Data query method and device

Abstract

This specification discloses a data query method and apparatus. The method includes: obtaining an SQL statement whose select part consists only of Boolean expressions, and determining a subquery statement targeting a single sensitive attribute based on several sensitive attributes located in a real data table. Then, each subquery statement is treated as a target statement and the following processing is performed: obtaining a target virtual table, whose corresponding target field value set is sampled from the target sensitive attribute fields in the real data table; determining multiple subsets of target field values ​​whose union is the target field value set based on the result matrix obtained by executing the target statement on the target virtual table; determining the target count of the target sensitive attribute field on each field value in each subset of target field values. Next, based on the multiple subsets of target field values ​​and the target count, determining a quantitative data leakage indicator value corresponding to the target statement to determine whether to provide the user with the query results of the SQL statement on the real data table.

Description

Technical Field

[0001] This specification relates to the field of computer technology, and more particularly to a data query method and apparatus, a computer-readable storage medium, and a computing device. Background Technology

[0002] With the advancement of big data technology, the value of data is increasing. To improve data utilization, many database providers are considering opening up access to custom Structured Query Language (SQL) queries in controlled environments. These SQL queries consist only of Boolean expressions. The risks associated with these Boolean-based SQL queries are manageable.

[0003] However, these SQL queries still pose a risk of excessive information leakage, and currently there is no technology available to detect such information leakage. Against this backdrop, this specification innovatively proposes an information leakage detection scheme for this type of SQL query. The detection results can be used to assist in deciding whether to provide SQL query results to external parties. Summary of the Invention

[0004] This specification describes a data query method and apparatus that can quantify data leakage in SQL statements consisting only of Boolean expressions.

[0005] According to the first aspect, a data query method is provided, including:

[0006] Obtain the SQL statement to be processed, where the select clause includes n Boolean expressions. Based on the k sensitive attributes located in the real data table involved in the n Boolean expressions, the SQL statement is converted into several subqueries, where all Boolean expressions in a single subquery contain the same sensitive attribute. Each subquery is treated as a target statement and the following processing is performed: Obtain the target virtual table corresponding to the target sensitive attribute in the target statement, where the target field value set is sampled from the target sensitive attribute fields in the real data table; based on the result matrix obtained by executing the target statement on the target virtual table, determine multiple subsets of target field values ​​whose union is the target field value set; determine the target count of the target sensitive attribute field on each field value in each subset of target field values. Based on the multiple subsets of target field values ​​and the target count, determine the quantitative data leakage indicator value corresponding to the target statement. Based on the indicator values ​​corresponding to the several subqueries, determine whether to provide the user with the query results of the SQL statement on the real data table.

[0007] In one embodiment, obtaining the SQL statement to be processed includes: receiving the SQL statement input by the user, and if it is determined that all expressions in the select clause are of Boolean type, using the SQL statement input by the user as the SQL statement to be processed.

[0008] In one embodiment, the SQL statement is converted into several subquery statements based on the k sensitive attributes located in the real data table involved in the n Boolean expressions, including: for any first sensitive attribute among the k sensitive attributes, determining several Boolean expressions among the n Boolean expressions that include the first sensitive attribute; and determining a first subquery statement corresponding to the first sensitive attribute based on the several Boolean expressions.

[0009] In one specific embodiment, the SQL statement includes a WHERE clause; wherein, determining the first subquery statement corresponding to the first sensitive attribute based on the plurality of Boolean expressions includes: when the first Boolean expression in the WHERE clause contains the first sensitive attribute, performing a logical AND combination of the first Boolean expression with each of the plurality of Boolean expressions to obtain an updated plurality of Boolean expressions; and constructing the first subquery statement by using the updated plurality of Boolean expressions as a SELECT query expression.

[0010] In another specific embodiment, the SQL statement includes a WHERE clause; wherein, determining the first subquery statement corresponding to the first sensitive attribute based on the plurality of Boolean expressions includes: if the second Boolean expression in the WHERE clause contains a second sensitive attribute different from the first sensitive attribute, constructing the first subquery statement by using the plurality of Boolean expressions as a SELECT query expression. Converting the SQL statement into a plurality of subquery statements further includes: constructing a second subquery statement by using the second Boolean expression as a SELECT query expression.

[0011] In one embodiment, the select clause of the target statement includes l Boolean expressions; wherein, determining multiple subsets of target field values ​​whose union is the target field value set based on the result matrix obtained by executing the target statement on the target virtual table includes: for each of the l Boolean expressions, based on the column vector corresponding to it in the result matrix, selecting one field value in the target virtual table and assigning it to the set of true values ​​(true) and the set of false values ​​(false); obtaining the multiple subsets of target field values ​​by grouping and intersecting the set of true values ​​and the set of false values ​​corresponding to the l Boolean expressions.

[0012] In one embodiment, determining multiple subsets of target field values ​​whose union is a result matrix obtained by executing the target statement on the target virtual table includes: for each Boolean expression in the l Boolean expressions, determining the number of elements in the column vector corresponding to the expression in the result matrix that indicate the execution result is true; solving for multiple subsets of count values ​​by taking multiple count values ​​and the number of elements as subsets and arrays and sums in the problem SSP; the multiple count values ​​include the count values ​​of all field values ​​in the target virtual table on each field value in the target field value set; and determining the multiple subsets of target field values ​​based on the multiple subsets of count values.

[0013] In one specific embodiment, the target field value set includes multiple field values; wherein, the construction of the target virtual table includes: sampling the multiple field values ​​from the target sensitive attribute fields, and setting multiple count values ​​accordingly, wherein any two subsets of the multiple count values ​​have different sum values; for each field value among the multiple field values, copying it a corresponding number of times according to its corresponding count value and then filling it into the target virtual table. Wherein, determining the multiple target field value subsets based on the multiple count value subsets includes: determining the field values ​​corresponding to the count values ​​in each count value subset based on the mapping relationship between the multiple count values ​​and the multiple field values, forming an initial field value subset; determining the multiple target field value subsets based on the multiple initial field value subsets corresponding to the multiple count value subsets.

[0014] Furthermore, in one example, determining the multiple target field value subsets based on the multiple initial field value subsets corresponding to the multiple count value subsets includes: determining multiple field value complements corresponding to the multiple initial field value subsets based on the target field value set; exhaustively finding the intersection of the multiple initial field subsets and the multiple field value complements, and using the final result obtained from the intersection as the multiple target field value subsets.

[0015] In one embodiment, determining multiple subsets of target field values ​​whose union is the target field value set, based on the result matrix obtained by executing the target statement on the target virtual table, includes:

[0016] The l Boolean expressions are divided into multiple groups of Boolean expressions, and multiple subsets of count values ​​corresponding to each group of Boolean expressions are determined. Specifically, this includes: for each Boolean expression in each group of Boolean expressions, based on the corresponding column vector in the result matrix, determining the number of elements in the column vector indicating that the execution result is true; using the multiple count values ​​and the number of elements as subsets and the array and sum value in the problem SSP, solving for multiple subsets of count values; the multiple count values ​​include the count values ​​of all field values ​​in the target virtual table for each field value in the target field value set. Based on the multiple subsets of count values, the multiple subsets of target field values ​​are determined.

[0017] In one embodiment, determining the target count of the target sensitive attribute field for each field value in each subset of target field values ​​includes: determining the target count based on the result matrix obtained by executing the target statement on the real data table.

[0018] In one embodiment, determining the quantitative data leakage index value corresponding to the target statement based on the plurality of target field value subsets and target counts includes: calculating a first preset index to measure the percentage of data leakage based on the plurality of target field value subsets and target counts, as well as the prior distribution estimated by the user for the target sensitive attributes.

