device 4 includes, but is not limited to, a memory 41, a processor 42, and a computer program, such as a privacy protection program, stored in the memory 41 and executable on the processor. Those skilled in the art will understand that the schematic diagrams are merely examples of computer devices and do not constitute a limitation on the computer device. The device may include more or fewer components than illustrated, or combine certain components, or different components. For example, the computer device may also include input / output devices, network access devices, buses, etc.

[0100] The memory 41 includes at least one type of computer-readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 may be an internal storage module of a computer device, such as the hard disk or memory of the computer device. In other embodiments, the memory 41 may also be an external storage device of the computer device, such as a plug-in hard disk, smart memory card (SMC), secure digital card (SD), flash memory card, etc., provided on the computer device. Of course, the memory 41 may include both the internal storage module and the external storage device of the computer device. In this embodiment, the memory 41 is typically used to store the operating system and various application software installed on the computer device. In addition, the memory 41 may also be used to temporarily store various types of data that have been output or will be output.

[0101] The processor 42 can be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor. The processor 42 is the core of the computer device's operation and control center, connecting various parts of the computer device through various interfaces and lines, and executing the computer device's operating system and various installed applications and program code.

[0102] The processor 42 executes the operating system of the computer device and various installed applications. The processor 42 executes the applications to implement the steps in the various privacy protection method embodiments described above, for example... Figure 1 The steps S100 and S200 are shown.

[0103] Example 4

[0104] This embodiment also provides a computer-readable storage medium, such as flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, server, App store, etc., which stores a computer program. When the program is executed by a processor, it performs corresponding functions. The computer-readable storage medium of this embodiment is used to store a computer program that implements the privacy protection method, and when executed by processor 42, it implements the privacy protection method of embodiment one, two, or three.

[0105] Furthermore, the computer-readable storage medium may primarily include a program storage area and a data storage area, wherein the program storage area may store the operating system, at least one application required for a function, etc.; and the data storage area may store data created based on the use of blockchain nodes, etc.

[0106] The blockchain referred to in this invention is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms. Essentially, a blockchain is a decentralized database, a chain of data blocks linked together using cryptographic methods. Each data block contains information about a batch of network transactions, used to verify the validity of the information (anti-counterfeiting) and generate the next block. A blockchain can include an underlying blockchain platform, a platform product service layer, and an application service layer.

[0107] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0108] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0109] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method.

[0110] The above are merely preferred embodiments of the present invention and do not limit the scope of the patent. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the scope of patent protection of the present invention.

Claims

1. A privacy protection method, characterized in that, include: Explanation of the purpose of identifying data to be de-identified; Determine the data security level and data security coefficient corresponding to the data to be de-identified based on the aforementioned usage description; Obtain benchmark anonymization index parameters, including K, L, and T values. The K value characterizes the privacy parameter value corresponding to the K-anonymity processing scheme, the L value characterizes the privacy parameter value corresponding to the L-diversity processing scheme, and the T value characterizes the privacy parameter value corresponding to the T-closeness processing scheme. These benchmark anonymization index parameters are obtained through the following steps: Obtain the dataset of de-identified samples, which includes multiple subsets of de-identified data with different field types; A predetermined number of desensitized data subsets are extracted from the desensitized sample dataset using a decreasing method to generate a first particle swarm, and a first desensitization index parameter of the first particle swarm is calculated. A predetermined number of desensitized data subsets are extracted from the desensitized sample dataset, combined with the first particle swarm to generate a second particle swarm, and the second desensitization index parameter of the second particle swarm is calculated. This calculation is iterated until the calculation of all desensitized data subsets in the dataset to be desensitized is completed, so as to obtain the baseline desensitization index parameter of the dataset to be desensitized; wherein, the baseline desensitization index parameter is used to characterize the privacy and security parameters of the desensitization result obtained after desensitizing the dataset to be desensitized, and the baseline desensitization index parameter is the median value of the maximum and minimum desensitization index parameters of the dataset to be desensitized; The minimum desensitization index parameter is calculated based on the desensitization result of the data in the first particle swarm according to the minimum privacy leakage desensitization strategy. The minimum desensitization index parameter is used to characterize the privacy security of the desensitization result of the first particle swarm after desensitization. The minimum privacy leakage desensitization strategy is a method with a high degree of desensitization. The maximum desensitization index parameter is calculated based on the desensitization results of the data in the first particle swarm according to the maximum privacy leakage desensitization strategy. The maximum desensitization index parameter is used to characterize the privacy security of the desensitization results of the first particle swarm after desensitization; the maximum privacy leakage desensitization strategy is a method with a low degree of desensitization. Based on the data security level and data security coefficient, the baseline desensitization index parameters are adjusted to obtain the actual desensitization index parameters; The data to be desensitized is desensitized based on the actual desensitization index parameters until the desensitization result meets the actual desensitization index parameters, and then the desensitization result is returned.

