Utility optimization key-value data protection method and device based on local differential privacy

Abstract

The application discloses a utility optimization key value data protection method and device based on local differential privacy, and the method comprises the following steps: dividing a key field into a sensitive data field and a non-sensitive data field, and disclosing the fields to users; a user distinguishes local key value data into sensitive key value data and non-sensitive key value data, respectively performs perturbation, obtains privacy key value data, and sends the privacy key value data to a server; the server collects privacy key value data of multiple users, respectively performs statistics on key data and value data in the sensitive privacy key value data and the non-sensitive privacy key value data, and calculates frequency distribution of key data and mean value of value data in original key value data. By using the technical method, different perturbation modes are adopted according to the importance of privacy in the local of the user, and corresponding protection intensity is distinguished, so that the user privacy is protected, the overall data utility is improved, and the accuracy of frequency estimation and mean value estimation results is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of information security, and particularly relates to a utility optimization key-value data protection method and device based on local differential privacy. BACKGROUND

[0002] With the rapid development of economy and technology, intelligent terminals and other devices are becoming increasingly popular, and the user data generated thereby is collected and studied by relevant companies. Key-value data is a very common data form in real life and has a wide range of application scenarios. By analyzing key-value data, hidden information can be mined therefrom, and better services can be provided for users. For example, video browsing records of users are collected, user preferences are analyzed and a recommendation system is improved, and medical records of users are collected to provide prospective diagnosis of diseases for users. However, a large amount of private information is often contained in the data, and if the data is directly provided to others for use, it will pose a great threat to the personal and property safety of users, and will also reduce the willingness of users to share data. Therefore, how to collect, analyze and publish data under the premise of protecting user privacy is a problem that needs to be solved.

[0003] Differential privacy is a privacy protection model. Unlike other privacy protection technologies, differential privacy has strict mathematical formalized security proof support and high efficiency and low overhead characteristics, and can quantify the degree of privacy protection, and does not need to consider how much background knowledge an attacker has. Under the traditional differential privacy model, a user needs to send his / her real data to a server, and the server completes the perturbation and publication of the data, which must ensure that the server is absolutely trustworthy. However, in actual applications, it is difficult to find such a completely trustworthy third party, and therefore local differential privacy is proposed.

[0004] Local differential privacy discards the requirement for a trusted third party, while inheriting the advantages of differential privacy, and is an application of differential privacy in a localized scenario. By migrating the data perturbation step from the server end to the user end and sending only the perturbed data to the server, the model can resist attacks from untrusted third parties under the premise of meeting the requirements of data statistical analysis, and greatly improves the practicality of the model.

[0005] Local differential privacy primarily focuses on homogeneous data. However, in real-world applications, mixed or heterogeneous data is used more extensively. Existing key-value data estimation mechanisms under local differential privacy perturb all data using the same perturbation method. However, in practical applications, different data types have varying sensitivities. For example, when collecting user shopping records, "medicine" is more sensitive than "daily necessities," and when collecting user movie viewing records, "horror" and "thriller" are more sensitive than "comedy" and "romance." Directly perturbing different data types in the same way would overprotect less sensitive data, leading to reduced accuracy in statistical results. Summary of the Invention

[0006] Purpose of the invention: This invention provides a utility-optimized key-value data protection method and apparatus based on local differential privacy. By dividing key-value data into sensitive and non-sensitive key-value data locally by the user, and perturbing them with different methods, the protection level is differentiated according to the importance of privacy. This not only protects user privacy but also improves the overall data utility and the accuracy of frequency and mean estimation results.

[0007] Technical Solution: This invention provides a utility-optimized key-value data protection method based on local differential privacy, comprising: a server dividing the key domain corresponding to key data into sensitive data domains and non-sensitive data domains, and disclosing the sensitive data domains and non-sensitive data domains to users; users, based on the disclosed sensitive data domains and non-sensitive data domains, distinguishing local key-value data into sensitive key-value data and non-sensitive key-value data, perturbing the sensitive key-value data and non-sensitive key-value data respectively to obtain private key-value data, and sending the private key-value data to the server; the server collecting private key-value data from multiple users, dividing it according to the sensitive data domains and non-sensitive data domains to obtain sensitive private key-value data and non-sensitive private key-value data, statistically analyzing the key data and value data in the sensitive private key-value data and non-sensitive private key-value data respectively, and calculating the frequency distribution of the key data and the mean of the value data in the original key-value data.

[0008] Specifically, sensitive data domains, non-sensitive data domains, and privacy budgets will be made public to users.

