Differential privacy method, system and device based on dynamic database histogram publishing

Abstract

The present invention discloses a differential privacy method, system and device based on dynamic database histogram publishing, which belongs to the technical field of database privacy protection. The method includes building a tree structure according to time nodes after receiving a data query request based on a histogram in any time range; counting and summarizing the histograms of all time nodes in the tree structure; adding noise that satisfies differential privacy to the histogram of each time node to obtain a noisy histogram and publish it; selecting and summarizing the noisy histogram on the target time node to respond to the data query request. The present invention divides time based on a tree structure to reduce the disturbance of noise, thereby improving the accuracy of histogram publishing. Building a tree structure according to time nodes can be applicable to data queries based on histograms in any time range. Using a tree structure to summarize and perturb all node histograms can respond to any query of a data analyst in a timely manner, thereby improving the real-time nature of query feedback.

Description

Technical Field

[0001] The present invention belongs to the technical field of database privacy protection, and in particular relates to a differential privacy method, system and device based on dynamic database histogram publishing. Background Art

[0002] With the rapid development of artificial intelligence and big data technology, data collection and analysis have become particularly easy. Service agencies analyze and query the databases collected and aggregated by data collectors in order to develop more personalized tools. However, with the continuous advancement of computer technology, database technology has been constantly changing, and data query methods are also constantly being explored and developed. Unlike static databases, dynamic databases are databases that can be dynamically updated and modified as needed. Dynamic databases allow data to be added, deleted, and modified to meet changing needs. Dynamic databases are usually used in scenarios where data needs to be frequently updated and queried, such as online trading systems and social networks. Data analysts (or third-party commercial organizations) submit dynamic query requests to trusted servers with dynamic databases, and the servers can respond to them with query results in a timely manner. However, untrustworthy data analysts may infer users' privacy information from multiple response results, thereby threatening users' property and personal safety. To address this problem, differential privacy technology ensures the security of users' data and privacy by perturbing query results. At present, differential privacy focuses on research such as aggregate queries for static data, while there are few works involving data queries and data publishing for dynamic data.

[0003] As databases continue to evolve, query methods are also changing, and histograms are also a form of count query. Data queries in dynamic databases are widely used in OLTP (On-Line Transaction Processing). How to protect user privacy in dynamic data while publishing histograms has become a new idea for differential privacy research. T The differential privacy scheme based on dynamic data histogram generally includes the following three steps: First, The data is summarized in histogram, and then noise is added to the true result of the node. According to the calculated global sensitivity size and each node The privacy cost Check the noise, The perturbation histogram is published to respond to the query results to the data analyst. However, since the amount of dynamic data increases over time, the update of data will affect the privacy protection effect of differential privacy technology. The perturbation results will also change over time. TTherefore, the current differential privacy histogram publishing schemes for dynamic databases generally have the problem that the added noise increases linearly with time, which ultimately leads to low availability of query results.

[0004] In order to solve the problem of excessive noise introduction, current differential privacy solutions focus on the sampling of time nodes. The basic idea of ​​differential privacy solutions based on time node sampling is: when a time node is sampled, the data of the time node is perturbed; otherwise, the data does not need to be processed, and the query response is based on the data results sampled at the previous moment. However, the defects of this solution include that only the data of certain time samples are used for analysis or query, which may reduce the accuracy of the analysis results. Therefore, it cannot fundamentally improve the impact of noise on dynamic database queries.

[0005] In addition, the above differential privacy histogram publishing scheme can only be applied to queries at a certain time node, and is not applicable to queries for updated data at any range of time nodes. The solution can only query the data of all time points in the range and then aggregate all the disturbance results. However, the error of the query result of this solution is proportional to the length of the query range, so when counting queries for longer ranges, too much noise will be introduced, resulting in reduced accuracy of the query results. At the same time, for queries on dynamic databases, the server cannot respond to feedback in a timely manner. Summary of the invention

[0006] The purpose of the present invention is to address the problems in the above-mentioned prior art and provide a differential privacy method, system and device based on dynamic database histogram publishing, which can perform counting queries on data at a certain time point and range queries between arbitrary nodes through the published results of the histogram, and use the structure of building a time tree to reduce noise and improve the accuracy of data query.

