Data query method and device based on privacy protection

Abstract

This specification provides a privacy-preserving data query method and apparatus, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space. The geographic space is divided into multiple partitions, and each partition is further divided into multiple subspaces. The querying party can determine the target partition to which the target sampling area belongs from the multiple partitions, determine the target subspace to which the target sampling area belongs from the target partition, and send a query request to the data party for querying statistical data, including indication information for indicating the target partition. Subsequently, based on the identifier of the target subspace, and based on the identifiers of the N subspaces included in the target partition, the querying party can jointly execute an N-choose-1 OT protocol, enabling the querying party to obtain target returned data from the data party. This target returned data includes statistical data of the sampling areas within the target subspace.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of computers, and more particularly to a data query method and apparatus based on privacy protection. Background Technology

[0002] Geographic location-based data querying is an important component of geographic information services. For example, a queryer can send a target sampling area to be queried to a geographic information service system provided by a geographic information service provider. The geographic information service system, as the data provider, can determine the sampling area to which the target sampling area belongs from multiple sampling areas distributed in geographic space and return the statistical data of that sampling area to the queryer.

[0003] We hope to find a new technological solution that can enable more secure and efficient location-based data queries. Summary of the Invention

[0004] This specification provides a privacy-preserving data query method and apparatus in one or more embodiments.

[0005] Firstly, a privacy-preserving data query method is provided, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, which is divided into multiple partitions, and each partition is further divided into multiple subspaces. The method includes: the querying party determining, from the multiple partitions, the target partition to which the target sampling area belongs, and determining, from the target partition, the target subspace to which the target sampling area belongs; the querying party sending a query request to the data party for querying statistical data, including indication information for identifying the target partition; the querying party, based on the identifier of the target subspace, and the data party, based on the identifiers of the N subspaces included in the target partition, jointly executing an N-choose-1 oblivious transfer (OT) protocol, so that the querying party obtains target returned data from the data party, the target returned data including statistical data of the sampling areas within the target subspace.

[0006] In one possible implementation, the querying party, based on the identifier of the target subspace, and the data party, based on the identifiers of the N subspaces included in the target partition, jointly execute an N-choose-1 OT protocol, comprising: the querying party sending a first ciphertext to the data party, the first ciphertext being obtained by encrypting the identifier of the target subspace using a first key of a commutative encryption algorithm; the data party encrypting the first ciphertext using a second key of a commutative encryption algorithm to obtain a second ciphertext; the data party sending the second ciphertext and N data ciphertexts to the querying party, wherein any j-th data ciphertext is obtained by encrypting j-th returned data using a j-th symmetric key, the j-th returned data including statistical data of the sampling area within the j-th subspace, and the j-th symmetric key being obtained by encrypting the identifier of the j-th subspace using a second key of a commutative encryption algorithm; the querying party decrypting the second ciphertext using a decryption key corresponding to the first key to obtain a third ciphertext, and using the third ciphertext as a decryption key to decrypt the data ciphertext corresponding to the target subspace among the N data ciphertexts to obtain the target returned data.

[0007] In one possible implementation, if the j-th subspace includes at least two sampling regions, the j-th returned data includes the location information of the at least two sampling regions and their respective corresponding statistical data; wherein, the method further includes: the querying party determining the statistical data of the target sampling region from the target returned data based on the location information of the target sampling region.

[0008] In one possible implementation, the geographic space is divided into multiple zones based on longitude and latitude, or the geographic space is divided into multiple zones based on administrative regions.

[0009] In one possible implementation, the statistical data includes any one or more of the following: pedestrian flow, vehicle flow, consumer spending power, and age distribution of the population.

[0010] Secondly, a privacy-preserving data query method is provided, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, which is divided into multiple partitions, and each partition is further divided into multiple subspaces. The method is executed by the querying party. The method includes: determining the target partition to which the target sampling area to be queried belongs from the multiple partitions, and determining the target subspace to which the target sampling area belongs from the target partition; sending a query request to the data party for querying statistical data, including indication information for indicating the target partition; and, based on the identifier of the target subspace, jointly executing an N-choose-1 OT protocol with the data party based on the identifiers of the N subspaces included in the target partition to obtain target returned data, wherein the target returned data includes statistical data of the sampling areas within the target subspace.