[0009] Specifically, before users perturb local key-value data, the value data and its corresponding value range are standardized using the following standardization formula:

[0010] v i '=2(v i -a) / (ba)-1,

[0011] Among them, v i This represents the i-th value, with a value range of [a, b].i ' indicates v i The standardized value data is then standardized to the range [-1, 1] using a standardization formula.

[0012] Specifically, the key data of sensitive key-value data is perturbed to the protected output, and the key data of non-sensitive key-value data is perturbed to either the protected output or the unprotected output. If the key data is perturbed to the protected output, the key data remains unchanged according to a first probability, and is converted into perturbed key data according to a second probability. The corresponding value data remains unchanged or is converted into perturbed value data according to a privacy budget probability. If the key data is perturbed to the unprotected output according to a third probability, the key data remains unchanged, and the corresponding value data remains unchanged. The key fields of the perturbed key data and the sensitive data fields are the same.

[0013] Specifically, if the key data is perturbed into the protected output, including: the corresponding value data being discretized to -1 or 1 according to the fourth probability; whether to convert the key data into perturbed key data is determined according to the following formula:

[0014] C1+(|U s |-1)C2=1,

[0015] Where C1 represents the first probability, C2 represents the second probability, and U s Indicates sensitive data fields;

[0016] If the key data remains unchanged, the corresponding value data is converted back to the original value data according to the privacy budget probability p after discretization, and converted to a negative value according to the probability (1-p); if the key data is converted to perturbed key data, the corresponding value data is converted back to the original value data according to the fifth probability q after discretization, and converted to a negative value according to the probability (1-q).

[0017] Specifically, the third probability C3 is calculated according to the following formula:

[0018] C3+|U s |C2=1;

[0019] The corresponding value data is discretized to -1 or 1 according to the fourth probability, including:

[0020] According to (1-v) o ) / 2 or (1+v o Discretize v to either -1 or 1, where v o This refers to the original value data corresponding to the value data.

[0021] Specifically, the specific values ​​corresponding to specific keys in sensitive privacy key-value data are statistically analyzed. The number of times the specific value is 1 is recorded as the first count, and the number of times the specific value is -1 is recorded as the second count. Combining the first and second counts, the frequency of occurrence of the specific key data is calculated. The frequency of occurrence of the specific key data is corrected by considering the number of users collecting privacy key-value data on the server, and the frequency of occurrence of the specific key data in sensitive privacy key-value data is calculated. The sum of the specific value data is calculated, and the sum of the specific value data is corrected by considering the privacy budget probability, and the mean of the specific value data is calculated.

[0022] Specifically, the selected key data in the non-sensitive privacy key-value data is statistically analyzed to calculate the frequency of occurrence of the selected key data. Combined with the third probability, the frequency of occurrence of the selected key data is corrected, and the frequency of occurrence of the selected key data in the non-sensitive privacy key-value data is calculated. The selected value data corresponding to the selected key data in the non-sensitive privacy key-value data is statistically analyzed to calculate the sum of the selected value data and the mean of the selected value data.

[0023] Specifically, the number of occurrences of a specific key data is calculated according to the following formula:

[0024] n1+n2,

[0025] Where n1 represents the first number and n2 represents the second number;

[0026] The correction for the occurrence frequency of specific key data is calculated according to the following formula:

[0027] (n1+n2-nC2) / (C1-C2), where n represents the number of users whose privacy key-value data is collected by the server;

[0028] The frequency f of specific key data appearing in sensitive privacy key-value data is calculated. s Calculate according to the following formula:

[0029] f s = ((n1+n2) / n-C2)(C1-C2);

[0030] The sum of the specific value data is calculated according to the following formula:

[0031] n1-n2;

[0032] The correction of the sum of specific value data is calculated according to the following formula:

[0033] (n1-n2) / (2p-1);

[0034] The calculation of the mean m of specific value data s Calculate according to the following formula:

[0035] m s =((n1-n2)(C1-C2)) / ((2p-1)(n1+n2-nC2)C1);

[0036] The correction of the occurrence count of the selected key data is calculated according to the following formula:

[0037] n k / C3,n k Indicates the number of times the selected key data appears;

[0038] The frequency f of the selected key data in the non-sensitive privacy key-value data is calculated. k Calculate according to the following formula:

[0039] f k =n k / (C3n);

[0040] The mean m of the selected value data is calculated. k Calculate according to the following formula:

[0041] m k =sum k / n k , sum k This represents the sum of the selected data values.