[0019] In one specific embodiment, the calculation of the first preset index includes: correcting the prior distribution using the subset of the plurality of target field values ​​and the target count to obtain a corrected distribution; and calculating the index value of the first preset index based on the prior distribution and the corrected distribution.

[0020] Furthermore, in one example, the calculation of the first preset indicator is also based on the actual distribution corresponding to the target sensitive attribute field.

[0021] In another example, the formula for calculating the first preset index is designed based on information gain or JS divergence.

[0022] In one embodiment, determining the quantitative data leakage index value corresponding to the target statement based on the plurality of target field value subsets and target counts includes: calculating a second preset index to measure the amount of residual data information based on the plurality of target field value subsets and target counts.

[0023] In one specific embodiment, the calculation of the second preset index includes: correcting the prior distribution using the subset of the multiple target field values ​​and the target count to obtain a corrected distribution; and calculating the index value of the second preset index based on the prior distribution and the corrected portion.

[0024] Furthermore, in one example, the formula for calculating the second predefined index is designed based on conditional entropy, expectation, or variance.

[0025] In one embodiment, the prior distribution is a uniform distribution, a distribution determined based on a random array, or a true distribution consistent with the data distribution of the target sensitive attribute field.

[0026] In one embodiment, determining whether to provide the user with the query results of the SQL statement on the real data table based on the indicator values ​​corresponding to the plurality of sub-query statements includes: adding differential privacy noise to the indicator values ​​to obtain corresponding noisy indicator values; comparing the noisy indicator values ​​with the corresponding indicator thresholds; and determining whether to provide the user with the query results based on the comparison results.

[0027] According to the second aspect, a data query device is provided, comprising:

[0028] The statement acquisition module is configured to acquire an SQL statement to be processed, wherein the select clause includes n Boolean expressions. The statement conversion module is configured to convert the SQL statement into several subquery statements based on k sensitive attributes located in the real data table involved in the n Boolean expressions, where all Boolean expressions in a single subquery statement contain the same sensitive attribute. The statement processing module is configured to perform target processing on each subquery statement as a target statement; the statement processing module includes the following units for performing the target processing: a virtual table acquisition unit, configured to acquire a target virtual table corresponding to the target sensitive attribute in the target statement, wherein the corresponding target field value set is sampled from the target sensitive attribute fields in the real data table; a subset determination unit, configured to determine multiple target field value subsets whose union is the target field value set based on the result matrix obtained by executing the target statement on the target virtual table; and a count determination unit, configured to determine the target count of the target sensitive attribute field on each field value in each target field value subset. The indicator value determination module is configured to determine the quantitative data leakage indicator value corresponding to the target statement based on the multiple target field value subsets and the target count. The feedback decision module is configured to determine whether to provide the user with the query results of the SQL statement on the real data table based on the indicator values ​​corresponding to the several sub-query statements.

[0029] According to a third aspect, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method provided in the first aspect.

[0030] According to a fourth aspect, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method provided in the first aspect.

[0031] By using the data query method and apparatus disclosed in the embodiments of this specification, it is possible to ensure that SQL BEAQ queries with information leakage exceeding a threshold are rejected, thereby allowing the database provider to confidently grant users the permission to write their own BEAQs to obtain partial information. Attached Figure Description

[0032] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0033] Figure 1 Example diagram of SQL Boolean array query;

[0034] Figure 2 This diagram illustrates the implementation framework of the data query method disclosed in the embodiments of this specification.

[0035] Figure 3 This diagram illustrates a data query method flowchart disclosed in an embodiment of this specification.

[0036] Figure 4 This diagram illustrates the structure of the data query device disclosed in the embodiments of this specification. Detailed Implementation

[0037] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0038] As mentioned earlier, many database providers are considering allowing access to custom SQL queries in controlled environments. Specifically, this involves restricting the select portion of custom SQL statements to include only Boolean expressions (BE). The result of such special SQL queries is a Boolean matrix, thus mitigating the associated risks.

[0039] This article refers to this special type of SQL as a Boolean expression array query (BEAQ). The structure of an SQL BEAQ statement is as follows:

[0040] Select BE1,BE2,BE3,…,BE n from table_name[where-clause].

[0041] The `where-clause` directive indicates the `where` clause, which is optional. Executing SQL BEAQ on a database will return an `m` x `n` Boolean matrix, where `m` represents the number of data entries filtered by the SQL statement, and `n` is the number of Boolean expressions. Values ​​in the Boolean matrix are either true or false. For example... Figure 1 The data table shown contains three data entries, d0, d1, and d2. By executing the following BEAQ query on this data table: `select a<5,a<15,a<25 from table_name`, the following Boolean matrix can be obtained:

[0042]

[0043] In equation (1), T represents true and F represents false.

[0044] In SQL BEAQ, each Boolean expression categorizes a data entry into one of two intervals: the true interval when the execution result is true and the false interval when the execution result is false. Figure 1 V is adopted in China i Represents the i-th Boolean expression BE i The truth interval of the value is adopted. Indicates BE i The interval of false values, for example, V0 = {a|a < 5}. Data entry d0 is classified into interval V0.

[0045] As shown above, by defining multiple Boolean expressions in the select section of SQL Beaq, users can determine the range of sensitive attribute values ​​for a row of data that it falls within the range of multiple intervals to which it is categorized (see [link to SQL Beaq] for more details). Figure 1 The analysis results also reveal the shape of the bar chart distribution of the data in the table.

[0046] However, different BEAQ queries reveal different amounts of information. Malicious actors may design complex and sophisticated Boolean expressions in BEAQ to narrow down the sensitive attribute values ​​of a row of data to a very narrow range, and even know the actual values ​​by combining some prior information (such as the value range).

[0047] Based on the above observations and analysis, this specification discloses a data query scheme that can ensure the filtering out of SQL BEAQs with information leakage exceeding a threshold, thereby allowing the database provider to confidently grant users the permission to write their own BEAQs to obtain partial information.

[0048] Figure 2 This diagram illustrates the implementation framework of the data query method disclosed in the embodiments of this specification. Figure 2 As shown, the implementation framework includes an input layer, a preprocessing layer, a semantic analysis layer, an information leakage measurement layer, and a post-processing layer. The input layer obtains user-defined SQL statements; the preprocessing layer filters out SQL BEAQ statements and converts them into subqueries targeting different sensitive attributes; the semantic analysis layer uses reverse engineering to perform simulated semantic analysis on the subqueries; the information leakage measurement layer measures the amount of information leaked by the SQL BEAQ statements based on the semantic analysis results; and the post-processing layer decides whether to allow or deny user-initiated custom SQL queries based on the information leakage measurement results.

[0049] The following describes the specific implementation steps under the above implementation framework, using more examples. Figure 3 This diagram illustrates a data query method flowchart disclosed in an embodiment of this specification. The execution entity of the method can be any device, platform, server, or device cluster with computing and processing capabilities. Figure 3 As shown, the method includes the following steps:

[0050] Step S310: Obtain the first SQL statement to be processed, where the select clause includes n Boolean expressions. It should be noted that the "first" in "first SQL statement," as well as similar terms such as "first," "second," etc., used elsewhere in the text, are for distinguishing similar items and do not have any sorting or other limiting function; in addition, n is a natural number, and in most cases n≥2.

[0051] In one implementation, the system receives a user-input SQL statement. If it determines that all expressions in the select clause of the SQL statement are of Boolean type, then the SQL statement is used as the first SQL statement. This allows for the filtering out of non-BEAQ statements. Furthermore, for non-BEAQ type queries, due to their uncontrollable risk, the corresponding query requests can be directly rejected.

