A user-driven flexible privacy budget allocation method

Abstract

The application provides a user-driven flexible privacy budget allocation method. First, the protection demand is determined based on the information entropy of the task data stream at different time stamps. Then, the priority and the adaptive sliding window are established according to the protection demand. Then, the budget allocation and recovery operation are performed on each time stamp by combining the dynamic privacy budget allocation algorithm. Finally, the data is aggregated by applying the data stream local differential privacy aggregation mechanism. The application can be applied to the collection and release of various group time series data and has good applicability and flexibility.

Description

Technical Field

[0001] This invention mainly relates to the fields of data stream publishing and crowdsourcing tasks, and particularly to data privacy protection in continuous publishing scenarios. Background Technology

[0002] Local Differential Privacy (LDP) is a privacy protection method primarily used for the collection, processing, and dissemination of publicly available information. It protects individual data while preserving the characteristics of the group data, and is typically used in scenarios such as statistical data and questionnaire data that do not significantly rely on personal data. The principle of LDP is to add noise to individual data before uploading, thereby avoiding the risk of privacy leakage. The noise follows a certain distribution pattern, thus ensuring unbiasedness in the final statistics and preserving the characteristics of the group data. The amount of noise depends on the privacy budget; a larger privacy budget results in less noise, lower privacy protection, and lower data utility. The degree of privacy protection depends on the privacy budget, usually denoted as ε, which measures the strength of privacy protection. A smaller ε value indicates stronger privacy protection. By allocating the privacy budget appropriately, user privacy can be protected while meeting the task protection requirements. A larger privacy budget can provide a higher level of privacy protection but may increase computational or storage costs. Therefore, determining a reasonable privacy budget allocation is a crucial factor in balancing data utility and privacy protection and is currently a hot research topic.

[0003] Personalized differential privacy is an extension of differential privacy protection methods. While incorporating basic differential privacy strategies, it places greater emphasis on protecting the privacy of individuals with varying needs. This is primarily achieved by adjusting the privacy budget for each individual. Personalized differential privacy methods can protect individual privacy while providing personalized budget adjustment and optimization strategies. It is widely used in federated learning, social networks, crowdsourcing, and other scenarios, and is currently one of the more popular technologies.

[0004] Existing differential privacy protection schemes for data streams can be mainly divided into three categories: event-level, w-event-level, and user-level. These three categories correspond to different levels of privacy protection and different privacy protection scenarios. Event-level schemes protect individual timestamps within the data stream, while w-event schemes extend event-level protection to a sliding window consisting of w timestamps. Smaller window sizes provide more granular data analysis and more accurate results, while larger window sizes offer higher levels of privacy protection. User-level schemes protect all timestamp data of a specific user within the data stream.

[0005] In crowdsourcing scenarios, user participation changes over time, meaning their privacy protection needs also evolve. Under existing data stream differential privacy protection schemes, privacy budgets primarily rely on the data itself and the data aggregation mechanism, neglecting the user's actual state. These three protection schemes lack flexibility and cannot form a widely applicable personalized allocation scheme to adapt to changing privacy protection needs. Therefore, there is an urgent need for a user-driven, flexible privacy budget allocation method to meet the ever-changing privacy protection requirements in crowdsourcing scenarios. Summary of the Invention

[0006] To address the aforementioned issues, this invention discloses a w-event-level local differential privacy solution. This solution can adjust the size of the w sliding window value in the w-event level for each user based on their data stream differential privacy needs. The value is dynamically adjusted between the maximum window limit and the minimum event level protection level, allowing for flexible allocation of the privacy budget at each moment to meet users' personalized privacy protection requirements.

[0007] This invention determines the level of privacy protection based on user participation on a crowdsourcing platform. Participation is determined by information entropy; higher information entropy indicates richer task involvement and thus higher participation, while lower information entropy suggests simpler or more singular task involvement and lower participation. Information entropy measures the diversity and complexity of personal data. Higher information entropy means the data contains more information, increasing the risk of privacy breaches. By using information entropy as a measure of participation, the level of user engagement on a crowdsourcing platform can be linked to the risk of privacy breaches.