[0011] In one possible implementation, the joint execution of an N-choose-1 OT protocol based on the identifier of the target subspace and the identifiers of the N subspaces included in the target partition by the data party includes: sending a first ciphertext to the data party, the first ciphertext being obtained by encrypting the identifier of the target subspace using a first key of a commutative encryption algorithm; receiving a second ciphertext and N data ciphertexts from the data party, wherein the second ciphertext is obtained by encrypting the first ciphertext using a second key of a commutative encryption algorithm, any j-th data ciphertext is obtained by encrypting j-th return data using a j-th symmetric key, the j-th return data including statistical data of the sampling region within the j-th subspace, the j-th symmetric key being obtained by encrypting the identifier of the j-th subspace using a second key of a commutative encryption algorithm; decrypting the second ciphertext using a decryption key corresponding to the first key to obtain a third ciphertext; and using the third ciphertext as a decryption key to decrypt the data ciphertext corresponding to the target subspace among the N data ciphertexts to obtain the target return data.

[0012] In one possible implementation, if the j-th subspace includes at least two sampling regions, the j-th returned data includes the location information of the at least two sampling regions and their respective corresponding statistical data; wherein, the method further includes: the querying party determining the statistical data of the target sampling region from the target returned data based on the location information of the target sampling region.

[0013] Thirdly, a privacy-preserving data query method is provided, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, which is divided into multiple partitions, and each partition is further divided into multiple subspaces. The method is executed by the data party. The method includes: receiving a query request from the querying party for querying statistical data, including indication information for the target partition, wherein the target partition is the partition to which the target sampling area to be queried belongs, determined from the multiple partitions; based on the identifiers of N subspaces included in the target partition, jointly executing an N-choose-1 unintentional transmission (OT) protocol with the querying party based on the identifiers of the target subspaces, so that the querying party obtains target returned data, wherein the target returned data includes statistical data of the sampling areas within the target subspace, and the target subspace is the subspace to which the target sampling area belongs, determined from the target partition.

[0014] In one possible implementation, the joint execution of an N-choose-1 OT protocol based on the identifiers of the N subspaces included in the target partition, and the querying party based on the identifiers of the target subspaces, includes: receiving a first ciphertext from the querying party, wherein the first ciphertext is obtained by encrypting the identifier of the target subspace using a first key of a commutative encryption algorithm; encrypting the first ciphertext using a second key of the commutative encryption algorithm to obtain a second ciphertext; sending the second ciphertext and N data ciphertexts to the querying party, wherein any j-th data ciphertext is obtained by encrypting j-th returned data using a j-th symmetric key, the j-th returned data including statistical data of the sampling area within the j-th subspace, and the j-th symmetric key being obtained by encrypting the identifier of the j-th subspace using a second key of the commutative encryption algorithm, such that the querying party decrypts the second ciphertext using a decryption key corresponding to the first key to obtain a third ciphertext, and uses the third ciphertext as a decryption key to decrypt the data ciphertext corresponding to the target subspace among the N data ciphertexts to obtain the target returned data.

[0015] In one possible implementation, if the j-th subspace includes at least two sampling regions, the j-th returned data includes the location information of the at least two sampling regions and their respective corresponding statistical data.

[0016] Fourthly, a privacy-preserving data query device is provided, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, which is divided into multiple partitions, and each partition is further divided into multiple subspaces. The device is deployed on the querying party. The device includes: a spatial determination unit configured to determine, from the multiple partitions, the target partition to which the target sampling area to be queried belongs, and to determine, from the target partition, the target subspace to which the target sampling area belongs; a request sending unit configured to send a query request to the data party for querying statistical data, including indication information for indicating the target partition; and a secure communication unit configured to, based on the identifier of the target subspace, jointly execute an N-choose-1 unintentional transmission (OT) protocol with the data party based on the identifiers of the N subspaces included in the target partition, to obtain target return data, wherein the target return data includes statistical data of the sampling areas within the target subspace.

[0017] Fifthly, a privacy-preserving data query device is provided, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, which is divided into multiple partitions, and each partition is further divided into multiple subspaces. The device is deployed on the data party. The device includes: a request receiving unit configured to receive a query request from the querying party for querying statistical data, including indication information for indicating the target partition, wherein the target partition is the partition to which the target sampling area to be queried belongs, determined from the multiple partitions; and a secure communication unit configured to, based on the identifiers of N subspaces included in the target partition, jointly execute an N-choose-1 unintentional transmission (OT) protocol with the querying party based on the identifiers of the target subspaces, enabling the querying party to obtain target returned data, wherein the target returned data includes statistical data of the sampling areas within the target subspace, and the target subspace is the subspace to which the target sampling area belongs, determined from the target partition.

