Privacy protection method, device and storage medium for information query

Abstract

An embodiment of the present invention provides a privacy protection method, device, and storage medium for information query. The method includes: splitting an original data set into a time-division data set and a code-division data set, where the time-division data set is allocated a first privacy budget, and the code-division data set is allocated a second privacy budget; adding noise to the time-division data set and the code-division data set; querying information from the time-division data set and / or the code-division data set, and consuming the privacy budget according to the query result. Wherein, when querying information from the time-division data set, the first privacy budget is consumed, and when querying information from the code-division data set, the second privacy budget is consumed.

Description

Technical Field

[0001] An embodiment of the present invention relates to the field of communications, and in particular, to a privacy protection method, device, and storage medium for information query. Background Art

[0002] Currently, a large number of applications (also simply referred to as APPs) are installed on each smart phone. During the operation of mobile application services, it is necessary to provide targeted services for users based on personal information, so a large amount of personal information needs to be collected, such as the International Mobile Equipment Identity (IMEI) number of the terminal, the Media Access Control (MAC) address, the network type, the user's mobile phone number, ID number, home address, family members and other information.

[0003] However, how to safely collect personal information without causing personal privacy leakage is a problem that must be solved in front of mobile application security control and mobile application security operation. Currently, a means to protect information privacy and security is to desensitize mobile terminal data. The mobile application collects personal information such as the mobile terminal IMEI number, MAC address, mobile phone number, etc., and after unified transformation, replaces it with other characters and stores it in the mobile terminal, and sends it to the server. After receiving the above information, the server can restore the originally desensitized information according to other background knowledge mastered by the server, such as the user name of the local machine, the IP address of the local machine, etc., so as to achieve the purpose of comprehensively mastering the user's personal information.

[0004] It can be seen that the method of using desensitization technology to protect personal information of mobile terminals cannot well protect personal information and there is a great hidden danger of personal information leakage. It should be noted that this problem not only exists in the scenario of using APPs on mobile terminals, but also in any scenario that may involve information collection and information transmission, similar information leakage problems will occur. Summary of the Invention

[0005] An embodiment of the present invention provides a privacy protection method, device, and storage medium for information query, so as to at least solve the problem that the method of using desensitization technology to protect personal information of mobile terminals cannot well protect personal information and there is a great hidden danger of personal information leakage.

[0006] According to an embodiment of the present invention, there is provided a privacy protection method for information query, including:

[0007] Split the original dataset into a time-division dataset and a code-division dataset, where the time-division dataset is allocated a first privacy budget and the code-division dataset is allocated a second privacy budget;

[0008] Add noise to the time-division dataset and the code-division dataset;

[0009] Query information from the time-division dataset and / or the code-division dataset, and consume the privacy budget according to the query result. Specifically, when querying information from the time-division dataset, consume the first privacy budget, and when querying information from the code-division dataset, consume the second privacy budget.

[0010] In at least one exemplary embodiment, splitting the original dataset into a time-division dataset and a code-division dataset includes:

[0011] Divide the original dataset into a first original dataset and a second original dataset according to a predetermined strategy;

[0012] Split the first original dataset into the time-division dataset in a time-division manner and split the second original dataset into the code-division dataset in a code-division manner.

[0013] In at least one exemplary embodiment, splitting the first original dataset into the time-division dataset in a time-division manner includes:

[0014] Pre-set a time divider, where a first preset duration is set on the time divider, and the time divider is used to divide multiple time periods according to the first preset duration;

[0015] Pack the log data in the first original dataset into multiple time-division datasets corresponding to the multiple time periods respectively.

[0016] In at least one exemplary embodiment, splitting the second original dataset into the code-division dataset in a code-division manner includes:

[0017] Pre-set a code divider, where a second preset duration is set on the code divider, and the code divider is used to generate random numbers with the second preset duration as a period;

[0018] Based on the random numbers, pack the log data in the first original dataset into multiple code-division datasets. Specifically, when the random numbers fall within a preset value range, complete the packing of the previous code-division dataset and generate a new code-division dataset.

[0019] In at least one exemplary embodiment, the predetermined strategy includes one of the following:

[0020] Based on the time division of the log data in the original dataset;

[0021] Divided based on the service types corresponding to the log data in the original dataset.

[0022] In at least one exemplary embodiment, adding noise to the time-division dataset and the code-division dataset includes: applying a first privacy protection algorithm to add noise to the time-division dataset, and applying a second privacy protection algorithm to add noise to the code-division dataset.

[0023] In at least one exemplary embodiment, the noise is random noise following a Laplace distribution; the first privacy protection algorithm M1 and the second privacy protection algorithm M2 satisfy the following conditions:

[0024] M1(F(D1)) = M1(F(D1'));

[0025] M2(F(D2)) = M2(F(D2')),

[0026] where F is a query function, D1 represents the time-division dataset, D1' represents the neighboring dataset of the time-division dataset, D2 represents the code-division dataset, and D2' represents the neighboring dataset of the code-division dataset.

[0027] In at least one exemplary embodiment, when querying information from the time-division dataset, consuming the first privacy budget, and when querying information from the code-division dataset, consuming the second privacy budget includes:

[0028] When querying information from the time-division dataset, consuming the first privacy budget based on a first privacy budget consumption algorithm;

[0029] When querying information from the code-division dataset, consuming the second privacy budget based on a second privacy budget consumption algorithm.

