Data query method and device, database system, electronic device and storage medium

Abstract

The present invention provides a data query method and apparatus, a database system, an electronic device, and a storage medium. In this embodiment, an aggregate query operation is first performed on a data table associated with a dataset to obtain a first query result of a numerical type. Then, differential privacy processing is performed based on whether user data that meets the query conditions exists in the data table to obtain a target differential privacy result. Finally, a second query result of a numerical type is determined based on the target differential privacy result and the first query result. This effectively reduces the error between the second query result after differential privacy processing and the true first query result, effectively balancing data usability and privacy protection.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a data query method and device, a database system, an electronic device, and a storage medium. Background Art

[0002] A dataset is a collection of large amounts of data. Open sharing of datasets helps maximize the value of data, for example, by relying on large, high-quality datasets to train machine learning models. Datasets involving personal data often contain a significant amount of private information, including, but not limited to, age, salary, medical records, personal consumption habits, and usage preferences. This private information is susceptible to disclosure when datasets are openly shared.

[0003] In practical applications, differential privacy (DP) processing is performed on datasets to effectively protect privacy. This is typically achieved using a Laplace machanism. However, in more complex data query scenarios, such as summing, averaging, minimizing, or maximizing, this Laplace machanism struggles to maintain a low error between the noised and unnoised query results, making it difficult to effectively balance data usability and privacy protection. Summary of the Invention

[0004] Various aspects of the present application provide a data query method and apparatus, a database system, an electronic device, and a storage medium to effectively balance data usability and privacy protection.

[0005] An embodiment of the present application provides a data query method, including: obtaining a data query request, the data query request including a query condition and an aggregation function; querying at least one user data that meets the query condition from a data table, the data table recording multiple user data in a data set; aggregating the at least one user data using the aggregation function to obtain a first query result of a numerical type; performing differential privacy processing based on the existence of user data that meets the query condition corresponding to each data record in the data table to obtain a target differential privacy result; and obtaining a second query result of a numerical type based on the target differential privacy result and the first query result.

[0006] An embodiment of the present application also provides a data query device, including: an acquisition module, used to obtain a data query request, the data query request includes a query condition and an aggregation function; a query module, used to query at least one user data that meets the query condition from a data table, the data table records multiple user data in a data set; an aggregation module, used to aggregate the at least one user data using an aggregation function to obtain a first query result of a numerical type; a differential privacy processing module, used to perform differential privacy processing based on the existence of user data that meets the query condition corresponding to each data record in the data table, to obtain a target differential privacy result; and a determination module, used to obtain a second query result of a numerical type based on the target differential privacy result and the first query result.

[0007] An embodiment of the present application also provides a database system, including: a client, a database server, and a database, wherein the database stores one or more data tables recording data in a data set; the client is used to send a data query request to the database server, the data query request including a query condition and an aggregation function; and receive a second query result of a numerical type returned by the database server; the database server is used to query at least one user data that meets the query condition from a data table according to the data query request, the data table recording multiple user data in the data set; aggregate the at least one user data using an aggregation function to obtain a first query result of a numerical type; perform differential privacy processing based on the existence of user data that meets the query condition corresponding to each data record in the data table to obtain a target differential privacy result; obtain a second query result of a numerical type based on the target differential privacy result and the first query result, and return the second query result to the client.

[0008] An embodiment of the present application also provides an electronic device, comprising: a memory and a processor; the memory is used to store a computer program; the processor is coupled to the memory and is used to execute the computer program to perform the steps in the data query method.

[0009] An embodiment of the present application further provides a computer storage medium storing a computer program. When the computer program is executed by a processor, the processor is enabled to implement the steps in the data query method.

[0010] In this embodiment of the present application, an aggregate query is first performed on the data tables associated with the dataset to obtain a first numeric query result. Then, differential privacy processing is performed based on whether user data that meets the query criteria exists in the data tables to obtain a target differential privacy result. Finally, based on the target differential privacy result and the first query result, a second numeric query result is determined. This effectively reduces the error between the differentially private second query result and the true first query result, effectively balancing data usability and privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0012] Figure 1 A schematic diagram of the structure of a database system provided in an embodiment of the present application;

[0013] Figure 2 A flowchart of a data query method provided in an embodiment of the present application;

[0014] Figure 3 A flowchart of another data query method provided in an embodiment of the present application;

[0015] Figure 4 A schematic diagram of the structure of a data query device provided in an embodiment of the present application;

[0016] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0017] To make the purpose, technical solutions, and advantages of this application more clear, the technical solutions of this application will be clearly and completely described below in conjunction with the specific embodiments of this application and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0018] In practical applications, in order to effectively protect privacy, differential privacy (DifferentialPrivacy) processing is performed on the data set. Generally, differential privacy processing is implemented based on the Laplace mechanism (Laplace Machanism). Specifically, the Laplace mechanism implements differential privacy processing by adding random noise that follows the Laplace distribution to the query results. However, in the counting query scenario of counting the number of statistics, the differential privacy processing based on the Laplace mechanism can achieve a small error between the query results after adding noise and the query results without adding noise, and can better balance the data usability and the degree of privacy protection; however, in the face of more complex data query scenarios such as summing, averaging, minimum or maximum values, it is difficult to achieve a small error between the query results after adding noise and the query results without adding noise, and it is difficult to effectively balance the data usability and the degree of privacy protection. To this end, the embodiments of the present application provide a data query method and device, a database system, an electronic device and a storage medium. In this embodiment of the present application, an aggregate query is first performed on the data tables associated with the dataset to obtain a first numeric query result. Then, differential privacy processing is performed based on whether user data that meets the query criteria exists in the data tables to obtain a target differential privacy result. Finally, based on the target differential privacy result and the first query result, a second numeric query result is determined. This effectively reduces the error between the differentially private second query result and the true first query result, effectively balancing data usability and privacy protection.

