Data collection method, data collection device, storage medium, and electronic device

Abstract

The present disclosure provides a data collection method, device, storage medium and electronic equipment, and relates to the technical field of information security. The data collection method applied to a first end comprises: sending feature anonymization information used for constructing an anonymous database to a second end; receiving second anonymous feature data sent by the second end, determining a target equivalence class to which the second anonymous feature data belongs, and judging whether the target equivalence class after adding the second anonymous feature data satisfies a K-anonymity condition; in the case of judging that the K-anonymity condition is satisfied, sending a data collection instruction to the second end, and receiving second sensitive data processed by privacy protection sent by the second end in response to the data collection instruction; and updating the anonymous database by using the second anonymous feature data and the second sensitive data processed by privacy protection. The present disclosure realizes data collection and privacy protection in a multi-party cooperation scenario, the collected data satisfies the K-anonymity condition, the security is relatively high, and the data processing and use cost is relatively low.

Description

Technical Field

[0001] This disclosure relates to the field of information security technology, and in particular to data collection methods, data collection devices, computer-readable storage media, and electronic devices. Background Technology

[0002] With the increasing demand for data sharing and information synchronization, how to effectively protect data privacy in multi-party collaborative scenarios (such as edge-cloud collaboration) and not expose individual information within the data to the outside world has become a key issue of concern in the industry.

[0003] In related technologies, most solutions for improving data security are designed for unilateral processing of local data and are not suitable for multi-party collaborative scenarios. Summary of the Invention

[0004] This disclosure provides data collection methods, data collection devices, computer-readable storage media, and electronic devices to at least partially address the problem that related technologies cannot protect data privacy in scenarios involving multi-party collaboration.

[0005] According to a first aspect of this disclosure, a data collection method is provided, applied to a first end, the method comprising: sending feature anonymization information used to construct an anonymous database to a second end, causing the second end to use the feature anonymization information to anonymize second feature data in second data to be processed to obtain second anonymous feature data; the second data to be processed includes second sensitive data and the second feature data corresponding to the second sensitive data; receiving the second anonymous feature data sent by the second end, determining the target equivalence class to which the second anonymous feature data belongs in the anonymous database, and determining whether the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition; K is a positive integer not less than 2; if it is determined that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition, sending a data collection instruction to the second end, and receiving the privacy-processed second sensitive data sent by the second end in response to the data collection instruction; and updating the anonymous database using the second anonymous feature data and the privacy-processed second sensitive data.

[0006] According to a second aspect of this disclosure, a data collection method is provided, applied to a second end, the method comprising: receiving feature anonymization information for constructing an anonymous database sent by a first end; anonymizing second feature data in second data to be processed using the feature anonymization information to obtain second anonymous feature data; the second data to be processed including second sensitive data and the second feature data corresponding to the second sensitive data; sending the second anonymous feature data to the first end, such that the first end, upon determining that a target equivalence class after adding the second anonymous feature data satisfies a K-anonymity condition, sends a data collection instruction to the second end; the target equivalence class is the equivalence class to which the second anonymous feature data belongs in the anonymous database; and, in response to the data collection instruction, sending the privacy-enhanced second sensitive data to the first end, such that the first end updates the anonymous database using the second anonymous feature data and the privacy-enhanced second sensitive data.

[0007] According to a third aspect of this disclosure, a data collection apparatus is provided, configured at a first end, the apparatus comprising: a feature anonymization information sending module, configured to send feature anonymization information used to construct an anonymous database to a second end, causing the second end to use the feature anonymization information to anonymize second feature data in second data to be processed to obtain second anonymous feature data; the second data to be processed includes second sensitive data and the second feature data corresponding to the second sensitive data; a second anonymous feature data receiving module, configured to receive the second anonymous feature data sent by the second end, determine the target equivalence class to which the second anonymous feature data belongs in the anonymous database, and determine whether the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition; K is a positive integer not less than 2; a data acquisition module, configured to, when determining that the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition, send a data acquisition command to the second end, and receive the privacy-processed second sensitive data sent by the second end in response to the data acquisition command; and an anonymous database updating module, configured to update the anonymous database using the second anonymous feature data and the privacy-processed second sensitive data.

[0008] According to a fourth aspect of this disclosure, a data collection apparatus is provided, configured at a second end, the apparatus comprising: a feature anonymization information receiving module, configured to receive feature anonymization information for constructing an anonymous database sent by a first end; a feature anonymization processing module, configured to anonymize second feature data in second data to be processed using the feature anonymization information to obtain second anonymous feature data; the second data to be processed includes second sensitive data and the second feature data corresponding to the second sensitive data; a second anonymous feature data sending module, configured to send the second anonymous feature data to the first end, such that the first end, upon determining that the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition, sends a data collection instruction to the second end; the target equivalence class is the equivalence class to which the second anonymous feature data belongs in the anonymous database; and a data collection instruction response module, configured to, in response to the data collection instruction, send the privacy-enhanced second sensitive data to the first end, such that the first end updates the anonymous database using the second anonymous feature data and the privacy-enhanced second sensitive data.

[0009] According to a fifth aspect of this disclosure, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the data collection method of the first or second aspect described above and its possible implementations.

[0010] According to a sixth aspect of this disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform the data collection method of the first or second aspect described above and possible implementations thereof by executing the executable instructions.

[0011] The technical solution disclosed herein has the following beneficial effects:

[0012] On the one hand, a data collection scheme for multi-party collaboration scenarios is provided, which ensures that the data collected by the first end from the second end directly meets the K-anonymity requirement, thereby providing effective privacy protection for the data and reducing the cost of subsequent data processing and use. On the other hand, the first and second ends engage in two rounds of communication. In the first round of communication, the second end only sends the second anonymity feature data to the first end and does not expose the second end's sensitive information (such as second sensitive data). Only after the first end sends the data collection command will the second end send the privacy-enhanced second sensitive data in the second round of communication. This ensures that the second end will not expose sensitive information in the first round of communication when the first end does not need to collect data, thereby improving the security of the second end's sensitive information. Attached Figure Description

[0013] Figure 1 This diagram illustrates the system architecture of the operating environment for this exemplary embodiment.

[0014] Figure 2 A flowchart illustrating the data collection method performed by the first end in this exemplary embodiment is shown.

[0015] Figure 3 This diagram illustrates a flowchart of constructing an anonymous database in this exemplary embodiment;

[0016] Figure 4 This diagram illustrates a flowchart of constructing hierarchical generalization information in this exemplary embodiment;

[0017] Figure 5 This illustrates a flowchart of the anonymization process for the first feature data in this exemplary embodiment;

[0018] Figure 6 This diagram illustrates a flowchart of ensuring that equivalence classes meet similarity requirements in this exemplary embodiment.

[0019] Figure 7 A flowchart illustrating the data collection method performed by the second end in this exemplary embodiment is shown.

[0020] Figure 8 This illustration shows a schematic diagram of constructing an anonymous database and two-way collaborative K-anonymous data collection in this exemplary embodiment;

[0021] Figure 9 This diagram illustrates the structure of a data collection device according to this exemplary embodiment.

[0022] Figure 10 This diagram illustrates the structure of another data collection device in this exemplary embodiment;

[0023] Figure 11 A schematic diagram of the structure of an electronic device in this exemplary embodiment is shown. Detailed Implementation

[0024] Exemplary embodiments of this disclosure will be described more fully below with reference to the accompanying drawings.

[0025] The accompanying drawings are schematic illustrations of this disclosure and are not necessarily drawn to scale. Some block diagrams shown in the drawings may be functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in hardware modules or integrated circuits, or in networks, processors, or microcontrollers. Implementations can be carried out in various forms and should not be construed as limited to the examples set forth herein. The features, structures, or characteristics described in this disclosure can be combined in any suitable manner in one or more embodiments. Numerous specific details are provided in the following description to give a thorough description of embodiments of this disclosure. However, those skilled in the art will recognize that one or more specific details may be omitted when implementing the technical solutions of this disclosure, or other methods, components, apparatuses, steps, etc., may be used to replace one or more specific details.

[0026] The following explains the technical terms used in this article.

[0027] Quasi-Identifier (QID): An identifier is a feature that can uniquely identify an individual, such as a national identity card number. A quasi-identifier refers to a feature that can identify an individual through a combination of multiple features or by association with other information.

[0028] K-anonymity: A standard for measuring the security of published data. If in a set of publicly available data, the information of any one individual cannot be distinguished from at least K-1 other individuals, then the publicly available data is said to satisfy K-anonymity. In other words, if the number of individuals corresponding to the same quasi-identifier is not less than K, then K-anonymity is satisfied. This article also discusses K... S Anonymous, F min Anonymous, etc., retain the same meaning; only the K value is replaced with K. S F min Other values.

[0029] Equivalence class: A set of records with the same quasi-identifier.

[0030] Differential privacy: a data protection technique that makes the results of statistical processing of a dataset insensitive to changes in a specific record by using random responses or adding noise to the original data.

[0031] Earth Mover's Distance (EMD): is the normalized minimum cost of transforming from one distribution to another, used to characterize the distance between two distributions.

[0032] With the advent of the big data era, data provided unilaterally by individuals can no longer meet user needs, requiring multi-party collaboration to collect more data. For example, in edge-cloud collaborative scenarios, the cloud can collect massive amounts of data from the user's end to build relevant databases or datasets, thereby better enabling data analysis, model training, and other purposes.

[0033] In related technologies, most solutions for improving data security are designed for unilateral processing of local data. For example, some solutions are based on k-anonymity technology and propose k-anonymity privacy protection methods to meet personalized needs for locally stored datasets. While these solutions can meet the needs of unilateral data processing, they are not suitable for multi-party collaborative scenarios.