[0007] In order to achieve the above object, the present invention has the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides a differential privacy method based on dynamic database histogram publishing, comprising:

[0009] After receiving a data query request based on a histogram in any time range, a tree structure is constructed according to the time nodes;

[0010] Count and summarize the histograms of all time nodes in the tree structure;

[0011] Add noise that satisfies differential privacy to the histogram of each time node, obtain the noisy histogram and publish it;

[0012] The noisy histogram at the target time node is selected and summarized to respond to the data query request.

[0013] As a preferred solution, the dynamic database collection D ={ D 1, D 2, …, D T} is included T databases at time points, any of which Indicates The database of time nodes; the arbitrary time range is ,in, and .

[0014] As a preferred solution, in the step of constructing a tree structure according to time nodes, the timestamps are divided using a binary tree hierarchical structure, according to the formula Divide the timestamp into disjoint periodic data, where: .

[0015] As a preferred solution, adding noise that satisfies differential privacy to the histogram of each time node includes:

[0016] Add noise that satisfies differential privacy to the histogram of each time node according to the hierarchical structure of the binary tree, including periodic data divided by timestamp , , add a histogram of size 1 to all time nodes in the divided time period. The noise, At the expense of privacy, Represents a function that obeys the Laplace distribution, and obtains the noisy histogram of each time node .

[0017] As a preferred solution, the statistical and summary of the histograms of all time nodes of the tree structure includes:

[0018] Perform histogram statistics on the data at each time node , and store the histogram in the leaf nodes of the tree structure; according to the tree structure, the histogram of each leaf node is summarized upward to obtain the histogram of all leaf nodes. The summary rule for upward summarization is that the parent node is the sum of all corresponding child nodes.

[0019] As a preferred solution, in the step of selecting and aggregating the noisy histograms at the target time nodes to respond to the data query request, the time nodes of the interval included in the query request are selected from top to bottom for each tree structure, and the minimum number of time nodes are selected to represent the query interval.

[0020] As a preferred solution, an untrusted data analyst submits a histogram-based data query request for any time range to the server, and the server publishes the histogram in a perturbative manner according to the dynamic database and responds to the data query request to the data analyst.

[0021] In a second aspect, an embodiment of the present invention provides a differential privacy system based on dynamic database histogram publishing, including:

[0022] A tree structure building module is used to build a tree structure according to time nodes after receiving a data query request based on a histogram in any time range;

[0023] Histogram summary module, used to count and summarize the histograms of all time nodes in the tree structure;

[0024] The histogram noise adding and publishing module is used to add noise that satisfies differential privacy to the histogram of each time node, obtain the noisy histogram and publish it;

[0025] The query request response module is used to select and summarize the noise-added histogram at the target time node to respond to the data query request.

[0026] In a third aspect, an embodiment of the present invention provides an electronic device, including:

[0027] A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the differential privacy method based on dynamic database histogram publishing as described in the first aspect.

[0028] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the differential privacy method based on dynamic database histogram publishing as described in the first aspect is implemented.

[0029] Compared with the prior art, the first aspect of the present invention has at least the following beneficial effects:

[0030] The perturbation results published for the current histogram over time TIn order to solve the problem of reduced data availability due to the increase in the number of data nodes, the differential privacy method of the present invention, after receiving a data query request based on a histogram in any time range, constructs a tree structure according to the time node, divides the time based on the tree structure, reduces the disturbance of noise, and thus improves the accuracy of histogram publishing. The current differential privacy histogram publishing scheme can only be applied to histogram queries at a certain time node. The present invention constructs a tree structure according to the time node, which can be applied to data queries based on histograms in any time range. In addition, the present invention adds noise that satisfies differential privacy to the histogram of each time node, obtains a noisy histogram and publishes it, selects and summarizes the noisy histogram at the target time node to respond to the data query request, and the present invention uses a tree structure to summarize the disturbance of all node histograms to promptly respond to any query of the data analyst, thereby improving the real-time nature of the query feedback.