[0052] In another implementation, the front end restricts users to write only Boolean expressions in the select section, so that the SQL statement submitted by the user can be directly used as the first SQL statement mentioned above.

[0053] For example, the first SQL statement obtained is: select a+b<3,b>7,a<5from table_a.

[0054] The above allows us to obtain the first SQL statement to be processed.

[0055] Step S320: Based on the k sensitive attributes located in the real data table involved in the n Boolean expressions in the first SQL statement, the first SQL statement is converted into several subquery statements. All Boolean expressions in a single subquery statement contain the same sensitive attribute. It should be understood that the real data table is the original business data table in the database, which is also the data table the user intends to query; k is a natural number, and in most cases k≥2; furthermore, "several subquery statements," as well as "several" elsewhere in the text, refers to one or more.

[0056] The aforementioned real data table contains multiple attribute fields (such as cost, registration time, or annual turnover) related to business objects (such as products, registered users, or enterprises). Which of these fields are considered sensitive attributes can be pre-defined by staff. In one implementation, it can be first determined whether any of the n Boolean expressions involve sensitive attributes. If so, this step is executed; otherwise, since there is no leakage of sensitive information, the SQL query can be directly executed and the query results provided to the user. In another implementation, it is assumed that all fields in the real data table are sensitive attributes, thus it can be assumed that Boolean expressions necessarily include sensitive attributes.

[0057] This step may include: for any first sensitive attribute among the k sensitive attributes, removing Boolean expressions that do not contain that first sensitive attribute from the select clause of the first SQL statement, thereby obtaining the corresponding subquery statement. Thus, k subquery statements corresponding to the k sensitive attributes can be obtained.

[0058] Furthermore, in one implementation, k subquery statements can be directly used as the transformed subquery statements. For example, assuming the first SQL statement is: `select a+b<3,b>7,a<5from table_ex`, which includes two sensitive attributes `a` and `b`, the following two subquery statements can be obtained:

[0059] BEAQ(a):select a+b<3,a<5from table_ex

[0060] BEAQ(b):select a+b<3,b>7from table_ex

[0061] In another implementation, considering that the first SQL statement includes a WHERE clause, the Boolean expression in the WHERE clause may contain sensitive attributes. In this case, in order to improve the accuracy of subsequent information leakage calculations, the above k subquery statements can be rewritten based on the WHERE clause to obtain the final subquery statements.

[0062] In one embodiment, if the WHERE clause does not contain sensitive attributes, there is no need to rewrite the k subqueries; instead, the k subqueries can be directly used as the final set of subqueries.

[0063] In another embodiment, when the WHERE clause contains sensitive attributes, the following processing is performed on each of the k subqueries:

[0064] 1) If the WHERE clause contains a first Boolean expression whose sensitive attribute is the same as that of the current subquery, then the first Boolean expression is logically ANDed with each Boolean expression in the current subquery to obtain the updated subquery corresponding to the current subquery. It should be understood that the first Boolean expression can be one or more.

[0065] For example, suppose the above k subqueries include the following subquery for sensitive attribute a:

[0066] BEAQ(a):select a+b<3,a<5from table_a where a>0

[0067] Because the Boolean expression a > 0 in the WHERE clause contains the sensitive attribute a, BEAQ(a) can be rewritten as:

[0068] BEAQ(a):select a+b<3AND a>0,a<5AND a>0from table_a where a>0

[0069] 2) If the WHERE clause contains a second Boolean expression whose sensitive attributes are different from those of the current subquery, then while retaining the current subquery, a new subquery is created by using the second Boolean expression as the SELECT query expression. The original WHERE clause is then used in the new subquery, which is then classified into the aforementioned subqueries.

[0070] For example, suppose the above k subqueries include the following subquery for sensitive attribute b:

[0071] BEAQ(b):select a+b<3,b>7from table_a where a>0

[0072] Since the Boolean expression 'a > 0' in the WHERE clause does not include the sensitive attribute 'b', a new subquery can be created:

[0073] select a>0from table_a where a>0

[0074] Thus, by rewriting BEAQ based on the WHERE clause, the sensitive attributes of the WHERE clause can be taken into account when quantifying information leakage.

[0075] The above can convert the first SQL statement into several subquery statements.

[0076] Step S330: Each subquery statement in the several subquery statements is treated as a target statement and the target processing is performed, thereby obtaining the triples corresponding to each subquery statement: (sensitive attribute, subset of multiple field values, count of the actual data on the subset).

[0077] To make it easier to understand, let me first introduce the design concept of this step.

[0078] Assuming 'a' is a sensitive attribute that needs protection, and it is an integer, in the actual data table, the minimum value of 'a' is 0 and the maximum value is 99. As mentioned above, any Boolean expression in the select part will divide the value range of 'a' into the true range and the false range.

[0079] Note that the information leaked by different intervals is not the same. For example, there are four BEs for the sensitive attribute 'a': BE1: a < 50, BE2: a < 10, BE3: a < 10000, and BE4: a < 200. The results of BE1 and BE2 will tell the user that some data satisfies the expression, while other data does not, but the size of this interval is different. The results of BE3 and BE4 will tell the user that all data satisfies the expression, but the information received by the user is also different.

[0080] Based on this, a method for quantifying the intervals of a single Boolean expression is proposed to quantify the information leaked by the BE (Block Array). To address how to quantify the intervals of a single Boolean expression, this problem is abstracted into a problem of guessing the distribution of balls and buckets, as explained below.

[0081] Assume there are p balls and q buckets (q ≤ p). Each ball represents a row of data, and each bucket represents one of the different values ​​of the sensitive attribute. Although the actual possible values ​​of the sensitive attribute may be infinite, it is still categorized into the bucket closest to it (for numerical data). For non-numerical data, the number of buckets is assumed to be consistent with the number of possible values. It can be known that each bucket contains at least one ball, but the exact number of balls in each bucket will be unknown to the user.

[0082] The significance of this quantification lies in the fact that, since each bucket represents a value taken from real data, it has statistical value. Therefore, the true value interval and the false value interval will not be an infinite range, but rather a quantifiable set.

[0083] For any given BE, the user will know that the value of the row of data they are interested in will definitely fall within the interval V. One of them, where the V interval is quantized as a set including t1 buckets, The interval is quantized as a set including t2 buckets. Clearly, the fewer the number of buckets, the narrower and more precise the interval. Assume that the interval V contains only one bucket, and... There are 99 buckets in the interval. If the value 'a' is assigned to interval V, then the user will receive sufficiently accurate information about the value 'a', and may even receive all the information about the value 'a' of that row of data.

[0084] As described above, by sampling and abstracting the values ​​taken from real data into buckets, Boolean expressions can be fully quantized. In practice, in Boolean array query BEAQ statements, there are often multiple Boolean expressions containing the same sensitive attribute. In this case, the intervals generated by the multiple Boolean expressions may overlap or coincide, requiring the 2k intervals generated by the k Boolean expressions to be quantized. k Each interval is reduced to a set of intervals with minimal overlap and preferably mutual exclusion, and each interval is quantized into a set of buckets.

[0085] To obtain a set of buckets corresponding to a set of intervals, a forward decoding approach is proposed for the Boolean expressions in BEAQ. However, since BEAQ is user-written, users can encode the range they want to query into a very complex Boolean expression, making it very difficult for the system to decode this Boolean expression to obtain its result range by writing a forward compiler. Therefore, a reverse engineering approach is proposed: executing BEAQ on the data table and determining the result range of the Boolean expression based on the returned execution result.