[0034] In addition, some data protection solutions involve multi-party collaboration scenarios. For example, obtaining K similar pieces of information from anonymized servers, obfuscating them, and sending them to a location-based server for anonymized location query processing to protect the location information on the client side. Most of these solutions are designed for specific data scenarios (such as location services) and lack universality. Furthermore, they cannot ensure that the data meets the K-anonymity condition during collection, which increases the cost of data processing and use.

[0035] In view of one or more of the above-mentioned problems, exemplary embodiments of this disclosure provide a data collection method that can achieve data collection and data privacy protection in general scenarios of multi-party collaboration.

[0036] Figure 1 A system architecture diagram of the operating environment of this exemplary embodiment is shown. This system architecture 100 may include a first end 110 and a second end 120. The first end 110 may be a data collector, and the second end 120 may be a data provider. The first end 110 collects data provided by the second end 120, and may also provide data itself. For example, in an end-cloud collaborative scenario, the first end 110 may be the cloud, such as a backend system providing data-related services, which may include one server or a cluster of multiple servers; the second end 120 is a user end, such as a personal computer, mobile phone, tablet computer, smart wearable device, or other terminal device. Alternatively, in decentralized scenarios such as blockchain, the first end 110 may be any user end, and the second end 120 may be other user ends. The first end 110 and the second end 120 may be connected via a wired or wireless communication link for data transmission.

[0037] This disclosure does not limit the number of the first terminal 110 or the second terminal 120. For example, in a cloud-edge collaboration scenario, the cloud can establish connections with a large number of user terminals and collect data from them.

[0038] Figure 2The flowchart illustrates a data collection method performed by the first terminal 110, which may include the following steps S210 to S240:

[0039] Step S210: Send the feature anonymization information used to construct the anonymous database to the second end, so that the second end uses the feature anonymization information to anonymize the second feature data in the second data to be processed to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data.

[0040] Step S220: Receive the second anonymous feature data sent by the second end, determine the target equivalence class to which the second anonymous feature data belongs in the anonymous database, and determine whether the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition; K is a positive integer not less than 2.

[0041] Step S230: If the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition, a data collection command is sent to the second end, and the second sensitive data after privacy processing is received from the second end in response to the data collection command.

[0042] Step S240: Update the anonymity database using the second anonymized feature data and the second sensitive data that has been privacy-processed.

[0043] based on Figure 2 The method described provides a data collection scheme for multi-party collaboration scenarios, ensuring that the data collected by the first end 110 from the second end 120 directly meets the K-anonymity requirement, thereby providing effective privacy protection for the data and reducing the cost of subsequent data processing and use. Furthermore, the method involves two rounds of communication between the first end 110 and the second end 120. In the first round of communication, the second end 120 only sends the second anonymity feature data to the first end 110, without exposing sensitive information (such as second sensitive data) of the second end 120. Only after the first end 110 sends a data collection command will the second end 120 send the privacy-enhanced second sensitive data in the second round of communication. This ensures that the second end 120 will not expose sensitive information in the first round of communication when the first end 110 does not need to collect data, thus improving the security of the sensitive information of the second end 120.

[0044] The following is about Figure 2 Each step in the process will be explained in detail.

[0045] refer to Figure 2In step S210, the feature anonymization information used to construct the anonymous database is sent to the second end, so that the second end uses the feature anonymization information to anonymize the second feature data in the second data to be processed to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data.

[0046] The anonymized database is constructed by the first end 110 based on its existing data or generated pseudo-data, performing feature anonymization and sensitive data privacy processing. Anonymization refers to summarizing or hiding some information in the original feature data to reduce data precision and prevent attackers from associating feature data with individual information (such as sensitive data). Specifically, in anonymization, the original feature data can be replaced with data that is more ambiguous. Feature anonymization information refers to the relevant information used to anonymize features, which can include the attribution relationship between feature values ​​and one or more levels of anonymization information, such as feature classification information, feature generalization information, and feature numerical range (which can be an integer range or a floating-point range) division information. The first end 110 uses feature anonymization information when constructing the anonymized database. This information is synchronized from the first end 110 to the second end 120, so that the second end 120 can use the same feature anonymization information to anonymize the features in its data. In this way, the first end 110 and the second end 120 perform feature anonymization in the same way, thereby ensuring the consistency of data format between the two ends.

[0047] The second data to be processed is data from the second terminal 120 itself, to be provided to the first terminal 110. The second data to be processed includes second sensitive data and second feature data corresponding to the second sensitive data. In this document, "second" in second data to be processed, second sensitive data, and second feature data indicates that it originates from the second terminal 120. Correspondingly, "first" in first data to be processed, first sensitive data, and first feature data below indicates that it originates from the first terminal 110. Feature data is data that can be used as a quasi-identifier, such as age, gender, occupation, height, and weight. Sensitive data is data with high privacy requirements, such as user search information, payment information, and disease information within an App (Application). In addition to second sensitive data and second feature data, the second data to be processed may also include identity data and non-sensitive data. Identity data can be used as an identifier, such as ID card number and device ID. Considering that identity data can also be used as a quasi-identifier after anonymization, it can also be used as feature data. Non-sensitive data is data with low privacy or no privacy requirements. In one implementation, considering the high risk of identity data exposing information, the identity data in the second data to be processed can be deleted. Considering that non-sensitive data may not be the data required by the first end 110, the non-sensitive data in the second data to be processed can be deleted, that is, the identity data or non-sensitive data will not be provided to the first end 110 in the future.

[0048] Before collecting data from the second end 120, the first end 110 can construct an anonymous database. This allows the collected data to be stored in the anonymous database during data collection from the second end 120. The process of constructing the anonymous database is illustrated below.

[0049] In one implementation, before sending the feature anonymization information used to construct the anonymized database to the second end, refer to Figure 3 As shown, the data collection method may further include the following steps S310 to S350:

[0050] Step S310: Construct hierarchical generalization information for the first feature data in the first data to be processed; the first data to be processed includes first sensitive data and the first feature data corresponding to the first sensitive data.

[0051] The first data to be processed is the data of the first terminal 110 itself, which is to be processed for privacy. The first feature data is the data in the first data to be processed that can be used as a quasi-identifier, and the first sensitive data is the data in the first data to be processed that has high privacy. In addition, the first data to be processed may also include identity data, non-sensitive data, etc. Similar to the processing of the second data to be processed, identity data and / or non-sensitive data can be deleted from the first data to be processed, so that these data are not collected in the anonymous database, which can improve the data quality of the anonymous database and better meet the needs of data analysis and other purposes.

[0052] In one implementation, if the first terminal 110 itself does not have data, or has very little data sufficient to construct an anonymous database, pseudo-data can be generated as the first data to be processed. For example, some pseudo-data can be randomly generated based on the distribution of existing data or other prior knowledge. This pseudo-data has a distribution similar to the existing data or satisfies prior knowledge. The generated pseudo-data can be used as the first data to be processed, or it can be added to the existing data to supplement the first data to be processed.

[0053] Feature data can be raw data with complete information, such as specific age, gender, occupation, height, and weight, which carries a high risk of information exposure. Therefore, feature data can be anonymized. Different anonymized feature data may yield the same result. For example, blurring the ages of 12, 15, and 18 into 11-20 years old results in the same outcome for three different feature data. Thus, anonymizing feature data is equivalent to a classification process. In this exemplary embodiment, multi-level classification can be set for feature data. For example, a first-level classification can be set for age, including categories such as 0-10, 11-20, 21-30, 31-40, 41-50, and 51-60. A second-level classification can also be set, including categories such as 0-20, 21-40, and 41-60. It is evident that the higher the level, the coarser the granularity of the classification, the larger the range included in each category, the higher the generalization of the feature data, and the greater the information loss. Hierarchical generalization information is used to characterize the hierarchical classification information of the first feature data, as well as the attribution relationship between the first feature data and one or more generalized categories at different levels. It should be understood that the hierarchical generalization information can be different for different features. For each feature, its hierarchical generalization information can include only one level of generalization information, or it can include generalization information at multiple levels.

[0054] For example, hierarchical generalization information can be recorded in the form of a generalization hierarchy structure table. For instance, the first feature data contains the feature "educational attainment," and Table 1 shows the generalization hierarchy structure table for this feature. As can be seen from Table 1, the original data for this feature includes 16 different values. Under the first level of classification, there are 7 generalization categories; under the second level, there are 3 generalization categories; and under the third level, there is only 1 generalization category. Clearly, as the hierarchy increases, the degree of generalization of the feature's information increases, i.e., the information becomes more generalized.

[0055] Table 1

[0056]

[0057]

[0058] In one implementation, the first feature data may include one or more of character features, integer features, floating-point features, and list features. Correspondingly, the construction of hierarchical generalization information for the first feature data in the first data to be processed may include one or more of the following methods:

[0059] ① For string features, hierarchical generalization information is constructed by replacing some characters with anonymized characters. Anonymized characters can be characters like "*" or "0" that do not contain actual information, or masks that can conceal information. The number or density of replaced characters varies at different levels. Higher-level generalization information has more replaced characters than lower-level generalization information, and the replaced characters in higher-level generalization information include those in lower-level generalization information. For example, if the original data of a character feature is "ABCDEFGHIJ", at the first level, 2 characters can be replaced in every 5 characters, and the anonymization result is "ABC**FGH**". At the second level, 3 characters can be replaced in every 5 characters (including the 2 characters replaced in the first level), and the anonymization result is "AB***FG***". At the third level, 4 characters can be replaced in every 5 characters (including the 3 characters replaced in the second level), and the anonymization result is "A****F****".

[0060] In one implementation, a length can be specified for character features. By filling the data of character features with anonymized characters, the specified length can be achieved. In this way, data under the same character feature has a uniform length, which facilitates anonymization processing.