[0018] In a sixth aspect, a computer-readable storage medium is provided having a computer program / instructions stored thereon, wherein when the computer program / instructions are executed in a computing device, the computing device implements the method described in any one of the second or third aspects.

[0019] In a seventh aspect, a computing device is provided, including a memory and a processor, wherein executable code is stored in the memory, and when the processor executes the executable code, it implements the method described in any one of the second or third aspects.

[0020] The methods and apparatus provided in one or more embodiments of this specification divide geographic space into multiple partitions and each partition into multiple subspaces. When a querying party wants to query statistical data for a target sampling area, it can determine the target partition to which the target sampling area belongs from the multiple partitions, then determine the target subspace to which the target sampling area belongs from the target partition, and send a query request for querying statistical data to the data provider, including indication information for indicating the target partition. Furthermore, based on the identifier of the target subspace, and based on the identifiers of the N subspaces included in the target partition, the querying party can jointly execute an N-to-m OT protocol, enabling the querying party to obtain the sampling area located within the target subspace from the data provider, and thus obtain the statistical data for the target sampling area. In this way, during the process of the querying party querying the statistical data of the target sampling area, the data provider cannot know the target sampling area being queried by the querying party, enabling more secure and efficient geographic location-based data queries. Attached Figure Description

[0021] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0022] Figure 1 This is a schematic diagram of a technical scenario provided in the embodiments of this specification;

[0023] Figure 2 This is a flowchart of a privacy-preserving data query method provided in the embodiments of this specification;

[0024] Figure 3 This is an example of a process where the querying party and the data party jointly execute the OT protocol.

[0025] Figure 4 This is one of the schematic diagrams of a privacy-preserving data query device provided in the embodiments of this specification;

[0026] Figure 5 This is a second schematic diagram of a privacy-preserving data query device provided in the embodiments of this specification. Detailed Implementation

[0027] The various non-limiting embodiments provided in this specification will now be described in detail with reference to the accompanying drawings.

[0028] In the geographic information systems provided by geographic information service providers, multiple different sampling areas may be set up in the geographic space, and different statistical data may be maintained for different sampling data. For example, a single sampling area may correspond to a doorway, and the statistical data of this sampling area may include, for example, the pedestrian flow at the corresponding intersection; another example is that a single sampling area may correspond to a section of a highway, and the statistical data of this sampling area may include, for example, the traffic flow of the corresponding section; yet another example is that a single sampling area may correspond to one or more residential areas, and the statistical data of this sampling area may include, for example, the consumption power and / or age distribution of the population in the corresponding residential area.

[0029] The aforementioned geographic space can be a two-dimensional geographic space or a three-dimensional geographic space.

[0030] See Figure 1 As shown, a geographic information service provider may offer a geographic information service system (GIS), which may store location information of multiple sampling areas distributed across a geographic space, along with their corresponding statistical data. When a user (individual or organization) wishes to query statistical data for a target sampling area in a geographic space, they can initiate a query request to the GIS. This query request typically needs to include the identifier of the target sampling area, such as its location information or a specific location within that area, so that the GIS can query and return the statistical data for that area. However, for privacy reasons, users may not wish to expose the target sampling area they wish to query.

[0031] This specification provides a privacy-preserving data query method and apparatus. By dividing the geographic space into multiple partitions and each partition into multiple subspaces, when a querying party wants to query statistical data of a target sampling area, it can determine the target partition to which the target sampling area belongs from the multiple partitions, then determine the target subspace to which the target sampling area belongs from the target partition, and send a query request for querying statistical data to the data provider, including indication information for the target partition. Then, based on the identifier of the target subspace, and based on the identifiers of the N subspaces included in the target partition, the querying party can jointly execute an N-to-m OT protocol, enabling the querying party to obtain the sampling area located within the target subspace from the data provider, and thus obtain the statistical data of the target sampling area. In this way, during the process of the querying party querying the statistical data of the target sampling area, the data provider cannot know the target sampling area being queried by the querying party, enabling more secure and efficient geographic location-based data querying.

[0032] Figure 2This is a flowchart illustrating a privacy-preserving data query method provided in the embodiments of this specification. The method involves two distinct parties: a querying party and a data provider. The data provider can correspond to a geographic information service provider offering a geographic information system (GIS), while the querying party can correspond to a user (including natural persons or organizations) using the GIS. Both the querying party and the data provider can typically be implemented as any device, platform, equipment, or cluster of devices with computing / processing capabilities.