[0008] Furthermore, in a multi-tasking environment, to effectively protect task privacy, this invention also introduces a prioritization mechanism. This mechanism measures the impact of a task on other tasks based on the number of overlaps between tasks. This mechanism can allocate privacy protection resources more effectively, ensuring that tasks with a greater impact on other tasks are protected first, thereby reducing the risk of privacy leaks and cascading effects.

[0009] This invention flexibly allocates privacy budgets based on information entropy and priority to achieve more precise privacy protection and data analysis. The dynamic sliding window adjustment of information entropy can balance the needs of privacy protection and analytical accuracy in different data analysis scenarios. Simultaneously, the priority-based allocation mechanism ensures that highly sensitive data receives stricter protection. This flexible privacy budget allocation method helps to maximize user privacy during data analysis while providing meaningful analytical results. Through this solution, users can better control their level of privacy protection and obtain a better user experience when participating in tasks on crowdsourcing platforms.

[0010] The user-driven flexible privacy budget allocation method proposed in this invention mainly includes the following steps:

[0011] Step 1: Develop an allocation plan:

[0012] 1) Obtain user status information, platform information, and other information;

[0013] 2) Calculate the upper limit of user window protection k, and obtain the set of upper limits of user windows {k1, ..., k}. n};

[0014] 3) Determine the sequence of user tasks to be completed, and obtain the user task sequence {T1, ..., T}. n}

[0015] Step 2: Establish different timestamp protection requirements for users:

[0016] 1) Calculate the analysis window size for each user separately, assuming the analysis window is T. a Then its size is |T a |=2k-1, k is a preset parameter. Requirements analysis is only performed within the analysis window, and the analysis window must be filled with tasks.

[0017] 2) Perform histogram statistics on the current task within the analysis window to obtain the histogram set C = {c2, c3, ..., c...} K This set records the frequency information of sequences generated by the current task during different sliding window traversals;

[0018] 3) Calculate the information entropy pairs for all histograms in the histogram set C and select the optimal timestamp window.

[0019] Step 3: Timestamp Priority Assessment

[0020] 1) Calculate the number of times the current task window is covered. For a certain task t m Only the preceding task t is calculated. m-k+1 , ..., t m-0 The number of times the protection window is covered.

[0021] Step 4: Dynamic Privacy Budget Allocation

[0022] 1) Determine the size w of the adaptive sliding window;

[0023] 2) Based on information such as sliding window and timestamp protection requirements, allocate privacy budget for tasks within the adaptive sliding window; dynamically determine the privacy budget;

[0024] 3) Based on the total budget ε within the adaptive sliding window sum Adjust the privacy budget based on the relationship with ε.

[0025] Step 5: User Data Upload and Aggregation

[0026] 1) Calculate the difference *dis* between the current task data and the data released in the last time this task was executed;

[0027] 2) Group users according to their privacy budget;

[0028] 3) Calculate the group variance, select the minimum group for extended Kalman filtering, and upload the user data;

[0029] 4) Budget recovery and reuse. Attached Figure Description

[0030] Figure 1 This is a flowchart of the present invention;

[0031] Figure 2 This is an example diagram illustrating the calculation of the protection requirements for the present invention.

[0032] Figure 3 This is the streaming data privacy budget partitioning diagram of the present invention;

[0033] Figure 4 This is a flowchart of the data publishing and aggregation steps of the present invention. Detailed Implementation

[0034] Figure 1 The overall process of this invention is introduced, and its specific implementation is as follows:

[0035] Step 1: Develop an allocation plan:

[0036] 1) Obtain the initial information required for crowdsourcing allocation, such as user status information and platform information;

[0037] 2) Calculate the window protection limit for each user, i.e., the upper limit of the adaptive sliding window size. The value depends on the total number of task types the user can complete and the upper limit of task types dispatched by the platform, taking the smaller value between them. k represents the maximum number of task types a user can accept; therefore, for i users, the corresponding task domain τ... i={ω1, ω2, ..., ω d}, d = ki. This means that the user can complete at most k tasks. i For each task, the protection limit is k. i ;

[0038] 3) Relying on the crowdsourcing task allocation algorithm, different users get their own task sequence T, and subsequent steps two, three and four all rely on this sequence for analysis.