[0086] In one implementation, interval quantization can be performed based on the results of executing BEAQ on a real data table. However, in many business scenarios, the amount of data in the real data table is often enormous, with real samples potentially reaching millions or even tens of millions of units. This presents a significant computational challenge for interval quantization based on the execution results.

[0087] Therefore, another implementation method is proposed: constructing a virtual data table based on the sensitive attribute field values ​​sampled from the real data table. This effectively reduces the computational load while ensuring the high availability of the quantification results. It should be understood that different virtual tables need to be constructed for different sensitive attributes.

[0088] In addition, determining the set of buckets corresponding to a certain sensitive attribute in a BEAQ statement actually determines the buckets in each interval. However, the amount of information leaked varies depending on the number of balls (which correspond to data rows in the actual data table) in each bucket. Therefore, it is necessary to further determine the count of the actual sensitive attribute values ​​corresponding to each interval (or each set of buckets).

[0089] To recap the triple mentioned earlier: (sensitive attribute, multiple field value subsets, count of real data in the subsets), where multiple field value subsets correspond to the aforementioned set of intervals and set of buckets, with 1 field value equivalent to 1 bucket; the count of real data in the field value subsets corresponds to the count of real sensitive attribute values ​​in each interval.

[0090] The design concept of this step has been introduced above. Next, the implementation process of this step will be introduced. The target processing in this step includes the execution of the following sub-steps S331, S332 and S333.

[0091] Step S331: Obtain the target virtual table corresponding to the target sensitive attribute in the target statement. The target field value set corresponding to it is sampled from the target sensitive attribute field in the real data table.

[0092] It is understandable that different sensitive attributes each have their own corresponding virtual tables. The following section uses any first sensitive attribute as an example to illustrate how its corresponding first virtual table is constructed.

[0093] In one possible construction approach, all distinct field values ​​can be extracted from the field corresponding to the first sensitive attribute in the real data table. Then, the total number of distinct field values ​​is determined, and if this total number is less than or equal to a corresponding preset threshold, a pre-selected set of field values ​​is formed using all distinct field values. Otherwise, the pre-selected set of field values ​​can be formed using the results of sampling all distinct field values. For example, the sampling can be random sampling or stratified sampling, etc.

[0094] Furthermore, each field value from the pre-selected set of field values ​​can be individually populated into the first virtual table. In one embodiment, each field value is populated only once. For example, the virtual table constructed for sensitive attribute 'a' is Table 1 below. It should be understood that the virtual tables constructed in actual business scenarios are generally more complex.

[0095] Table 1

[0096]

[0097] In another possible construction method, the field corresponding to the first sensitive attribute is extracted from the real data table, and the field values ​​are deduplicated to obtain the first virtual table.

[0098] The above describes the construction process of any virtual table, from which virtual tables corresponding to different sensitivity attributes can be obtained. Accordingly, in this step, a pre-constructed target virtual table can be directly read based on the target sensitivity attribute, or the target virtual table can be constructed based on the target sensitivity attribute.

[0099] Step S332: Based on the result matrix obtained by executing the target statement on the target virtual table, determine multiple subsets of target field values ​​whose union is the target field value set.

[0100] Let's denote the number of Boolean expressions included in the SELECT clause of the target statement as l. Correspondingly, the result matrix M includes l column vectors corresponding to the l Boolean expressions. For example, suppose the target statement is: SELECT a<10, a<20 FROM table_a, and the target virtual table is table1. Therefore, by executing the target statement on the target virtual table, we can obtain the following result matrix M, where T represents true and F represents false.

[0101]

[0102] The above provides an example of the resulting matrix M. Based on the resulting matrix M, subsets of multiple target field values ​​can be determined.

[0103] In one implementation, for each Boolean expression, first determine the bucket set for quantizing its true value range and the bucket set for quantizing its false value range, or simply the true value set and the false value set. Then, by grouping and intersecting all the true value combinations and false value sets, multiple subsets of target field values ​​are obtained.

[0104] Specifically, for any i-th Boolean expression among l Boolean expressions, based on the i-th column vector corresponding to it in the result matrix M, the field values ​​in the target virtual table are assigned to the set of true values ​​V for which the execution result is true. i and the set of false values ​​whose execution result is false. Therefore, we can obtain the set of truth values ​​and the set of false values ​​for each Boolean expression in the l Boolean expressions, denoted as:

[0105]

[0106] For example, based on the result matrix M shown in equation (2), the following set of true and false values ​​can be obtained:

[0107]

[0108] Furthermore, by grouping and intersecting the sets of true and false values ​​corresponding to the l Boolean expressions, multiple subsets of target field values ​​are obtained. In a specific embodiment, the sets of true and false values ​​corresponding to each of the l Boolean expressions can be selected and combined to obtain 2 l The sets are then intersected within each set. After removing the empty set from the intersection result, multiple subsets of target field values ​​are obtained. In one example, based on the true and false value sets shown in equation (4), four sets can be obtained, namely: (V0, V1), and After performing the intersection of the sets within the group, we can obtain multiple subsets of the target field values: {3,7} and {19}.

[0109] It should be noted that other grouping methods can also be used. For example, based on the 2l true and false value sets corresponding to l Boolean expressions, l sets can be extracted as a group, and multiple groups can be obtained by exhaustive extraction.

[0110] In another embodiment, the problem of finding multiple subsets of target field values ​​based on the result matrix M can be transformed into a subset sum problem (SSP).

[0111] Generally, the Single-Sum Parallel Probability (SSP) problem involves finding a subset x of set A, given a set of positive numbers A and a number w, such that the sum of all elements in x equals w. Clearly, the SSP problem involves three core elements: a set, a subset, and a sum. The set and the sum are the inputs to the SSP problem, and the subset is the output. Furthermore, the set of positive numbers A and the subset x in the SSP problem can also be arrays. Unlike sets, arrays can contain duplicate elements.

[0112] Based on this, in the current scenario of solving for multiple subsets of target field values, the determination of the input for the SSP problem includes:

[0113] i) For each target field value in the above target field value set, determine the count value of the sensitive attribute value in the target virtual table on the target field value, and then use all the obtained count values ​​as an array in the SSP problem.

[0114] ii) For any i-th Boolean expression among l Boolean expressions, based on the i-th column vector corresponding to it in the result matrix M, determine the number of elements in the i-th column vector that indicate the execution result is true, and then use the obtained l element counts as l sum values.

[0115] Based on i) and ii), multiple subsets of count values ​​can be solved to determine multiple subsets of target field values.

[0116] Note that the SSP problem may have multiple solutions. The SSP problem can be optimized into a subset sumdistinct (SSD) problem. The sets in the SSD problem have a special property: the sums of all subsets of the set are distinct. Therefore, the SSD problem has at most one solution or no solution.

[0117] In the current scenario of solving for a subset of multiple target field values, determining the input for the SSD problem includes:

[0118] (i′) Obtain multiple manually set count values, where any two subsets of these count values ​​have different sums. For example, the j-th count value is 2. j , where j is a non-negative integer. Therefore, these multiple count values ​​are used as an array in the SSD problem.

[0119] Comparing i′) and i), it can be found that the multiple count values ​​also need to be count values ​​of the target field value. Therefore, it can be deduced that in the embodiments disclosed in this specification, the aforementioned construction of any virtual table includes: for each field value in the pre-selected set of field values, based on the count value corresponding to that field value from a set of manually set count values, copying the field value a corresponding number of times and filling it into the virtual table. For example, the pre-selected set of field values ​​is {3,7,19}, and the multiple count values ​​are 2. 0 2 1 2 2 Therefore, the following virtual table can be obtained:

[0120] Table 2

[0121]

[0122] The above describes the multiple count values ​​included in the SSD problem input.

