A data protection method and related equipment

Abstract

The present application discloses a method and related equipment for data protection, which is applied to a terminal device, wherein the method includes: determining target combination data that meets preset conditions from M combination data, where M is an integer greater than or equal to 1; determining the number of candidate combination data corresponding to the target combination data based on N candidate sets corresponding to N characters contained in the target combination data, where N is an integer greater than 1; splitting the target combination data based on the number of candidate combination data to generate multiple sub-data; performing noise processing on the multiple sub-data respectively to generate first noise-added data, and sending the first noise-added data to a server. By adopting the embodiments of the present application, the accuracy of server recognition data can be improved on the basis of ensuring the security of user data.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a data protection method and related equipment. Background Art

[0002] In order to improve the end user experience, it is necessary to collect user data for intelligent analysis. For example, the server (also called the cloud or cloud server) collects multiple user data sent by the terminal device to analyze and improve the user experience. However, in the above data collection process, privacy data is always a controversial point. For example, when collecting topics that users are concerned about or applications installed on the user's terminal, the user's privacy information may be touched, such as geographic location, writing habits, etc.

[0003] In order to prevent user privacy leakage, differential privacy (DP) technology can be used to protect the user behavior data that needs to be counted. In the existing technology, one is that the terminal device splits the user data into combinations of equal length, scrambles each combination, and reports the scrambled combination to the server for analysis; the other is that the terminal device scrambles the entire combination and one of the fragments of the combination and reports it to the server, and then the server analyzes the reported data in combination with the fragment and the overall related information.

[0004] However, for combination type data in which the number of characters contained in the user data is too large, the number of candidate combination data formed by the combination type data is too large (for example, the number of candidate combination data is greater than 10). 7 ), and the amount of data of this combination type is small (for example, the amount of data is less than 10 4 ), processing user data through the above two existing technologies and reporting it to the server for analysis may increase the risk of user privacy leakage and affect the accuracy of the server's recognition of the reported data. Therefore, how to provide a data protection method that can improve the accuracy of server recognition data while ensuring the security of user data has become an urgent problem to be solved. Summary of the invention

[0005] The embodiments of the present application disclose a data protection method and related equipment, which improve the accuracy of server data identification while ensuring the security of user data.

[0006] In order to achieve the above technical objectives, the embodiments of the present application provide the following technical solutions:

[0007] In a first aspect, the present application provides a method for data protection, which is applied to a terminal device, and the method may include: determining target combination data that meets preset conditions from M combination data, wherein each combination data includes multiple characters, each character corresponds to a candidate set, and the candidate set includes multiple candidate characters of the same character type, and the multiple candidate characters include at least the character corresponding to the candidate set, and M is an integer greater than or equal to 1; based on N candidate sets corresponding to the N characters contained in the target combination data, determining the number of candidate combination data corresponding to the target combination data, wherein the candidate combination data is obtained by arranging and combining the candidate characters in each of the N candidate sets, and N is an integer greater than 1; based on the number of candidate combination data, splitting the target combination data to generate multiple sub-data; performing noise processing on the multiple sub-data respectively to generate first noisy data, and sending the first noisy data to a server.

