A kd-tree-based privacy-preserving outsourced k-means clustering method and system

Abstract

The application provides a privacy protection outsourcing k-means clustering method and system based on a kd-tree, wherein the method comprises the following steps: obtaining a secure maximum protocol, a secure Euclidean distance protocol, a secure comparison protocol and a secure clustering protocol; a user constructs a kd-tree based on data on a plaintext, and then performs additive secret sharing and sends the kd-tree to a cloud server in two parts; two cloud servers obtain a set number of data cluster centers, adopt a filtering algorithm, and perform clustering on the data to be clustered according to the secure Euclidean distance protocol, the secure comparison protocol, the secure maximum protocol, the secure clustering protocol and the kd-tree. The technical scheme of the application can perform efficient and secure outsourcing k-means clustering on two cloud servers.

Description

Technical Field

[0001] This invention belongs to the field of data security storage technology, specifically relating to a privacy-preserving outsourced k-means clustering method based on kd-tree, a computer device, a computer storage medium, and a privacy-preserving outsourced k-means clustering system based on kd-tree. Background Technology

[0002] A cloud server is a simple, efficient, secure, reliable computing server with elastically scalable processing power. Its management is simpler and more efficient than that of a physical server, and users can quickly create or release any number of cloud servers without purchasing hardware in advance. Storing data on cloud servers not only reduces the storage space required by user clients but also improves user convenience. For example, when using different clients, users can log in to the cloud server through their accounts to retrieve the data they need. Meanwhile, personal machines typically have limited resources and performance, making it impossible to store massive amounts of data or perform efficient clustering calculations. Cloud computing allows users to outsource data and clustering tasks to cloud servers, eliminating the need to consider intermediate processes and directly obtaining the calculation results, which is extremely convenient and fast.

[0003] However, storing user data on cloud servers presents security risks, making it vulnerable to unauthorized access. To address this, a common approach in existing technologies is data encryption. The client encrypts the data before sending it to the cloud server for storage and computation. The cloud server then performs calculations using a given protocol for encrypted data, ultimately retrieving the encrypted result. However, existing encryption schemes often struggle to balance efficiency and security. Secure solutions typically require significant time investment, while efficient solutions with acceptable time consumption may sacrifice some data security. Therefore, secure computing solutions on cloud servers need to consider how to balance efficiency and security. In conclusion, existing cloud server technologies present a trade-off between efficiency and security when clustering encrypted data. Summary of the Invention

[0004] The purpose of this invention is to provide a privacy-preserving outsourced k-means clustering method and system based on kd-tree, which at least solves the problems of clustering efficiency and data security when clustering encrypted data on cloud servers in the prior art.

[0005] To at least address the aforementioned problems, in a first aspect, this invention provides a privacy-preserving outsourced k-means clustering method based on a kd-tree, comprising: obtaining a secure maximum / minimum protocol, a secure Euclidean distance protocol, a secure comparison protocol, and a secure clustering protocol; obtaining the secure maximum / minimum protocol, secure Euclidean distance protocol, secure comparison protocol, and secure clustering protocol, wherein the kd-tree is constructed by the user on plaintext, then encrypted and sent to a dual-cloud server; obtaining the data to be clustered, calculating the variance of all dimensions of the data, and using the dimension with the largest variance as a reference; finding the median of the dimension data according to the reference dimension, dividing the data evenly into two parts, and repeating the above process until the data is divided into a given number; obtaining a set number of data cluster centers, and using a filtering algorithm, clustering the data to be clustered according to the secure Euclidean distance protocol, secure comparison protocol, secure maximum / minimum protocol, secure clustering protocol, and the kd-tree.

[0006] According to one embodiment of the present invention, a user constructs a kd-tree of the data to be clustered on plaintext, comprising: using the data to be clustered as a set of root nodes; in response to the presence of multiple data to be clustered in the set of nodes, obtaining the median of the data to be clustered in the set of nodes under the reference dimension, storing the data to be clustered corresponding to the median in the node, and using the data to be clustered that are greater than and less than the median under the reference dimension as the set of left child nodes and the set of right child nodes of the node, respectively; in response to the presence of only one data to be clustered in the set of nodes, storing the data to be clustered in the node.

[0007] According to an embodiment of the present invention, the clustering of the kd-tree using a filtering algorithm includes: traversing each node of the kd-tree starting from the root node and clustering each node according to a secure filtering algorithm; and stopping the traversal of the kd-tree in response to successful clustering.