[0019] The following describes in detail the technical solutions provided by various embodiments of the present application in conjunction with the accompanying drawings.

[0020] Figure 1 This is a schematic diagram of the structure of a database system provided in an embodiment of the present application. Figure 1 As shown, the database system (DBS) includes a client, a database server and a database. The database system provides data query services for the client to perform data queries. Generally, the database server generally undertakes tasks such as database management, database query and database maintenance. The database is a warehouse for storing data. In an embodiment of the present application, the data in the data set is recorded in one or more data tables, and the one or more data tables are stored in the database. Wherein, the data table includes multiple data records, and each data record includes one or more data. Optionally, a data table is a collection of a series of two-dimensional arrays, consisting of vertical columns and horizontal rows. In this case, a data record is the data recorded in a row in the data table.

[0021] When the data query party has data query needs, refer to Figure 1In ①, the data query party sends a data query request to the database server through the client. The data query request includes query conditions and aggregate functions. The database server responds to the data query request. Figure 1 ② in the query, query at least one user data that meets the query conditions from the data table, the data table records at least one user data of the data set; see Figure 1 In ③, the database server uses the aggregation function to aggregate at least one user data to obtain the first query result of the numerical type. Figure 1 In ④, the database server performs differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record in the data table, and obtains the target differential privacy result. Figure 1 In ⑤, the database server obtains the second query result of the numerical type based on the target differential privacy result and the first query result. Figure 1 In step ⑥, the database server returns the second query result to the client, thus completing the data query task.

[0022] It is worth noting that the query conditions in the data query request are used to filter data from the data table. Only the data in the data table that meets the query conditions will be filtered out for subsequent operations.

[0023] It is worth noting that, in this embodiment, querying using aggregate functions can be understood as an aggregate query that performs statistics on at least one user data item that meets the query criteria and is retrieved from a data table. Aggregate functions include, but are not limited to, the COUNT() function for querying the number of rows in a data table, the SUM() function for querying the sum of data in a data column in a data table, the AUG() function for querying the average of data in a data column in a data table, the MAX() function for querying the maximum value of data in any column in a data table, and the MIN() function for querying the minimum value of data in any column in a data table.

[0024] Figure 2 This is a flow chart of a data query method provided in an embodiment of the present application. The method can be executed by a data query device, which can be implemented in software and / or hardware and can generally be integrated into an electronic device, such as a terminal device or a server. Figure 2 , the method may include the following steps:

[0025] 201. Obtain a data query request, where the data query request includes a query condition and an aggregate function.

[0026] 202. Query at least one user data satisfying a query condition from a data table, where the data table records at least one user data in a data set.

[0027] 203. Aggregate at least one user data using an aggregation function to obtain a first query result of a numerical type.

[0028] 204. Perform differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record in the data table to obtain a target differential privacy result.

[0029] 205. Obtain a second query result of a numerical type according to the target differential privacy result and the first query result.

[0030] In this embodiment, a data query request sent by a data query party through a client is obtained, and query conditions and aggregation functions are parsed from the data query request, wherein the query conditions can indicate the data table associated with the required query data set and the user data in the data table.

[0031] In this embodiment, different data sets are used in different application scenarios, including but not limited to: a shopping data set including user shopping behavior data, a text data set including product descriptions, and a medical information data set including various information of medical personnel.

[0032] In this embodiment, after parsing the query conditions and aggregation functions from the data query request, an aggregate query is performed in the data table associated with the data set based on the query conditions and aggregation functions. Specifically, when performing an aggregate query operation, at least one user data that meets the query conditions is first queried from each data record in the data table, where the data table records at least one user data of the data set; then, the at least one user data is aggregated using the aggregation function to obtain a first query result of a numerical type. It is worth noting that the first query result obtained by the aggregate query is a true query result that has not undergone differential privacy processing. If the true query result is directly returned to the data query party, the data query party can easily obtain user privacy information from the true query result through attacks such as differential attacks, increasing the risk of user privacy information leakage. In addition, the data table includes multiple data records, and each data record in the data table includes one or more user data. In some application scenarios, a data record can be referred to as a row record. User data that meets the query conditions refers to user data that participates in the aggregation processing.

[0033] In this embodiment, in addition to aggregating at least one user data item retrieved from the data table, differential privacy processing is also performed based on the existence of user data that meets the query criteria corresponding to each data record in the data table. Differential privacy is a cryptographic technique that aims to maximize the accuracy of data queries when querying from a statistical database while minimizing the chance of identifying its records. This technique removes individual characteristics while preserving statistical features to protect user privacy.