[0061] For example, character-based feature data can be first aligned to the left (or right) and filled with anonymized characters until a specified length is reached. Then, following a right-to-left (or left-to-right) order, some characters are replaced with anonymized characters according to a set replacement rule (which can include the position, length, or interval of the replacement). For instance, the first 5 characters from right to left can be replaced with anonymized characters, or an interval replacement can be used, such as replacing 2 characters, retaining 5 characters, and then replacing 2 more characters. This prioritizes replacing the anonymized characters padded at the far right, minimizing information loss. Replacement rules can be set at one or more levels to construct hierarchical generalization information.

[0062] ② For integer (int) features, hierarchical generalization information for the integer feature is constructed by dividing its numerical range into multiple integer intervals at one or more levels. The division of integer intervals can be based on the data distribution of the integer feature or specific requirements; for example, the data of the integer feature can be evenly distributed across the intervals. One integer interval in a higher-level generalization information can include multiple integer intervals from lower-level generalization information. For example, in the above example, age is an integer feature. The first-level integer intervals could include 0–10, 11–20, 21–30, 31–40, 41–50, 51–60, etc., and the second-level integer intervals could include 0–20, 21–40, 41–60, etc. A higher-level integer interval can be the union of multiple lower-level integer intervals. By setting multiple levels of integer intervals, hierarchical generalization information for the integer feature can be obtained, such as outputting a generalization hierarchy structure table formed by one or more levels of integer intervals.

[0063] ③ For floating-point features, two exemplary schemes for constructing hierarchical generalization information are provided.

[0064] The first approach involves dividing the numerical range of floating-point features into multiple floating-point intervals across one or more levels to construct hierarchical generalization information for the floating-point features. The division of floating-point intervals is similar to that of integer intervals, and can be based on the data distribution of the floating-point features or specific needs. For example, the data of the floating-point features can be evenly distributed across the various floating-point intervals. The difference between floating-point intervals and integer intervals is that floating-point intervals are generally continuous. One floating-point interval in the higher-level generalization information includes multiple floating-point intervals from the lower-level generalization information. For example, height is a floating-point feature. The first level of floating-point values ​​can be set to [0,120], (120,150], (150,155], (155,160], (160,165], (165,170], (170,175], (175,180], (180,185], (185,190], (190,200], (200,+∞). The second level of floating-point values ​​can be set... The floating-point value ranges are [0,150], (150,160], (160,170], (170,180], (180,190], and (190,+∞). A higher-level floating-point value range can be the union of multiple lower-level floating-point value ranges. By setting multiple levels of floating-point value ranges, the hierarchical generalization information of floating-point features can be obtained, such as outputting a generalization hierarchy structure table formed by one or more levels of floating-point value ranges.

[0065] The second approach involves setting the number of decimal places retained for floating-point features at one or more levels to construct hierarchical generalization information for those features. Higher-level generalization information retains fewer decimal places than lower-level generalization information. For example, the first level could retain 3 decimal places, the second level 2, and the third level 1, thus forming hierarchical generalization information.

[0066] ④ For list-type features, hierarchical generalization information is constructed by hiding data at specified positions within the list-type feature data at one or more levels. Higher-level generalization information contains more hidden data than lower-level generalization information, and the hidden data in higher-level generalization information includes the hidden data in lower-level generalization information. For example, the feature "Apps opened on the phone within one hour" is a list-type feature, including two columns: time and opened apps, and multiple rows of data. Each row represents the time and the app opened. At the first level, data excluding the first three rows can be hidden; at the second level, data excluding the first two rows can be hidden; and at the third level, data excluding the first row can be hidden. Alternatively, at the first level, data excluding the first and last three rows can be hidden; at the second level, data excluding the first and last two rows can be hidden; and at the third level, data excluding the first and last rows can be hidden. The higher the level, the more data is hidden. Hiding can be done by replacing data with anonymous characters or by deleting data. By setting the locations of data to be hidden at one or more levels, you can obtain hierarchical generalization information for list-type features.

[0067] In addition to the four types of features mentioned above, other types of features can be considered as enumerated features, and the hierarchical generalization information of enumerated features can be directly defined. As shown in Table 1, "Educational Attainment" is an enumerated feature. Multiple levels of generalization categories can be set for enumerated features, and the attribution relationship between the values ​​of enumerated features and the generalization categories at each level can be manually specified, outputting a generalization hierarchy structure table.

[0068] In one implementation, the process of constructing hierarchical generalization information can be referred to Figure 4As shown, after inputting the first feature data, each feature can be processed as follows: determine the type of the feature, and output the hierarchical generalization information in the corresponding manner according to the type of the feature. For example, the expression for this feature can be input into a switch function. First, it checks if the type is `string`. If `string` (i.e., the feature is a `string`) is selected, it aligns left / right, pads to the specified length, and replaces some characters with anonymous characters at specified intervals from right to left / left to right, constructing hierarchical generalization information. This hierarchical generalization information for the feature is then output. If it's not a `string` (i.e., `string` is false), it further checks if the type is `int`. If `int` (i.e., the feature is an `int`) is selected, the numerical range is divided into integer ranges, constructing hierarchical generalization information. This hierarchical generalization information for the feature is then output. If it's not an `int` (i.e., `int` is false), it further checks if the type is `float`. If `float` (i.e., the feature is a `float`) is selected, the numerical range is divided into floating-point ranges, constructing hierarchical generalization information, or determining the number of decimal places to retain, constructing hierarchical generalization information. This hierarchical generalization information for the feature is then output. If it's not a `float` (i.e., `float` is false), it further checks if the type is `list`. If `list` is false, it further checks if the type is `list`. If the feature is a list (i.e., the feature is of type list), retain the first few rows of the list and hide the rest, constructing hierarchical generalization information. Alternatively, retain a few rows from the beginning and end of the list and hide the rest, constructing hierarchical generalization information, and thus outputting the hierarchical generalization information for that feature. If it is not a list type (i.e., the list type is false), execute the default statement, treating the feature as an enumerated feature, directly defining hierarchical generalization information, and thus outputting the hierarchical generalization information for that feature. By constructing hierarchical generalization information for each type of feature, the overall hierarchical generalization information can be obtained.

[0069] Step S320: Anonymize the first feature data based on hierarchical generalization information to obtain first anonymous feature data, such that the equivalence classes of the first data to be processed, using the first anonymous feature data as quasi-identifiers, satisfy K S Anonymous condition; K S It is a positive integer in the range [2, K].

[0070] The first feature data can include multiple features. Combining these features may identify an individual. For example, it's difficult to associate each of age, gender, occupation, height, and weight individually with a specific person, but combining these features may lead to an association with a specific person, easily revealing information. In this exemplary embodiment, the first feature data is anonymized based on hierarchical generalization information. This means replacing the first feature data with a generalized category that summarizes or conceals some information. For example, the original data for the feature "educational status" in Table 1 can be replaced with a first-level, second-level, or third-level generalized category. The anonymized data results in first anonymous feature data, which improves the ambiguity of information, ensuring that individual information cannot be associated when the first anonymous feature data is used as a quasi-identifier. A standard is set for the required level of anonymity (i.e., the degree of generalization or ambiguity) of the first anonymous feature data. This standard defines the equivalence classes of the first data to be processed, using the first anonymous feature data as a quasi-identifier. Each equivalence class must satisfy K... S Anonymity conditions. Specifically, the first anonymous feature data is the same for each equivalence class, K S The anonymity condition is that the number of records in the equivalence class is not less than K. S After dividing the first set of data into equivalence classes, each equivalence class satisfies K S The anonymity condition is that at least K records in the first set of data to be processed share the same first anonymity feature. S Item. K S The anonymity condition must be no less than 2 and no greater than K, where K is the anonymity condition that the anonymity database must meet during the data collection phase. S The larger the value, the less likely it is to reveal information. K can be set based on experience or specific needs. S Value. In one implementation, K can be set. S The requirement is less than K, meaning that the anonymity requirement during the construction phase of the anonymized database can be lower than that during the data collection phase. This is because data from the second end (120) is collected during the data collection phase and added to the anonymized database, increasing its anonymity. Therefore, a relatively low anonymity condition can be set during the database construction phase to anonymize the primary feature data with appropriate force. This prevents excessive anonymization and reduces computational load to some extent.

[0071] In anonymization, it is necessary to select an appropriate generalization level for different features in the first feature data. Taking the feature "educational attainment" in Table 1 as an example, if a high generalization level is selected, such as the third level, the anonymity of the data is very high, but the information loss is also severe. If a low generalization level is selected, such as the first level, the information loss is lower, but the anonymity of the data is also lower, and the risk of information exposure is higher. Therefore, it is necessary to determine an appropriate generalization level. By selecting an appropriate generalization level for each feature, the anonymized first feature data as a whole can satisfy K. S Anonymization conditions are used to achieve a better balance between the degree of data anonymity and the degree of information loss.

[0072] In one implementation, reference Figure 5 As shown, the above-mentioned anonymization processing of the first feature data based on hierarchical generalization information yields the first anonymous feature data, such that the equivalence classes of the first data to be processed, using the first anonymous feature data as the quasi-identifier, satisfy K S Anonymity conditions may include the following steps S510 and S520:

[0073] Step S510: Use the highest level of generalization information in the hierarchical generalization information to anonymize the first feature data to obtain the first anonymous feature data.

[0074] Among them, the highest level of generalization information represents the highest degree of generalization, as shown in Table 1 where the third level is the highest level. By replacing the original data of each feature in the first feature data with the highest level of generalization, the resulting first anonymous feature data is the feature data with the highest overall degree of generalization.