[0031] It can be understood that the beneficial effects of the second to fourth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0033] Figure 1 Schematic diagram of application scenario of differential privacy method based on dynamic database histogram publishing in an embodiment of the present invention;

[0034] Figure 2 A schematic diagram of an embodiment of the present invention using a binary tree hierarchical structure to divide timestamps and construct a tree structure;

[0035] Figure 3 Flowchart of a differential privacy method based on dynamic database histogram publishing in an embodiment of the present invention. DETAILED DESCRIPTION

[0036] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0037] The existing differential privacy histogram publishing schemes have the following technical problems:

[0038] 1. Low availability of query results. The amount of dynamic data increases over time, and the disturbance results published by the histogram will also change over time. T The availability of data decreases as the number of

[0039] 2. Poor scalability. The error of the perturbation result is proportional to the length of the query range, so when counting queries for a longer range, too much noise will be introduced, resulting in reduced accuracy of the query results. Therefore, the current differential privacy histogram publishing scheme can only be applied to count queries at a certain time node, and is not applicable to queries on data at any range of time nodes.

[0040] 3. Poor real-time performance. The current differential privacy solution is based on sampling to improve the availability of data queries. The sampling process may take a certain amount of time to select and extract samples. Especially when the data changes in real time, this delay will make real-time feedback unfeasible.

[0041] In order to solve the above technical problems, the embodiment of the present invention proposes a differential privacy method based on dynamic database histogram publishing, which uses a time tree hierarchical method to reduce disturbance noise and improve the accuracy of histogram publishing. The application scenarios are as follows: Figure 1 As shown, an untrusted data analyst makes a histogram-based data query request for an arbitrary time range to the server, and the server publishes the histogram in a perturbative manner according to the dynamic database and responds to the data query request to the data analyst.

[0042] See also Figure 3 , the differential privacy method based on dynamic database histogram publishing in an embodiment of the present invention includes the following steps:

[0043] S1. After receiving a data query request based on a histogram in any time range, a tree structure is constructed according to the time nodes;

[0044] S2, counting and summarizing the histograms of all time nodes of the tree structure;

[0045] S3. Add noise that satisfies differential privacy to the histogram of each time node, obtain the noisy histogram and publish it;

[0046] S4. Select and summarize the noise-added histogram at the target time node to respond to the data query request.

[0047] In a possible implementation manner, the dynamic database set in the embodiment of the present invention is D ={ D 1, D 2, …, D T} is includedT databases at time points, any of which Indicates A database of time nodes; any time range is ,in, and The purpose of this invention is to publish a noisy histogram based on the query of the data analyst , so that data analysts can query data at a certain moment and in any time range A query to update data within.

[0048] See also Figure 2 When constructing a tree structure according to time nodes in step S1, the timestamps are divided using the hierarchical structure of the binary tree, according to the formula Divide the timestamps into disjoint periodic data, .

[0049] In a possible implementation, step S2 of counting and summarizing the histograms of all time nodes of the tree structure includes:

[0050] Perform histogram statistics on the data at each time node , and store the histogram in the leaf nodes of the tree structure; then, the histogram of each leaf node is aggregated upward according to the tree structure to obtain the histogram of all leaf nodes. The aggregation rule for upward aggregation is that the parent node is the sum of all corresponding child nodes.

[0051] In a possible implementation, when step S3 adds noise satisfying differential privacy to the histogram of each time node, the noise satisfying differential privacy is added to the histogram of each time node according to the hierarchical structure of the binary tree, including periodic data divided by timestamps. , , add a histogram of size 1 to all time nodes in the divided time period. The noise, At the expense of privacy, Represents a function that obeys the Laplace distribution, and obtains the noisy histogram of each time node .