[0042] This invention also provides a utility-optimized key-value data protection device based on local differential privacy, comprising: a partitioning unit, a perturbation unit, and a statistics unit, wherein: the partitioning unit is used by the server to partition the key domain corresponding to the key data into sensitive data domains and non-sensitive data domains, and to expose the sensitive data domains and non-sensitive data domains to the user; the perturbation unit is used by the user to distinguish local key-value data into sensitive key-value data and non-sensitive key-value data according to the exposed sensitive data domains and non-sensitive data domains, to perturb the sensitive key-value data and non-sensitive key-value data respectively, to obtain privacy key-value data, and to send the privacy key-value data to the server; the statistics unit is used by the server to collect privacy key-value data from multiple users, partition it according to the sensitive data domains and non-sensitive data domains to obtain sensitive privacy key-value data and non-sensitive privacy key-value data, to perform statistics on the key data and value data in the sensitive privacy key-value data and non-sensitive privacy key-value data respectively, and to calculate the frequency distribution of the key data and the mean of the value data in the original key-value data.

[0043] Beneficial effects: Compared with the prior art, the present invention has the following significant advantages: different perturbation methods are adopted locally by the user according to the importance of privacy, and the corresponding protection level is differentiated. While protecting user privacy, the overall data utility and the accuracy of frequency estimation and mean estimation results are improved. Attached Figure Description

[0044] Figure 1 A schematic diagram illustrating the steps of the utility-optimized key-value data protection method based on local differential privacy provided by the present invention;

[0045] Figure 2 A schematic diagram of the user terminal provided by the present invention;

[0046] Figure 3 This is a schematic diagram of the server-side process provided by the present invention. Detailed Implementation

[0047] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0048] See Figure 1 This is a schematic diagram illustrating the steps of the utility-optimized key-value data protection method based on local differential privacy provided by the present invention.

[0049] Step S1: The server divides the key fields corresponding to the key data into sensitive data fields and non-sensitive data fields, and exposes the sensitive data fields and non-sensitive data fields to the user.

[0050] In this embodiment of the invention, sensitive data domains, non-sensitive data domains, and privacy budgets are disclosed to users.

[0051] In practice, key data and corresponding value data form key-value pairs, and multiple key-value pairs form key-value data. Key data is usually user input data, and the corresponding value data is data generated based on the input data or related value data. For example, a user has multiple movie viewing records (key data k) and rates the corresponding movie viewing records (value data v). That is, each user has a set of key-value pairs (k, v). By collecting all users' rating records and aggregating them, and statistically analyzing the relevant attributes of a movie, such as the number of people who watched the movie and the average rating of the movie, the server can provide movie suggestions by selecting high-frequency and high-average ratings.

[0052] In practical implementation, the formal definition of local differential privacy is as follows: A random perturbation algorithm M:X→Y, where X is the domain and Y is the range, satisfies ε-local differential privacy if and only if, for any two user data x, x^'∈X, any possible output y∈Y satisfies the inequality Pr[M(x)=y] / Pr[M(x^')=y]≤e^ε (ε≥0). The ε in this inequality is called the privacy budget, which measures the degree of indistinguishability between any two data points within the data domain, i.e., the strength of protection for user data. The smaller the privacy budget ε, the higher the indistinguishability and the stronger the privacy protection; correspondingly, the lower the accuracy of the final data statistical estimate. Conversely, the larger the privacy budget ε, the lower the indistinguishability and the weaker the privacy protection, and the higher the estimation accuracy. The privacy budget probability is analogous to the privacy budget.

[0053] In practice, key fields are divided into sensitive data fields and non-sensitive data fields, which means differentiating the privacy sensitivity of user data and the level of protection.

[0054] See Figure 2 This is a flowchart of the user terminal provided by the present invention.

[0055] In step S2, the user distinguishes local key-value data into sensitive key-value data and non-sensitive key-value data based on the publicly disclosed sensitive data domain and non-sensitive data domain. The user then perturbs the sensitive key-value data and non-sensitive key-value data respectively to obtain privacy key-value data, and sends the privacy key-value data to the server.

[0056] In this embodiment of the invention, before the user perturbs the local key-value data, the value data and the corresponding value range are standardized using the following standardization formula:

[0057] v i '=2(v i -a) / (ba)-1,

[0058] Among them, v i This represents the i-th value, with a value range of [a, b]. i ' indicates v i The standardized value data is then standardized to the range [-1, 1] using a standardization formula.

[0059] In this embodiment of the invention, the key data of sensitive key-value data is perturbed to the protected output, and the key data of non-sensitive key-value data is perturbed to either the protected output or the unprotected output. If the key data is perturbed to the protected output, the key data remains unchanged according to a first probability and is converted into perturbed key data according to a second probability, while the corresponding value data remains unchanged or is converted into perturbed value data according to a privacy budget probability. If the key data is perturbed to the unprotected output according to a third probability, the key data remains unchanged, and the corresponding value data remains unchanged. The key fields of the perturbed key data and the sensitive data field are the same.