[0030] In at least one exemplary embodiment, after querying information from the time-division dataset and / or the code-division dataset, the method further includes:

[0031] Obtaining a query record;

[0032] Update the Merkle tree composed of hash nodes and service nodes according to the query record, where the service nodes are located at the bottom layer of the Merkle tree, and there are multiple layers of hash nodes above the service nodes. The query records of the time-division dataset and the code-division dataset are stored in different service nodes. For any hash node in the bottom-layer hash nodes, the hash value is generated based on the query records stored in all its subordinate service nodes. For any hash node in the non-bottom-layer hash nodes, the hash value is generated based on the hash values of all its subordinate hash nodes.

[0033] In at least one exemplary embodiment, the consumption of the privacy budget according to the query result includes:

[0034] Detect that the hash value of the highest-layer hash node in the Merkle tree has changed;

[0035] Compare whether the hash values of all hash nodes in the next layer have changed. If the hash value of a node has changed, continue to compare whether the hash values of all its subordinate hash nodes in the layer below have changed until the service node where the change has occurred is reached, and determine from which dataset the information was queried;

[0036] Consume the privacy budget allocated to the determined dataset.

[0037] In at least one exemplary embodiment, after consuming the privacy budget according to the query result, the method further includes:

[0038] If the consumed privacy budget meets a predetermined condition, re-determine the added noise and perform the step of adding noise.

[0039] According to an embodiment of the present invention, there is also provided a privacy protection device for information query, including:

[0040] A dataset partitioning module for splitting the original dataset into a time-division dataset and a code-division dataset, where the time-division dataset is allocated a first privacy budget, and the code-division dataset is allocated a second privacy budget;

[0041] A noise addition module for adding noise to the time-division dataset and the code-division dataset;

[0042] A query processing module for querying information from the time-division dataset and / or the code-division dataset and consuming the privacy budget according to the query result, where when querying information from the time-division dataset, the first privacy budget is consumed, and when querying information from the code-division dataset, the second privacy budget is consumed.

[0043] According to an embodiment of the present invention, there is also provided a computer-readable storage medium storing a computer program, wherein the computer program is configured to execute the steps in any one of the above method embodiments when running.

[0044] According to an embodiment of the present invention, there is also provided an electronic device including a memory and a processor, where the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0045] Through the present invention, since the original data set is split into a time-division data set and a code-division data set, different original privacy budgets are respectively allocated to different data sets, and different noises are respectively added. When information queries are made based on different data sets, the privacy budget corresponding to the queried data set is adjusted. This method is equivalent to isolating different data sets and providing separate differential attack protection for each data set, which can solve the problem that the method of using desensitization technology to protect personal information of mobile terminals cannot well protect personal information and there is a great potential risk of personal information leakage, and greatly improve the personal information protection ability and the security during the data usage process. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 is a schematic diagram of the data desensitization process according to an embodiment of the present invention;

[0047] Figure 2 is a hardware structure block diagram of a computer device for the privacy protection method of information query according to an embodiment of the present invention;

[0048] Figure 3 is a flowchart of the privacy protection method of information query according to an embodiment of the present invention;

[0049] Figure 4 is a structure block diagram of the privacy protection device for information query according to an embodiment of the present invention;

[0050] Figure 5 is a schematic diagram of the overall architecture of the information privacy protection solution according to an embodiment of the present invention;

[0051] Figure 6 is a schematic diagram of the generation of the time-division data set according to an embodiment of the present invention;

[0052] Figure 7 is a schematic diagram of the generation of the code-division data set according to an embodiment of the present invention;

[0053] Figure 8 is a schematic diagram of the noise algorithm according to an embodiment of the present invention;

[0054] Figure 9Schematic diagram of a Merkle tree for personal information query according to an embodiment of the present invention;

[0055] Figure 10 Schematic diagram of the update of the Merkle tree for personal information query according to an embodiment of the present invention;

[0056] Figure 11 PMW value range histogram according to an embodiment of the present invention;

[0057] Figure 12 Schematic diagram of the system architecture when applied to a specific project according to an embodiment of the present invention;

[0058] Figure 13 Schematic diagram of the random noise technology principle according to an embodiment of the present invention. Detailed implementation manners

[0059] Currently, the industry mainly uses data desensitization technology to replace and delete sensitive information to achieve the purpose of data security protection. Figure 1 Schematic diagram of the data desensitization process according to an embodiment of the present invention. Currently, there are mainly two data desensitization technologies: dynamic desensitization and static desensitization. Among them, dynamic desensitization means that after the system obtains the data to be desensitized, it immediately performs the desensitization operation, and then sends the desensitized data to the data user. This method requires a relatively high processing capacity for the desensitization program. Static desensitization means that the data set to be desensitized is uniformly desensitized first and then stored in an intermediate medium. The data user reads the desensitized data from the intermediate medium. This desensitization method obviously has an asynchronous feature and generally does not have a very high requirement for the real-time performance of the desensitization program.

[0060] Some adoptable desensitization methods are as follows:

[0061] Replacement method, that is, replacing specific characters in the original data, such as numbers, with random numbers. This method is generally applied to the desensitization of ID numbers and mobile phone numbers.

[0062] Masking method, that is, replacing specific characters in the original data, such as a person's name, with asterisks.

[0063] Transformation method, that is, replacing specific characters in the original data, such as a person's name, with other strings. This method is generally used when the data is transferred from the production environment to the test environment, although the relationship between the data is retained. If all are replaced with asterisks, the primary and foreign key relationships between the data will be lost and it cannot be used for program testing.