[0039] Step 2: Establish different timestamp protection requirements for users:

[0040] 1) Determine the analysis window T a Its size is calculated using the following formula (1):

[0041] |T a |=2k-1 (1)

[0042] Protection requirements are reflected in the required protection window size, which corresponds to the sliding window value w in w-event. At the current moment, the analysis window T needs to be determined. a The protection requirements for the k-th task are determined (assuming the first k tasks in the analysis window are already determined at any given time). The analysis window iterates through the task sequence to derive the protection requirements for each task. Similar to a sliding window, the window moves forward and introduces a new task as each intermediate task is completed. If the analysis window is not completely filled, it waits to be filled; protection requirement analysis is only performed when the analysis window is fully filled. Assume a user U currently has a task sequence T = {t1, t2, t3, ..., t...}. n}, then |T must be satisfied a Analysis can only proceed if the condition is |≤|T|; otherwise, it will continue to wait for the fill condition.

[0043] 2) Traverse the current task through windows of different sizes and obtain the histogram statistics. For task T in the window... a ={t m-k+1 , ..., t m-1 , t m , t m+1 , ..., t m+k-1 Only analyze intermediate task t. m This refers to the k-th task in the window. The protected window size is l, l = 1, 2, 3, ..., k. To calculate the information entropy, a sliding window of size from 2 to k is used to traverse and analyze the sequence containing intermediate tasks in the window, resulting in a histogram set C = {c2, c3, ..., c...}. K}, where histogram c K = <c k [1], c k[2], c k [3], ..., c k [d]>. c[d] represents the number of times the d-th task type appears. For a sliding window of length k, iterate through tasks t... m The sequence t will generate a total of k sequences. m The position moves from the beginning of the sequence to the end of the sequence. The specific traversal sequence can be represented as the following set of sequences {t}. m-k+1 , . ..., t m-1 , t m}, {t m-k , ..., t m , t m+1},...,{t m , ..., t m+k-2 , t m+k-1 A histogram is generated by counting the frequency of each element in a set of sequences. Figure 2 This involves performing a histogram collection process with a protected window size of 4 for task t3 in the task sequence. The histogram statistics process does not include the task itself.

[0044] 3) The frequency of different types of tasks is obtained through histograms, thus allowing the calculation of information entropy. The information entropy is calculated for all histograms in the histogram set, as shown in formula (2):

[0045]

[0046] Where H(X) represents the information entropy of the random variable X, and P x This represents the probability of taking the value x in the histogram. The sliding window size corresponding to the histogram with the highest information entropy is selected as the protection requirement for the intermediate task, and set as the value of the protection window l. By selecting the histogram with the highest information entropy, the diversity and complexity in the data stream can be better captured, thus providing more effective privacy protection.

[0047] Step 3: Task Priority Assessment

[0048] 1) Calculate task t m The number of times the window is covered by other task protection windows. For task t m In other words, it may be affected by the preceding task t m-k+1 , . ..., t m-1 The protection window coverage, calculate t m The number of times the window is covered by the protection window of the preceding task is used to facilitate priority determination. A high coverage count indicates that other tasks are affected by the protection window. mThe impact is significant (this task substantially affects the information entropy calculation of other tasks, which is why it is covered by the protection windows of other tasks). A leak could affect other tasks, threatening their privacy as well. Therefore, more privacy protection measures are needed to ensure the privacy and security of the entire system.