[0008] According to one embodiment of the present invention, the clustering of nodes using the secure filtering algorithm includes: obtaining the mean of each data to be clustered in the set of nodes; calculating the Euclidean distance between the mean and the cluster centers of each data cluster in the candidate cluster set according to the secure Euclidean distance protocol, and obtaining the data cluster center with the smallest Euclidean distance to the mean according to the secure maximum / minimum protocol, and using this data cluster center as the first candidate data cluster center; comparing the first candidate cluster center with other cluster centers in the candidate cluster set, if all data in the node is closer to the candidate cluster center than other cluster centers, then the other cluster centers are removed from the candidate cluster set; if only one cluster remains in the candidate cluster set, then all data in the node is considered to be assigned to the candidate data cluster center, and no further clustering is performed on the child nodes. Otherwise, the current candidate cluster set is used as the candidate cluster set for child nodes, and the above process is performed on the child nodes until all nodes are successfully partitioned.

[0009] According to one embodiment of the present invention, obtaining a set number of data cluster centers includes: generating the set number of data cluster centers using a random number algorithm.

[0010] In a second aspect, the present invention provides a computer device including a processor and a memory, wherein the memory stores computer program instructions for execution on the processor, and when the processor executes the computer program instructions, it implements the privacy-preserving outsourced k-means clustering method based on kd-tree as described in any of the above embodiments.

[0011] Thirdly, the present invention provides a computer storage medium, wherein the computer instructions, when executed by a processor, implement the privacy-preserving outsourced k-means clustering method based on kd-tree as described in any of the above embodiments.

[0012] Fourthly, the present invention provides a privacy-preserving outsourced k-means clustering system based on kd-tree, comprising multiple clients and multiple cloud servers. The clients first divide the data into two parts using additive secret sharing, and then send each part to different cloud servers respectively. The cloud servers are used to cluster the received data according to the privacy-preserving outsourced k-means clustering method based on kd-tree as described in any of the above embodiments.

[0013] The technical solution provided by this invention involves a user constructing a kd-tree on plaintext, encrypting it, and distributing it to dual cloud servers. The cloud servers then use a filtering algorithm based on a secure Euclidean distance protocol, a secure comparison protocol, a secure maximum / minimum protocol, and a secure clustering protocol to obtain the kd-tree of the data to be clustered, thereby achieving clustering of the data. Since this invention's technical solution clusters based on the kd-tree of the data to be clustered, the structure of the kd-tree does not need to be updated during the clustering process, thus reducing the complexity of clustering and improving the clustering speed. Attached Figure Description

[0014] The above and other objects, features, and advantages of exemplary embodiments of the present invention will become readily apparent upon reading the following detailed description with reference to the accompanying drawings. In the drawings, several embodiments of the invention are illustrated by way of example and not limitation, and like or corresponding reference numerals denote like or corresponding parts, wherein:

[0015] Figure 1 This is a flowchart of a privacy-preserving outsourced k-means clustering method based on kd-tree according to an embodiment of the present invention;

[0016] Figure 2 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Those skilled in the art should understand that the embodiments described below are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0018] Please see Figure 1 , Figure 1 The diagram illustrates the workflow of a privacy-preserving k-means clustering method based on kd-tree, as described in this application. This method is executed on a cloud server to cluster received data. The following section combines... Figure 1 The flowchart shown provides a detailed introduction to the privacy-preserving outsourced k-means clustering method based on kd-tree in this application.

[0019] like Figure 1 As shown, the privacy-preserving outsourced k-means clustering method based on kd-tree provided in this application includes the following steps:

[0020] In step S1, a safe maximum / minimum protocol, a safe Euclidean distance protocol, a safe comparison protocol, and a safe clustering protocol are obtained. The safe maximum / minimum protocol is used to obtain the minimum or maximum value in a specific data sequence. For example, the minimum or maximum value in a specific data sequence can be obtained by using a bubble sort method. The safe comparison protocol is used to compare the size of each data in a specific data sequence. The safe Euclidean distance protocol is used to calculate the Euclidean distance. The safe clustering protocol is used to cluster the specific data sequence based on a kd-tree using a filtering algorithm.

[0021] In this embodiment, to reduce computational complexity, the variance calculation protocol in the aforementioned secure kd-tree protocol eliminates the denominator when calculating the variance of a specific data sequence, thereby eliminating division calculations and converting the entire calculation process into multiplication calculations. The conversion process is as follows:

[0022]

[0023] In the above formula, s represents the variance of a specific data sequence in the x-dimensional dimension, and x... i Let be the value of the i-th data point in the x-th dimension of a specific data sequence, and n be the total number of data points in the specific data sequence. It represents the variance of a specific data sequence in the x-dimensional dimension.