[0075] Step S520: Iteratively update the first anonymous feature data in the following manner until, using the updated first anonymous feature data as the quasi-identifier, the equivalence classes partitioned for the first data to be processed exactly satisfy K. S Anonymization condition: In the first feature data, a feature to be downgraded is determined. The feature to be downgraded is re-anonymized using the lower-level generalization information in the hierarchical generalization information, or the feature to be downgraded is restored to the original data to update the first anonymized feature data.

[0076] The first anonymous feature data obtained in step S510 has the highest generalization degree but also the most severe information loss, and usually exceeds the K expression. S The anonymity condition, that is, using the first anonymous feature data as a quasi-identifier, divides the first data to be processed into equivalence classes. The number of data in each equivalence class will be much greater than K. S Therefore, by iteratively updating the first anonymous feature data, the generalization can be gradually reduced to a suitable level, that is, exactly satisfying K. SThe level of anonymity. Exactly satisfies K. S Anonymous conditions can refer to the fact that the number of data in an equivalence class is equal to K. S or just greater than K S (i.e., the current first anonymous feature data satisfies K) S If the anonymity condition is updated again for the first anonymized feature data, then K will no longer be satisfied. S Anonymity conditions).

[0077] In the iterative update, each time a feature is selected from the first feature data as the feature to be downgraded, the feature to be downgraded is re-anonymized using the lower-level generalization information in the hierarchical generalization information. This means refining the feature to be downgraded to a lower-level generalization category. It should be noted that if the feature to be downgraded was originally in the first-level generalization category, it can be restored to its original data, which can be considered as level 0. Therefore, restoring it to the original data is equivalent to refining it to a lower level. For example, if the feature "Educational Attainment" in Table 1 is selected as the feature to be downgraded, and if the data has already been anonymized using third-level generalization information (representing all data as "*"), then second-level generalization information can be used for re-anonymization to refine the data to the second-level generalization category. The data would then be processed as "Higher Education," "Secondary Education," or "Primary Education." If the data has already been anonymized using second-level generalization information, then first-level generalization information can be used for re-anonymization to refine the data to the first-level generalization category. The data would then be processed as "University Education," "High School Education," "Vocational Education," "Junior High School Education," "Post-University Education," "Primary Education," or "Preschool Education." If the data has already been anonymized using first-level generalization information, then the feature "Educational Attainment" can be restored to its original state. By re-anonymizing or restoring the original data to update the first anonymized feature data, the generalization degree of the first anonymized feature data is reduced. Furthermore, this exemplary embodiment updates only one feature at a time and reduces the level of that feature by only one level. This results in a small change in the generalization degree of the first anonymous feature data after each update, which is beneficial for accurately achieving exactly K. S The level of anonymity. If multiple features are updated each time, or the feature level is reduced by multiple levels (e.g., from the third level in Table 1 to the first level), the generalization degree of the first anonymized feature data will change drastically, potentially leading to an excessive decrease in generalization degree and failing to satisfy K. S Anonymous conditions, or difficulty in precisely satisfying K S The level of anonymity.

[0078] If, after a certain update, the minimum number of data points in each equivalence class equals K... S Then at this time, K exactly satisfies SThe anonymization condition can terminate the iteration and output the updated first anonymized feature data. If, after any update, the minimum number of data points in each equivalence class is less than K... S This indicates that the generalization is too low after this update and does not satisfy K. S Anonymity conditions can terminate the iteration, backtrack to the first anonymized feature data before the current update, and output it. This first anonymized feature data exactly satisfies K. S Anonymity condition.

[0079] based on Figure 5 The method shown performs coarse-to-fine feature refinement during the anonymization process of the first feature data. It is suitable for scenarios where the amount of data collected by the first end 110 increases from small to large. It can also support the first end 110 to reasonably and dynamically adjust the fine granularity of the generalization level and related parameter information, and has versatility in real-world scenarios.

[0080] In one implementation, determining a feature to be downgraded from the first feature data may include the following steps:

[0081] For each feature of the first feature data, if the feature is re-anonymized using the lower-level generalization information in the hierarchical generalization information or the feature is restored to the original data, the number of values ​​corresponding to the feature is obtained, and the feature with the smallest number of values ​​is determined as the feature to be downgraded.

[0082] For example, the first feature data includes three features: age, gender, and occupation. In the current first anonymized feature data, age is processed as a generalized category at level p1, gender at level p2, and occupation at level p3. The number of values ​​for age at level p1-1 (i.e., the number of generalized categories) is obtained. If p1 is 1, the number of values ​​for the original age data, the number of values ​​for gender at level p2-1, and the number of values ​​for occupation at level p3-1 are obtained. If the number of values ​​for age at level p1-1 is the smallest, then age is determined as the feature to be downgraded. When updating the first anonymized feature data, the age data is re-anonymized using the generalization information at level p1-1, updating the age data from a generalized category at level p1 to a generalized category at level p1-1. The feature to be downgraded has the fewest values ​​at the next lower level, indicating that its generalization at that level is higher than that of other features. Therefore, refining the feature to be downgraded by one level in this update has minimal impact on the overall generalization of the first anonymized feature data. This keeps the change in the generalization of the first anonymized feature data to a minimum with each update, making it more conducive to accurately achieving the K-value. S The level of anonymity.

[0083] In one implementation, during the anonymization of the first feature data, a frequency dictionary can be constructed. The frequency dictionary can include key names and key values. Key names are quasi-identifiers formed by the first anonymous feature data, i.e., quasi-identifiers of equivalence classes. Key values ​​are the frequencies corresponding to the quasi-identifiers, i.e., the number of data entries (records) in the equivalence classes. The frequency dictionary can characterize the generalization degree of the first anonymous feature data. Specifically, the minimum value in the key values ​​represents the number of data entries in the smallest equivalence class, indicating the anonymization condition currently satisfied by the first anonymous feature data, such as F... min This represents the minimum value among the key values, indicating that the first anonymous feature data currently satisfies F. min Anonymous conditions, by F min With K S By comparing the data, we can determine whether the first anonymous feature data exactly satisfies K. S Anonymization conditions. In the process of anonymizing feature data, frequency-based databases can efficiently retrieve information such as the existence and quantity of specific equivalence classes, making it easier to determine whether the anonymized feature data meets the anonymization conditions and improving processing efficiency.

[0084] The following example illustrates the process of anonymizing the first feature data.

[0085] Table 2 shows the original first batch of data to be processed, which includes five features: ramUsage, diskUsage, Bluetooth, darkMode, and scheduleNum. The first five columns in Table 2 represent the first feature data, and the step column represents the first sensitive data. The number of data entries is 8. K is set to... S =2.

[0086] Table 2

[0087] 0.46 0.92 1 1 15 1354 0.15 0.76 0 1 0 21465 0.33 0.59 0 0 2 2315 0.29 0.62 1 0 3 16874 0.61 0.41 1 0 8 1234 0.75 0.39 0 1 9 6521 0.88 0.33 0 0 19 8893 0.53 0.12 1 1 6 32154

[0088] Anonymizing the first feature data in Table 2 using the highest-level generalization information yields the data shown in Table 3. The first five columns of Table 3 represent the current anonymized first feature data; the original data for all five features are processed as *, indicating a high degree of generalization. Table 4 shows the frequency dictionary corresponding to Table 3. The quasi-identifiers of the eight data entries in Table 3 are identical, meaning there is currently only one equivalence class with the quasi-identifier {*,*,*,*,*}. The frequency of this equivalence class is 8, which is much greater than K. S Therefore, the current first anonymous feature data can be iteratively updated to reduce its generalization.

[0089] Table 3

[0090] * * * * * 1354 * * * * * 21465 * * * * * 2315 * * * * * 16874 * * * * * 1234 * * * * * 6521 * * * * * 8893 * * * * * 32154

[0091] Table 4

[0092]

[0093]

[0094] In the next lower level of generalization, both the features "bluetooth" and "darkMode" have two possible values. One can be randomly selected as the feature to be downgraded, for example, "bluetooth". It should be noted that the hierarchical generalization information for "bluetooth" is relatively simple, with only one generalization level. Therefore, the next lower level is the original data. Restoring the "bluetooth" column to its original state results in an update, as shown in Table 5. The first five columns represent the updated first anonymous feature data. Simultaneously, the frequency dictionary can be updated, as shown in Table 6. At this point, there are two equivalence classes with quasi-identifiers {*,*,0,*,*} and {*,*,1,*,*}, each with four data points and a frequency of 4. The minimum frequency (4) represents the current level of generalization, which is still greater than K. S Therefore, the first anonymous feature data can continue to be iteratively updated.

[0095] Table 5

[0096] * * 1 * * 1354 * * 0 * * 21465 * * 0 * * 2315 * * 1 * * 16874 * * 1 * * 1234 * * 0 * * 6521 * * 0 * * 8893 * * 1 * * 32154

[0097] Table 6

[0098] {*,*,0,*,*} 4 {*,*,1,*,*} 4

[0099] In the next lower level of generalization, the feature `darkMode` has two values ​​and can be used as a feature to be downgraded. It should be noted that the hierarchical generalization information for `darkMode` is relatively simple, with only one generalization level. Therefore, the next lower level is the original data. Restoring the `darkMode` column to its original state results in another update, yielding the data shown in Table 7, where the first five columns represent the updated first anonymous feature data. Simultaneously, the frequency dictionary can be updated, as shown in Table 8. At this point, there are four equivalence classes with quasi-identifiers: {*,*,0,0,*}, {*,*,0,1,*}, {*,*,1,0,*}, and {*,*,1,1,*}. Each equivalence class has two data points, each with a frequency of 2. The minimum frequency (i.e., 2) equals K. S This indicates that the current first anonymous feature data exactly satisfies K S Anonymization condition. This can terminate the iteration process, complete the anonymization of the first feature data, and output the first anonymized feature data.