[0033] The aforementioned data provider holds statistical data on the location information of multiple sampling areas distributed within a geographic space, and may also hold the location information of these multiple sampling areas. This geographic space is divided into multiple zones, for example, based on longitude and latitude, or based on administrative regions. A single zone can be divided into multiple subspaces: for example, when the geographic space is two-dimensional, a single zone can be gridded according to longitude and latitude to divide it into multiple subspaces, i.e., a single subspace is a square or approximately square; similarly, when the geographic space is three-dimensional, a single zone can be divided into multiple subspaces according to longitude, latitude, and altitude, i.e., a single subspace is a cube or approximately cube. The aforementioned exemplary method of dividing a single zone into multiple subspaces is merely illustrative; it is understood that other methods can also be used to divide subspaces. It is understood that different zones can contain different numbers of subspaces.

[0034] See Figure 2 As shown, the method may include, but is not limited to, some or all of the following steps S21 to S25.

[0035] Step S21: The querying party determines the target partition to which the target sampling area to be queried belongs from multiple partitions of the geospatial space, and determines the target subspace to which the target sampling area belongs from the target partition.

[0036] The querying party can obtain the location information of partitions and subspaces. The location information of a single partition is, for example, the coordinates of multiple sampling points that make up the boundary / contour of that partition; the location information of a single subspace is, for example, the coordinates of multiple sampling points that make up the boundary / contour of that subspace. Based on the location information of multiple partitions, the target partition to which the target sampling region belongs can be determined from these partitions. Furthermore, based on the location information of the target sampling region, the target subspace to which the target sampling region belongs can be determined from the N subspaces included in the target partition.

[0037] In a typical application scenario, the querying party can be a terminal owned by a user and equipped with a specific application. The user can input the identifier of the target sampling area into the terminal through the application, such as the location information of the target sampling area or a target location belonging to the target sampling area, thereby triggering the terminal to perform the aforementioned step S21.

[0038] Step S23: The querying party sends a query request to the data party for querying statistical data, including indication information for indicating the target partition.

[0039] In step S25, the querying party, based on the identifier of the target subspace, and the data party, based on the identifiers of the N subspaces included in the target partition, jointly execute the N-choose-1 OT protocol, so that the querying party obtains the target returned data from the data party. The target returned data includes statistical data of the sampling area within the target subspace.

[0040] In one possible implementation, see Figure 3 As shown, the process by which the querying party and the data party jointly execute the OT protocol may include some or all of the following steps S301 to S315.

[0041] In step S301, the querying party encrypts the identifier of the target subspace using the first key of the commutative encryption algorithm to obtain the first ciphertext corresponding to the target subspace.

[0042] Exchangeable encryption algorithms satisfy E k1 (E k2 (L))=E k2 (E k1 Let E represent a commutative encryption algorithm, k1 and k2 represent two different keys, and L represent the data to be encrypted. The commutative encryption algorithm satisfies the condition that the ciphertext obtained by encrypting data L sequentially using keys k1 and k2 is equivalent to the ciphertext obtained by encrypting data L sequentially using keys k2 and k1. It is easy to verify that for ciphertext E... k1 (E k2 (L)) or E k2 (E k1 (L)) can be used to decrypt the ciphertext using the decryption key d1 corresponding to key k1 to obtain ciphertext E. k2 (L), using the decryption key d2 corresponding to key k2 to decrypt the ciphertext, we can obtain ciphertext E. k1(L). The commutative encryption algorithm is usually an asymmetric encryption algorithm, such as the SRA algorithm or the Pohlig Hellman algorithm. In this case, the aforementioned decryption key d1 is different from the key k1, and the aforementioned decryption key d2 is different from the key k2. When the commutative encryption algorithm is a symmetric encryption algorithm, the aforementioned decryption key d1 is the same as the key k1, and the aforementioned decryption key d2 is the same as the key k2.

[0043] That is, the querying party can hold the first key of the commutative encryption algorithm E (e.g., the aforementioned key k1), and use the key k1 of the commutative encryption algorithm E to identify the target subspace H. p Encryption is performed to obtain the corresponding first ciphertext E. k1 (H p ).