[0064] Random method, that is, replacing specific characters in the original data, such as bank statements, with random numbers. This is because bank statements generally do not appear as primary keys or foreign keys, and replacing them with random numbers can ensure personal information security without leaking personal information.

[0065] In the scenario of mobile terminal data desensitization, the mobile application collects personal information such as the mobile terminal IMEI number, MAC address, mobile phone number, etc. After unified transformation, it replaces them with other characters and stores them in the mobile terminal, and sends them to the server. After receiving the above information, the server can restore the originally desensitized information according to other background knowledge mastered by the server, such as the user name of this machine, the Internet Protocol (IP) address of this machine, etc., so as to achieve the purpose of comprehensively mastering the user's personal information. It can be seen that the method of using desensitization technology to protect personal information on mobile terminals cannot well protect personal information, and there is a great hidden danger of personal information leakage. The personal information collection method based on desensitization technology cannot resist differential attacks. An attacker can associate the desensitized data with other publicly available or already mastered data sets, and gradually restore personal information completely or partially by continuously accumulating and enriching background knowledge.

[0066] Considering that desensitization technology can no longer well protect the privacy of public data sets, the embodiments of the present invention propose a privacy protection method, device and storage medium for information query, which provide a means for secure collection of personal information based on differential privacy. Differential privacy is a new privacy definition proposed for the privacy leakage problem of statistical databases. Differential privacy is applicable to statistical queries and is the first method to systematically quantify privacy mathematically, evaluate privacy leakage and the effectiveness of protection means quantitatively. The privacy protection solution for information query provided by the embodiments of the present invention solves the problem of privacy leakage caused by the fact that when mobile applications collect personal information of terminal users in the past, the public data set can be restored through differential attacks. This method sends the personal information protected by differential privacy to the server, ensuring that the server cannot restore this personal information that has undergone privacy protection processing through technical means, thus achieving the purpose of secure use of personal information.

[0067] The embodiments of the present invention will be described in detail below with reference to the accompanying drawings and in conjunction with the embodiments.

[0068] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and do not have to be used to describe a specific order or sequence.

[0069] The method embodiments provided in the embodiments of the present application can be executed on a computer device, a mobile terminal or a similar computing device. Taking running on a computer device as an example, Figure 2 is a hardware structure block diagram of a computer device for a privacy protection method for information query according to an embodiment of the present invention. As Figure 2 shown, the computer device may include one or more ( Figure 2Only one processor 202 is shown (the processor 202 may include, but is not limited to, a processing device such as a microprocessor MCU or a field programmable gate array FPGA), and a memory 204 for storing data. Among them, the above computer device may further include a transmission device 206 for communication functions and an input / output device 208. Those of ordinary skill in the art can understand that Figure 1 The structure shown is only schematic and does not limit the structure of the above computer device. For example, the computer device may further include more or fewer components than Figure 1 shown in, or have a different configuration from Figure 1 shown.

[0070] The memory 204 can be used to store computer programs. For example, software programs and modules of application software, such as the computer program corresponding to the privacy protection method for information query in the embodiment of the present invention. The processor 202 executes various functional applications and data processing by running the computer program stored in the memory 204, that is, implements the above method. The memory 204 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memories. In some instances, the memory 204 may further include a memory remotely set relative to the processor 202, and these remote memories can be connected to the computer device through a network. Examples of the above network include, but are not limited to, the Internet, an enterprise intranet, a local area network, a mobile communication network, and combinations thereof.

[0071] The transmission device 206 is used to receive or send data via a network. Specific examples of the above network may include a wired or wireless network provided by a communication provider of the computer device. In one instance, the transmission device 206 includes a network adapter (abbreviated as NIC), which can be connected to other network devices and thus communicate with the Internet. In one instance, the transmission device 206 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly, or may also be a wired communication module, which is used to communicate with the Internet by wire.

[0072] In this embodiment, a privacy protection method for information query running on the above computer device is provided. Figure 3 It is a flowchart of the privacy protection method for information query according to the embodiment of the present invention. As Figure 3 shown, the process includes the following steps:

[0073] Step S302: Split the original data set into a time-division data set and a code-division data set. Among them, the time-division data set is allocated a first privacy budget, and the code-division data set is allocated a second privacy budget.

[0074] In at least one exemplary embodiment, the original data set can be split into a time-division data set and a code-division data set in the following manner:

[0075] Step S302-1: Divide the original data set into a first original data set and a second original data set according to a predetermined strategy. The predetermined strategy can be a strategy designed according to the application scenario or information query requirements. For example, in at least one exemplary embodiment, the original data set can be divided into a first original data set and a second original data set based on the time of the log data in the original data set. For example, the log data for different dates is divided into different original data sets; or, it is divided based on the service type corresponding to the log data in the original data set. For example, the log data for different service types is divided into different original data sets. It should be noted that the first original data set and the second original data set here do not specifically refer to two data sets, but generally refer to two types of data sets, that is, the original data set to be divided by code-division and the original data set to be divided by time-division.

[0076] Step S302-2: Split the first original data set into the time-division data set in a time-division manner and split the second original data set into the code-division data set in a code-division manner.

[0077] In at least one exemplary embodiment, splitting the first original data set into the time-division data set in Step S302-2 may include:

[0078] Pre-set a time divider, where a first preset duration is set on the time divider, and the time divider is used to divide multiple time periods according to the first preset duration;

[0079] Pack the log data in the first original data set into multiple time-division data sets corresponding to the multiple time periods respectively.