[0060] In this embodiment of the invention, if the key data is disturbed to the protected output, the corresponding value data is discretized to -1 or 1 according to a fourth probability.

[0061] Determine whether to convert key data to perturbation key data using the following formula:

[0062] C1+(|U s |-1)C2=1,

[0063] Where C1 represents the first probability, C2 represents the second probability, and U s Indicates sensitive data fields;

[0064] If the key data remains unchanged, the corresponding value data is converted back to the original value data according to the privacy budget probability p after discretization, and converted to a negative value according to the probability (1-p); if the key data is converted to perturbed key data, the corresponding value data is converted back to the original value data according to the fifth probability q after discretization, and converted to a negative value according to the probability (1-q).

[0065] In this embodiment of the invention, the third probability C3 is calculated according to the following formula:

[0066] C3+|U s |C2=1;

[0067] The corresponding value data is discretized to -1 or 1 according to the fourth probability, including:

[0068] According to (1-v) o ) / 2 or (1+v o Discretize v to either -1 or 1, where v o This refers to the original value data corresponding to the value data.

[0069] In practice, the relevant probabilities in this invention can be obtained through statistical calculations or set according to the actual application scenario.

[0070] In practice, users determine the sensitive data field U based on the key field divisions publicly disclosed by the server. S Non-sensitive data domain U NDetermine the number of key-value pairs (k) you possess. i ,v i The data type is either sensitive or non-sensitive; if the key k i ∈U S That is, the key-value data (k i ,v i The data type is sensitive data, key k i ∈U S The disturbance will be directed to the protected output Y P In the middle, keep the original bond k i The probability is C1, and it changes to another key k. i '∈U S The probability is C2, where C1+(|U S |-1)C2=1;If key k i ∈U N That is, the key-value data (k i ,v i The data type is non-sensitive, and the key is k. i ∈U N The protected output Y will be perturbed according to probability. P Or unprotected output Y I In the middle, the perturbation to Y P When, it becomes another key k i '∈U S The probability is C2, and the perturbation to Y is... I At that time, it means preserving the original bond k i The probability is C3, where C3 + |U S |C2=1; if key-value data (k i ,v i The key k of ') i Disturbed to Y I In the middle, at this time, key k i The value v remains unchanged. i 'Also remains unchanged, if key-value data (k i ,v i ) key k i Disturbed to Y P In the middle, the value v i First, based on the original value v i The size depends on the probability (1-v) i ) / 2 or (1+v i Discretize ) / 2 to -1 or 1, if the key k i If it remains unchanged, then its value v i 'The probability p related to ε is converted to the original value v' i The probability 1-p related to ε is converted to a negative value (-v). i '), if key k i If it changes, then its value vi 'Revert to the original value v with a probability of 0.5' i Or negative value (-v) i ').

[0071] See Figure 3 This is a schematic diagram of the server-side process provided by the present invention.

[0072] Step 3: The server collects privacy key-value data from multiple users, divides it according to sensitive data domains and non-sensitive data domains to obtain sensitive privacy key-value data and non-sensitive privacy key-value data, and performs statistical analysis on the key data and value data in the sensitive privacy key-value data and non-sensitive privacy key-value data respectively to calculate the frequency distribution of key data and the mean of value data in the original key-value data.

[0073] In practice, the original key-value data refers to the user's local, undisturbed data. The calculation of the frequency distribution of the key data and the mean of the value data in the original key-value data is generally an estimation result.

[0074] In this embodiment of the invention, the specific value data corresponding to specific key data in sensitive privacy key-value data are statistically analyzed. The number of times the specific value data is 1 is recorded as the first count, and the number of times the specific value data is -1 is recorded as the second count. Combining the first count and the second count, the occurrence frequency of the specific key data is calculated. The occurrence frequency of the specific key data is corrected by combining the number of users collecting privacy key-value data on the server, and the occurrence frequency of the specific key data in sensitive privacy key-value data is calculated. The sum of the specific value data is calculated, and the sum of the specific value data is corrected by combining the privacy budget probability, and the mean of the specific value data is calculated.

[0075] In this embodiment of the invention, the selected key data in the non-sensitive privacy key value data is statistically analyzed, the occurrence frequency of the selected key data is calculated, and the occurrence frequency of the selected key data is corrected by combining the third probability, and the occurrence frequency of the selected key data in the non-sensitive privacy key value data is calculated; the selected value data corresponding to the selected key data in the non-sensitive privacy key value data is statistically analyzed, the sum of the selected value data is calculated, and the mean of the selected value data is calculated.