[0034] In this embodiment, in order to maximize the accuracy of data queries and effectively balance data usability and privacy protection, the optional implementation of step 204 includes: determining the differential privacy parameters of each data record based on the existence of user data corresponding to each data record that meets the query conditions; obtaining the current differential privacy result, and determining a count value based on the differential privacy parameters of each data record and the current differential privacy result, where the count value represents the number of differential privacy parameters that meet the current differential privacy result; if the total number of data records in the data table does not match the count value, updating the current differential privacy result, and continuing to execute the step of determining the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result until the total number of data records in the data table matches the count value, and using the current differential privacy result as the target differential privacy result.

[0035] It is worth noting that the target differential privacy result obtained after multiple iterations has a high probability of satisfying the following properties:

[0036] (1)

[0037] (2) Greater than The number of elements of is at most

[0038] in, That is, the target differential privacy result obtained by querying the dataset D, Δ w (D) is the actual first query result obtained by querying the dataset D; Δ w (D) with The error between n is the size of the dataset (that is, the amount of data in the dataset). ∈ is the privacy protection budget. The smaller ∈ is, the higher the privacy protection level is.

[0039] In this embodiment, when determining the differential privacy parameter corresponding to each data record based on the existence of user data that meets the query criteria, for each data record, if user data that meets the query criteria exists in the data record, the user data that meets the query criteria in the data record is used as the differential privacy parameter corresponding to the data record; if user data that meets the query criteria does not exist in the data record, a specified value is used as the differential privacy parameter corresponding to the data record. The specified value is set according to the actual situation, for example, 0.

[0040] In this embodiment, the current differential privacy result is iteratively updated until the number of differential privacy parameters that satisfy the current differential privacy result matches the total number of data records in the data table. In this embodiment, there is no restriction on the method of updating the current differential privacy result. The following are several examples of optional implementation methods:

[0041] Method 1: The current differential privacy result is updated monotonically as the number of iterations increases. Specifically, in the first iteration, the current differential privacy result is the minimum value; as the number of iterations increases, the current differential privacy result increases.

[0042] Method 2: The current differential privacy result is updated in a monotonically decreasing manner as the number of iterations increases. Specifically, at the first iteration, the current differential privacy result is the largest value; as the number of iterations increases, the current differential privacy result decreases.

[0043] Method 3: To maximize data query accuracy and effectively balance data usability and privacy protection, the current differential privacy result is updated exponentially as the number of iterations increases. For example, if the current differential privacy result is m to the power of n, m to the power of n+1 is used as the new current differential privacy result; where m is a positive integer and n is a natural number. For example, if m is 2, the current differential privacy result is updated to 1, 2, 4, 8, 16, and so on, as the number of iterations increases.

[0044] In this embodiment, there is no limitation on the method for determining the count value based on the differential privacy parameters of each data record and the current differential privacy result. The following are several optional implementation methods:

[0045] Method 1: Count the number of differential privacy parameters that are greater than or equal to the current differential privacy result. For ease of understanding, the number of differential privacy parameters that are greater than or equal to the current differential privacy result is recorded as the first number; the difference between the total number of data records in the data table and the first number is used as the count value.

[0046] Method 2: Eliminate user data whose differential privacy parameters are greater than or equal to the current differential privacy result; count the number of remaining differential privacy parameters; and use the number of remaining differential privacy parameters as the count value.

[0047] Method 3: Initialize the count value. For each differential privacy parameter, compare the differential privacy parameter with the current differential privacy result. If the differential privacy parameter is less than the current differential privacy result, increase the count value by 1. The count value can be initialized flexibly according to application requirements, for example, it can be initialized to 0.

[0048] In this embodiment, when performing differential privacy processing, if the total number of data records in the data table does not match the count value representing the number of differential privacy parameters that satisfy the current differential privacy result, the current differential privacy result is updated and subsequent steps are executed; if the total number of data records in the data table matches the count value representing the number of differential privacy parameters that satisfy the current differential privacy result, the entire differential privacy processing task is completed.

[0049] In this embodiment, there is no limitation on how the total number of data records in a data table and the count value representing the number of differential privacy parameters that satisfy the current differential privacy result are compared. For example, if the total number of data records in a data table is equal to the count value, then the total number of data records in the data table is determined to match the count value. For another example, if the difference between the total number of data records in a data table and the count value falls within an allowable range of values, then the total number of data records in the data table is determined to match the count value.

[0050] In this embodiment, after obtaining the first query result based on the aggregate query and obtaining the target differentially private result based on the differential privacy processing, a second query result of a numerical type is obtained based on the target differentially private result and the first query result. The following examples illustrate several optional ways to determine the second query result:

[0051] Method 1: Perform weighted summation on the target differential privacy result and the first query result to obtain the second query result.

[0052] Method 2: Average the target differential privacy result and the first query result to obtain the second query result.

[0053] Method 3: The smaller value between the target differential privacy result and the first query result is used as the second query result.

[0054] It's worth noting that method 3, using a truncated query, can effectively reduce the probability of leaking user privacy data. Truncated queries can be understood as returning the first query result as the second query result if the target differentially private result is greater than the first query result; and returning the target differentially private result as the second query result if the target differentially private result is less than the first query result.