[0100] Table 7

[0101] * * 1 1 * 1354 * * 0 1 * 21465 * * 0 0 * 2315 * * 1 0 * 16874 * * 1 0 * 1234 * * 0 1 * 6521 * * 0 0 * 8893 * * 1 1 * 32154

[0102] Table 8

[0103] {*,*,0,0,*} 2 {*,*,0,1,*} 2 {*,*,1,0,*} 2 {*,*,1,1,*} 2

[0104] Step S330: Record the target level generalization information in the hierarchical generalization information used in the anonymization process as feature anonymization information.

[0105] The hierarchical generalization information for each feature can include one or more levels of generalization information. When anonymizing the first feature data, each feature's data is ultimately processed into a generalization category at a certain level, or the original data is used; this level is called the target level. The target level's generalization information is the actual generalization information used and can be recorded as feature anonymization information for subsequent synchronization to the second end 120. For example, for the feature "Education Status" in Table 1, if the second level of generalization information is ultimately used for anonymization, processing the data into "University Education," "High School Education," "Vocational Education," "Junior High School Education," "Post-University Education," "Primary School Education," or "Preschool Education," the second level of generalization information can be recorded as the feature anonymization information corresponding to the feature "Education Status." This includes information such as which generalization categories exist at the second level and the attribution relationship between the original data and the second level's generalization categories. Integrating the target level generalization information for all features yields complete feature anonymization information.

[0106] Step S340: Perform privacy processing on the first sensitive data.

[0107] This disclosure does not limit the specific methods of privacy processing, but may include differential privacy processing, data anonymization, etc. For example, random noise can be added to the first sensitive data to achieve differential privacy processing, thereby improving the security of the first sensitive data.

[0108] Step S350: Combine the first anonymous feature data and the first sensitive data that has been privacy-processed to construct an anonymous database.

[0109] In the aforementioned steps, the first feature data in the first data to be processed was anonymized to obtain the first anonymized feature data, and the first sensitive data in the first data to be processed was privatized. Combining the two processed data results in the fully processed first data to be processed, which is then used to construct an anonymous database. Therefore, the initially constructed anonymous database includes the first anonymized feature data and the privatized first sensitive data.

[0110] In one implementation, reference Figure 6As shown, before combining the first anonymized feature data and the first sensitive data that has undergone privacy processing to construct the anonymized database, the data collection method may further include the following steps S610 and S620:

[0111] Step S610: Calculate the data distribution similarity between the first sensitive data of each equivalence class in the first data to be processed and all the first sensitive data;

[0112] Step S620: If there is an equivalence class in the first data to be processed whose data distribution similarity does not meet the similarity requirement, the equivalence class is taken as the equivalence class to be optimized. By merging the equivalence class to be optimized with other equivalence classes in the first data to be processed, the data distribution similarity of the merged equivalence class meets the similarity requirement, and the feature anonymization information is updated according to the merging result.

[0113] The first sensitive data used to calculate the similarity of data distribution can be either the first sensitive data without privacy processing or the first sensitive data after privacy processing. Therefore, steps S610 and S620 can be executed before step S340, or after step S340 and before step S350.

[0114] The data distribution similarity is calculated by comparing the first sensitive data of each equivalence class with all first sensitive data. This yields the data distribution similarity for each equivalence class. This disclosure does not limit the method for calculating data distribution similarity. For example, the "moving distance" between the data distribution of the first sensitive data of each equivalence class and the data distribution of all first sensitive data can be calculated. A larger moving distance indicates lower data distribution similarity. A moving distance threshold T can be set; if the moving distance for a certain equivalence class is greater than T, it indicates that the data distribution similarity is too low and does not meet the similarity requirement. Alternatively, the data distribution of the first sensitive data of each equivalence class can be formed into a vector (e.g., histogram statistics can be performed on the first sensitive data, and vectors can be generated based on the statistical results). The data distributions of all first sensitive data can also be formed into vectors, and the similarity or distance between the vectors can be calculated to represent the data distribution similarity.

[0115] Similarity requirements refer to the requirement that the similarity of data distributions should reach a certain level. For example, a similarity requirement could be that the moving distance is less than or equal to a moving distance threshold T, indicating that the equivalence class achieves a similarity of T. If there is an equivalence class in the first set of data to be processed whose data distribution similarity does not meet the similarity requirement (e.g., the moving distance is greater than the moving distance threshold T), it indicates that the distribution of the first sensitive data in that equivalence class differs too much from the overall distribution, easily exposing information. This equivalence class can be designated as an equivalence class to be optimized, and by merging it with other equivalence classes, the data distribution similarity of the merged equivalence class can be made to meet the similarity requirement. When merging two or more equivalence classes, the quasi-identifiers of these equivalence classes can be unified. For example, when merging equivalence class A and equivalence class B, the quasi-identifier of equivalence class A can be selected as the benchmark, and the quasi-identifier of equivalence class B can be changed to be the same as the benchmark. In one implementation, changing the quasi-identifier of equivalence class B means that the hierarchical generalization information of some or all features in equivalence class B needs to be changed. The target hierarchical generalization information of some or all features can be updated based on the merging result of equivalence classes (mainly the result of changing the quasi-identifier), thereby updating the feature anonymization information.

[0116] In one implementation, one equivalence class can be randomly selected from other equivalence classes and merged with the equivalence class to be optimized. Alternatively, the equivalence class with the fewest data points can be selected from other equivalence classes and merged with the equivalence class to be optimized, so that the merged equivalence class is not too large and causes imbalance between different equivalence classes.

[0117] In one implementation, the above-mentioned merging of the equivalence class to be optimized with other equivalence classes in the first data to be processed may include the following steps:

[0118] Merge the equivalence class that is most similar to the first anonymous feature data of the equivalence class to be optimized with the equivalence class to be optimized.

[0119] Among them, the first anonymous feature data is the most similar, that is, the quasi-identifiers are the most similar. In this way, when merging equivalence classes, the degree of change to the quasi-identifiers is minimized, thus minimizing the change to the hierarchical generalization information, and thus minimizing the computational cost of merging equivalence classes.

[0120] In one implementation, if multiple equivalence classes in the first set of data to be processed do not meet the similarity requirement (i.e., multiple equivalence classes to be optimized), they can be sorted from highest to lowest according to the degree of dissatisfaction with the similarity requirement. For example, multiple equivalence classes with a moving distance greater than a moving distance threshold T can be sorted from largest to smallest moving distance, and each equivalence class to be optimized can be merged sequentially. During merging, two or more equivalence classes to be optimized can be merged first to improve efficiency.

[0121] By merging equivalence classes, the data distribution similarity of each equivalence class meets the similarity requirements. This ensures that the distribution of the first sensitive data in each equivalence class does not differ too much from the overall distribution, making it difficult for the first-end security agency or attackers to associate the distribution of the first sensitive data with a specific individual. This reduces the risk of information exposure and enhances the protection of data privacy.

[0122] The following three pseudocode snippets further illustrate the process of building an anonymous database.

[0123] First, here is the pseudocode for anonymizing the first feature data and privatizing the first sensitive data:

[0124]

[0125]

[0126] Next is the pseudocode for the temporary variable (Specialization mentioned above) of the updated frequency dictionary:

[0127]

[0128] Finally, the pseudocode for satisfying the similarity requirement T by merging equivalence classes is as follows:

[0129]

[0130] The above describes the process by which the first end 110 constructs the anonymous database. During the construction of the anonymous database, feature anonymization information is used and recorded. The first end 110 can send the feature anonymization information to the second end 120 at any time after the anonymous database is constructed. For example, it can send the feature anonymization information immediately after the database is constructed, or it can send the feature anonymization information to the second end 120 when data needs to be collected or when the second end 120 requests data to be sent.

[0131] The second terminal 120 can anonymize the second feature data using feature anonymization information. Since the feature anonymization information records the target-level generalization information for each feature, or only records the target-level generalization information for each feature without recording generalization information for other levels, the second terminal 120 can generalize the data of each feature in the second feature data to the target level based on the target-level generalization information of each feature, thus obtaining the second anonymized feature data. Clearly, compared to the first anonymized feature data in the anonymized database, the second anonymized feature data has the same generalization level and generalization method for each feature; therefore, the two parts of data are compatible and difficult to distinguish after mixing.

[0132] In one implementation, the second end 120 can organize the second anonymous feature data into the form of an anonymous feature vector and send it to the first end 110 for processing.

[0133] In one implementation, the second feature data may contain data that cannot be anonymized based on feature anonymization information. For example, the second feature data may contain values ​​that are not present in the first feature data. When constructing hierarchical generalization information for the first feature data, the first end 110 may not have included these values. Therefore, the second end 120 cannot classify these values ​​based on feature anonymization information. In this case, the second end 120 can process the data that cannot be anonymized as empty data (such as an empty anonymized feature vector), and the first end 110 may not process the empty data.

[0134] Continue to refer to Figure 2 In step S220, the second anonymous feature data sent by the second end is received, the target equivalence class to which the second anonymous feature data belongs in the anonymous database is determined, and it is determined whether the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition; K is a positive integer not less than 2.

[0135] The anonymous database includes multiple existing equivalence classes, namely the equivalence classes formed based on the first anonymous feature data. The target equivalence class is the equivalence class to which the second anonymous feature data belongs. That is, the quasi-identifier of the second anonymous feature data is the same as the quasi-identifier of the target equivalence class.

[0136] Adding the second anonymization feature data to the anonymization database increases the number of data points in the target equivalence class (i.e., increases the frequency), thus improving the anonymity. It can then be determined whether the target equivalence class after adding the second anonymization feature data satisfies the K-anonymity condition. K can be set based on experience or specific needs. As mentioned above, a stricter anonymity condition can be set during the data collection phase, in which case K can be greater than the aforementioned K. S .