[0123] ii′) is the same as the content in ii) above.

[0124] Based on i′) and ii′), multiple subsets of count values ​​can be solved to determine multiple subsets of target field values.

[0125] On the other hand, since the SSP is a problem that cannot be solved exactly in polynomial time, a constraint is proposed to limit the complexity of the SSP to exponential level. The design strategy is to decompose the SSP problem into multiple subproblems by dividing the value range into multiple disjoint intervals, then solving the SSP for each interval, and finally taking the union of the results.

[0126] The implementation of the above strategy includes: first, dividing the above l Boolean expressions into multiple groups of Boolean expressions, and then determining multiple subsets of count values ​​corresponding to each group of Boolean expressions. It should be noted that any two groups of Boolean expressions have no overlap; in addition, the method for determining multiple subsets of count values ​​corresponding to a group of Boolean expressions can be found in the aforementioned i), ii), or i′), ii′).

[0127] The above methods, by solving the SSP problem (including the SSD problem), yield multiple subsets of output count values. The following section introduces a method for determining multiple subsets of target field values ​​based on these subsets of count values.

[0128] First, for each subset of count values ​​in the multiple subsets of count values, based on the mapping relationship between count values ​​and field values, the field values ​​corresponding to each count value in the subset of count values ​​are determined to form an initial subset of field values.

[0129] Then, based on the multiple initial field value subsets corresponding to the multiple count value subsets, multiple target field value subsets are determined. It should be understood that in solving the SSP problem above, the sum used is the count of true values. Therefore, the multiple initial field value subsets belong to the set of true values ​​whose execution result is true. By taking the complement of these subsets, the corresponding set of false values ​​can be obtained.

[0130] Specifically, based on the target field value set mentioned above, multiple field value complements corresponding to multiple initial field value subsets are determined. It can be understood that the sum of each initial field value subset and its corresponding field value complement equals the target field value set.

[0131] Furthermore, in one embodiment, multiple initial field value subsets and multiple field value complements can be used together as multiple target field value subsets.

[0132] In another embodiment, considering that multiple initial field subsets and multiple field complements may have correlations—for example, the intersection between a certain initial field subset and a certain field complement may not be empty—this will affect the accuracy of subsequent information leakage index calculations. Therefore, a method for pruning multiple initial field value subsets and multiple field value complements is proposed.

[0133] Specifically, an exhaustive intersection can be performed on multiple initial field subsets and multiple field value complements, and the final result obtained from the intersection can be used as multiple target field value subsets.

[0134] Based on the result matrix obtained by executing the target statement on the target virtual table, multiple subsets of target field values ​​whose union is the target field value set can be determined.

[0135] Step S333: Determine the target sensitive attribute field in the real data table, and the target count for each field value in each subset of target field values.

[0136] In one embodiment, the target count can be determined directly through statistical methods. In another embodiment, the target count can also be determined based on the result matrix obtained by executing the target statement on a real data table.

[0137] The above steps S331, S332, and S333 achieve target processing of the target statement, thereby obtaining the target triplet corresponding to the target statement, which can be denoted as:

[0138] (Target sensitive attribute, multiple subsets of target field values, count of actual data on the subsets of target field values)

[0139] Step S340: Determine the quantitative data leakage index value corresponding to the target statement based on multiple subsets of target field values ​​and the target count.

[0140] This step proposes two perspectives for measuring data leakage: the percentage of data leakage and the amount of residual information. Different metrics are used for each perspective. It's understood that these two perspectives can be used individually or simultaneously.

[0141] First, let's introduce the percentage perspective of data breaches. To measure the percentage of data breaches, the following three items need to be calculated:

[0142] (1) The initial amount of information the user has about the real data before executing the target statement.

[0143] (2) The amount of corrected information the user has about the real data after executing the target statement.

[0144] (3) The percentage of information leakage.

[0145] The calculations for the above three items require prior knowledge (or prior distribution), i.e., the user's guess about the distribution of the sensitive attribute. However, in reality, it's difficult for staff to know how users guess the distribution of the sensitive attribute. Therefore, it's proposed to use a uniform distribution, a distribution determined based on a random array, or a true distribution consistent with the data distribution of the target sensitive attribute field. It's important to understand that the set of values ​​for the variable in the prior distribution can be set to match the set of values ​​for the field corresponding to the target sensitive attribute field. Let's denote the variable corresponding to the target sensitive attribute as X, and its i-th value as x. i Therefore, the prior distribution can be denoted as: P(X=x i ) = p i , where p i This indicates that a row of data in the actual data table contains a target sensitive attribute field with a value of x. i The probability of.

[0146] In one embodiment, a first metric based on information gain design can be used to measure the percentage of data leakage.

[0147] Specifically, in information theory, the above three terms are: the information entropy before executing the target statement, the conditional entropy after executing the target statement, and the ratio of information gain to information entropy. See formulas (5), (6), and (7) below for corresponding details.

[0148] H(X)=∑ i＝1 -P(x i log2 P(x) i )*m (5)

[0149] H(X|Y)=∑ x∈x ∑ y∈Y P(x, y)logP(x|y) (6)

[0150] G(X,Y) / H(X)=(H(X)-H(X|Y)) / H(X) (7)

[0151] In formulas (5), (6), and (7), m represents the number of data rows in the actual data table, and condition Y represents the user's known execution result of the target statement on the actual data table, or in other words, the known target triplet. It can be understood that the execution result can help the user correct their prior knowledge. P(x, y) and P(x|y) in formula (6) can be calculated based on the prior distribution and the triplet.

[0152] For example, assume:

[0153] The target statement is: select a<5, a<15, a<25 from table_a

[0154] The prior distributions are: P(x1) = 0.2, P(x2) = 0.4, P(x3) = 0.4

[0155] The result matrix after executing the target statement on the actual data table is as follows:

[0156]

[0157] At this point, for the first row of data in the real data table, the user corrects the prior distribution to: P(x1) = 1, P(x2) = 0, P(x3) = 0. Similarly, the user can correct the prior knowledge for other rows in the real data table. Based on this, the following calculations can be performed using the above formulas (5), (6), and (7):

[0158] H(X)=-(0.2*log2 0.2+0.4*log2 0.4+0.4*log2 0.4)*3=4.5657

[0159] H(X|Y)=H(X1|Y1)+H(X2|Y2)+H(X3|Y3)

[0160] H(X1|Y1)=-(1*log2 1+0*log2 0+0*log2 0)=0

[0161] H(X2|Y2)=-(0*log2 0+1*log2 1+0*log2 0)=0

[0162] H(X3|Y3)=-(0*log2 0+0*log2 0+1*log2 1)=0

[0163] H(X|Y)=0

[0164] G(X,Y)=H(X)-H(X|Y)=4.5657

[0165]

[0166] In this example, the data breach percentage reached 100%.

[0167] The above introduction uses the first metric based on information gain design to measure the percentage of data leakage.

[0168] In another embodiment, a second metric based on JS divergence design can be used to measure the percentage of data leakage.

[0169] Specifically, regarding statistical distance, the aforementioned three calculation items are: the JS divergence before executing the target statement, the JS divergence after executing the target statement, and the percentage decrease in JS divergence before and after execution. The relevant calculation formulas include:

[0170] D KL (P||Q)=∑ i＝1 P(x i log2P(x) i ) / Q(x i (10)

[0171] M = (P + Q) / 2 (11)

[0172]

[0173] Furthermore, the reduction ratio of JS divergence before and after execution can be calculated: As a percentage of data breaches.

[0174] In formulas (10) and (11), P represents the prior distribution and Q represents the true distribution. In formula (12), P represents the modified distribution and Q represents the true distribution.