[0076] In this embodiment of the invention, the calculation of the occurrence count of specific key data is performed according to the following formula:

[0077] n1+n2,

[0078] Where n1 represents the first number and n2 represents the second number;

[0079] The correction for the occurrence frequency of specific key data is calculated according to the following formula:

[0080] (n1+n2-nC2) / (C1-C2), where n represents the number of users whose privacy key-value data is collected by the server, that is, the number of users who send privacy key-value data to the server;

[0081] The frequency f of specific key data appearing in sensitive privacy key-value data is calculated. s Calculate according to the following formula:

[0082] f s = ((n1+n2) / n-C2)(C1-C2);

[0083] The sum of the specific value data is calculated according to the following formula:

[0084] n1-n2;

[0085] The correction of the sum of specific value data is calculated according to the following formula:

[0086] (n1-n2) / (2p-1);

[0087] The calculation of the mean m of specific value data s Calculate according to the following formula:

[0088] m s =((n1-n2)(C1-C2)) / ((2p-1)(n1+n2-nC2)C1);

[0089] The correction of the occurrence count of the selected key data is calculated according to the following formula:

[0090] n k / C3,n k Indicates the number of times the selected key data appears;

[0091] The frequency f of the selected key data in the non-sensitive privacy key-value data is calculated. k Calculate according to the following formula:

[0092] f k =n k / (C3n);

[0093] The mean m of the selected value data is calculated. k Calculate according to the following formula:

[0094] m k =sum k / n k , sum k This represents the sum of the selected data values.

[0095] In practical implementation, if a specific key data k s ∈U SThen, using sensitive privacy key-value data Y P The data in the key k s Perform frequency estimation for key k s The corresponding value v s The server performs mean estimation using Y. P Statistical value v s The number of times n1 is 1, and the value v s The number of times n2 is -1, and n1+n2 is used as the key k. s The number of occurrences is determined by the key k, which is corrected using (n1+n2-nC2) / (C1-C2). s The estimated frequency of occurrence is obtained by calculating the key k using ((n1+n2) / n-C2)(C1-C2). s ∈U S Frequency estimation f s Using n1-n2 as specific value data v s The sum, corrected by the formula (n1-n2) / (2p-1) v s The sum is obtained using the formula ((n1-n2)(C1-C2)) / ((2p-1)(n1+n2-nC2)C1), which gives the value v. s Mean estimate m s .

[0096] In practical implementation, if the selected key data k k ∈U N Then, using non-sensitive privacy key-value data Y I The data in the key k k Perform frequency estimation for key k k The corresponding value v k The server performs mean estimation using Y. I Statistical key k k Number of occurrences n k And through n k / C3 calibration key k k The estimated number of occurrences, using n k / (C3n) obtain key k k ∈U N Frequency estimation f k Through Y I Statistical key k k The corresponding selected value data v k sum k Using sum k / n k Get value v k Mean estimate m k .

[0097] In practice, there is a clear distinction between key-value data after local user disturbance. The range of values ​​for non-sensitive key-value data and sensitive key-value data are very different. The values ​​of non-sensitive data are continuous, and their mean can be estimated by simple summation and averaging. The values ​​of sensitive data are discrete and restricted to [-1, 1]. Frequency estimation and mean estimation are required based on the number of times the value is -1 or 1.

[0098] In practical implementation, experiments were conducted using the method provided by this invention. The dataset used in the experiments was Clothing, a dataset on Kaggle, which recorded ratings from 105,508 users for 5,850 items. Each rating is a record, totaling 192,544 records. This invention divides the records of each user's rating into several parts, with the sensitive data field size |U... S The privacy level was set to 500, and seven privacy levels were defined in the experiment, with privacy budgets of 0.1, 1.0, 2.0, 3.0, 4.0, 5.0, and 6.0 respectively. In the experiment, each user perturbed the data locally and sent the results to the server. The server then statistically analyzed and calculated the final frequency distribution and mean.

[0099] The experimental results of the utility-optimized local differential privacy key-value data acquisition method on this dataset are shown in Tables 1, 2, 3, and 4. To avoid the influence of randomness on the experimental results, the experiment was conducted 5 times. The mean-square error (MSE) was used as the evaluation criterion for the experiment. The MSE of the frequency was obtained by calculating the square of the difference between the estimated frequency and the true frequency, and the MSE of the mean was obtained by calculating the square of the difference between the estimated mean and the true mean.