[0044] The aforementioned step S301 is optional. For example, the querying party can pre-encrypt the identifiers of all subspaces belonging to the geographic space using the first key of the exchangeable encryption algorithm, obtaining the first ciphertext corresponding to each subspace belonging to the geographic space. Correspondingly, during the joint execution of the N-choose-1 OT protocol with the data party, the querying party does not need to execute the aforementioned step S301, but instead obtains the first ciphertext corresponding to the target subspace from the pre-obtained first ciphertext corresponding to each of the subspaces belonging to the geographic space.

[0045] Step S303: The querying party sends the first ciphertext to the data provider.

[0046] In step S305, the data provider encrypts the first ciphertext using the second key of the exchangeable encryption algorithm to obtain the second ciphertext. That is, the data provider can possess the second key of the exchangeable encryption algorithm E (e.g., the aforementioned key k2), and encrypt the first ciphertext E using the key k2 of the exchangeable encryption algorithm E. k1 (H p Encrypt the second ciphertext E. k2 (E k1 (H p )).

[0047] In step S307, the data party encrypts the identifiers of the N subspaces included in the target partition using the second key of the exchangeable encryption algorithm to obtain N symmetric keys.

[0048] That is, for any j-th subspace among the N subspaces, the data party can use the second key of the commutative encryption algorithm E to identify the j-th subspace's identifier H. j Encryption is performed to obtain the symmetric key E corresponding to the j-th subspace. k2 (H j ).

[0049] In step S309, the data provider performs symmetric encryption on the N return data corresponding to the N subspaces using the N symmetric keys to obtain N ciphertexts. The j-th return data includes statistical data of the sampling area within the j-th subspace.

[0050] When the j-th subspace includes a single sampling region, the j-th returned data may include only the statistical data of that sampling region and not the location information of that sampling region.

[0051] When the j-th subspace includes at least two sampling regions, the j-th returned data may specifically include the location information of the aforementioned at least two sampling regions and their respective statistical data.

[0052] That is, the data party can use the symmetric key E corresponding to the j-th subspace. k2 (H j For the j-th returned data (denoted as R), j Perform symmetric encryption to obtain the j-th ciphertext F(E) corresponding to the j-th subspace. k2 (H j ), R j ), where F represents the symmetric encryption algorithm used.

[0053] Steps S307 and S309 are optional. For example, for any partition among multiple partitions belonging to geospatial space, the data provider can pre-encrypt the identifiers of multiple subspaces included in the partition using the second key of the exchangeable encryption algorithm to obtain the symmetric keys corresponding to each of the multiple subspaces included in the partition. Then, based on the symmetric keys corresponding to each of the multiple subspaces, the data provider can symmetrically encrypt the returned data corresponding to each of the multiple subspaces to obtain multiple ciphertexts corresponding to the multiple subspaces. Correspondingly, during the joint execution of the N-choose-1 OT protocol with the querying party, the data provider does not need to execute the aforementioned steps S307 and S309. Instead, it can obtain the N ciphertexts corresponding to the N subspaces included in the target partition from the various ciphertexts obtained in advance by the data provider.

[0054] In step S311, the data provider sends the second ciphertext and N data ciphertexts to the querying party.

[0055] In step S313, the querying party decrypts the second ciphertext using the decryption key corresponding to the first key of the interchangeable encryption algorithm to obtain the third ciphertext.

[0056] That is, for the second ciphertext E k2 (E k1 (H p The querying party can use the decryption key d1 corresponding to the key k1 of the interchangeable encryption algorithm to decrypt the second ciphertext E.k2 (E k1 (H p Decryption yields the third ciphertext E. k2 (H p ).

[0057] In step S315, the querying party uses the third ciphertext as the decryption key to decrypt the ciphertext corresponding to the target subspace among the N ciphertexts, and obtains the target return data corresponding to the target subspace.

[0058] Referring to the preceding text, the querying party obtains the third ciphertext E. k2 (H p This is equivalent to the data party identifying the target subspace H based on the key k2 of the exchangeable encryption algorithm. p The result obtained after encryption. For any j-th ciphertext F(E) among the N ciphertexts obtained by the querying party... k2 (H j ), R j (This refers to the data provider using the symmetric key E based on the symmetric encryption algorithm F.) k2 (H j ), for R j The data returned in the j-th subspace is obtained by symmetric encryption. Therefore, it's easy to understand that when H... p Same as H j Only under these circumstances can the querying party obtain the third ciphertext E. k2 (H p Using ) as the symmetric key, the corresponding ciphertext F(E) is... k2 (H j ), R j This ensures that the querying party can obtain the returned data corresponding to the target subspace (i.e., the target returned data) without obtaining excessive returned data corresponding to other subspaces in the target partition. Moreover, the key negotiation and data encryption / decryption process is simple, reliable, and highly efficient.