[0175] The above introduction quantifies data leakage from the perspective of data leakage percentage, including calculating the proportion of information gain and the reduction ratio of JS divergence.

[0176] The following section introduces how to quantify data leakage from the perspective of residual information content. This residual information content can be measured using metrics such as conditional entropy, expected value, and variance.

[0177] 1) Conditional entropy

[0178] From an information theory perspective, the conditional entropy after executing the target statement means how many bits of information the user needs to know all the information in the data. The conditional entropy can be calculated using the formula (6) above, which can be found in the relevant content mentioned above and will not be repeated here.

[0179] 2) Expectations

[0180] From a probabilistic perspective, the expected value of obtaining an exact result measures the probability that a user will obtain the final exact result after receiving the BEAQ query results. The expected value is calculated as follows: Let the variable value x... i The number of times a target sensitive attribute appears in the actual data table is denoted as q. i Let m be the number of all data entries in the actual data table. Based on this, first calculate x. i The frequency of occurrence in real data is represented by f. i =q i / m. In the user's prior knowledge, the target sensitivity attribute X takes the value x. i The probability is denoted as p i Therefore, the expected value of a user correctly guessing the value of X can be calculated as follows:

[0181] E(P X )=∑ i＝1 f i *p i (13)

[0182] Furthermore, two calculation methods are proposed. The first method assumes that the user has the most prior knowledge, that is, the user knows the true distribution of the data, i.e., p. i =f i ,at this time:

[0183] E(P X )=∑ i＝1 f i 2 (14)

[0184] The second approach considers that regardless of the user's prior knowledge or its accuracy, the user's expectation of guessing the exact value will never exceed f. iThe maximum value f in max ,at this time:

[0185] E(P X )=f max (15)

[0186] 3) Variance

[0187] From a statistical perspective, users know that a value falls within a certain range. However, due to different range definitions, some ranges, while containing many real samples, may be very narrow, with the values ​​of these real samples being very close. Whether a range is narrow can be measured not only by the number of samples within that range (i.e., the number of buckets in that interval) but also by the variance among these samples.

[0188] Because the values ​​of different samples vary significantly, normalization is required before calculating the variance. For each subset of target field values ​​within the aforementioned subsets of target field values, normalization can be achieved using the following formula:

[0189]

[0190]

[0191] In formulas (16) and (17), x i Let represent the i-th field value in the subset of target field values, u represent the mean of all field values ​​in the subset of target field values, and t represent the number of field values ​​in the subset of target field values.

[0192] The formula for calculating the variance corresponding to each subset of target field values ​​is:

[0193]

[0194] The above introduction quantifies data information leakage from the perspective of residual data information, including the calculation of indicators such as conditional entropy, expectation, and variance.

[0195] From the above, we can determine the quantitative data leakage indicator value corresponding to the target statement. Similarly, we can obtain the indicator value corresponding to each subquery statement within several subquery statements.

[0196] Step S350: Based on the indicator values ​​corresponding to several subquery statements, determine whether to provide the user with the query results of the first SQL statement on the actual data table. It should be understood that there can be one or more indicator values.

[0197] In one embodiment, each metric value can be compared with its corresponding threshold, and the result of the comparison can be used to determine whether to provide query results to the user. In a specific embodiment, all metric values ​​must meet the specified threshold before query results are provided to the user. Furthermore, in one example, for a metric measuring the percentage of data leakage, the metric value must be less than the corresponding threshold. In another example, for a metric measuring residual data information, the metric value must be greater than a predetermined threshold.

[0198] In another specific embodiment, the comparison results can be used to calculate a comprehensive score, such as assigning different weights to different indicators, and then determining whether to provide query results to the user based on the comprehensive score.

[0199] In another embodiment, to mitigate the threat of inference attacks, for example, users can infer the distribution of real data based on which SQL queries are allowed and which are denied. This involves adding noise that satisfies differential privacy (DP) to the indicator values ​​and then making a decision on whether to provide query results based on this noise.

[0200] Specifically, DP noise is first added to the index value to obtain the corresponding noisy index value. It should be understood that if there are multiple index values, DP noise is added to each index value; in addition, the DP noise can be Laplace noise or Gaussian noise, etc., that satisfy the differential privacy mechanism.

[0201] Then, the noise-adding metric value is compared with the corresponding metric threshold, and based on the comparison result, it is determined whether to provide the user with the query results of the first SQL statement. This can be referred to the relevant description in the foregoing embodiments, and will not be repeated here.

[0202] In summary, the data query scheme disclosed in the embodiments of this specification can ensure the rejection of SQL BEAQ queries with information leakage exceeding a threshold, thereby allowing database providers to confidently grant users the authority to write their own BEAQs to obtain partial information. Specifically: 1) It pioneered the quantitative analysis of information leakage in SQL Boolean expression array queries. 2) It uses semantic analysis based on reverse engineering to solve the problem of difficulty in forward analysis of the result range of Boolean expressions. 3) Through sampling, it effectively divides the infinite value range, allowing the true and false value ranges of a Boolean expression result range to be quantified as sets. 4) It proposes multiple indicators to effectively measure the amount of information leaked by SQL Boolean array queries.

[0203] Corresponding to the above data query method, the embodiments of this specification also disclose a data query device. Figure 4 This specification shows a schematic diagram of the data query device structure disclosed in an embodiment, wherein the data query device 400 shown includes:

[0204] The statement acquisition module 410 is configured to acquire SQL statements to be processed, wherein the select clause includes n Boolean expressions.

[0205] The statement conversion module 420 is configured to convert the SQL statement into several subquery statements based on the k sensitive attributes located in the real data table involved in the n Boolean expressions, wherein all Boolean expressions in a single subquery statement contain the same sensitive attribute.

[0206] The statement processing module 430 is configured to perform target processing on each subquery statement as a target statement. The statement processing module includes the following units for performing the target processing: a virtual table acquisition unit 431, configured to acquire a target virtual table corresponding to the target sensitive attribute in the target statement, wherein the target field value set corresponding to it is sampled from the target sensitive attribute field in the real data table; a subset determination unit 432, configured to determine multiple target field value subsets whose union is the target field value set based on the result matrix obtained by executing the target statement on the target virtual table; and a counting determination unit 433, configured to determine the target count of the target sensitive attribute field on each field value in each target field value subset.

[0207] The indicator value determination module 440 is configured to determine the quantitative data leakage indicator value corresponding to the target statement based on the subset of multiple target field values ​​and the target count.

[0208] The feedback decision module 450 is configured to determine whether to provide the user with the query results of the SQL statement on the real data table based on the indicator values ​​corresponding to the several sub-query statements.

[0209] In one embodiment, the statement acquisition module 410 is specifically configured to: receive the SQL statement input by the user, and if it is determined that the expressions in the select clause are all of Boolean type, use the SQL statement input by the user as the SQL statement to be processed.

[0210] In one embodiment, the statement conversion module 420 is specifically configured to: for any first sensitive attribute among the k sensitive attributes, determine several Boolean expressions among the n Boolean expressions that include the first sensitive attribute; and based on the several Boolean expressions, determine a first sub-query statement corresponding to the first sensitive attribute.

[0211] In a specific embodiment, the SQL statement includes a WHERE clause; the statement conversion module 420 is further configured to: when the first Boolean expression in the WHERE clause contains a first sensitive attribute, perform a logical AND combination of the first Boolean expression with each of the several Boolean expressions to obtain an updated several Boolean expressions; and construct the first subquery statement by using the updated several Boolean expressions as select query expressions.