[0137] In one implementation, the above-mentioned determination of whether the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition may include the following steps:

[0138] The number of data corresponding to the second anonymous feature data belonging to the target equivalence class is accumulated and summed with the number of data in the target equivalence class. If the sum is greater than or equal to K, it is determined that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition.

[0139] The second anonymous feature data belonging to the target equivalence class can be one or more sets. For example, multiple second ends 120 may have sent second anonymous feature data to the first end 110, resulting in multiple sets of second anonymous feature data belonging to the target equivalence class. The data counts corresponding to these second anonymous feature data can be accumulated and summed with the original data count of the target equivalence class. This sum represents the data count of the target equivalence class after adding the second anonymous feature data. If it is greater than or equal to K, it indicates that the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition. This allows for an accurate determination of whether the target equivalence class satisfies the K-anonymity condition.

[0140] In one implementation, the above-mentioned accumulation of the number of data corresponding to the second anonymous feature data belonging to the target equivalence class may include the following steps:

[0141] The number of data corresponding to the second anonymous feature data belonging to the target equivalence class received within the first preset time period is accumulated.

[0142] The first preset time can be the data collection cycle of the first terminal 110, which can be set based on experience or specific needs. For example, the first preset time can be the most recent hour, meaning that the first terminal 110 will collect and judge the second anonymized feature data received from the second terminal 120 every hour. Therefore, the first terminal 110 does not need to collect data in real time. It can accumulate the number of second anonymized feature data belonging to the target equivalence class received within the first preset time each time, and then determine whether the target equivalence class satisfies the K-anonymity condition after adding these second anonymized feature data to it, thereby determining whether to collect data from the second terminal 120 within the first preset time. This improves the efficiency of data collection and processing.

[0143] In one implementation, before sending the second anonymous feature data to the first end 110, the second end 120 can perform privacy processing on the second anonymous feature data, such as differential privacy processing. In this way, the second anonymous feature data received by the first end 110 is privacy-processed second anonymous feature data, which can further improve the security of the second anonymous feature data.

[0144] Continue to refer to Figure 2 In step S230, if it is determined that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition, a data acquisition command is sent to the second end, and the second sensitive data after privacy processing is received from the second end in response to the data acquisition command.

[0145] The data collection command indicates that the first terminal 110 agrees to collect data from the second terminal 120. After receiving the data collection command, the second terminal 120 can send the privacy-protected second sensitive data to the first terminal 110. The privacy protection processing performed by the second terminal 120 on the second sensitive data can be differential privacy processing, data anonymization, etc., and its specific method can be the same as or different from the privacy protection processing performed by the first terminal 110 on the first sensitive data.

[0146] In this exemplary embodiment, the second terminal 120 provides the first terminal 110 with second anonymous feature data (or second anonymous feature data after privacy processing) and second sensitive data after privacy processing through two rounds of communication interaction. When there are multiple second terminals 120, the first terminal 110 has difficulty tracing which specific second terminal 120 the collected data comes from, and also has difficulty knowing the specific quasi-identifier and sensitive information on the side of the second terminal 120, thereby more effectively protecting the data of the second terminal 120.

[0147] Continue to refer to Figure 2 In step S240, the anonymity database is updated using the second anonymity feature data and the second sensitive data that has been privacy-processed.

[0148] The first end 110 can add the second anonymized feature data and the privacy-processed second sensitive data to the anonymized database to update the anonymized database. After adding the second anonymized feature data and the privacy-processed second sensitive data, the target equivalence class satisfies the K-anonymity requirement, that is, the data collected from the second end 120 directly satisfies the K-anonymity requirement. This eliminates the need for further processing by the first end 110 and facilitates subsequent use.

[0149] In one implementation, if it is determined that the target equivalence class after adding the second anonymous feature data does not satisfy the K-anonymity condition, a data collection instruction may not be sent to the second end, that is, the second sensitive data (after privacy processing) corresponding to the second anonymous feature data may not be collected from the second end 120, because the collected data does not satisfy the K-anonymity condition and cannot effectively guarantee data security.

[0150] In one implementation, after receiving the second anonymity feature data sent by the second end, the data acquisition method may further include the following steps:

[0151] If it is determined that the second anonymous feature data does not belong to an existing equivalence class in the anonymous database, then the second anonymous feature data is recorded as anonymous feature data to be classified.

[0152] If the accumulated anonymous feature data to be classified within the second preset time period meets the classification conditions, then a new equivalence class is added to the anonymous database based on the accumulated anonymous feature data to be classified within the second preset time period.

[0153] In this context, the second anonymous feature data does not belong to any existing equivalence class in the anonymous database; that is, the second anonymous feature data can form a new feature class. Such second anonymous feature data is recorded as anonymous feature data to be classified. If there is a small amount of anonymous feature data to be classified, forming a new equivalence class will result in insufficient anonymity and ineffective data protection. Therefore, anonymous feature data to be classified can be accumulated within a second preset time period, and it can be determined whether it meets the classification conditions. The classification conditions can be anonymity conditions related to the anonymous feature data to be classified, such as K. S Anonymity conditions or K-anonymity conditions. The second preset time is the duration for accumulating anonymized feature data to be classified. The second preset time can be set based on experience or specific needs; for example, the second preset time can be the most recent 1 hour, 2 hours, etc. In one implementation, the duration of the second preset time can be longer than the duration of the first preset time.

[0154] For example, with K S Anonymity is used as a classification condition. The first end 110 can accumulate the anonymized feature data to be classified received within the last 2 hours. If the accumulated data quantity is greater than or equal to K... S If the accumulated unclassified anonymous feature data meets the classification conditions, it means that the accumulated unclassified anonymous feature data can be formed into a new equivalence class in the anonymous database. Further, the first end 110 can send a data collection instruction to the second end 120 regarding the unclassified anonymous feature data to collect the second sensitive data corresponding to the unclassified anonymous feature data. Alternatively, the first end 110 can, upon receiving more second anonymous feature data belonging to the new equivalence class and determining that the new equivalence class satisfies the K-anonymity condition after adding the second anonymous feature data, send a data collection instruction to the second end 120 regarding the unclassified anonymous feature data and the second anonymous feature data belonging to the new equivalence class to collect the second sensitive data corresponding to the unclassified anonymous feature data and the second anonymous feature data belonging to the new equivalence class.

[0155] By accumulating anonymous feature data to be classified within a second preset time period, and establishing a new equivalence class when it meets the classification conditions, the anonymity of the new equivalence class can be guaranteed, thereby protecting data security.

[0156] In one implementation, if the accumulated anonymous feature data to be classified within a second preset time period does not meet the classification conditions, the accumulated anonymous feature data to be classified within the second preset time period can be deleted to reduce data storage costs.

[0157] The above describes the data collection method performed by the first terminal 110. Figure 7A data collection method performed by the second terminal 120 is shown, which may include the following steps S710 to S740:

[0158] Step S710: Receive feature anonymization information for constructing the anonymization database sent by the first end;

[0159] Step S720: Anonymize the second feature data in the second data to be processed using feature anonymization information to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data.

[0160] Step S730: The second anonymous feature data is sent to the first end, so that the first end sends a data collection command to the second end if it determines that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition; the target equivalence class is the equivalence class to which the second anonymous feature data belongs in the anonymous database;

[0161] In step S740, in response to the data acquisition command, the second sensitive data that has been privacy-processed is sent to the first end, so that the first end updates the anonymous database using the second anonymous feature data and the privacy-processed second sensitive data.

[0162] Figure 7 The method shown is Figure 2 The details of the part executed by the second end 120 in the method shown have been explained above and will not be repeated here.

[0163] based on Figure 7 The method described provides a data collection scheme for multi-party collaboration scenarios, ensuring that the data collected by the first end 110 from the second end 120 directly meets the K-anonymity requirement, thereby providing effective privacy protection for the data and reducing the cost of subsequent data processing and use. Furthermore, the method involves two rounds of communication between the first end 110 and the second end 120. In the first round of communication, the second end 120 only sends the second anonymity feature data to the first end 110, without exposing sensitive information (such as second sensitive data) of the second end 120. Only after the first end 110 sends a data collection command will the second end 120 send the privacy-enhanced second sensitive data in the second round of communication. This ensures that the second end 120 will not expose sensitive information in the first round of communication when the first end 110 does not need to collect data, thus improving the security of the sensitive information of the second end 120.

[0164] Figure 8 This diagram illustrates the construction of an anonymous database and the two-way collaborative K-anonymity data collection. The scheme can include two phases: an anonymous database construction phase and a K-anonymity data collection phase, which are described below.

[0165] In the construction of the anonymous database, the first terminal 110 divides the first data to be processed into first feature data and first sensitive data. Additionally, it may include identity data, non-sensitive data, etc., which can be deleted. The first feature data is anonymized to obtain first anonymous feature data (i.e., quasi-identifiers), forming feature anonymization information. The first sensitive data is privatized to obtain privatized first sensitive data. The first anonymous feature data and the privatized first sensitive data are used to construct the anonymous database. Furthermore, other existing data from the first terminal 110 can be obtained, and its feature data can be anonymized using the aforementioned feature anonymization information, and its sensitive data can be privatized, and then added to the anonymous database. This completes the construction of the anonymous database.

[0166] During the K-anonymization data collection phase, the second end 120 has second data to be processed, including second feature data and second sensitive data. The first end 110 sends feature anonymization information to the second end 120, and the second end 120 uses the feature anonymization information to anonymize the second feature data, obtaining second anonymous feature data. The second end 120 sends the second anonymous feature data to the first end 110. The first end 110 determines, based on the anonymization database, whether the target equivalence class after adding the second anonymous feature data satisfies the K-anonymization condition. If it does, it sends a data collection command to the second end 120. In response to the data collection command, the second end 120 sends the second anonymous feature data and its corresponding privacy-processed second sensitive data to the first end 110. The first end 110 adds the received second anonymous feature data and privacy-processed second sensitive data to the anonymization database to update the anonymization database. This achieves K-anonymization data collection through collaborative efforts between the first end 110 and the second end 120.