2. The privacy protection method according to claim 1, characterized in that, Before the description of the purpose of identifying the data to be de-identified, the following is included: Intercept user data requests and extract the data to be de-identified from the data requests; Identify the user's identity information and obtain a description of the purpose of the data to be de-identified based on the identity information.

3. The privacy protection method according to claim 1, characterized in that, The step of determining the data security level and data security coefficient corresponding to the data to be de-identified according to the usage description includes: The data security level and data security coefficient corresponding to the usage description are retrieved from the preset level configuration area; wherein, the level configuration area pre-stores the correspondence between each usage description and the corresponding data security level and data security coefficient.

4. The privacy protection method according to claim 1, characterized in that, The calculation of the first desensitization index parameter of the first particle swarm includes: Obtain the preset minimum privacy leakage desensitization strategy and maximum privacy leakage desensitization strategy of the first particle swarm; The first particle swarm is desensitized according to the minimum privacy leakage desensitization strategy and the maximum privacy leakage desensitization strategy respectively, so as to obtain the minimum desensitization index parameter and the maximum desensitization index parameter of the first particle swarm. The first desensitization index parameter of the first particle swarm is obtained based on the minimum and maximum desensitization index parameters.

5. The privacy protection method according to claim 1, characterized in that, The step of adjusting the baseline de-identification index parameters according to the data security level and data security coefficient to obtain the actual de-identification index parameters includes: The baseline de-identification index parameters are determined based on the data security level. Obtain the preset weight value of the data security coefficient; The baseline desensitization index parameters are adjusted according to the weight values ​​to obtain the actual desensitization index parameters.

6. The privacy protection method according to claim 1, characterized in that, The process of desensitizing the data to be desensitized based on the actual desensitization index parameters, until the desensitization result meets the actual desensitization index parameters, and then returning the desensitization result includes: The desensitization results include multiple desensitization strategies, and each of the desensitization strategies conforms to the actual desensitization index parameters; The desensitization strategies are scored and ranked, and then sorted in descending order based on the scores and returned.

7. A privacy protection device, characterized in that, include: The purpose of the identification module is to identify the data to be de-identified. The determination module is used to determine the data security level and data security coefficient corresponding to the data to be de-identified according to the above-described purpose. The acquisition module is used to acquire baseline de-identification index parameters, which include K value, L value, and T value. The K value is used to characterize the privacy parameter value corresponding to the K-anonymity processing scheme, the L value is used to characterize the privacy parameter value corresponding to the L-diversity processing scheme, and the T value is used to characterize the privacy parameter value corresponding to the T-closeness processing scheme. The baseline de-identification index parameters are obtained through the following steps: acquiring the dataset of samples to be de-identified, which includes multiple subsets of de-identified data with different field types. A predetermined number of desensitized data subsets are extracted from the desensitized sample dataset using a decreasing method to generate a first particle swarm, and a first desensitization index parameter of the first particle swarm is calculated. A predetermined number of desensitized data subsets are extracted from the desensitized sample dataset and combined with the first particle swarm to generate a second particle swarm. The second desensitization index parameter of the second particle swarm is calculated, and this calculation is iteratively repeated until all desensitized data subsets in the dataset to be desensitized are calculated to obtain the baseline desensitization index parameter of the dataset to be desensitized. The baseline desensitization index parameter is used to characterize the privacy and security parameters of the desensitized result obtained after desensitizing the dataset to be desensitized. The baseline desensitization index parameter is the median value between the maximum and minimum desensitization index parameters of the dataset to be desensitized; the minimum... The desensitization index parameter is calculated based on the desensitization results of the data in the first particle swarm using a minimum privacy leakage desensitization strategy. The minimum desensitization index parameter characterizes the privacy security of the desensitized data in the first particle swarm, and the minimum privacy leakage desensitization strategy represents a method with a high degree of desensitization. The maximum desensitization index parameter is calculated based on the desensitization results of the data in the first particle swarm using a maximum privacy leakage desensitization strategy. The maximum desensitization index parameter characterizes the privacy security of the desensitized data in the first particle swarm, and the maximum privacy leakage desensitization strategy represents a method with a low degree of desensitization. The adjustment module is used to adjust the baseline de-identification index parameters according to the data security level and data security coefficient to obtain the actual de-identification index parameters; The desensitization module is used to desensitize the data to be desensitized based on the actual desensitization index parameters until the desensitization result meets the actual desensitization index parameters, and then return the desensitization result.

8. A computer device, characterized in that, include: Memory, which stores at least computer programs; and The processor executes a computer program stored in the memory to implement the privacy protection method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, characterized in that the computer program is executed by a processor to implement the privacy protection method as described in any one of claims 1 to 6.

Images