[0055] For ease of understanding, Table 1 is used as an example for explanation. Table 1 is an employee information table that records various employee information.

[0056] Table 1

[0057] Serial number Name gender age salary 1 Li male 28 8500 2 Bai female 30 6500 3 Mu female 26 7500 4 Zhang female 25 10000 5 Du male 26 8500 6 Ma male 25 6500 7 Jiang female 22 7500 8 Zhou female 23 10000 9 Liu female 24 10000 10 Tu female 30 10000

[0058] Upon receiving a data query request from the client, "SELECT SUM(CASE WHEN age < 23 THEN salary ELSE 0 END) FROM employee_information_table," which requests the total salary of employees under 23 years old, the query condition is to query the salaries of employees under 23 years old. The salary of employees (user data) that meet the query condition is summed. First, the count value is initialized to 0, and the current differential privacy result is set to 1. Each data record in the employee_information_table is traversed in turn to check whether there is a salary of an employee under 23 years old. If so, the differential privacy parameter corresponding to the data record is the corresponding salary. If not, the differential privacy parameter corresponding to the data record is 0. The differential privacy parameter of the data record is compared with the current differential privacy result. If the differential privacy parameter of the data record is greater than or equal to the current differential privacy result, the count value is not updated. If the differential privacy parameter of the data record is less than the current differential privacy result, the count value is incremented by one. Therefore, if the current differential privacy result is 1, after traversing all data records in the employee_information_table, the count value is updated to 9. Since the count value (9) is equivalent to the number of rows in the employee data table (10 rows), the current differential privacy result 1 is the maximum approximation that matches the true query result 7500. Since the maximum approximation is smaller than the true query result, the smaller maximum approximation is selected and returned to the client.

[0059] Upon receiving a data query request from the client, "SELECT SUM(CASE WHEN age < 28 THEN salary ELSE 0 END) FROM employee_information_table," which requests the total salary of employees under 28 years old, the query condition is to query the salaries of employees under 28 years old. The salary of employees (user data) that meet the query condition is summed. First, the current differential privacy result is set to 1, the count is initialized to 0, and each data record in the employee_information_table is traversed in turn to check whether there is a salary of an employee under 28 years old. If so, the differential privacy parameter corresponding to the data record is the corresponding salary; if not, the differential privacy parameter is 0. The differential privacy parameter of the data record is compared with the current differential privacy result. If the differential privacy parameter of the data record is greater than or equal to the current differential privacy result, the count is not updated. If the differential privacy parameter of the data record is less than the current differential privacy result, the count is incremented by one. Therefore, if the current differential privacy result is 1, after traversing all data records in the employee_information_table, the count is updated to 3. Since the count value (3) differs somewhat from the number of rows in the employee data table (10 rows), the current differential privacy result is updated to 2, and the steps to initialize the count value to 0 and subsequent steps are re-executed. With the current differential privacy result of 2, after traversing all the data records in the employee information table, the count value is updated to 3. Since the count value (3) differs somewhat from the number of rows in the employee data table (10 rows), the current differential privacy result is updated to 4. Similarly, the current differential privacy result is continuously updated exponentially until the count value is equal to the total number of data records in the employee data table. The current differential privacy result when the count value is equal to the total number of data records in the employee data table is used as the maximum approximation. The maximum approximation and the true query result are selected, and the smaller maximum approximation is returned to the client. The true query result is the total salary of employees under 28 years old.

[0060] The technical solution provided by the embodiments of this application first performs an aggregate query operation on the data tables associated with the dataset to obtain a first query result of numerical type. Then, differential privacy processing is performed based on whether each data record in the data table contains user data that meets the query conditions to obtain a target differential privacy result. Finally, based on the target differential privacy result and the first query result, a second query result of numerical type is determined. This effectively reduces the error between the second query result after differential privacy processing and the true first query result, and effectively balances data usability and privacy protection.

[0061] In actual applications, the user data queried by the data query party may or may not include user privacy data. If the user data to be queried by the data query party does not include user privacy data, differential privacy processing is not necessary. If differential privacy processing is still performed during the data query process, the query efficiency will be low. If the user data to be queried by the data query party includes user privacy data, differential privacy processing needs to be performed during the data query process to reduce the leakage of user privacy data. Therefore, further optionally, before performing differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record, it is also possible to identify whether at least one user data that meets the query conditions includes user privacy data. If it does, the step of performing differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record and subsequent steps are performed. If it does not include it, the first query result obtained by the aggregate query can be returned to the data query party, and the entire query operation is terminated.

[0062] In some application scenarios, in order to effectively protect user privacy data and reduce the leakage of user privacy data, it is necessary to verify whether the data query party that initiates the data query request has the permission to use the user privacy data. If the data query party has the permission to use the user privacy data, it means that the probability of the data query party leaking the user privacy data is low; if the data query party does not have the permission to use the user privacy data, it means that the probability of the data query party leaking the user privacy data is high, and differential privacy processing needs to be performed. Therefore, further optionally, before performing differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record, it is determined that at least one user data includes user privacy data, and it is determined that the data query party that initiates the data query request does not have the permission to use the user privacy data. And after obtaining a second query result of a numerical type based on the target differential privacy result and the first query result, the second query result is output to the data query party.