[0080] In at least one exemplary embodiment, splitting the second original data set into the code-division data set in Step S302-2 may include:

[0081] Pre-set a code divider, where a second preset duration is set on the code divider, and the code divider is used to generate random numbers with the second preset duration as a period;

[0082] Based on the random number, the log data in the first original data set is packed into multiple code-division data sets. Wherein, when the random number falls within a preset value range, the packing of the previous code-division data set is completed, and a new code-division data set is newly generated. In practical applications, the preset value range can be set according to the random number generation algorithm on the code-division device and the distribution ratio of time-division and code-division data sets. An exemplary setting method is that if the random number is positive, a new data set package is generated. If the random number is negative, a new data set package is not generated, and the old data set package is continued to be used.

[0083] Step S304, add noise to the time-division data set and the code-division data set.

[0084] In at least one exemplary embodiment, adding noise to the time-division data set and the code-division data set may include: applying a privacy protection algorithm to add noise to the time-division data set and the code-division data set.

[0085] In at least one exemplary embodiment, the noise is random noise that follows a Laplace distribution (i.e., the Laplace distribution, which is a continuous probability distribution); the privacy protection algorithm M satisfies the following conditions, that is, the privacy protection algorithm M should be able to provide differential privacy protection for the time-division data set D1 and the code-division data set D2:

[0086] M(F(D1)) = M(F(D1'));

[0087] M(F(D2)) = M(F(D2')),

[0088] wherein, F is a query function, D1 represents the time-division data set, D1' represents the neighboring data set of the time-division data set, D2 represents the code-division data set, and D2' represents the neighboring data set of the code-division data set.

[0089] In at least one exemplary embodiment, adding noise to the time-division data set and the code-division data set may include: applying a first privacy protection algorithm to add noise to the time-division data set, and applying a second privacy protection algorithm to add noise to the code-division data set.

[0090] In at least one exemplary embodiment, the noise is random noise that follows a Laplace distribution (i.e., the Laplace distribution, which is a continuous probability distribution); the first privacy protection algorithm M1 and the second privacy protection algorithm M2 satisfy the following conditions, that is, the first privacy protection algorithm M1 and the second privacy protection algorithm M2 should be able to provide differential privacy protection for the corresponding time-division data set D1 and code-division data set D2:

[0091] M1(F(D1)) = M1(F(D1'));

[0092] M2(F(D2)) = M2(F(D2')),

[0093] where F is a query function, D1 represents the time-division data set, D1' represents the neighboring data set of the time-division data set, D2 represents the code-division data set, and D2' represents the neighboring data set of the code-division data set.

[0094] As an exemplary embodiment, let the bit-setting parameter be 0, and the Laplace distribution of the scale parameter a be Lap(a), and its probability density function is:

[0095] Another expression form is

[0096] Step S306, query information from the time-division data set and / or the code-division data set, and consume the privacy budget according to the query result. Among them, when querying information from the time-division data set, consume the first privacy budget, and when querying information from the code-division data set, consume the second privacy budget.

[0097] In at least one exemplary embodiment, when step S306 queries information from the time-division data set, consuming the first privacy budget, and when querying information from the code-division data set, consuming the second privacy budget may include:

[0098] When querying information from the time-division data set, consume the first privacy budget based on the first privacy budget consumption algorithm;

[0099] When querying information from the code-division data set, consume the second privacy budget based on the second privacy budget consumption algorithm.

[0100] Both the first privacy budget consumption algorithm and the second privacy budget consumption algorithm are algorithms that can calculate the corresponding budget consumption situation based on the query result. For example, for the first privacy budget, the median (i.e., the number in the middle position in a set of data arranged in order) mechanism can be used as the first privacy budget consumption algorithm, and for the second privacy budget, the private multiplicative weights (PMW, which constructs a composite algorithm through a voting mechanism for privacy budget consumption) algorithm can be used as the second privacy budget consumption algorithm.

[0101] Some examples of the first privacy budget consumption algorithm and the second privacy budget consumption algorithm are given below. It should be noted that these examples are only for easy understanding and do not limit the protection scope of the present invention.

[0102] The first privacy budget consumption algorithm: For queries on time-division data sets, construct a result set matrix M{type,count} composed of the result set of the query result and the number of result set entries, where type is the result set type and count is the number of result set entries; determine whether the result set type corresponding to the query result appears in the result set matrix M. If it does not appear in the result set matrix M, add the result set type type and the corresponding number of result set entries count to the result set matrix M, and use the remainder obtained by taking the value of the number of result set entries count modulo 2 as the privacy budget consumed by this query. If it appears in the result set matrix M, add the number of result set entries corresponding to the query result to the number of result set entries count corresponding to the result set type in the result set matrix M. Then, determine the median of the number of result set entries in the result set matrix, and use the remainder obtained by taking the median modulo 2 as the privacy budget consumed by this query.

[0103] The second privacy budget consumption algorithm: For queries on code-division data sets, construct a result set matrix M{type,count} composed of the result set of the query result and the number of result set entries, where type is the result set type and count is the number of result set entries; determine whether two consecutive query results are in the same value range. If they are in the same value range, use the number of result set entries corresponding to the current query modulo 2 as the privacy budget consumed by this query. If they are in different value ranges, use the sum of the maximum value of the histogram of the previous value range modulo 2 and the number of result set entries corresponding to the current query modulo 2 as the privacy budget consumed by this query.