[0049] Step 4: Dynamic Privacy Budget Allocation

[0050] 1) Determine the sliding window size at the current moment. A reasonable privacy budget allocation window size *w* must be determined while meeting the protection requirements of the task. Assume the set of coverage window sizes when the current timestamp is covered by a backward task is γ, and *n* is the protection window size of the task itself at the current moment, calculated as shown in formula (3):

[0051] w=max{n, max{i|i∈γ}} (3)

[0052] 2) Initially allocate the privacy budget for the current timestamp. For example... Figure 3 As shown, a portion of the budget is based on the data flow publishing strategy and is a fixed size ε for each task. d This is used for data discrepancy detection. In reality, only another portion of the budget ε needs to be allocated. r , ε d and ε r Satisfy the following formulas (4) and (5):

[0053]

[0054]

[0055] The process of allocating a privacy budget consists of the following two steps:

[0056] 1. For tasks within the current window that have not yet been allocated a privacy budget, allocate the average privacy budget ε for the current window. r / w;

[0057] 2. For tasks with allocated privacy budgets, no changes will be made;

[0058] 3) Implement corresponding adjustment strategies to ensure that the total privacy budget of the current window does not exceed the set privacy budget limit ε, i.e., satisfy the formula:

[0059] ε d +ε r ≤ε (6)

[0060] First, sort all tasks within the window by coverage count from lowest to highest and calculate their corresponding priorities. Tasks with fewer coverage counts have higher priority and are allocated privacy budgets more quickly; tasks with more coverage counts have lower priority and are allocated privacy budgets relatively later. Then, adjust the budget, which involves the following two steps:

[0061] 1. If the privacy budget within the window is ε sum If the value is greater than ε, then a privacy budget deduction will be made, deducting budget in ascending order of priority until ε is reached. sum =ε End;

[0062] 2. If ε sum If the value is less than or equal to ε, then the requirement has not been exceeded and no budget deduction will be made.

[0063] Step 5: User Data Upload and Aggregation

[0064] 1) The overall process is as follows Figure 4 As shown. All users who need to upload data for that specific task consume their privacy budget to upload perturbation data. The platform aggregates this data to derive an unbiased estimate of the histogram c. t，1 At the same time, the platform retrieves the histogram c of the data from the last time this task was published. l The difference between the two histograms is compared using the mean squared error calculation method to obtain the specific difference value dis. The specific calculation formula is as follows:

[0065]

[0066] 2) Use a range-based method to perform statistical analysis on user data. Assume the data is divided into several ranges. There are h+1 intervals in total, ε / 2, each interval corresponding to a group. Different users have different privacy budgets for the current task. If a user's privacy budget ε r =ε / 2, and is classified into the last group; otherwise, each user's privacy budget is classified into the p-th group, where p satisfies:

[0067] ε p-1 ≤ε r <ε p (8)

[0068] 3) Obtain the number of participants and the published privacy budget for each interval. Calculate the variance of the final data based on these two pieces of information, select the interval with the smallest variance, perform extended Kalman filtering, and upload its data. The GRR (Generalized Random Response) mechanism is used, and the variance is calculated as shown in formula (9):

[0069]

[0070] Where n is the number of people, d is the domain size of the histogram, and ε is the privacy budget;

[0071] 4) For selected users, differential privacy processing is performed on the data based on their privacy budget range before uploading the data. Simultaneously, extended Kalman filtering is applied, and the minimum value within that range is used as the privacy budget. For example, all users within their privacy budget range should use the budget value when uploading after differential privacy processing. Specifically, considering data utility, users with a privacy budget less than ε1 are directly ignored; that is, users with a privacy budget in the range [0, ε1) are disregarded and will not be included in the upload process.

[0072] 5) After data release, the privacy budget for each user will be reclaimed. The privacy budget for each user is categorized into several scenarios:

[0073] 1. The data has been published and is fully in use;

[0074] 2. Data has been published, but not fully utilized;

[0075] 3. Unpublished data, not used;

[0076] The privacy budgets of users in the second and third scenarios will be reclaimed and allocated to subsequent tasks with higher priority, based on the scenario's criteria:

[0077] 1. If this task has the highest priority, it will be assigned to a lower-priority task;

[0078] 2. If the task is not of the highest priority, it will be assigned to the highest priority task.