[0063] It is worth noting that if at least one user data does not include user privacy data, or the data query party has the right to use the user privacy data, the first query result can be output to the data query party.

[0064] In practical applications, if the data querying party does not have permission to use the user's private data and the user data being queried involves a situation, the second query result can be directly output to the data querying party. Furthermore, optionally, outputting the second query result to the data querying party can be achieved by: determining error information between the first query result and the second query result; and outputting the second query result and the error information to the data querying party.

[0065] It is worth noting that simultaneously outputting the second query result and error information to the data query party can intuitively enable the data query party to confirm whether the second query result can be used for subsequent data processing, thereby ensuring the reliability of the data processing task.

[0066] In actual applications, a data querying party that does not have permission to use the user's private data may not accept the error information between the first query result and the second query result, and may need to obtain the true first query result. Furthermore, to meet this need of the data querying party, after outputting the second query result and error information to the data querying party, a permission request from the data querying party may be received. Upon approval of the permission request, permission to use the user's private data is granted to the data querying party, and the first query result is output to the data querying party.

[0067] In this embodiment, a data querying party that does not have permission to use a user's private data can initiate a permission request. The permission request carries the application information required to apply for permission to use the user's private data. The permission request is used to request permission to use the user's private data. The application information in the received permission request is reviewed. If the review passes, the data querying party is granted permission to use the user's private data, and a first query result is output to the data querying party. If the review fails, the data querying party is not granted permission to use the user's private data, and a notification message indicating that the permission request review failed is returned to the data querying party, so that the data querying party is informed of the permission request review status.

[0068] Figure 3 This is a flow chart of another data query method provided in an embodiment of the present application. Figure 3 , the data query method may include the following steps:

[0069] 301. Obtain a data query request, where the data query request includes a query condition and an aggregation function.

[0070] 302. Query at least one user data that meets a query condition from a data table, where the data table records at least one user data in a data set.

[0071] 303. Aggregate at least one user data using an aggregation function to obtain a first query result of a numerical type.

[0072] 304 . Identify whether the at least one user data meeting the query condition includes user privacy data. If so, execute step 305 ; if not, execute step 309 .

[0073] 305 . Verify whether the data query party initiating the data query request has the permission to use the user's private data. If so, execute step 309 ; if not, execute step 306 .

[0074] 306. Perform differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record in the data table to obtain a target differential privacy result.

[0075] 307. Obtain a second query result of a numerical type according to the target differential privacy result and the first query result.

[0076] 308. Output the second query result to the data query party.

[0077] 309. Output the first query result to the data query party.

[0078] For the specific implementation of each step in this embodiment, please refer to the relevant introduction of the above embodiment and will not be repeated here.

[0079] The technical solution provided by the embodiments of this application integrates differential privacy processing into the data query process, effectively balancing data usability and privacy protection, when the user data requested by the data query party initiating the data query request involves user privacy data and the data query party does not have permission to use the user privacy data. If the user data requested by the data query party initiating the data query request does not involve user privacy data, or the data query party has permission to use the user privacy data, the aggregated query results can be directly returned to the data query party, improving data query efficiency.

[0080] Figure 4 This is a structural diagram of a data query device provided in an embodiment of the present application. Figure 4 , the apparatus may include the following steps:

[0081] An acquisition module 41 is configured to acquire a data query request, wherein the data query request includes a query condition and an aggregation function;

[0082] A query module 42 is configured to query at least one user data satisfying a query condition from a data table, where the data table records a plurality of user data in a data set;

[0083] Aggregation module 43, configured to aggregate at least one user data using an aggregation function to obtain a first query result of a numerical type;

[0084] A differential privacy processing module 44 is configured to perform differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record in the data table to obtain a target differential privacy result;

[0085] The determination module 45 is configured to obtain a second query result of a numerical type according to the target differential privacy result and the first query result.

[0086] Further optionally, the differential privacy processing module 44 performs differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record in the data table. When the target differential privacy result is obtained, it is specifically used to: determine the differential privacy parameters of each data record based on the existence of user data that meets the query conditions corresponding to each data record; obtain the current differential privacy result, and determine a count value based on the differential privacy parameters of each data record and the current differential privacy result, where the count value represents the number of differential privacy parameters that meet the current differential privacy result; if the total number of data records in the data table does not match the count value, update the current differential privacy result, and continue to execute the step of determining the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result, until the total number of data records in the data table matches the count value, and use the current differential privacy result as the target differential privacy result.

[0087] Further optionally, when the differential privacy processing module 44 determines the differential privacy parameter corresponding to each data record based on the existence of user data that meets the query conditions corresponding to each data record, it is specifically used as follows: for each data record, if there is user data that meets the query conditions in the data record, the user data that meets the query conditions in the data record is used as the differential privacy parameter corresponding to the data record; if there is no user data that meets the query conditions in the data record, a specified value is used as the differential privacy parameter corresponding to the data record.

[0088] Further optionally, when the differential privacy processing module 44 determines the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result, it is specifically used to: initialize the count value; for the differential privacy parameters corresponding to each data record, compare the numerical size of the differential privacy parameters with the current differential privacy result; if the differential privacy parameter is less than the current differential privacy result, increase the count value by one.