[0052] In a possible implementation, when step S4 selects and summarizes the noise histogram at the target time node to respond to the data query request, according to the query of the data analyst, selects appropriate nodes from the noise histograms of all published time nodes for summary, and responds to the data analyst with its noise result. Figure 2 As shown in the example, if the data analyst wants to query the time t=13, the node selection rule is to select the time nodes of the interval included in the query request from top to bottom for each tree structure, and select the minimum number of time nodes to represent the query interval. Therefore, t =13 can be summarized with the noisy histogram of {1,[2,3],[4,7],[8,11],[12,13]}, and the result is responded to the data analyst. In the same way, if the data analyst wants to query the histogram of updated data in the range of [2,5], the node can select the noisy histogram of {[2,3],[4,5]5} for summary and respond to the data analyst.

[0053] The differential privacy method based on dynamic database histogram release in the embodiment of the present invention aims at the shortcomings of the existing technology and proposes a rationally designed, safe and efficient differential privacy method, that is, a tree structure is constructed for the current time node, the time is divided by the tree structure, and the data of each divided time period is differentially privately disturbed. The privacy cost is The noise value added to each time node is reduced, the query accuracy is improved, and it can be applied to any range count query. At the same time, only the histogram data of the time node needs to be summarized to respond to the query, and the query results can be responded to in a timely manner.

[0054] Another embodiment of the present invention provides a differential privacy system based on dynamic database histogram publishing, including:

[0055] A tree structure building module is used to build a tree structure according to time nodes after receiving a data query request based on a histogram in any time range;

[0056] Histogram summary module, used to count and summarize the histograms of all time nodes in the tree structure;

[0057] The histogram noise adding and publishing module is used to add noise that satisfies differential privacy to the histogram of each time node, obtain the noisy histogram and publish it;

[0058] The query request response module is used to select and summarize the noise-added histogram at the target time node to respond to the data query request.

[0059] The data of a dynamic database changes with time, and its data volume increases with time. Compared with static data query, the data in the dynamic database changes in real time, and its query will also change with the change of data volume and query conditions, which increases the performance requirements for dynamic data query. At present, the differential privacy scheme for dynamic database query only perturbs the data or query results at each time node, resulting in excessive consumption of privacy cost and introduction of too much noise, and the query can only query the data of a certain time node, and cannot select the data between any time nodes for range query. According to the scheme proposed in the embodiment of the present invention, after receiving a data query request based on a histogram in any time range, a tree structure is constructed according to the time node, and the time is divided based on the tree structure, which reduces the disturbance of noise, thereby improving the accuracy of histogram release. In addition, the present invention constructs a tree structure according to the time node, which can be applied to data query based on the histogram in any time range. In addition, the present invention uses a tree structure to summarize and perturb all node histograms to respond to any query of the data analyst in a timely manner, further improving the real-time nature of the query feedback.

[0060] Another embodiment of the present invention further provides an electronic device, comprising:

[0061] A memory storing at least one instruction; and a processor executing the instruction stored in the memory to implement the differential privacy method based on dynamic database histogram publishing.

[0062] Another embodiment of the present invention further proposes a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the differential privacy method based on dynamic database histogram publishing is implemented.

[0063] Exemplarily, the instructions stored in the memory may be divided into one or more modules / units, which are stored in a computer-readable storage medium and executed by the processor to complete the differential privacy method based on dynamic database histogram publishing of the present invention. The one or more modules / units may be a series of computer-readable instruction segments capable of completing specific functions, which are used to describe the execution process of the computer program in the server.

[0064] The electronic device may be a computing device such as a smart phone, a notebook, a PDA, and a cloud server. The electronic device may include, but is not limited to, a processor and a memory. Those skilled in the art will appreciate that the electronic device may also include more or fewer components, or a combination of certain components, or different components, for example, the electronic device may also include an input / output device, a network access device, a bus, etc.