[0079] 3. If all tasks have the same priority, the task will be assigned to the next task.

[0080] 6) Repeat the above process: the platform continuously distributes tasks and collects task data; users continuously accept tasks and publish task data. The establishment of protection requirements and the aggregation of user data uploads operate in parallel, but there is a certain order between the two. This order cannot be violated. That is, for a certain user's task, the protection requirements must be established first, and then the data upload step can be performed. There is no task where the protection requirements have not been established when the data is uploaded.

[0081] The embodiments described above are intended to illustrate the technical principles of the present invention for researchers to understand and apply, and are merely one specific implementation. Researchers in related fields can, within the scope of the invention's innovation, transfer the technical principles of the invention through non-inventive design and develop other embodiments. Therefore, the scope of the present invention is not limited to the above embodiments; any embodiments designed without departing from the scope of the present invention should be included within the protection scope of the present invention.

Claims

1. A user-driven, flexible privacy budget allocation method, characterized in that, The method includes: developing an allocation scheme, determining different timestamp protection needs of users, prioritizing tasks, dynamically allocating privacy budgets, and uploading and aggregating user data, specifically including the following steps: Step 1: Develop an allocation plan and obtain the initial information required for crowdsourcing allocation from users and the platform; determine the window protection limit based on the smaller of the maximum number of task types that users can complete and the maximum number of task types that the platform can distribute. Step 2: Based on the information entropy-based timestamp protection standard, traverse the data stream containing the current timestamp using windows of different coverage sizes, calculate the task types covered by each window, calculate the information entropy through the set of task types covered by different windows, and select a window of a specified size as the protection standard for the current timestamp based on the information entropy. Step 3: Measure the weight of different timestamps, calculate the number of times the current task is covered by the protection window of the preceding task, and use the number of times it is covered to measure the weight of the current task, thereby determining the task priority; Step 4: Dynamically allocate privacy budgets for tasks, determine adaptive sliding windows based on the protection window size relationship of different tasks, and adjust and allocate privacy budgets according to coverage priority; Step 5: User data upload and aggregation. Group users according to the privacy budget allocated to each user. Measure the variance between groups to determine the appropriate groups to publish data. Finally, reclaim unused budget and redistribute it.

2. The user-driven flexible privacy budget allocation method according to claim 1, characterized in that: Step 2, information entropy calculation, is based on a frequency histogram of task types over a period of time. Privacy protection requirements are determined through information entropy. Step 2 includes: The duration is measured by the size of the window, and a sliding window is used to specify the task. The upper traversal takes windows ranging from 2 to k, where k is the upper limit. For a sliding window of size k in the task... For the traversal of the above, the traversal results are as follows: By analyzing the above sequence, the frequency of occurrence of each type of task is counted, and a histogram is obtained.

3. The user-driven flexible privacy budget allocation method according to claim 1, characterized in that: In step 4, the dynamic privacy budget allocation depends on the protection needs of neighboring tasks. The size of the adaptive sliding window w used for budget allocation is dynamically determined at different times, as shown in formula (1): Where n is the protection window size of the task itself at the current moment, γ is the set of coverage window sizes when the current timestamp is covered by the backward task, and subsequent budget adjustments within the adaptive window are based on the priority of all tasks within the window, according to the privacy budget within the window. as well as We will discuss two scenarios. If so, the privacy budget will be deducted according to priority; No adjustment will be made, where ε is the set upper limit of the privacy budget.

4. The user-driven flexible privacy budget allocation method according to claim 1, characterized in that: Step 5 involves data aggregation and uploading using budget-based grouping. Different users are assigned to different privacy budget groups, and each user allocates a privacy budget for publishing. for If a user's privacy budget is classified into the last group, then the user's privacy budget is classified into the p-th group, where p satisfies formula (2): Select the group with the minimum variance for data upload.

Images