[0024] The aforementioned safe European distance protocol uses the following formula when calculating the safe distance:

[0025]

[0026] Where α is the scaling factor, x i This represents the data of a kd-tree node in dimension x, where k is the data of the cluster center in one dimension.

[0027] In step S2, the data to be clustered is obtained. The variance of the data to be clustered in each dimension is calculated using the aforementioned safe variance calculation sub-protocol. The dimension with the largest variance is obtained using the safe maximum / minimum value protocol, and this dimension is used as the reference dimension. For example, assuming that the data to be clustered are all two-dimensional data, with x-dimensional and y-dimensional dimensions respectively, in this step S2, the aforementioned safe variance calculation sub-protocol is used to calculate the variance of the data to be clustered in the x-dimensional and the y-dimensional dimensions respectively. Then, the maximum value of the variance of the data to be clustered in the x-dimensional and the y-dimensional dimensions is obtained using the safe maximum / minimum value protocol, and the dimension corresponding to this maximum value is used as the reference dimension. That is, if the variance of the data to be clustered in the x-dimensional is greater than the variance in the y-dimensional, then the x-dimensional is used as the reference dimension.

[0028] In step S3, based on the aforementioned reference dimension, the aforementioned secure comparison protocol and secure partitioning sub-protocol are used to construct the kd-tree of the data to be clustered. That is, in this step S3, the size relationship of the data to be clustered under the reference dimension is obtained through the secure comparison protocol, and then the secure partitioning sub-protocol is used to partition the data according to the size relationship of the data to be clustered under the reference dimension, so as to complete the construction of the kd-tree.

[0029] In step S4, a set number of data cluster centers are obtained. Then, based on the secure Euclidean distance protocol, secure comparison protocol, secure maximum / minimum protocol, secure clustering protocol, and the kd-tree of the data to be clustered, a filtering algorithm is used to cluster the data to be clustered. That is, the filtering algorithm is used to obtain the cluster centers of the data to be clustered based on the kd-tree of the data to be clustered, so as to achieve the clustering of the data to be clustered.

[0030] The technical solution provided by this invention, when storing data to be clustered, first constructs a kd-tree for the data using a secure maximum / minimum value protocol, a secure comparison protocol, and a secure kd-tree construction protocol. Then, it uses a filtering algorithm based on a secure Euclidean distance protocol, a secure comparison protocol, a secure maximum / minimum value protocol, and a secure clustering protocol to obtain the kd-tree for clustering, thereby achieving clustering of the data. Since the technical solution of this invention clusters the data based on the kd-tree, it eliminates the need for separate calculations for each piece of data during the clustering process, thus reducing the complexity of clustering and improving the clustering speed of the data.

[0031] The preceding text has provided a detailed description of the secure data storage method based on kd-tree and k-means clustering of the present invention. The following text, in conjunction with a specific application scenario, provides a detailed description of the method for constructing the kd-tree of the data to be clustered within this secure data storage method. It is understood that the detailed description of the method for constructing the kd-tree of the data to be clustered below is exemplary and not restrictive, and the description of the method above also applies to the following text.

[0032] In one embodiment, the method for constructing the kd-tree of the data to be clustered includes: the kd-tree is constructed by the user in plaintext, then encrypted and sent to the dual-cloud server. The construction process includes: using all the data to be clustered as the set of root nodes of the kd-tree, and using a secure comparison protocol to obtain the median of each data to be clustered in the reference dimension, then using the data to be clustered corresponding to the median as the root node of the kd-tree, and using all data to be clustered in the reference dimension that are greater than the median and all data to be clustered that are less than the median as the set of two child nodes of the root node of the kd-tree, and then constructing the two child nodes according to the method described above based on the root node of the kd-tree; and so on. When there is only one data to be clustered in the set of nodes, the node can be considered as a leaf node, and the data to be clustered can be stored in the node; when all leaf nodes are set, the kd-tree of the data to be clustered can be considered to be constructed.

[0033] For example, suppose there are seven data points to be clustered, each a two-dimensional data point with a reference dimension of x. When constructing a kd-tree for the data using the method described above, firstly, obtain the median of the seven data points in the x-dimensional dimension. Assuming the fourth data point has a median value of x4 in the x-dimensional dimension, store this median in the root node. Set the data points in the reference dimension greater than x4 as the set of the root node's left child nodes, and the data points in the reference dimension less than x4 as the set of the root node's right child nodes. Then, following the same method for setting the root node, set each node according to its set. When a node's set contains only one data point, simply store that data in that node; this node is a leaf node, and construction of that branch can stop. After constructing all leaf nodes, the kd-tree construction of the data can be considered complete.