[0065] The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0066] The memory may be an internal storage unit of the server, such as a hard disk or memory of the server. The memory may also be an external storage device of the server, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the server. Furthermore, the memory may include both an internal storage unit of the server and an external storage device. The memory is used to store the computer-readable instructions and other programs and data required by the server. The memory may also be used to temporarily store data that has been output or is to be output.

[0067] It should be noted that the information interaction, execution process and other contents between the above-mentioned module units are based on the same concept as the method embodiment. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0068] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0069] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera device / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), electrical carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a disk or an optical disk.

[0070] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0071] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A differential privacy method based on dynamic database histogram publishing, characterized in that: include: After receiving a data query request based on a histogram in any time range, a tree structure is constructed according to the time nodes; Count and summarize the histograms of all time nodes in the tree structure; Add noise that satisfies differential privacy to the histogram of each time node, obtain the noisy histogram and publish it; Select and summarize the noise-added histogram at the target time node to respond to the data query request; In the step of constructing a tree structure according to time nodes, the timestamps are divided using the hierarchical structure of the binary tree, according to the formula Divide the timestamp into disjoint periodic data, where: ; Adding noise that satisfies differential privacy to the histogram of each time node includes: Add noise that satisfies differential privacy to the histogram of each time node according to the hierarchical structure of the binary tree, including periodic data divided by timestamp , , add a histogram of size 1 to all time nodes in the divided time period. The noise, At the expense of privacy, Represents a function that obeys the Laplace distribution, and obtains the noisy histogram of each time node ; The histogram of all time nodes of the tree structure that is counted and summarized includes: Perform histogram statistics on the data at each time node , and store the histogram in the leaf nodes of the tree structure; according to the tree structure, the histogram of each leaf node is summarized upward to obtain the histogram of all leaf nodes. The summary rule for summarizing upward is that the parent node is the sum of all corresponding child nodes.

2. The differential privacy method based on dynamic database histogram publishing according to claim 1, characterized in that: In the step of selecting and summarizing the noisy histograms on the target time nodes to respond to the data query request, the time nodes of the interval included in the query request are selected from top to bottom for each tree structure, and the minimum number of time nodes is selected to represent the query interval.

3. The differential privacy method based on dynamic database histogram publishing according to claim 1 is characterized in that: An untrusted data analyst makes a histogram-based data query request for any time range to the server. The server publishes the histogram in a perturbed manner according to the dynamic database and responds to the data analyst's data query request.

4. A differential privacy system based on dynamic database histogram publishing, characterized in that: include: A tree structure building module is used to build a tree structure according to time nodes after receiving a data query request based on a histogram in any time range; In the step of constructing a tree structure according to time nodes, the timestamps are divided using the hierarchical structure of the binary tree, according to the formula Divide the timestamp into disjoint periodic data, where: ; Histogram summary module, used to count and summarize the histograms of all time nodes in the tree structure; The histogram of all time nodes of the tree structure that is counted and summarized includes: Perform histogram statistics on the data at each time node , and store the histogram in the leaf nodes of the tree structure; according to the tree structure, the histogram of each leaf node is aggregated upward to obtain the histogram of all leaf nodes, and the aggregation rule for the upward aggregation is that the parent node is the sum of all corresponding child nodes; The histogram noise adding and publishing module is used to add noise that satisfies differential privacy to the histogram of each time node, obtain the noisy histogram and publish it; adding noise that satisfies differential privacy to the histogram of each time node includes: Add noise that satisfies differential privacy to the histogram of each time node according to the hierarchical structure of the binary tree, including periodic data divided by timestamp , , add a histogram of size 1 to all time nodes in the divided time period. The noise, At the expense of privacy, Represents a function that obeys the Laplace distribution, and obtains the noisy histogram of each time node ; The query request response module is used to select and summarize the noise-added histogram at the target time node to respond to the data query request.

5. An electronic device, characterized in that: include: A memory storing at least one instruction; and a processor, executing instructions stored in the memory to implement the differential privacy method based on dynamic database histogram publishing as described in any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the differential privacy method based on dynamic database histogram publishing as described in any one of claims 1 to 3 is implemented.

Images