[0059] The foregoing Figure 3 The process of the query party and the data party jointly executing the N-choose-1 OT protocol shown is exemplary. For example, the query party can obtain the decryption key corresponding to the target subspace through a third party, and the data party can obtain N encryption keys through a third party to encrypt the return data corresponding to each of the N subspaces respectively, so that the query party can decrypt the corresponding ciphertext through the decryption key and obtain the return data corresponding to the target subspace.

[0060] Back Figure 2When the target subspace includes a single sampling region, the target returned data only includes statistical data for the target sampling region. After the querying party and the data party jointly execute the N-to-one OT protocol, the target returned data obtained is the statistical data for the target sampling region. When the target subspace includes at least two sampling regions, after the querying party and the data party jointly execute the N-to-one OT protocol, the target returned data obtained includes the location information of the aforementioned at least two sampling regions and their respective corresponding statistical data, while the target sampling region is only one of the aforementioned at least two sampling regions. In this case, the querying party can continue to execute step S27 to determine the statistical data of the target sampling region from the target returned data based on the location information of the target sampling region. More specifically, the same location information as the target sampling region can be determined from the location information of the at least two sampling regions included in the target returned data, and then the statistical data corresponding to the queried location information can be determined as the statistical data of the target sampling region.

[0061] Based on the same concept, the technical solutions provided in the embodiments of this specification can also be extended from geographic space to non-geographic space, such as to feature spaces including multiple dimensions to solve similar technical problems, for example, applied to privacy-preserving model inference. For example, a data provider holds a classification model (e.g., a KNN model), and a querying party holds sample feature data to be inferred. The classification model can divide the multi-dimensional feature space into multiple subspaces, where sample data within a subspace belongs to the same category. The querying party can determine the subspace to which its sample data belongs and provide the subspace identifier to the data provider holding the KNN. The querying party returns classification information based on the subspace identifier. During this process, the data provider cannot know the sample data to be classified held by the querying party, nor can the querying party know the classification model held by the data provider.

[0062] Based on the same concept as the aforementioned method embodiments, this specification also provides a privacy-preserving data query device 400, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space. The geographic space is divided into multiple partitions, and each partition is further divided into multiple subspaces. The device 400 is deployed on the querying party. See also Figure 4The apparatus 400 includes: a space determination unit 401, configured to determine the target partition to which the target sampling area to be queried belongs from the plurality of partitions, and to determine the target subspace to which the target sampling area belongs from the target partition; a request sending unit 403, configured to send a query request for querying statistical data to the data party, including indication information for indicating the target partition; and a secure communication unit 405, configured to, based on the identifier of the target subspace, jointly execute an N-choose-1 inadvertent transmission (OT) protocol with the data party based on the identifiers of the N subspaces included in the target partition, to obtain target return data, wherein the target return data includes statistical data of the sampling area within the target subspace.

[0063] Based on the same concept as the aforementioned method embodiments, this specification also provides a privacy-preserving data query device 500, involving a querying party and a data party. The data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space. The geographic space is divided into multiple partitions, and each partition is further divided into multiple subspaces. The device 500 is deployed on the data party. See also Figure 5 The apparatus 500 includes: a request receiving unit 501 configured to receive a query request from the querying party for querying statistical data, including indication information for indicating the target partition, wherein the target partition is the partition to which the target sampling area to be queried belongs, determined from the plurality of partitions; and a secure communication unit 503 configured to, based on the identifiers of the N subspaces included in the target partition, jointly execute an N-choose-1 unintentional transmission (OT) protocol with the querying party based on the identifiers of the target subspaces, so that the querying party obtains target return data, wherein the target return data includes statistical data of the sampling area within the target subspace, wherein the target subspace is the subspace to which the target sampling area belongs, determined from the target partition.

[0064] Those skilled in the art will recognize that, in one or more of the examples above, the functions described herein can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, the computer program corresponding to these functions can be stored in a computer-readable medium or transmitted as one or more instructions / code on a computer-readable medium so that when the computer program corresponding to these functions is executed by a computer, the methods described in any embodiment of this specification can be implemented by the computer.