[0100] Table 1. Experimental results of frequency estimation under different privacy budgets:

[0101]

[0102] Table 2. Experimental results of mean estimation under different privacy budgets:

[0103]

[0104] Table 3: Experimental results of frequency estimation with or without distinguishing between sensitive data:

[0105]

[0106] Table 4. Experimental results on mean estimation with or without distinguishing between sensitive data:

[0107]

[0108] As shown in Table 1, although there is a certain deviation between the frequency estimation results and the true frequency of the utility-optimized local differential privacy key-value data collection method, this deviation is relatively small. Table 2 shows that the deviation between the mean estimation and the true mean is also less than 1, which is within the acceptable range for the server. Furthermore, the estimation accuracy can be further improved by increasing the privacy budget. Meanwhile, although the results of the five experiments differ slightly, the fluctuations are all very small. In addition, if user data is collected directly without privacy protection, users may be unwilling to submit their data due to concerns about privacy leaks, or they may submit false data, which is very detrimental to the server's data analysis work. Tables 3 and 4 compare whether sensitive data is distinguished. It can be seen that distinguishing between sensitive and non-sensitive data can reduce the mean squared error of frequency estimation by several orders of magnitude, and the mean squared error of mean estimation is also significantly reduced. In other words, by reducing the protection of non-sensitive data, the estimation accuracy can be greatly improved, thus improving the overall data utility.

[0109] This invention also provides a utility-optimized key-value data protection device based on local differential privacy, comprising: a partitioning unit, a perturbation unit, and a statistics unit, wherein: the partitioning unit is used by the server to partition the key domain corresponding to the key data into sensitive data domains and non-sensitive data domains, and to expose the sensitive data domains and non-sensitive data domains to the user; the perturbation unit is used by the user to distinguish local key-value data into sensitive key-value data and non-sensitive key-value data according to the exposed sensitive data domains and non-sensitive data domains, to perturb the sensitive key-value data and non-sensitive key-value data respectively, to obtain privacy key-value data, and to send the privacy key-value data to the server; the statistics unit is used by the server to collect privacy key-value data from multiple users, partition it according to the sensitive data domains and non-sensitive data domains to obtain sensitive privacy key-value data and non-sensitive privacy key-value data, to perform statistics on the key data and value data in the sensitive privacy key-value data and non-sensitive privacy key-value data respectively, and to calculate the frequency distribution of the key data and the mean of the value data in the original key-value data.

[0110] In this embodiment of the invention, the partitioning unit is used to expose the sensitive data domain, the non-sensitive data domain, and the privacy budget to the user.

[0111] In this embodiment of the invention, the perturbation unit is used to standardize the value data and its corresponding value range before the user perturbs the local key-value data, using the following standardization formula:

[0112] v i '=2(v i -a) / (ba)-1,

[0113] Among them, v iThis represents the i-th value, with a value range of [a, b]. i ' indicates v i The standardized value data is then standardized to the range [-1, 1] using a standardization formula.

[0114] In this embodiment of the invention, the perturbation unit is used to perturb the key data of sensitive key-value data to the protected output, and to perturb the key data of non-sensitive key-value data to either the protected output or the unprotected output. If the key data is perturbed to the protected output, the key data remains unchanged according to a first probability and is converted into perturbed key data according to a second probability, while the corresponding value data remains unchanged or is converted into perturbed value data according to a privacy budget probability. If the key data is perturbed to the unprotected output according to a third probability, the key data remains unchanged, and the corresponding value data remains unchanged. The perturbed key data and the key field of the sensitive data field are the same.

[0115] In this embodiment of the invention, the perturbation unit is used to discretize the corresponding value data to -1 or 1 according to a fourth probability; and to determine whether to convert the key data into perturbation key data according to the following formula: C1+(|U s |-1)C2=1, where C1 represents the first probability, C2 represents the second probability, U s This represents the sensitive data domain. If the key data remains unchanged, the corresponding value data is converted to the original value data according to the privacy budget probability p after discretization, and converted to a negative value according to the probability (1-p). If the key data is converted to perturbation key data, the corresponding value data is converted to the original value data according to the fifth probability q after discretization, and converted to a negative value according to the probability (1-q).

[0116] In this embodiment of the invention, the perturbation unit is used to calculate the third probability C3 according to the following formula: C3 + |U s |C2=1; The corresponding value data is discretized to -1 or 1 according to the fourth probability, including: according to (1-v o ) / 2 or (1+v o Discretize v to either -1 or 1, where v o This refers to the original value data corresponding to the value data.

[0117] In this embodiment of the invention, the statistical unit is used to statistically analyze the specific value data corresponding to specific key data in sensitive privacy key-value data. The number of times the specific value data is 1 is recorded as the first count, and the number of times the specific value data is -1 is recorded as the second count. Combining the first count and the second count, the occurrence count of the specific key data is calculated. The occurrence count of the specific key data is corrected by combining the number of users collecting privacy key-value data on the server, and the occurrence frequency of the specific key data in sensitive privacy key-value data is calculated. The sum of the specific value data is calculated, and the sum of the specific value data is corrected by combining the privacy budget probability, and the mean of the specific value data is calculated.