[0104] In at least one exemplary embodiment, after querying information from the time-division data set and / or the code-division data set, the method further includes:

[0105] Obtain a query record;

[0106] Update a Merkle tree composed of hash nodes and service nodes according to the query record, where the service nodes are located at the bottom layer of the Merkle tree, and there are multiple layers of hash nodes above the service nodes. Query records for the time-division data set and the code-division data set are saved in different service nodes. For any hash node in the bottom layer of hash nodes, the hash value is generated based on the query records saved in all its subordinate service nodes. For any hash node in non-bottom-layer hash nodes, the hash value is generated based on the hash values of all its subordinate hash nodes.

[0107] In at least one exemplary embodiment, privacy budget consumption based on query results includes:

[0108] Detect that the hash value of the highest layer of hash nodes in the Merkle tree has changed;

[0109] Compare whether the hash values of all hash nodes in the next layer have changed. In the case where the hash value of a node has changed, continue to compare whether the hash values of all subordinate hash nodes of the changed node in the next lower layer have changed until the service node where the change occurs is reached, and determine from which data set the information is queried;

[0110] Consume the privacy budget allocated to the determined data set.

[0111] Through the Merkle tree, the situation of each query can be quickly recorded, and it can be convenient to quickly identify the query subsequently. Thus, subsequently, according to the personal information query situation through the Merkle tree, the privacy budget of the query method can be dynamically adjusted.

[0112] In at least one exemplary embodiment, after consuming the privacy budget according to the query result, the method further includes:

[0113] In the case where the consumed privacy budget meets a predetermined condition, re-determine the added noise and perform the step of adding noise.

[0114] As an exemplary embodiment, the consumed privacy budget meeting a predetermined condition may include: the deviation value of the median exceeds a predetermined number of standard deviations.

[0115] Through the above steps, since the original data set is split into a time-division data set and a code-division data set, different original privacy budgets are respectively allocated to different data sets, and different noises are respectively added. When querying information based on different data sets, the privacy budget corresponding to the queried data set is adjusted. This method is equivalent to isolating different data sets and performing differential attack protection for each data set separately. It can solve the problem that the method of protecting personal information of mobile terminals by using desensitization technology cannot well protect personal information and there is a great hidden danger of personal information leakage, and greatly improve the personal information guarantee ability and the security during the data usage process.

[0116] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases the former is a better implementation manner. Based on such an understanding, the technical solution of the present invention, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disc) and includes several instructions for causing a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in various embodiments of the present invention.

[0117] In this embodiment, a privacy protection device for information query is further provided. This device is used to implement the above-mentioned embodiments and preferred implementation manners, and those that have been described will not be repeated. As used hereinafter, the term "module" can be a combination of software and / or hardware that can achieve a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware is also possible and contemplated.

[0118] Figure 4 is a structural block diagram of a privacy protection device for information query according to an embodiment of the present invention. As Figure 4 shown, the device includes:

[0119] A dataset partitioning module 42, configured to split an original dataset into a time-division dataset and a code-division dataset, wherein the time-division dataset is allocated a first privacy budget, and the code-division dataset is allocated a second privacy budget;

[0120] A noise addition module 44, configured to add noise to the time-division dataset and the code-division dataset;

[0121] A query processing module 46, configured to query information from the time-division dataset and / or the code-division dataset, and consume the privacy budget according to the query result. Wherein, when querying information from the time-division dataset, the first privacy budget is consumed, and when querying information from the code-division dataset, the second privacy budget is consumed.

[0122] It should be noted that the above-mentioned various modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above-mentioned modules are all located in the same processor; or, the above-mentioned various modules are respectively located in different processors in any combination form.

[0123] Specific examples in this embodiment can refer to the examples described in the above-mentioned embodiments and exemplary implementation manners, and will not be repeated here.

[0124] An embodiment of the present invention further provides a computer-readable storage medium, in which a computer program is stored, and wherein the computer program is configured to execute the steps in any one of the above-mentioned method embodiments when running.

[0125] In an exemplary embodiment, the above-mentioned computer-readable storage medium may include, but is not limited to: a USB flash drive, a read-only memory (ROM for short), a random access memory (RAM for short), a mobile hard disk, a magnetic disk, or an optical disc, etc., various media that can store computer programs.

[0126] Specific examples in this embodiment may refer to the examples described in the above embodiments and exemplary embodiments, and will not be elaborated herein.

[0127] An embodiment of the present invention also provides an electronic device, including a memory and a processor. A computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0128] In an exemplary embodiment, the above electronic device may further include a transmission device and an input / output device. Among them, the transmission device is connected to the above processor, and the input / output device is connected to the above processor.

[0129] Specific examples in this embodiment may refer to the examples described in the above embodiments and exemplary embodiments, and will not be elaborated herein.

[0130] The following further illustrates the information privacy protection solution through a detailed embodiment for better understanding of the solution. This embodiment adopts a personal information security collection method and system based on differential privacy to provide differential privacy protection for the original data set containing a large amount of personal information, so that the server can safely use these data, not only reducing the security risk, but also meeting its business requirements at the same time.

[0131] Figure 5 is a schematic diagram of the overall architecture of the information privacy protection solution according to an embodiment of the present invention, as Figure 5 shown. The technical implementation process of this solution is as follows:

[0132] I. Data set generation. Generate a data set according to the requirements of time-division data set or code-division data set.

[0133] II. Adding obfuscation noise. The Laplace mechanism is used to add random noise obeying the Laplace distribution to the data set during collection.

[0134] III. Personal information query. Adopt time-division query or code-division query method to query personal information from the data set.

[0135] IV. Updating the privacy budget. Update the privacy budget value according to the query situation to avoid differential attacks.