[0089] Further optionally, when the differential privacy processing module 44 updates the current differential privacy result, it is specifically configured to: when the current differential privacy result is m to the power of n, use m to the power of n+1 as the new current differential privacy result; wherein m and n are positive integers.

[0090] Further optionally, when the determination module 45 obtains a second query result of a numerical type based on the target differential privacy result and the first query result, it is specifically used to: use the smaller value of the target differential privacy result and the first query result as the second query result; or, perform a weighted sum of the target differential privacy result and the first query result to obtain the second query result; or, calculate the average of the target differential privacy result and the first query result to obtain the second query result.

[0091] Further optionally, the above device further includes: an identification module and an output module;

[0092] The identification module is used to determine that at least one user data includes user privacy data, and to determine that the data query party initiating the data query request does not have the permission to use the user privacy data, and to trigger the differential privacy processing module 44 to perform differential privacy processing;

[0093] After obtaining the second query result, the determination module 45 triggers the output module;

[0094] The output module is used to output the second query result to the data query party.

[0095] Further optionally, if the identification module determines that at least one user data does not include user privacy data, or the data query party has permission to use the user privacy data, the output module is triggered to output the first query result to the data query party.

[0096] Further optionally, when the output module outputs the second query result to the data query party, it is specifically used to:

[0097] determining error information between the first query result and the second query result;

[0098] The second query result and error information are output to the data query party.

[0099] Further optionally, after the output module outputs the second query result and error information to the data query party, the acquisition module 41 is also used to receive a permission application request sent by the data query party; after the permission application request is reviewed and approved, the data query party is granted permission to use the user's privacy data; and the output module is triggered to output the first query result to the data query party.

[0100] Figure 4 The data query device shown can execute Figure 2 or Figure 3 The data query method of the embodiment shown, its implementation principle and technical effects are not described in detail. Figure 4 The specific manner in which each module and unit performs operations in the data query device shown has been described in detail in the embodiment of the method, and will not be elaborated here.

[0101] It should be noted that the execution entity of each step of the method provided in the above embodiment can be the same device, or the method can be executed by different devices. For example, the execution entity of steps 401 to 403 can be device A; for another example, the execution entity of steps 401 and 402 can be device A, and the execution entity of step 403 can be device B; and so on.

[0102] In addition, in some of the processes described in the above embodiments and the accompanying drawings, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or may be executed in parallel. The sequence numbers of the operations, such as 401, 402, etc., are only used to distinguish between different operations, and the sequence numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., and do not represent a sequential order, nor do they limit "first" and "second" to being different types.

[0103] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 5 As shown, the electronic device includes: a memory 51 and a processor 52;

[0104] The memory 51 is used to store computer programs and can be configured to store various other data to support operations on the computing platform. Examples of such data include instructions for any application or method operating on the computing platform, contact data, phone book data, messages, pictures, videos, etc.

[0105] The memory 51 can be implemented by any type of volatile or non-volatile memory device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0106] The processor 52 is coupled to the memory 51 and is used to execute the computer program in the memory 51, so as to: obtain a data query request, the data query request includes a query condition and an aggregation function; query at least one user data that meets the query condition from a data table, where the data table records multiple user data in a data set; aggregate the at least one user data using the aggregation function to obtain a first query result of a numerical type; perform differential privacy processing based on the existence of user data that meets the query condition corresponding to each data record in the data table to obtain a target differential privacy result; and obtain a second query result of a numerical type based on the target differential privacy result and the first query result.

[0107] Further optionally, the processor 52 performs differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record in the data table. When the target differential privacy result is obtained, it is specifically used to: determine the differential privacy parameters of each data record based on the existence of user data that meets the query conditions corresponding to each data record; obtain the current differential privacy result, and determine a count value based on the differential privacy parameters of each data record and the current differential privacy result, where the count value represents the number of differential privacy parameters that meet the current differential privacy result; if the total number of data records in the data table does not match the count value, update the current differential privacy result, and continue to execute the step of determining the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result, until the total number of data records in the data table matches the count value, and use the current differential privacy result as the target differential privacy result.

[0108] Further optionally, when the processor 52 determines the differential privacy parameter corresponding to each data record based on the existence of user data that meets the query conditions corresponding to each data record, it is specifically used as follows: for each data record, if there is user data that meets the query conditions in the data record, the user data that meets the query conditions in the data record is used as the differential privacy parameter corresponding to the data record; if there is no user data that meets the query conditions in the data record, a specified value is used as the differential privacy parameter corresponding to the data record.

[0109] Further optionally, when the processor 52 determines the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result, it is specifically used to: initialize the count value; for the differential privacy parameters corresponding to each data record, compare the differential privacy parameters with the current differential privacy result; if the differential privacy parameter is less than the current differential privacy result, increase the count value by one.

[0110] Further optionally, when the processor 52 updates the current differential privacy result, it is specifically configured to: when the current differential privacy result is m to the power of n, use m to the power of n+1 as the new current differential privacy result; wherein m and n are positive integers.