[0118] In this embodiment of the invention, the statistical unit is used to perform statistics on the selected key data in the non-sensitive privacy key value data, calculate the number of times the selected key data appears, and correct the number of times the selected key data appears in combination with a third probability, and calculate the frequency of the selected key data in the non-sensitive privacy key value data; to perform statistics on the selected value data corresponding to the selected key data in the non-sensitive privacy key value data, calculate the sum of the selected value data, and calculate the mean of the selected value data.

[0119] In this embodiment of the invention, the statistical unit is used to calculate the occurrence frequency of specific key data according to the following formula: n1 + n2, where n1 represents the first occurrence and n2 represents the second occurrence; the correction of the occurrence frequency of specific key data is calculated according to the following formula: (n1 + n2 - nC2) / (C1 - C2), where n represents the number of users whose privacy key-value data is collected by the server; the calculation of the occurrence frequency f of specific key data in sensitive privacy key-value data is also included. s Calculate according to the following formula: f s = ((n1+n2) / n-C2)(C1-C2); The sum of the specific value data is calculated according to the following formula: n1-n2; The correction of the sum of the specific value data is calculated according to the following formula: (n1-n2) / (2p-1); The mean m of the specific value data is calculated. s Calculate m according to the following formula: s =((n1-n2)(C1-C2)) / ((2p-1)(n1+n2-nC2)C1); The correction of the occurrence count of the selected key data is calculated according to the following formula: n k / C3,n k This indicates the number of times the selected key data appears; the calculation of the frequency f of the selected key data in non-sensitive privacy key-value data. k Calculate according to the following formula: f k =n k / (C3n); The mean m of the selected value data is calculated. k Calculate m according to the following formula: k =sumk / n k , sum k This represents the sum of the selected data values.

Claims

1. A utility-optimized key-value data protection method based on local differential privacy, characterized in that, include: The server divides the key fields corresponding to the key data into sensitive data fields and non-sensitive data fields, and discloses the sensitive data fields, non-sensitive data fields, and privacy budget to users; Users can distinguish local key-value data into sensitive key-value data and non-sensitive key-value data based on publicly available sensitive and non-sensitive data fields. The value data and its corresponding value range are standardized using the following standardization formula: in i '=2(in i -a) / (ba)-1, Among them, v i This represents the i-th value, with a value range of [a, b]. i ' indicates v i The standardized value data is then standardized to the range [-1, 1] using a standardization formula. The key data of sensitive key-value data is perturbed and sent to the protected output. The key data of non-sensitive key-value data is perturbed and sent to either the protected output or the unprotected output to obtain privacy key-value data. This privacy key-value data is then sent to the server. If the key data is perturbed and sent to the protected output, the key data remains unchanged according to a first probability, is converted into perturbed key data according to a second probability, and the corresponding value data is determined according to a fourth probability (1-v). o ) / 2 or (1+v o Discretize v to -1 or 1 respectively, where v o This represents the original value data of the corresponding value data; whether to convert the key data into perturbation key data is determined according to the following formula: C1 + (|U s |-1)C2=1, where C1 represents the first probability, C2 represents the second probability, U s This represents the sensitive data domain. If the key data remains unchanged, the corresponding value data, after discretization, is converted back to the original value data according to the privacy budget probability p, and then converted to a negative value according to probability (1-p). If the key data is converted to perturbed key data, the corresponding value data, after discretization, is converted back to the original value data according to the fifth probability q, and then converted to a negative value according to probability (1-q). The key data is perturbed to the unprotected output according to the third probability. If the key data is perturbed to the unprotected output, the key data remains unchanged, and the corresponding value data remains unchanged. The third probability C3 is calculated according to the following formula: C3 + |U s | C2=1; The key fields of the perturbation key data and the sensitive data field are the same; The server collects privacy key-value data from multiple users, divides it into sensitive and non-sensitive data fields, and obtains sensitive privacy key-value data and non-sensitive privacy key-value data. The key data and value data in the sensitive privacy key-value data and non-sensitive privacy key-value data are statistically analyzed to calculate the frequency distribution of the key data and the mean of the value data in the original key-value data.

2. The utility-optimized key-value data protection method based on local differential privacy according to claim 1, characterized in that, The statistical analysis of key and value data in sensitive and non-sensitive privacy key-value data includes: Statistical analysis is performed on specific values ​​corresponding to specific keys in sensitive privacy key-value data. The number of times a specific value is 1 is recorded as the first count, and the number of times a specific value is -1 is recorded as the second count. Combining the first and second counts, the frequency of occurrence of specific key data is calculated. The frequency of occurrence of specific key data is corrected by considering the number of users collecting privacy key-value data on the server, and the frequency of occurrence of specific key data in sensitive privacy key-value data is calculated. The sum of specific value data is calculated, and the sum of specific value data is corrected by considering the privacy budget probability, and the mean of specific value data is calculated.