[0167] Exemplary embodiments of this disclosure also provide a data collection device configured at the first end 110. (See reference...) Figure 9 As shown, the data collection device 900 may include the following modules:

[0168] The feature anonymization information sending module 910 is configured to send the feature anonymization information used to build the anonymous database to the second end, so that the second end uses the feature anonymization information to anonymize the second feature data in the second data to be processed to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data.

[0169] The second anonymous feature data receiving module 920 is configured to receive the second anonymous feature data sent by the second end, determine the target equivalence class to which the second anonymous feature data belongs in the anonymous database, and determine whether the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition; K is a positive integer not less than 2.

[0170] The data acquisition module 930 is configured to send a data acquisition command to the second end when it is determined that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition, and to receive the second sensitive data after privacy processing sent by the second end in response to the data acquisition command.

[0171] Anonymous database update module 940 is configured to update the anonymous database using second anonymized feature data and second sensitive data that has been privacy-processed.

[0172] In one implementation, determining whether the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition includes:

[0173] The number of data corresponding to the second anonymous feature data belonging to the target equivalence class is accumulated and summed with the number of data in the target equivalence class. If the sum is greater than or equal to K, it is determined that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition.

[0174] In one implementation, the above-mentioned accumulation of the number of data corresponding to the second anonymous feature data belonging to the target equivalence class includes:

[0175] The number of data corresponding to the second anonymous feature data belonging to the target equivalence class received within the first preset time period is accumulated.

[0176] In one implementation, the second anonymity feature data receiving module 920 is further configured to:

[0177] After receiving the second anonymous feature data sent by the second end, if it is determined that the second anonymous feature data does not belong to an existing equivalence class in the anonymous database, the second anonymous feature data is recorded as anonymous feature data to be classified; if the anonymous feature data to be classified accumulated within a second preset time meets the classification conditions, a new equivalence class is added to the anonymous database based on the anonymous feature data to be classified accumulated within the second preset time.

[0178] In one embodiment, the data collection device 900 further includes an anonymous database construction module, configured to perform the following steps before the feature anonymization information sending module 910 sends the feature anonymization information used to construct the anonymous database to the second end:

[0179] Hierarchical generalization information is constructed for the first feature data in the first data to be processed; the first data to be processed includes first sensitive data and the first feature data corresponding to the first sensitive data.

[0180] Anonymize the first feature data based on hierarchical generalization information to obtain first anonymous feature data, such that the equivalence classes of the first data to be processed, using the first anonymous feature data as the quasi-identifier, satisfy K. S Anonymous condition; K S A positive integer in the range [2, K].

[0181] The target level generalization information in the hierarchical generalization information used in the anonymization process is recorded as feature anonymization information;

[0182] Privacy processing is performed on the most sensitive data;

[0183] An anonymous database is constructed by combining primary anonymized feature data with primary sensitive data that has undergone privacy processing.

[0184] In one implementation, the above-mentioned anonymization processing of the first feature data based on hierarchical generalization information yields first anonymous feature data, such that the equivalence classes of the first data to be processed, using the first anonymous feature data as quasi-identifiers, satisfy K. S Anonymity conditions include:

[0185] The first feature data is anonymized using the highest-level generalization information in the hierarchical generalization information to obtain the first anonymized feature data; the highest-level generalization information represents the highest degree of generalization.

[0186] The first anonymous feature data is iteratively updated in the following manner until, using the updated first anonymous feature data as the quasi-identifier, the equivalence classes of the first data to be processed exactly satisfy K. S Anonymization condition: In the first feature data, a feature to be downgraded is determined. The feature to be downgraded is re-anonymized using the lower-level generalization information in the hierarchical generalization information, or the feature to be downgraded is restored to the original data to update the first anonymized feature data.

[0187] In one implementation, determining a feature to be downgraded from the first feature data includes:

[0188] For each feature of the first feature data, if the feature is re-anonymized using the lower-level generalization information in the hierarchical generalization information or the feature is restored to the original data, the number of values ​​corresponding to the feature is obtained, and the feature with the smallest number of values ​​is determined as the feature to be downgraded.

[0189] In one implementation, the anonymous database construction module is further configured to:

[0190] Before constructing the anonymized database by combining the first anonymized feature data and the first sensitive data that has undergone privacy processing, the data distribution similarity of the first sensitive data of each equivalence class in the first data to be processed is calculated with all the first sensitive data. If there is an equivalence class in the first data to be processed whose data distribution similarity does not meet the similarity requirement, the equivalence class is regarded as the equivalence class to be optimized. By merging the equivalence class to be optimized with other equivalence classes in the first data to be processed, the data distribution similarity of the merged equivalence class meets the similarity requirement, and the feature anonymization information is updated according to the merging result.

[0191] In one implementation, the above-mentioned merging of the equivalence class to be optimized with other equivalence classes in the first data to be processed includes:

[0192] Merge the equivalence class that is most similar to the first anonymous feature data of the equivalence class to be optimized with the equivalence class to be optimized.

[0193] In one implementation, the first feature data includes one or more of character features, integer features, floating-point features, and list features; the above-mentioned construction of hierarchical generalization information on the first feature data in the first data to be processed includes one or more of the following methods:

[0194] For character-type features, hierarchical generalization information of character-type features is constructed by setting different numbers of characters in the data of character-type features to be replaced with anonymized characters at one or more levels. The characters replaced in the higher-level generalization information are more than the characters replaced in the lower-level generalization information, and the characters replaced in the higher-level generalization information include the characters replaced in the lower-level generalization information.

[0195] For integer features, the numerical range of integer features is divided into multiple integer numerical intervals at one or more levels to construct hierarchical generalization information for integer features. In this case, an integer numerical interval in the higher-level generalization information includes multiple integer numerical intervals in the lower-level generalization information.

[0196] For floating-point features, hierarchical generalization information of floating-point features is constructed by dividing the numerical range of floating-point features into multiple floating-point numerical intervals at one or more levels, wherein a floating-point numerical interval in a higher-level generalization information includes multiple floating-point numerical intervals in a lower-level generalization information; or, hierarchical generalization information of floating-point features is constructed by setting the number of decimal places retained by the data of floating-point features at one or more levels, wherein the number of decimal places retained in the higher-level generalization information is less than the number of decimal places retained in the lower-level generalization information.

[0197] For list-type features, hierarchical generalization information of the list-type feature is constructed by setting one or more levels to hide data at specified positions in the list-type feature data. The hidden data in the higher-level generalization information is more than the hidden data in the lower-level generalization information, and the hidden data in the higher-level generalization information includes the hidden data in the lower-level generalization information.

[0198] Exemplary embodiments of this disclosure also provide a data collection device configured at the second end 120. (See reference...) Figure 10 As shown, the data collection device 1000 may include the following modules:

[0199] The feature anonymization information receiving module 1010 is configured to receive feature anonymization information sent by the first end for constructing an anonymous database;

[0200] The feature anonymization processing module 1020 is configured to anonymize the second feature data in the second data to be processed using feature anonymization information to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data.

[0201] The second anonymous feature data sending module 1030 is configured to send the second anonymous feature data to the first end, so that the first end, after determining that the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition, sends a data collection command to the second end; the target equivalence class is the equivalence class to which the second anonymous feature data belongs in the anonymous database;

[0202] The data acquisition instruction response module 1040 is configured to respond to a data acquisition instruction by sending the second sensitive data that has been privacy-processed to the first end, so that the first end can update the anonymous database using the second anonymized feature data and the privacy-processed second sensitive data.

[0203] The specific details of each part of the above-mentioned apparatus 900 and apparatus 1000 have been described in detail in the method section of the embodiments. For any undisclosed details, please refer to the method section of the embodiments, and therefore will not be repeated here.

[0204] Exemplary embodiments of this disclosure also provide a computer-readable storage medium that can be implemented as a program product including program code, which, when run on an electronic device, causes the electronic device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. In an alternative embodiment, the program product can be implemented as a portable compact disc read-only memory (CD-ROM) including program code and can run on an electronic device, such as a personal computer. However, the program product of this disclosure is not limited thereto. In this document, the readable storage medium can be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0205] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples (a non-exhaustive list) of readable storage media include: electrical connections having one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0206] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0207] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0208] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing devices can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0209] Exemplary embodiments of this disclosure also provide an electronic device, such as the first terminal 110 or the second terminal 120 described above. The electronic device may include a processor and a memory. The memory stores executable instructions for the processor, such as program code. The processor executes the executable instructions to perform the methods of this exemplary embodiment.

[0210] The following is for reference. Figure 11 The electronic device is illustrated by way of a general-purpose computing device. It should be understood that... Figure 11 The electronic device 1100 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0211] like Figure 11 As shown, the electronic device 1100 may include: a processor 1110, a memory 1120, a bus 1130, an I / O (input / output) interface 1140, and a network adapter 1150.

[0212] Memory 1120 may include volatile memory, such as RAM 1121 and cache unit 1122, and may also include non-volatile memory, such as ROM 1123. Memory 1120 may also include one or more program modules 1124, such program modules 1124 including, but not limited to: operating system, one or more application programs, other program modules, and program data. Each or some combination of these examples may include an implementation of a network environment. For example, program module 1124 may include the modules in the above-described apparatus.

[0213] Bus 1130 is used to connect different components of electronic device 1100 and may include a data bus, an address bus and a control bus.

[0214] Electronic device 1100 can communicate with one or more external devices 1200 (e.g., keyboard, mouse, external controller, etc.) through I / O interface 1140.