[0136] The following elaborates on each step in detail.

[0137] I. Generation of personal information data set

[0138] The data set splitting methods include two types: time-division data set and code-division data set. Among them, the time-division data set refers to splitting the data set by time period, and the code-division data set refers to splitting the data set by the random number of randomly produced terminals.

[0139] (1) Time-division data set, Figure 6 is a schematic diagram of the generation of the time-division data set according to an embodiment of the present invention, as Figure 6 shown:

[0140] A time divider is preset on the terminal application, and the server dynamically sets the length of its time period, which can be one minute, one hour, or other time periods.

[0141] The terminal application packs the terminal log data packets into small packets according to the time period set by the time divider.

[0142] (2) Code-division data set, Figure 7 is a schematic diagram of the generation of the code-division data set according to an embodiment of the present invention, as Figure 7 shown:

[0143] A code divider is preset on the terminal application, and the server sets the random number generation frequency of the code divider, which can generate code-division identifiers per minute or per hour. According to the logical setting of the code divider, if the random number is positive, a new data set packet is generated. If the random number is negative, no new data set packet is generated, and the old data set packet is continued to be used.

[0144] II. Adding obfuscation noise

[0145] Figure 8 is a schematic diagram of the noise algorithm according to an embodiment of the present invention. In this embodiment, differential privacy protection technology is adopted to provide differential privacy protection for the data set. The Laplace mechanism is used to add random noise obeying the Laplace distribution to the query result. Let the Laplace distribution with the bit parameter of 0 and the scale parameter a be Lap(a), and its probability density function is:

[0146]

[0147] Let D be the desensitized data set, and F(D) be the query result of the data set D;

[0148] Let D’ be the neighboring data set of D, and F(D’) be the query result of the data set D’;

[0149] If M(F(D)) = M(F(D’)), then the privacy protection algorithm M provides differential privacy protection for D.

[0150] Among them, M(F(D)) = F(D) + p(x), M(F(D’)) = F(D’) + p(x).

[0151] III. Personal information query

[0152] The mobile application provides a personal information usage service protected by a Merkle trusted tree for the server to use a differentially private dataset through a security service. After each service call, the privacy budget value is updated according to the call situation.

[0153] (1) Merkle trusted tree construction

[0154] The mobile application automatically constructs a Merkle trusted tree, Figure 9 which is a schematic diagram of a Merkle tree for personal information query according to an embodiment of the present invention. As Figure 9 shown. The Merkle trusted binary tree consists of hash nodes and service nodes, and one application constructs one Merkle trusted tree.

[0155] First, according to the service call address, service name, parameters, return value, and call time, the domestic digest cipher algorithm SM3 is used to generate the hash value of the first-level Merkle trusted tree.

[0156] Then, the hash values of two first-level nodes are combined to generate the hash value of the second-level node.

[0157] Secondly, the hash values of two second-level nodes are combined to generate the hash value of the third-level node.

[0158] Finally, by analogy, all nodes are summarized together to generate a total hash value.

[0159] (2) Merkle trusted tree hash value update

[0160] When using the query service, the SM3 algorithm is automatically used to generate a new first-level node hash value according to the service call record.

[0161] By analogy upwards, the hash value of the highest node is updated.

[0162] Figure 10 which is a schematic diagram of the update of the Merkle tree for personal information query according to an embodiment of the present invention. Figure 10 It can be seen from

[0163] (3) Left-side time-division query and right-side code-division query

[0164] Dynamically use the left branch in the Merkle trusted tree as the time-division query and the right branch as the code-division query. Each time a query is made, the privacy protection algorithm updates the privacy budget or adjusts the noise according to the query type to ensure the security of personal information and avoid differential attacks.

[0165] IV. Update the privacy budget

[0166] In this embodiment, the privacy budget is divided into two categories: time-division budget and code-division budget.

[0167] (1) Time-division privacy budget

[0168] Adopt the median data mechanism in the query result set to construct a result set matrix M{type,count} composed of the result set and the number of result set entries, where type is the type of the result set and count is the number of result set entries.

[0169] If the type of the newly queried result set does not appear in matrix M, then add the type type and the number of result set entries count to the matrix, and use the remainder obtained by count value mod2 as the privacy budget value used for this query.

[0170] If the type of the newly queried result set already exists in matrix M, then increase the number of result set entries count under the M type in the matrix, and find the median of the count values under this M, and use the remainder obtained by the median of the count value mod2 as the privacy budget value used for this query.

[0171] During the query process, it gradually deviates outward from the median. When the deviation value exceeds 2 standard deviations, generate random noise again to adjust the probability density distribution of the output result.

[0172] (2) Code-division privacy budget

[0173] For the code-division privacy budget, adopt the PMW mechanism proposed by Hardt. PMW constructs a composite algorithm through a voting mechanism to consume the privacy budget. PWM takes the distribution of the query structure in the value domain as a histogram, sets the corresponding frequency for each query value and adds noise. If the difference between two queries is less than the preset acceptable difference value, then output the result of the previous query and do not consume the privacy budget. If the difference value is too large, then publish the new query result and consume a higher privacy budget.

[0174] Figure 11 It is based on the PMW value domain histogram of the embodiment of the present invention, as Figure 11 shown. When the previous and subsequent queries are in the same value domain, the privacy consumption is small, and use the number of result set entries mod2 as the privacy consumption value. When the previous and subsequent queries are in different values, the privacy consumption is large, and the sum of the maximum value of the previous value domain histogram mod2 plus the number of result set entries of this query mod2 is used as the privacy consumption value.