3. The utility-optimized key-value data protection method based on local differential privacy according to claim 2, characterized in that, The statistical analysis of key and value data in sensitive and non-sensitive privacy key-value data includes: Statistically analyze the selected key data in the non-sensitive privacy key-value data, calculate the frequency of the selected key data, and correct the frequency of the selected key data in the non-sensitive privacy key-value data by combining the third probability. Statistically analyze the selected value data corresponding to the selected key data in the non-sensitive privacy key-value data, calculate the sum of the selected value data, and calculate the mean of the selected value data.

4. The utility-optimized key-value data protection method based on local differential privacy according to claim 3, characterized in that, The statistical analysis of key and value data in sensitive and non-sensitive privacy key-value data includes: The count of occurrences of a specific key data is calculated according to the following formula: n1 + n2, Where n1 represents the first number and n2 represents the second number; The correction for the occurrence frequency of specific key data is calculated according to the following formula: (n1 + n2 - nC2) / (C1 - C2), where n represents the number of users whose privacy key-value data is collected by the server; The frequency f of specific key data appearing in sensitive privacy key-value data is calculated. s Calculate according to the following formula: f s =((n1+ n2) / n- C2)(C1-C2); The sum of the specific value data is calculated according to the following formula: n1- n2; The correction of the sum of specific value data is calculated according to the following formula: (n1- n2) / (2p-1); The calculation of the mean m of specific value data s Calculate according to the following formula: m s =((n1- n2)(C1-C2)) / ((2p-1)(n1+ n2-nC2)C1); The correction of the occurrence count of the selected key data is calculated according to the following formula: n k / C3,n k Indicates the number of times the selected key data appears; The frequency f of the selected key data in the non-sensitive privacy key-value data is calculated. k Calculate according to the following formula: f k =n k / (C3n); The mean m of the selected value data is calculated. k Calculate according to the following formula: m k =sum k / n k , sum k This represents the sum of the selected data values.

5. A utility-optimized key-value data protection device based on local differential privacy, characterized in that, include: Divided into three units: partitioned units, disturbance units, and statistical units, wherein: The partitioning unit is used by the server to divide the key field corresponding to the key data into a sensitive data field and a non-sensitive data field, and to expose the sensitive data field, the non-sensitive data field, and the privacy budget to the user. The perturbation unit is used by the user to distinguish local key-value data into sensitive key-value data and non-sensitive key-value data based on publicly available sensitive and non-sensitive data domains; and to standardize the value data and its corresponding value domain using the following standardization formula: v i '=2(v i -a) / (ba)-1, where, v i This represents the i-th value, with a value range of [a, b]. i ' indicates v i The standardized value data is standardized to [-1, 1] using a standardization formula. Sensitive key-value data is perturbed into the protected output, while non-sensitive key-value data is perturbed into either the protected or unprotected output to obtain privacy key-value data, which is then sent to the server. If key data is perturbed into the protected output, the key data remains unchanged according to a first probability, is converted to perturbed key data according to a second probability, and the corresponding value data is determined according to a fourth probability (1-v). o ) / 2 or (1+v o Discretize v to -1 or 1 respectively, where v o This represents the original value data of the corresponding value data; whether to convert the key data into perturbation key data is determined according to the following formula: C1 + (|U s |-1)C2=1, where C1 represents the first probability, C2 represents the second probability, U s This represents the sensitive data domain. If the key data remains unchanged, the corresponding value data, after discretization, is converted back to the original value data according to the privacy budget probability p, and then converted to a negative value according to probability (1-p). If the key data is converted to perturbed key data, the corresponding value data, after discretization, is converted back to the original value data according to the fifth probability q, and then converted to a negative value according to probability (1-q). The key data is perturbed to the unprotected output according to the third probability. If the key data is perturbed to the unprotected output, the key data remains unchanged, and the corresponding value data remains unchanged. The third probability C3 is calculated according to the following formula: C3 + |U s | C2=1; The key fields of the perturbation key data and the sensitive data field are the same; The statistical unit is used by the server to collect privacy key-value data from multiple users, divide it according to sensitive data fields and non-sensitive data fields to obtain sensitive privacy key-value data and non-sensitive privacy key-value data, and perform statistics on the key data and value data in the sensitive privacy key-value data and non-sensitive privacy key-value data respectively to calculate the frequency distribution of key data and the mean of value data in the original key-value data.

Images