[0215] Electronic device 1100 can communicate with one or more networks via network adapter 1150. For example, network adapter 1150 can provide mobile communication solutions such as 3G / 4G / 5G, or wireless communication solutions such as wireless LAN, Bluetooth, and near-field communication. Network adapter 1150 can communicate with other modules of electronic device 1100 via bus 1130.

[0216] although Figure 11 Other hardware and / or software modules, including but not limited to: displays, microcode, device drivers, redundant processors, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, may also be configured in electronic device 1100.

[0217] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to exemplary embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0218] Those skilled in the art will understand that various aspects of this disclosure can be implemented as systems, methods, or program products. Therefore, various aspects of this disclosure can be embodied in entirely hardware implementations, entirely software implementations (including firmware, microcode, etc.), or implementations combining hardware and software aspects, collectively referred to herein as “circuit,” “module,” or “system.” Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and embodiments are to be considered exemplary only, and the true scope and spirit of this disclosure are indicated by the claims.

[0219] It should be understood that this disclosure is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of this disclosure is defined only by the appended claims.

Claims

1. A data collection method, applied to a first end, characterized in that, The method includes: The feature anonymization information used to construct the anonymous database is sent to the second end, so that the second end uses the feature anonymization information to anonymize the second feature data in the second data to be processed to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data; The system receives the second anonymous feature data sent by the second end, determines the target equivalence class to which the second anonymous feature data belongs in the anonymous database, and judges whether the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition; K is a positive integer not less than 2. If the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition, a data collection instruction is sent to the second end, and the second end receives the second sensitive data after privacy processing in response to the data collection instruction. The anonymous database is updated using the second anonymous feature data and the second sensitive data that has been privacy-processed.

2. The method according to claim 1, characterized in that, The determination of whether the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition includes: The number of data corresponding to the second anonymous feature data belonging to the target equivalence class is accumulated and summed with the number of data in the target equivalence class. If the summation result is greater than or equal to K, it is determined that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition.

3. The method according to claim 2, characterized in that, The step of accumulating the number of data corresponding to the second anonymous feature data belonging to the target equivalence class includes: The number of data corresponding to the second anonymous feature data belonging to the target equivalence class received within the first preset time period is accumulated.

4. The method according to claim 1, characterized in that, After receiving the second anonymity feature data sent by the second end, the method further includes: If it is determined that the second anonymous feature data does not belong to an existing equivalence class in the anonymous database, then the second anonymous feature data is recorded as anonymous feature data to be classified. If the accumulated anonymous feature data to be classified within the second preset time period meets the classification conditions, then a new equivalence class is added to the anonymous database based on the accumulated anonymous feature data to be classified within the second preset time period.

5. The method according to claim 1, characterized in that, Before sending the feature anonymization information used to construct the anonymous database to the second end, the method further includes: Hierarchical generalization information is constructed for the first feature data in the first data to be processed; the first data to be processed includes first sensitive data and the first feature data corresponding to the first sensitive data. Based on the hierarchical generalization information, the first feature data is anonymized to obtain first anonymous feature data, such that the equivalence classes of the first data to be processed, using the first anonymous feature data as quasi-identifiers, satisfy K... S Anonymous condition; K S A positive integer in the range [2, K]. The target level generalization information in the hierarchical generalization information used in the anonymization process is recorded as the feature anonymization information; The first sensitive data is processed to protect its privacy. The anonymous database is constructed by combining the first anonymous feature data and the first sensitive data that has undergone privacy processing.

6. The method according to claim 5, characterized in that, The first feature data is anonymized based on the hierarchical generalization information to obtain first anonymous feature data, such that the equivalence classes of the first data to be processed, using the first anonymous feature data as a quasi-identifier, satisfy K. S Anonymity conditions include: The first feature data is anonymized using the highest-level generalization information in the hierarchical generalization information to obtain the first anonymous feature data; the highest-level generalization information represents the highest degree of generalization. The first anonymous feature data is iteratively updated in the following manner until, using the updated first anonymous feature data as the quasi-identifier, the equivalence classes partitioned by the first data to be processed exactly satisfy K. S Anonymization condition: In the first feature data, a feature to be downgraded is determined, and the feature to be downgraded is re-anonymized using the lower-level generalization information in the hierarchical generalization information or the feature to be downgraded is restored to the original data to update the first anonymized feature data.

7. The method according to claim 6, characterized in that, The step of determining a feature to be downgraded from the first feature data includes: For each feature of the first feature data, if the feature is re-anonymized using the lower-level generalization information in the hierarchical generalization information or the feature is restored to its original data, the number of values ​​corresponding to the feature is obtained, and the feature with the smallest number of values ​​is determined as the feature to be downgraded.

8. The method according to claim 5, characterized in that, Before combining the first anonymized feature data and the first sensitive data that has undergone privacy processing to construct the anonymized database, the method further includes: Calculate the data distribution similarity between the first sensitive data of each equivalence class in the first data to be processed and all the first sensitive data. If there is an equivalence class in the first data to be processed whose data distribution similarity does not meet the similarity requirement, the equivalence class is regarded as the equivalence class to be optimized. By merging the equivalence class to be optimized with other equivalence classes in the first data to be processed, the data distribution similarity of the merged equivalence class meets the similarity requirement, and the feature anonymization information is updated according to the merging result.

9. The method according to claim 8, characterized in that, The merging of the equivalence class to be optimized with other equivalence classes in the first data to be processed includes: The equivalence class that is most similar to the first anonymous feature data of the equivalence class to be optimized among the other equivalence classes is merged with the equivalence class to be optimized.

10. The method according to claim 5, characterized in that, The first feature data includes one or more of the following: character features, integer features, floating-point features, and list features; the construction of hierarchical generalization information for the first feature data in the first data to be processed includes one or more of the following methods: For the character-type feature, hierarchical generalization information of the character-type feature is constructed by setting different numbers of characters in the data of the character-type feature to be replaced with anonymized characters at one or more levels. The characters replaced in the higher-level generalization information are more than the characters replaced in the lower-level generalization information, and the characters replaced in the higher-level generalization information include the characters replaced in the lower-level generalization information. For the integer feature, the hierarchical generalization information of the integer feature is constructed by dividing the numerical range of the integer feature into multiple integer numerical intervals at one or more levels, wherein an integer numerical interval in the higher-level generalization information includes multiple integer numerical intervals in the lower-level generalization information. For the floating-point feature, hierarchical generalization information of the floating-point feature is constructed by dividing the numerical range of the floating-point feature into multiple floating-point numerical intervals at one or more levels, wherein a floating-point numerical interval in a higher-level generalization information includes multiple floating-point numerical intervals in a lower-level generalization information; or, hierarchical generalization information of the floating-point feature is constructed by setting the number of decimal places retained by the data of the floating-point feature at one or more levels, wherein the number of decimal places retained in the higher-level generalization information is less than the number of decimal places retained in the lower-level generalization information. For the list-type feature, the hierarchical generalization information of the list-type feature is constructed by setting one or more levels to hide the data at specified positions in the data of the list-type feature. The hidden data in the higher-level generalization information is more than the hidden data in the lower-level generalization information, and the hidden data in the higher-level generalization information includes the hidden data in the lower-level generalization information.

11. A data collection method, applied to a second end, characterized in that, The method includes: Receive feature anonymization information sent by the first end for constructing the anonymous database; The second feature data in the second data to be processed is anonymized using the aforementioned feature anonymization information to obtain second anonymous feature data; the second data to be processed includes second sensitive data and the second feature data corresponding to the second sensitive data; The second anonymous feature data is sent to the first end, and the first end, after determining that the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition, sends a data collection command to the second end; the target equivalence class is the equivalence class to which the second anonymous feature data belongs in the anonymous database; In response to the data acquisition command, the second sensitive data, after privacy processing, is sent to the first terminal, so that the first terminal updates the anonymous database using the second anonymous feature data and the second sensitive data after privacy processing.

12. A data collection device, disposed at a first end, characterized in that, The device includes: The feature anonymization information sending module is configured to send the feature anonymization information used to construct the anonymous database to the second end, so that the second end uses the feature anonymization information to anonymize the second feature data in the second data to be processed to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data; The second anonymous feature data receiving module is configured to receive the second anonymous feature data sent by the second end, determine the target equivalence class to which the second anonymous feature data belongs in the anonymous database, and determine whether the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition; K is a positive integer not less than 2. The data acquisition module is configured to send a data acquisition instruction to the second end when it is determined that the target equivalence class after adding the second anonymous feature data satisfies the K anonymity condition, and to receive the second sensitive data after privacy processing sent by the second end in response to the data acquisition instruction. An anonymous database update module is configured to update the anonymous database using the second anonymous feature data and the second sensitive data that has been privacy-processed.

13. A data collection device, disposed at a second end, characterized in that, The device includes: The feature anonymization information receiving module is configured to receive feature anonymization information sent by the first end for constructing an anonymous database; The feature anonymization processing module is configured to anonymize the second feature data in the second data to be processed using the feature anonymization information to obtain the second anonymous feature data; the second data to be processed includes the second sensitive data and the second feature data corresponding to the second sensitive data; The second anonymous feature data sending module is configured to send the second anonymous feature data to the first end, so that when the first end determines that the target equivalence class after adding the second anonymous feature data satisfies the K-anonymity condition, it sends a data collection command to the second end; the target equivalence class is the equivalence class to which the second anonymous feature data belongs in the anonymous database; The data acquisition instruction response module is configured to respond to the data acquisition instruction by sending the second sensitive data, which has been privacy-processed, to the first end, so that the first end can update the anonymous database using the second anonymous feature data and the second sensitive data that has been privacy-processed.

14. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method described in any one of claims 1 to 11.

15. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the method of any one of claims 1 to 11 by executing the executable instructions.

Images