[0034] The above text provides a detailed introduction to the method of constructing a kd-tree for the data to be clustered. The following text, in conjunction with specific application scenarios, provides a detailed introduction to the clustering methods for the data to be clustered.

[0035] In one embodiment, the method for clustering a kd-tree using a filtering algorithm includes: traversing each node starting from the root node of the kd-tree, and clustering each node according to a safe Euclidean distance protocol and a safe maximum / minimum protocol until clustering is successful. During clustering, the cluster centers of each node are obtained, and the data to be clustered is divided into clusters based on these cluster centers. For example, if the root node of the kd-tree is successfully clustered, the cluster center corresponding to the root node is obtained, and all the data to be clustered is assigned to the cluster corresponding to that cluster center. If the root node is not successfully clustered, its two child nodes are clustered separately. If the two child nodes are successfully clustered, the data to be clustered in the sets of the two child nodes are assigned to their respective clusters; if clustering fails, the child nodes of the two child nodes are clustered, and so on, until clustering is successful.

[0036] The following section provides a detailed introduction to the clustering methods for each node in a kd-tree of data to be clustered, using specific application scenarios as examples. It should be understood that the node clustering methods described below are exemplary and not restrictive.

[0037] In one embodiment, when clustering nodes in a kd-tree, the mean of each data point to be clustered in the node set is first obtained. That is, the average value of each data point to be clustered is calculated in each dimension, and then a data point is formed by the average values ​​of each dimension. This data point is the mean of each data point to be clustered. Then, according to the safe Euclidean distance protocol, the Euclidean distance between this mean and each data cluster center is calculated, and according to the safe maximum / minimum protocol, the data cluster center with the smallest Euclidean distance to the mean is obtained, and this data cluster center is used as the first candidate data cluster center. The first candidate cluster center is compared with other cluster centers in the candidate cluster set. If all data in the node is closer to the candidate cluster center than other cluster centers, then the other cluster centers are removed from the candidate cluster set. If only one cluster remains in the candidate cluster set, then all data in the node is considered to be assigned to the candidate data cluster center, and no further clustering is performed on the child nodes. Otherwise, the current candidate cluster set is used as the candidate cluster set for child nodes, and the above process is performed on the child nodes until all nodes are successfully partitioned.

[0038] Taking the clustering of the root node of a kd-tree as an example, when using a filtering algorithm to cluster it, after selecting the first candidate cluster center from the candidate cluster set, we compare the first candidate cluster center with the other candidate cluster centers in the candidate cluster set. If all the data in the kd-tree node are closer to the first candidate cluster center, then this candidate cluster center can be removed from the candidate cluster set. If after comparing all other cluster centers in the candidate cluster set, only one remains, then it is considered that the node can be assigned to the first candidate cluster center.

[0039] The above text provides a detailed introduction to node clustering methods. Below, we will explain in detail the methods for obtaining data cluster centers, taking into account specific application scenarios.

[0040] According to a second aspect of the invention, the invention also provides a computer device, such as... Figure 2 As shown, the device includes a processor, a memory, a communication interface, and a communication bus. The processor, memory, and communication interface communicate with each other via the communication bus. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system and computer program instructions. The internal memory provides an environment for the operation of the operating system and computer program instructions in the non-volatile storage medium. The communication interface of the device is used for wired or wireless communication with external terminals. Wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The memory stores computer program instructions that cause the processor to execute the above-described invention. Figure 1 The example shown is a privacy-preserving k-means clustering method based on kd-tree.

[0041] According to a third aspect of the present invention, a computer-readable storage medium is also provided. Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by instructing related hardware through computer program instructions. These computer program instructions can be stored in a non-volatile computer-readable storage medium, and when executed, they can implement the above-described present invention. Figure 1 The illustrated example is a privacy-preserving k-means clustering method based on kd-tree. Any references to memory, storage, databases, or other media used in the embodiments provided in this invention may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and RAMbus dynamic RAM (RDRAM), etc.

[0042] According to a fourth aspect of the present invention, the present invention also provides a privacy-preserving outsourced k-means clustering system based on kd-tree. This system includes multiple clients and multiple cloud servers, and each client can send data to each cloud server for storage. When a client needs to store data, it first encrypts the data, then divides the encrypted data into a predetermined number of parts, for example, two parts, with the data size of each part randomly set. Each part of the data is then sent to a different cloud server. After receiving the data sent by the client, the cloud server treats it as data to be clustered, clusters the data according to the privacy-preserving outsourced k-means clustering method based on kd-tree described in the above embodiments, and then stores the clustered data.