[0065] This specification also provides a computer-readable storage medium storing a computer program / instruction, which, when executed in a computing device, implements the method steps performed by the querying party or the data provider in any embodiment of this specification.

[0066] This specification also provides a computing device in its embodiments, including a memory and a processor. The memory stores executable code / instructions, and when the processor executes the executable code / instructions, it implements the method steps performed by the querying party or the data party in any embodiment of this specification.

[0067] The various embodiments in this specification are described in a progressive manner. Similar or identical parts in each embodiment can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the apparatus embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0068] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0069] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A privacy-preserving data query method, involving a querying party and a data party, wherein the data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, the geographic space being divided into multiple partitions, and each partition being further divided into multiple subspaces, the method comprising: The querying party determines the target partition to which the target sampling region to be queried belongs from the plurality of partitions, and determines the target subspace to which the target sampling region belongs from the target partition; The querying party sends a query request to the data party for querying statistical data, including indication information for indicating the target partition; The querying party, based on the identifier of the target subspace, and the data party, based on the identifiers of the N subspaces included in the target partition, jointly execute an N-choose-1 unintentional transmission (OT) protocol, so that the querying party obtains target returned data from the data party. The target returned data includes statistical data of the sampling area within the target subspace.

2. The method according to claim 1, wherein, The querying party, based on the identifier of the target subspace, and the data party, based on the identifiers of the N subspaces included in the target partition, jointly execute an N-choose-1 OT protocol, including: The querying party sends a first ciphertext to the data party, the first ciphertext being obtained by encrypting the identifier of the target subspace using a first key of a commutative encryption algorithm; The data party encrypts the first ciphertext using a second key of an exchangeable encryption algorithm to obtain the second ciphertext; The data direction sends the second ciphertext and N data ciphertexts to the querying party, wherein any j-th data ciphertext is obtained by encrypting the j-th returned data according to the j-th symmetric key, the j-th returned data includes statistical data of the sampling area in the j-th subspace, and the j-th symmetric key is obtained by encrypting the identifier of the j-th subspace according to the second key of the interchangeable encryption algorithm; The querying party decrypts the second ciphertext using the decryption key corresponding to the first key to obtain the third ciphertext, and uses the third ciphertext as the decryption key to decrypt the data ciphertext corresponding to the target subspace among the N data ciphertexts to obtain the target returned data.

3. The method according to claim 2, wherein when the j-th subspace includes at least two sampling regions, the j-th returned data includes the location information of the at least two sampling regions and their respective corresponding statistical data; in, The method further includes: the querying party determining the statistical data of the target sampling area from the target returned data based on the location information of the target sampling area.

4. The method according to claim 1, wherein the geographic space is divided into multiple partitions based on longitude and latitude, or the geographic space is divided into multiple partitions based on administrative regions.

5. The method according to any one of claims 1-4, wherein the statistical data includes any one or more of the following: pedestrian flow, vehicle flow, consumer spending power, and age distribution of the population.

6. A privacy-preserving data query method, involving a querying party and a data provider, wherein the data provider holds multiple statistical data points distributed across multiple sampling areas in a geographic space, the geographic space being divided into multiple partitions, and each partition being further divided into multiple subspaces, the method being executed by the querying party, the method comprising: From the plurality of partitions, determine the target partition to which the target sampling region to be queried belongs, and from the target partition, determine the target subspace to which the target sampling region belongs; Send a query request to the data provider for querying statistical data, including indication information for indicating the target partition; Based on the identifier of the target subspace, the data provider, based on the identifiers of the N subspaces included in the target partition, jointly executes an N-choose-1 unintentional transmission (OT) protocol to obtain target return data, which includes statistical data of the sampling area within the target subspace.

7. The method according to claim 6, wherein, The joint execution of an N-choose-1 OT protocol based on the identifier of the target subspace and the identifier of the N subspaces included in the target partition by the data party includes: Send a first ciphertext to the data party, the first ciphertext being obtained by encrypting the identifier of the target subspace with a first key of a commutative encryption algorithm; The data source receives a second ciphertext and N ciphertexts, wherein the second ciphertext is obtained by encrypting the first ciphertext with a second key of a commutative encryption algorithm, and any j-th ciphertext is obtained by encrypting the j-th returned data with a j-th symmetric key. The j-th returned data includes statistical data of the sampling region within the j-th subspace, and the j-th symmetric key is obtained by encrypting the identifier of the j-th subspace with a second key of a commutative encryption algorithm. Based on the decryption key corresponding to the first key, the second ciphertext is decrypted to obtain the third ciphertext; Using the third ciphertext as the decryption key, the ciphertext corresponding to the target subspace among the N ciphertexts is decrypted to obtain the target returned data.