[0175] The following takes the application of this solution to the data security control service project of a certain city commercial bank as an example to illustrate the application method of the solution provided by the embodiment of the present invention.

[0176] This city commercial bank is a large commercial bank in my country, with branches in all provinces. Over years of operation, it has accumulated a vast amount of data, encompassing eight key categories: personal depositor data, credit data, corporate data, retail banking data, and guarantee data. The bank's parent group specializes in banking, consumer finance, and financial leasing. The bank's high-quality data assets provide effective data support for these sectors, improving decision-making accuracy and reducing non-performing loan rates. my country's relevant data security laws and regulations require data holders to safeguard the privacy of their customers' data. Therefore, how to meet the data needs of consumer finance and financial leasing institutions while protecting customer privacy is a crucial challenge facing financial institutions.

[0177] Figure 12 This is a schematic diagram of the system architecture of a specific project based on an embodiment of the present invention. This project uses differential privacy protection technology to build a data sharing system, ensuring secure data use while protecting personal privacy. The original dataset in this project is a massive dataset containing 10 million pieces of personal account information and transaction flow information. The method includes the following steps:

[0178] The first step is to desensitize the customer number, name, ID number, bank account number, and telephone number through desensitization technology.

[0179] In the second step, data noise is generated and added using the Laplace noise algorithm.

[0180] The third step is to query the dataset through the interface.

[0181] The fourth step is to update the privacy budget through the time budget or code budget algorithm.

[0182] Figure 13 2 is a schematic diagram of a random noise technology according to an embodiment of the present invention.

[0183] The desensitized dataset contains 10 million data items, which are divided into X datasets using the time-division dataset and code-division dataset algorithms.

[0184] Dataset X represents a dataset of 10 million records;

[0185] The dataset D∈Xi is a subset of X;

[0186] F(D) is the usage function for the data set;

[0187] M() is a privacy-preserving algorithm;

[0188] For data set D, M(F(D))=F(D)+e

[0189] D' is a subset of the data set D. For D', M(F(D'))=F(D')+e

[0190] where is the probability density function of the random noise in e.

[0191] where the Laplace distribution with scale parameter a is Lap(a).

[0192] The statistical results of M(F(D)) = M(F(D')) are the same.

[0193] When using conditions such as age, education level, income range, etc. to query the mortgage overdue ratio within a certain time period,

[0194] The probability distribution of M(F(D)) is {1.9, 1.9, 2.0, 2.3}

[0195] The overview distribution of M(F(D')) is {1.9, 1.9, 2.0, 2.3}

[0196] According to the principle of differential privacy protection, it can be proved that differential privacy protection that conforms to the mathematical basis has been provided for the dataset D.

[0197] In summary, the solution provided by the embodiments of the present invention proposes time-division datasets, code-division datasets, and dynamically generates personal information datasets to increase the difficulty of background knowledge attacks; applies the Laplace random noise algorithm to personal information protection, adds noise to the dataset by using the Laplace noise algorithm to achieve the purpose of satisfying both data usage and security; proposes a personal information query method based on the Merkle trusted tree, and dynamically adjusts the privacy budget of the query method according to the personal information query situation through the Merkle trusted tree; proposes time-division privacy budget and code-division privacy budget, associates the privacy budget with the dataset, and dynamically updates the privacy set of the personal information dataset to improve the protection intensity of the dataset.

[0198] This solution has the following advantages:

[0199] Greatly improve the personal information guarantee ability. The personal information protection method and system based on differential privacy, its security is mainly reflected in the following 3 points: 1. Use time-division datasets and code-division datasets to dynamically generate personal information datasets to increase the difficulty of background knowledge attacks. 2. Add noise to the dataset through the Laplace random noise algorithm to achieve the purpose of satisfying both data usage and security. 3. Dynamically update the privacy set of the personal information dataset by using time-division privacy budget and code-division privacy budget to improve the protection intensity of the dataset. Through the above methods, personal information protection is achieved, and personal privacy security is effectively guaranteed.

[0200] Significantly improve data usage efficiency. The personal information collection system based on differential privacy protection uses progressive data sets, code-division data sets, and splits data packets. The Laplace mechanism is used to add data noise. The time-division privacy budget and code-division privacy budget are used to improve security during data usage. Thus, it effectively protects personal information security. Data that could not originally be used by the server can be safely used under the condition of differential privacy protection, helping the server to realize the value of data and promoting business development with data.

[0201] Obviously, those skilled in the art should understand that the above-mentioned modules or steps of the present invention can be implemented by a general-purpose computing device. They can be concentrated on a single computing device or distributed on a network composed of multiple computing devices. They can be implemented with program codes executable by the computing device. Thus, they can be stored in a storage device and executed by the computing device. And in some cases, the steps shown or described can be executed in a different order than here, or they can be separately fabricated into individual integrated circuit modules, or multiple modules or steps among them can be fabricated into a single integrated circuit module to be implemented. In this way, the present invention is not limited to any specific combination of hardware and software.