[0043] The terms "first" or "second," etc., used to designate numbers or ordinal numbers in this specification are for descriptive purposes only and should not be construed as indicating relative importance or implying the number of indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this specification, "a plurality of" means at least two, such as two, three, or more, unless otherwise expressly and specifically defined.

[0044] While various embodiments of the invention have been shown and described herein, it will be apparent to those skilled in the art that such embodiments are provided by way of example only. Many modifications, alterations, and alternatives will occur to those skilled in the art without departing from the spirit and essence of the invention. It should be understood that various alternatives to the embodiments of the invention described herein may be employed in the practice of the invention. The claims are intended to define the scope of protection of the invention and therefore cover the modular compositions, equivalents, or alternatives within the scope of these claims.

Claims

1. A privacy-preserving outsourced k-means clustering method based on kd-tree, characterized in that, include: The system acquires a secure maximum / minimum value protocol, a secure Euclidean distance protocol, a secure comparison protocol, and a secure clustering protocol. The secure maximum / minimum value protocol is used to find the minimum value or minimum value in a specific data sequence; the secure Euclidean distance protocol is used to calculate the Euclidean distance; the secure comparison protocol is used to compare the size of each data point in a specific data sequence; and the secure clustering protocol is used to cluster a specific data sequence based on a kd-tree using a filtering algorithm. The kd-tree construction is provided to the user and then encrypted before being sent to the dual-cloud servers. Constructing the kd-tree includes: Obtain the data to be clustered, calculate the variance of all dimensions of the data, and use the dimension with the largest variance as the reference dimension; Based on the reference dimension, find the median of the dimension data, divide the data evenly into two parts, and repeat the above process of finding the median and dividing the data until the data is divided to a given number. The specific methods for constructing the kd-tree include: The data to be clustered is used as the set of root nodes; In response to the fact that there are multiple data to be clustered in the root node set, the median of the data to be clustered in the root node set under the reference dimension is obtained according to the secure comparison protocol. The data to be clustered corresponding to the median is stored in the root node, and the data to be clustered under the reference dimension that are greater than and less than the median are respectively used as the set of the left child node and the set of the right child node of the root node. If there is only one data to be clustered in the set of the root node, store the data to be clustered in the root node; Obtain a set number of data cluster centers, and use a filtering algorithm to cluster the data to be clustered according to the secure Euclidean distance protocol, secure comparison protocol, secure maximum / minimum protocol, secure clustering protocol and the kd-tree; The step of using a filtering algorithm to cluster the data to be clustered includes: Starting from the root node of the kd-tree, traverse each root node and cluster each root node according to the security filtering algorithm; In response to successful clustering, stop traversing the kd-tree; The clustering of each root node according to the security filtering algorithm includes: Obtain the mean of each data point to be clustered in the set of root nodes; According to the safe Euclidean distance protocol, the Euclidean distance between the mean and the center of each data cluster in the candidate cluster set is calculated, and the data cluster center with the smallest Euclidean distance is obtained according to the safe maximum and minimum value protocol, and the data cluster center is used as the first candidate data cluster center. The first candidate cluster center is compared with other cluster centers in the candidate cluster set. If all data in the root node is closer to the first candidate cluster center than other cluster centers, the other cluster centers are removed from the candidate cluster set. If only one cluster remains in the candidate cluster set, it is considered that all data in the root node can be assigned to the first candidate cluster center, and no further clustering is performed on the child nodes. Otherwise, the current candidate cluster set is used as the candidate cluster set for child nodes, and the above process is performed on the child nodes until all root nodes are successfully partitioned.

2. A computer device, characterized in that, It includes a processor and a memory, the memory storing computer program instructions for execution on the processor, wherein when the processor executes the computer program instructions, it implements the privacy-preserving outsourced k-means clustering method based on kd-tree as described in claim 1.

3. A computer storage medium, characterized in that, It stores computer instructions, which, when executed by a processor, implement the privacy-preserving outsourced k-means clustering method based on kd-tree as described in claim 1.

4. A privacy-preserving outsourced k-means clustering system based on kd-tree, characterized in that, It includes multiple clients and two cloud servers, among which The client is used to: first construct a kd-tree based on the stored data, then divide the additive secret sharing into two parts, and finally send each part to a different cloud server; The cloud server is used to cluster the received data using the k-means clustering method based on kd-tree privacy protection outsourcing as described in claim 1.

Images