8. The method according to claim 7, wherein when the j-th subspace includes at least two sampling regions, the j-th returned data includes the location information of the at least two sampling regions and their respective corresponding statistical data; in, The method further includes: the querying party determining the statistical data of the target sampling area from the target returned data based on the location information of the target sampling area.

9. A privacy-preserving data query method, involving a querying party and a data party, wherein the data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, the geographic space being divided into multiple partitions, each partition being further divided into multiple subspaces, the method being executed by the data party, the method comprising: The querying party receives a query request for querying statistical data, including indication information for indicating the target partition, which is the partition to which the target sampling area to be queried belongs, determined from the plurality of partitions; Based on the identifiers of the N subspaces included in the target partition, the querying party, based on the identifiers of the target subspaces, jointly executes an N-choose-1 unintentional transmission (OT) protocol, enabling the querying party to obtain target return data. The target return data includes statistical data of the sampling area within the target subspace, and the target subspace is the subspace to which the target sampling area belongs, determined from the target partition.

10. The method according to claim 9, wherein, The step of jointly executing an N-choose-1 OT protocol based on the identifiers of the N subspaces included in the target partition and the identifiers of the target subspaces by the querying party includes: The querying party receives a first ciphertext, which is obtained by encrypting the identifier of the target subspace using a first key of a commutative encryption algorithm. The first ciphertext is encrypted using the second key of the interchangeable encryption algorithm to obtain the second ciphertext; The querying party sends the second ciphertext and N ciphertexts, wherein any j-th ciphertext is obtained by encrypting the j-th returned data using the j-th symmetric key. The j-th returned data includes statistical data of the sampling region within the j-th subspace. The j-th symmetric key is obtained by encrypting the identifier of the j-th subspace using the second key of the exchangeable encryption algorithm. The querying party decrypts the second ciphertext using the decryption key corresponding to the first key to obtain the third ciphertext, and uses the third ciphertext as the decryption key to decrypt the ciphertext corresponding to the target subspace among the N ciphertexts to obtain the target returned data.

11. The method according to claim 10, wherein if the j-th subspace includes at least two sampling regions, the j-th returned data includes the location information of the at least two sampling regions and their respective corresponding statistical data.

12. A privacy-preserving data query device, involving a querying party and a data party, wherein the data party holds multiple statistical data from multiple sampling areas distributed within a geographic space, the geographic space being divided into multiple partitions, each partition being further divided into multiple subspaces, the device being deployed on the querying party, the device comprising: The spatial determination unit is configured to determine the target partition to which the target sampling area to be queried belongs from the plurality of partitions, and to determine the target subspace to which the target sampling area belongs from the target partition; The request sending unit is configured to send a query request for querying statistical data to the data party, including indication information for indicating the target partition; A secure communication unit is configured to, based on the identifier of the target subspace, jointly execute an N-choose-1 unintentional transmission (OT) protocol with the data party based on the identifiers of the N subspaces included in the target partition, to obtain target return data, wherein the target return data includes statistical data of the sampling area within the target subspace.

13. A privacy-preserving data query device, involving a querying party and a data party, wherein the data party holds multiple statistical data points distributed across multiple sampling areas in a geographic space, the geographic space being divided into multiple partitions, each partition being further divided into multiple subspaces, the device being deployed on the data party, the device comprising: The request receiving unit is configured to receive a query request for querying statistical data from the querying party, including indication information for indicating the target partition, wherein the target partition is the partition to which the target sampling area to be queried belongs, determined from the plurality of partitions; A secure communication unit is configured to, based on the identifiers of the N subspaces included in the target partition, jointly execute an N-choose-1 unintentional transmission (OT) protocol with the querying party based on the identifiers of the target subspaces, so that the querying party obtains target return data. The target return data includes statistical data of the sampling area within the target subspace, and the target subspace is the subspace to which the target sampling area belongs, determined from the target partition.

14. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method of any one of claims 6-11.

15. A computer-readable storage medium having a computer program stored thereon, wherein when executed in a computing device, the computing device implements the method of any one of claims 6-11.

Images