[0202] The above are only the preferred embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention can have various changes and modifications. Any modifications, equivalent replacements, improvements, etc. made within the principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A privacy protection method for information query, characterized in that, Including: Splitting the original dataset into a time-division dataset and a code-division dataset, where the time-division dataset is assigned a first privacy budget and the code-division dataset is assigned a second privacy budget; Adding noise to the time-division dataset and the code-division dataset; Querying information from the time-division dataset and / or the code-division dataset and consuming the privacy budget according to the query result. Specifically, when querying information from the time-division dataset, the first privacy budget is consumed, and when querying information from the code-division dataset, the second privacy budget is consumed; After querying information from the time-division dataset and / or the code-division dataset, it further includes: Obtaining the query record; Updating the Merkle tree composed of hash nodes and service nodes according to the query record. Here, the service nodes are located at the bottom layer of the Merkle tree, and there are multiple layers of hash nodes above the service nodes. The query records for the time-division dataset and the code-division dataset are saved in different service nodes. For any hash node in the bottom layer of hash nodes, the hash value is generated based on the query records saved in all its subordinate service nodes. For any hash node in non-bottom-layer hash nodes, the hash value is generated based on the hash values of all its subordinate hash nodes; Consuming the privacy budget according to the query result includes: Detecting that the hash value of the highest-layer hash node in the Merkle tree has changed; Comparing whether the hash values of all hash nodes in the next layer have changed. If the hash value of a node has changed, continue to compare whether the hash values of all its subordinate hash nodes in the next lower layer have changed until the changed service node has been compared to determine from which dataset the information was queried; Consuming the privacy budget assigned to the determined dataset.

2. The method according to claim 1, characterized in that, Splitting the original dataset into a time-division dataset and a code-division dataset includes: Dividing the original dataset into a first original dataset and a second original dataset according to a predetermined strategy; Splitting the first original dataset into the time-division dataset in a time-division manner and splitting the second original dataset into the code-division dataset in a code-division manner.

3. The method according to claim 2, wherein Splitting the first original dataset into the time-division dataset in a time-division manner includes: Pre-setting a time divider, where a first preset duration is set on the time divider, and the time divider is used to divide into multiple time periods according to the first preset duration; Packing the log data in the first original dataset into multiple time-division datasets corresponding to the multiple time periods respectively.

4. The method according to claim 2, wherein Splitting the second original dataset into the code-division dataset in a code-division manner includes: Pre-setting a code divider, where a second preset duration is set on the code divider, and the code divider is used to generate random numbers with the second preset duration as a period; Based on the random numbers, packing the log data in the first original dataset into multiple code-division datasets. Specifically, when the random number falls within a preset value range, the packing of the previous code-division dataset is completed, and a new code-division dataset is generated.

5. The method according to claim 2, wherein The predetermined policy includes one of the following: Partitioning based on the time of the log data in the original dataset; Partitioning based on the service type corresponding to the log data in the original dataset.

6. The method according to claim 1, wherein Adding noise to the time-division dataset and the code-division dataset includes: Applying a first privacy protection algorithm to add noise to the time-division dataset and applying a second privacy protection algorithm to add noise to the code-division dataset.

7. The method according to claim 6, characterized in that, The noise is random noise subject to a Laplace distribution; the first privacy protection algorithm M1 and the second privacy protection algorithm M2 satisfy the following conditions: M1(F(D1)) = M1(F(D1')); M2(F(D2)) = M2(F(D2')), where F is a query function, D1 represents the time-division dataset, D1' represents the neighboring dataset of the time-division dataset, D2 represents the code-division dataset, and D2' represents the neighboring dataset of the code-division dataset.

8. The method according to claim 1, wherein When querying information from the time-division dataset, consuming the first privacy budget, and when querying information from the code-division dataset, consuming the second privacy budget includes: When querying information from the time-division dataset, consuming the first privacy budget based on the first privacy budget consumption algorithm; When querying information from the code-division dataset, consuming the second privacy budget based on the second privacy budget consumption algorithm.

9. The method according to claim 1 or 8, characterized in that, After consuming the privacy budget according to the query result, it further includes: When the consumed privacy budget meets the predetermined condition, re-determining the added noise and performing the step of adding noise.

10. A privacy protection device for information query, characterized in that, It includes: A dataset partitioning module for splitting the original dataset into a time-division dataset and a code-division dataset, where the time-division dataset is allocated a first privacy budget and the code-division dataset is allocated a second privacy budget; A noise adding module for adding noise to the time-division dataset and the code-division dataset; A query processing module for querying information from the time-division dataset and / or the code-division dataset and consuming the privacy budget according to the query result, where when querying information from the time-division dataset, consuming the first privacy budget, and when querying information from the code-division dataset, consuming the second privacy budget; The query processing module is further configured to obtain query records; update a Merkle tree composed of hash nodes and service nodes according to the query records, where the service nodes are located at the bottom layer of the Merkle tree, and there are multiple layers of hash nodes above the service nodes, and the query records of the time division dataset and the code division dataset are stored in different service nodes. For any hash node in the bottom layer of hash nodes, the hash value is generated based on the query records stored in all the subordinate service nodes of the hash node. For any hash node in the non-bottom layer of hash nodes, the hash value is generated based on the hash values of all the subordinate hash nodes of the hash node; the privacy budget consumption according to the query result includes: detecting that the hash value of the highest layer of hash nodes in the Merkle tree has changed; comparing whether the hash values of all the hash nodes in the next layer have changed. In the case where the hash value of a node has changed, continue to compare whether the hash values of all the subordinate hash nodes of the changed node in the next lower layer have changed until the changed service node has been compared, and determine from which dataset the information has been queried; consume the privacy budget allocated to the determined dataset.

11. A computer-readable storage medium, characterized in that, A computer program is stored in the computer-readable storage medium, where the computer program is configured to execute the method described in any one of claims 1 to 9 when running.

Images