[0111] Further optionally, when the processor 52 obtains a second query result of a numerical type based on the target differential privacy result and the first query result, it is specifically used to: use the smaller value of the target differential privacy result and the first query result as the second query result; or, perform a weighted sum of the target differential privacy result and the first query result to obtain the second query result; or, calculate the average of the target differential privacy result and the first query result to obtain the second query result.

[0112] Further optionally, before performing differential privacy processing based on the existence of user data that meets the query conditions corresponding to each data record, the processor 52 is also used to: determine that at least one user data includes user privacy data, and determine that the data query party that initiates the data query request does not have the right to use the user privacy data; after the processor 52 obtains a second query result of a numerical type based on the target differential privacy result and the first query result, it is also used to: output the second query result to the data query party.

[0113] Further optionally, the processor 52 is further configured to: output the first query result to the data query party if the at least one user data does not include the user privacy data, or the data query party has the permission to use the user privacy data.

[0114] Further optionally, when the processor 52 outputs the second query result to the data query party, it is specifically configured to: determine error information between the first query result and the second query result; and output the second query result and the error information to the data query party.

[0115] Further optionally, after outputting the second query result and error information to the data query party, the processor 52 is also used to: receive a permission application request sent by the data query party; after the permission application request is reviewed and approved, grant the data query party the right to use the user's privacy data, and output the first query result to the data query party.

[0116] Further, if Figure 5 As shown, the electronic device also includes: a communication component 53, a display 54, a power component 55, an audio component 56 and other components. Figure 5 Only some components are shown schematically, which does not mean that the electronic device only includes Figure 5 In addition, Figure 5 The components in the dotted box are optional components, not mandatory components, and the specific components may depend on the product form of the electronic device. The electronic device of this embodiment can be implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone or an IOT device, or a server device such as a conventional server, a cloud server or a server array. If the electronic device of this embodiment is implemented as a terminal device such as a desktop computer, a laptop computer, a smart phone, etc., it may include Figure 5 If the electronic device of this embodiment is implemented as a conventional server, cloud server or server array and other server-side devices, it may not include Figure 5 Components within the dotted box.

[0117] The detailed implementation process of the processor executing each action can be found in the relevant description in the aforementioned method embodiment or device embodiment, and will not be repeated here.

[0118] Accordingly, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed, can implement the steps that can be performed by the electronic device in the above method embodiment.

[0119] Accordingly, an embodiment of the present application also provides a computer program product, including a computer program / instruction. When the computer program / instruction is executed by a processor, the processor is enabled to implement the steps in the above method embodiment that can be performed by an electronic device.

[0120] The above-mentioned communication component is configured to facilitate wired or wireless communication between the device where the communication component is located and other devices. The device where the communication component is located can access a wireless network based on a communication standard, such as WiFi, 2G, 3G, 4G / LTE, 5G and other mobile communication networks, or a combination thereof. In an exemplary embodiment, the communication component receives a broadcast signal or broadcast-related information from an external broadcast management system via a broadcast channel. In an exemplary embodiment, the communication component also includes a near field communication (NFC) module to facilitate short-range communication. For example, the NFC module can be implemented based on radio frequency identification (RFID) technology, infrared data association (IrDA) technology, ultra-wideband (UWB) technology, Bluetooth (BT) technology and other technologies.

[0121] The above-mentioned display includes a screen, which may include a liquid crystal display (LCD) and a touch panel (TP). If the screen includes a touch panel, the screen may be implemented as a touch screen to receive input signals from a user. The touch panel includes one or more touch sensors to sense touches, slides, and gestures on the touch panel. The touch sensor can not only sense the boundaries of a touch or slide action, but also detect the duration and pressure associated with the touch or slide operation.

[0122] The power supply assembly provides power to various components of the device in which the power supply assembly is located. The power supply assembly may include a power management system, one or more power supplies, and other components associated with generating, managing, and distributing power to the device in which the power supply assembly is located.

[0123] The above-mentioned audio component can be configured to output and / or input audio signals. For example, the audio component includes a microphone (MIC), and when the device where the audio component is located is in an operating mode, such as call mode, recording mode, and voice recognition mode, the microphone is configured to receive external audio signals. The received audio signal can be further stored in a memory or sent via a communication component. In some embodiments, the audio component also includes a speaker for outputting audio signals.

[0124] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0125] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0126] These computer program instructions may also be stored in a computer readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 a process or multiple processes and / or boxes Figure 1 The function specified in one or more boxes.

[0127] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0128] In a typical configuration, a computing device includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0129] Memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0130] Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer-readable media does not include transitory computer-readable media (transitory media), such as modulated data signals and carrier waves.

[0131] It should also be noted that the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, commodity, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements inherent to such process, method, commodity, or apparatus. In the absence of further limitations, an element defined by the phrase "comprises a ..." does not exclude the presence of other identical elements in the process, method, commodity, or apparatus that includes the element.

[0132] The above are merely embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should all be included within the scope of the claims of the present application.