[0212] In one specific embodiment, the SQL statement includes a WHERE clause; the statement conversion module 420 is further configured to: when the second Boolean expression in the WHERE clause contains a second sensitive attribute different from the first sensitive attribute, construct the first subquery statement by using the plurality of Boolean expressions as SELECT query expressions; and construct the second subquery statement by using the second Boolean expression as SELECT query expressions.

[0213] In one embodiment, the subset determination unit 432 is specifically configured as follows: for each of the l Boolean expressions, based on the column vector corresponding to it in the result matrix, select one of the field values ​​in the target virtual table and classify it into the set of true values ​​where the execution result is true and the set of false values ​​where the execution result is false; by grouping and intersecting the set of true values ​​and the set of false values ​​corresponding to the l Boolean expressions, the plurality of target field value subsets are obtained.

[0214] In one embodiment, the subset determination unit 432 is specifically configured to: for each of the l Boolean expressions, based on the corresponding column vector in the result matrix, determine the number of elements in the column vector indicating that the execution result is true; use the multiple count values ​​and the number of elements as the array and sum value in the subset and problem SSP to solve for multiple subsets of count values; the multiple count values ​​include the count values ​​of all field values ​​in the target virtual table on each field value in the target field value set; and determine the multiple subsets of target field values ​​based on the multiple subsets of count values.

[0215] In one specific embodiment, the target field value set includes multiple field values; wherein, the construction of the target virtual table includes: sampling the multiple field values ​​from the target sensitive attribute field, and setting the multiple count values ​​accordingly, wherein any two subsets of the multiple count values ​​have different sum values; for each field value among the multiple field values, copying it a corresponding number of times according to its corresponding count value and then filling it into the target virtual table. The subset determination unit 432 is configured to determine the multiple target field value subsets based on the multiple count value subsets, specifically including: determining the field values ​​corresponding to the count values ​​in each count value subset based on the mapping relationship between the multiple count values ​​and the multiple field values, forming an initial field value subset; and determining the multiple target field value subsets based on the multiple initial field value subsets corresponding to the multiple count value subsets.

[0216] In a more specific embodiment, the subset determination unit 432 is configured to determine the multiple target field value subsets based on the multiple initial field value subsets corresponding to the multiple count value subsets, specifically including: determining multiple field value complements corresponding to the multiple initial field value subsets based on the target field value set; exhaustively finding the intersection of the multiple initial field subsets and the multiple field value complements, thereby using the final result obtained from the intersection as the multiple target field value subsets.

[0217] In one embodiment, the subset determination unit 432 is specifically configured to: divide the l Boolean expressions into multiple groups of Boolean expressions, and determine multiple subsets of count values ​​corresponding to each group of Boolean expressions. Specifically, this includes: for each Boolean expression in each group of Boolean expressions, based on the corresponding column vector in the result matrix, determining the number of elements in the column vector indicating that the execution result is true; using the multiple count values ​​and the number of elements as subsets and arrays and sums in the problem SSP, solving for multiple subsets of count values; the multiple count values ​​include the count values ​​of all field values ​​in the target virtual table for each field value in the target field value set. Based on the multiple subsets of count values, the multiple subsets of target field values ​​are determined.

[0218] In one embodiment, the counting determination unit 433 is specifically configured to determine the target count based on the result matrix obtained by executing the target statement on the real data table.

[0219] In one embodiment, the indicator value determination module 440 is specifically configured to: calculate a first preset indicator to measure the percentage of data leakage based on the subset of the multiple target field values ​​and the target count, as well as the prior distribution estimated by the user for the target sensitive attributes.

[0220] In a specific embodiment, the indicator value determination module 440 is further configured to: correct the prior distribution using the subset of multiple target field values ​​and the target count to obtain a corrected distribution; and calculate the indicator value of the first preset indicator based on the prior distribution and the corrected distribution.

[0221] Furthermore, in one example, the calculation of the first preset indicator is also based on the actual distribution corresponding to the target sensitive attribute field.

[0222] On the other hand, in one specific embodiment, the formula for calculating the first preset index is designed based on information gain or JS divergence.

[0223] In one embodiment, the indicator value determination module 440 is specifically configured to: calculate a second preset indicator for measuring the amount of residual information in the data based on the subset of the multiple target field values ​​and the target count.

[0224] In a specific embodiment, the indicator value determination module 440 is further configured to: correct the prior distribution using the subset of multiple target field values ​​and the target count to obtain a corrected distribution; and calculate the indicator value of the second preset indicator based on the prior distribution and the corrected portion.

[0225] Furthermore, in one example, the formula for calculating the second predefined index is designed based on conditional entropy, expectation, or variance.

[0226] In one specific embodiment, the prior distribution is a uniform distribution, a distribution determined based on a random array, or a true distribution consistent with the data distribution of the target sensitive attribute field.

[0227] In one embodiment, the feedback decision module 450 is specifically configured to: add differential privacy noise to the indicator value to obtain the corresponding noisy indicator value; compare the noisy indicator value with the corresponding indicator threshold; and determine whether to provide the query result to the user based on the comparison result.

[0228] According to another embodiment, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed in a computer, causes the computer to perform a combination Figure 3 The method described.

[0229] According to another embodiment, a computing device is also provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements a combination... Figure 3The methods described herein. Those skilled in the art will recognize that, in one or more of the examples above, the functions described in this invention can be implemented using hardware, software, firmware, or any combination thereof. When implemented in software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium.

[0230] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made on the basis of the technical solution of the present invention should be included within the scope of protection of the present invention.

Claims

1. A data query method, comprising: Retrieve the SQL statement to be processed, where the select clause contains n Boolean expressions; Based on the k sensitive attributes located in the real data table involved in the n Boolean expressions, the SQL statement is converted into several subquery statements, and all Boolean expressions in a single subquery statement contain the same sensitive attribute; Each subquery statement is treated as a target statement and the following processing is performed: obtain the target virtual table corresponding to the target sensitive attribute in the target statement, and the corresponding target field value set is sampled from the target sensitive attribute field in the real data table; Based on the result matrix obtained by executing the target statement on the target virtual table, determine multiple subsets of target field values ​​whose union is the target field value set. The select clause of the target statement includes l Boolean expressions, and the multiple subsets of target field values ​​correspond to 2 generated by the l Boolean expressions. l The intervals are reduced to a set of intervals with less overlap; Determine the target count of the target sensitive attribute field for each field value in each subset of target field values; Based on the subset of target field values ​​and the target count, determine the quantitative data leakage index value corresponding to the target statement; Based on the indicator values ​​corresponding to the subqueries, determine whether to provide the user with the query results of the SQL statement on the actual data table.

2. The method according to claim 1, wherein, Retrieve the SQL statements to be processed, including: The system receives SQL statements input by the user. If it is determined that all expressions in the select clause are of Boolean type, the user-input SQL statement is used as the SQL statement to be processed.

3. The method according to claim 1, wherein, Based on the k sensitive attributes located in the actual data table involved in the n Boolean expressions, the SQL statement is converted into several subquery statements, including: For any first sensitive attribute among the k sensitive attributes, determine several Boolean expressions among the n Boolean expressions that include the first sensitive attribute; Based on the aforementioned Boolean expressions, a first sub-query statement corresponding to the first sensitive attribute is determined.

4. The method according to claim 3, wherein, The SQL statement includes a WHERE clause; wherein, based on the plurality of Boolean expressions, determining the first subquery statement corresponding to the first sensitive attribute includes: If the first Boolean expression in the WHERE clause contains a first sensitive attribute, the first Boolean expression is logically ANDed with each of the Boolean expressions in the plurality of Boolean expressions to obtain the updated plurality of Boolean expressions. The first subquery statement is constructed by using the updated Boolean expressions as select query expressions.