Claims

1. A data query method, comprising: Obtaining a data query request, wherein the data query request includes a query condition and an aggregation function; Querying at least one user data satisfying the query condition from a data table, wherein the data table records a plurality of user data in the data set; Performing aggregation processing on the at least one user data using the aggregation function to obtain a first query result of a numerical type; Determining that the at least one user data includes user privacy data, and determining that a data query party initiating the data query request does not have permission to use the user privacy data; Determining a differential privacy parameter for each data record based on the existence of user data corresponding to each data record that meets the query condition; Obtaining a current differential privacy result, and determining a count value based on the differential privacy parameters of each data record and the current differential privacy result, where the count value represents the number of differential privacy parameters that satisfy the current differential privacy result; If the total number of data records in the data table does not match the count value, then update the current differential privacy result and continue to perform the step of determining the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result until the total number of data records in the data table matches the count value, and use the current differential privacy result as the target differential privacy result; The smaller value between the target differential privacy result and the first query result is used as the second query result; or, the target differential privacy result and the first query result are weighted summed to obtain the second query result; or, the target differential privacy result and the first query result are averaged to obtain the second query result; determining error information between the first query result and the second query result; The second query result and the error information are output to the data query party.

2. The method according to claim 1, determining the differential privacy parameter corresponding to each data record based on the existence of user data corresponding to each data record that meets the query condition, comprising: For each data record, if there is user data that meets the query condition in the data record, the user data that meets the query condition in the data record is used as the differential privacy parameter corresponding to the data record; If there is no user data that meets the query condition in the data record, the specified value will be used as the differential privacy parameter corresponding to the data record.

3. The method according to claim 1, determining the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result comprises: Initialize the count value; For each data record, the differential privacy parameter corresponding to the differential privacy parameter is compared with the current differential privacy result; If the differential privacy parameter is less than the current differential privacy result, the count value is increased by one.

4. The method according to claim 1, updating the current differential privacy result, comprising: When the current differential privacy result is m to the power of n, m to the power of n+1 is used as the new current differential privacy result; where m and n are positive integers.

5. The method according to claim 1, further comprising: If the at least one user data does not include user privacy data, or the data query party has permission to use the user privacy data, the first query result is output to the data query party.

6. The method according to claim 1, after outputting the second query result and the error information to the data query party, further comprising: Receiving the permission application request sent by the data query party; After the permission application request is reviewed and approved, the data query party is granted permission to use the user's private data, and the first query result is output to the data query party.

7. A data query device comprising: An acquisition module, configured to acquire a data query request, wherein the data query request includes a query condition and an aggregation function; A query module, configured to query at least one user data satisfying the query condition from a data table, wherein the data table records a plurality of user data in the data set; an aggregation module, configured to perform aggregation processing on the at least one user data using the aggregation function to obtain a first query result of a numerical type; Determining that the at least one user data includes user privacy data, and determining that a data query party initiating the data query request does not have permission to use the user privacy data; a differential privacy processing module, configured to determine a differential privacy parameter for each data record based on the existence of user data corresponding to each data record that satisfies the query condition; obtain a current differential privacy result; and determine a count value based on the differential privacy parameter for each data record and the current differential privacy result, where the count value represents the number of differential privacy parameters that satisfy the current differential privacy result; If the total number of data records in the data table does not match the count value, then update the current differential privacy result and continue to perform the step of determining the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result until the total number of data records in the data table matches the count value, and use the current differential privacy result as the target differential privacy result; a determination module configured to use the smaller value of the target differential privacy result and the first query result as a second query result; or to perform a weighted sum of the target differential privacy result and the first query result to obtain the second query result; or to average the target differential privacy result and the first query result to obtain the second query result; determining error information between the first query result and the second query result; The second query result and the error information are output to the data query party.

8. A database system comprising: A client, a database server and a database, wherein the database stores one or more data tables recording data in a data set; The client is used to send a data query request to the database server, wherein the data query request includes a query condition and an aggregate function; and receiving a second query result of a numerical type and error information returned by the database server; The database server is configured to query, based on a data query request, at least one user data that meets the query conditions from a data table, where the data table records multiple user data in a data set; perform aggregation processing on the at least one user data using the aggregation function to obtain a first query result of a numerical type; determine that the at least one user data includes user privacy data, and determine that the data query party that initiates the data query request does not have permission to use the user privacy data; determine the differential privacy parameter of each data record based on the existence of user data that meets the query conditions corresponding to each data record; obtain a current differential privacy result, and determine a count value based on the differential privacy parameters of each data record and the current differential privacy result, where the count value represents the number of differential privacy parameters that meet the current differential privacy result; If the total number of data records in the data table does not match the count value, then update the current differential privacy result and continue to perform the step of determining the count value based on the differential privacy parameters corresponding to each data record and the current differential privacy result until the total number of data records in the data table matches the count value, and use the current differential privacy result as the target differential privacy result; The smaller value between the target differential privacy result and the first query result is used as the second query result; or, the target differential privacy result and the first query result are weighted summed to obtain the second query result; or, the target differential privacy result and the first query result are averaged to obtain the second query result; determining error information between the first query result and the second query result; The second query result and the error information are output to the data query party.

9. An electronic device comprising: memory and processor; The memory is used to store computer programs; The processor is coupled to the memory and configured to execute the computer program to perform the steps of the method according to any one of claims 1 to 6.

10. A computer storage medium storing a computer program, wherein when the computer program is executed by a processor, the processor is enabled to implement the steps of the method according to any one of claims 1 to 6.

Images