5. The method according to claim 3, wherein, The SQL statement includes a WHERE clause; wherein, based on the plurality of Boolean expressions, determining the first subquery statement corresponding to the first sensitive attribute includes: If the second Boolean expression in the WHERE clause contains a second sensitive attribute that is different from the first sensitive attribute, the first subquery statement is constructed by using the several Boolean expressions as SELECT query expressions; Converting the SQL statement into several subquery statements also includes: The second subquery statement is constructed by using the second Boolean expression as the select query expression.

6. The method according to claim 1, wherein, Based on the result matrix obtained by executing the target statement on the target virtual table, determine multiple subsets of target field values ​​whose union is the target field value set, including: For each of the l Boolean expressions, based on the column vector corresponding to it in the result matrix, the field values ​​in the target virtual table are selected and assigned to the set of true values ​​and the set of false values ​​whose execution result is false. By grouping and intersecting the truth value sets and false value sets corresponding to the l Boolean expressions, the subsets of the multiple target field values ​​are obtained.

7. The method according to claim 1, wherein, Based on the result matrix obtained by executing the target statement on the target virtual table, determine multiple subsets of target field values ​​whose union is the target field value set, including: For each of the l Boolean expressions, based on the corresponding column vector in the result matrix, determine the number of elements in the column vector that indicate the execution result is true; Multiple count values ​​and element counts are used as subsets and arrays and sums in problem SSP to solve for multiple subsets of count values; the multiple count values ​​include the count values ​​of all field values ​​in the target virtual table for each field value in the target field value set; Based on the plurality of subsets of count values, the plurality of subsets of target field values ​​are determined.

8. The method according to claim 7, wherein, The target field value set includes multiple field values; wherein, the construction of the target virtual table includes: Sample the values ​​of the plurality of fields from the target sensitive attribute fields, and set the plurality of count values ​​accordingly, wherein any two subsets of the plurality of count values ​​have different sum values; For each of the multiple field values, copy it to the target virtual table according to its corresponding count value and then fill it into the target virtual table. Specifically, determining the subsets of target field values ​​based on the plurality of subsets of count values ​​includes: Based on the mapping relationship between the multiple count values ​​and the multiple field values, the field values ​​corresponding to the count values ​​in each subset of count values ​​are determined to form an initial subset of field values; Based on the multiple initial field value subsets corresponding to the multiple count value subsets, the multiple target field value subsets are determined.

9. The method according to claim 8, wherein, Based on the multiple initial field value subsets corresponding to the multiple count value subsets, the multiple target field value subsets are determined, including: Based on the target field value set, determine multiple field value complements corresponding to multiple initial field value subsets; Exhaustive intersection is performed on multiple initial field subsets and multiple field value complements, and the final result of the intersection is taken as the multiple target field value subsets.

10. The method according to claim 1, wherein, Based on the result matrix obtained by executing the target statement on the target virtual table, determine multiple subsets of target field values ​​whose union is the target field value set, including: The l Boolean expressions are divided into multiple groups of Boolean expressions, and multiple subsets of count values ​​corresponding to each group of Boolean expressions are determined. Specifically, this includes: for each Boolean expression in each group of Boolean expressions, based on the column vector corresponding to it in the result matrix, determining the number of elements in the column vector indicating that the execution result is true; using the multiple count values ​​and the number of elements as subsets and the array and sum value in the problem SSP, solving for multiple subsets of count values; the multiple count values ​​include the count values ​​of all field values ​​in the target virtual table for each field value in the target field value set; Based on the plurality of subsets of count values, the plurality of subsets of target field values ​​are determined.

11. The method according to claim 1, wherein, Determining the target count of the target sensitive attribute field for each field value in each subset of target field values ​​includes: The target count is determined based on the result matrix obtained by executing the target statement on the real data table.

12. The method according to claim 1, wherein, Based on the subset of target field values ​​and the target count, determine the quantitative data leakage indicator value corresponding to the target statement, including: Based on the subset of target field values ​​and the target count, as well as the prior distribution estimated by the user for the target sensitive attributes, a first preset indicator is calculated to measure the percentage of data leakage.

13. The method according to claim 12, wherein, The calculation of the first preset index includes: The prior distribution is corrected using the subset of target field values ​​and the target count to obtain the corrected distribution; Based on the prior distribution and the corrected distribution, the index value of the first preset index is calculated.

14. The method according to claim 13, wherein, The calculation of the first preset index is also based on the actual distribution corresponding to the target sensitive attribute field.

15. The method according to any one of claims 12-14, wherein, The formula for calculating the first preset index is designed based on information gain or JS divergence.

16. The method according to claim 1, wherein, Based on the subset of target field values ​​and the target count, determine the quantitative data leakage indicator value corresponding to the target statement, including: Based on the subset of target field values ​​and the target count, a second preset index is calculated to measure the amount of residual information in the data.

17. The method according to claim 16, wherein, The calculation of the second preset index includes: Using the subset of target field values ​​and the target count, the prior distribution of the user's estimate of the target sensitive attributes is corrected to obtain the corrected distribution; Based on the prior distribution and the correction portion, the index value of the second preset index is calculated.

18. The method according to claim 16 or 17, wherein, The formula for calculating the second preset index is designed based on conditional entropy, expectation, or variance.

19. The method according to any one of claims 12-14, 17, wherein, The prior distribution is a uniform distribution, a distribution determined based on a random array, or a true distribution consistent with the data distribution of the target sensitive attribute field.

20. The method according to claim 1, wherein, Based on the indicator values ​​corresponding to the aforementioned subqueries, determine whether to provide the user with the query results of the SQL statement on the actual data table, including: Differential privacy noise is added to the index value to obtain the corresponding noise-added index value; The noise-adding index value is compared with the corresponding index threshold; Based on the comparison results, determine whether to provide the query results to the user.

21. A data query device, comprising: The statement retrieval module is configured to retrieve SQL statements to be processed, where the select clause includes n Boolean expressions; The statement conversion module is configured to convert the SQL statement into several subquery statements based on the k sensitive attributes located in the real data table involved in the n Boolean expressions, wherein all Boolean expressions in a single subquery statement contain the same sensitive attribute; The statement processing module is configured to treat each subquery statement as a target statement and perform target processing accordingly; the statement processing module includes the following units for performing the target processing: The virtual table acquisition unit is configured to acquire a target virtual table corresponding to the target sensitive attribute in the target statement, wherein the target field value set corresponding to the target field of the real data table is sampled from the target sensitive attribute field of the real data table. The subset determination unit is configured to determine, based on the result matrix obtained by executing the target statement on the target virtual table, multiple subsets of target field values ​​whose union is the target field value set. The select clause of the target statement includes l Boolean expressions, and the multiple subsets of target field values ​​correspond to two subsets generated by the l Boolean expressions. l The intervals are reduced to a set of intervals with less overlap; The counting determination unit is configured to determine the target count of the target sensitive attribute field on each field value in each subset of target field values; The indicator value determination module is configured to determine the quantitative data leakage indicator value corresponding to the target statement based on the subset of the multiple target field values ​​and the target count; The feedback decision module is configured to determine whether to provide the user with the query results of the SQL statement on the real data table based on the indicator values ​​corresponding to the several sub-query statements.

22. A computer-readable storage medium having a computer program stored thereon, wherein, When the computer program is executed in the computer, it causes the computer to perform the method of any one of claims 1-20.

23. A computing device comprising a memory and a processor, wherein, The memory stores executable code, and when the processor executes the executable code, it implements the method of any one of claims 1-20.

Images