[0008] When the server collects and analyzes terminal user data, in order to prevent user privacy leakage, differential privacy technology is usually used to protect the user behavior data that needs to be counted. However, when the existing differential privacy technology is used to process user data and report it to the server for analysis, there may be data duplication or intersection, which increases the privacy budget of differential privacy, thereby increasing the risk of user privacy leakage. At the same time, for combination data with too many characters, the number of candidate combination data formed by the combination data is too large (for example, the number of candidate combination data is greater than 10). 7 ), and the amount of data of the combined data is small (for example, the amount of data is less than 10 4 ), the algorithm recognition effect of the server on the combined data is limited, thereby affecting the accuracy of the server identifying the data. In response to this technical problem, the embodiment of the present application can split and identify the combined data when the number of candidate sets of the combined data is large but the amount of original data is low, and the combined data needs to be processed for differential privacy protection, so that the split sub-data satisfies the parallel combination principle of differential privacy while the number of corresponding candidate combined data decreases exponentially, thereby improving the accuracy of the server identifying data without increasing the privacy budget and ensuring the security of user data. Specifically, the embodiment of the present application first simply filters out the combined data with a large number of candidate sets from a large amount of combined data, that is, determines the target combined data that meets the preset conditions from M combined data; then, since the screened combined data (that is, the target combined data) may contain too many corresponding candidate combined data (for example, the number of candidate combined data is greater than 10 7), and directly performing differential privacy processing on combination data with too many candidate combination data and reporting them to the server for analysis will increase the difficulty for the server to accurately identify the corresponding combination data from a large number of candidate combination data, thereby affecting the accuracy of the server in identifying the combination data. Therefore, for each target combination data in the target combination data that meets the preset conditions, it is necessary to determine the number of candidate combination data corresponding to the target combination data to determine whether the target combination data needs to be split to reduce the number of candidate combination data, that is, based on the candidate set corresponding to each character contained in the target combination data, the number of candidate combination data corresponding to the target combination data is calculated. Furthermore, based on the calculated number of candidate combination data, the target combination data is split, for example, the target combination data corresponding to a large number of candidate combination data is split, so that the number of candidate combination data corresponding to the multiple sub-data generated after the splitting is greatly reduced; each sub-data is further subjected to noise processing, and the noise processing may include, for example, determining the encoding data corresponding to the split sub-data and identifying the encoding data, and then determining the hash data corresponding to the encoding data and randomly adding noise and other processing steps to ensure that there is no data duplication or intersection in the encoding data corresponding to the split sub-data, thereby ensuring that the encoding data corresponding to the split sub-data satisfies the parallel combination principle of differential privacy; finally, the first noisy data generated after the noise processing is sent to the server for analysis, so as to further ensure the security of user data and the level of privacy protection during data transmission. Through the embodiments of the present application, combined data with too large a number of candidate combined data can be split in a targeted manner, so that the number of candidate combined data corresponding to the split sub-data decreases exponentially, thereby reducing the difficulty of the subsequent server identifying the corresponding sub-data through the algorithm, thereby improving the accuracy of the server identifying data; at the same time, through noise adding processing including processing steps such as encoding, identifying and adding random noise to the split sub-data, there is no data duplication or intersection in the encoded data corresponding to the split sub-data, so as to ensure that the split sub-data complies with the parallel combination principle of differential privacy, thereby achieving the improvement of the accuracy of the server identifying data without increasing the privacy budget and ensuring the security of user data.

[0009] In a possible implementation, the method further includes: obtaining P original data, the original data including one or more of the characters, P being an integer greater than or equal to 1; determining the original data whose number of characters contained in the P original data is greater than or equal to a first preset value as the combined data; and determining the original data whose number of characters contained in the P original data is less than the first preset value as non-combined data. In the embodiment of the present application, by judging whether the number of characters contained in the original data is greater than or equal to a first preset value (for example, 2), it is determined whether the original data is combined data, so that different processing can be performed on the combined data and the non-combined data respectively, so as to improve the accuracy and efficiency of the data protection method for processing different types of data.

[0010] In a possible implementation, the determining of the target combination data satisfying the preset condition from the M combination data may include: determining Q combination data satisfying the first condition from the M combination data, the first condition including the condition satisfied by the characters in the combination data; determining the combination data satisfying the second condition from the Q combination data as the target combination data satisfying the preset condition, the second condition including the condition satisfied by the candidate set corresponding to the characters in the combination data. The embodiment of the present application firstly filters out the Q combination data satisfying the first condition from the M combination data by the condition satisfied by the characters in the combination data (that is, the first condition), and then filters out the target combination data satisfying the preset condition from the Q combination data by the condition satisfied by the candidate set corresponding to the characters in the combination data (that is, the second condition), so that the terminal device can accurately and efficiently determine the target combination data satisfying the preset condition from a large amount of combination data, so as to improve the accuracy and processing efficiency of the data processing process.

[0011] In a possible implementation, determining Q combination data satisfying the first condition from the M combination data may include: querying, for the M combination data, whether relevant characters of the corresponding combination data are stored in the target device; the relevant characters include one or more candidate characters in a candidate set corresponding to at least one character in the corresponding combination data, and the target device includes the terminal device and / or the server; among the M combination data, the combination data corresponding to the relevant characters stored in the target device are determined to be Q combination data, where Q is an integer less than or equal to M. In the embodiment of the present application, the step of determining Q combination data satisfying the first condition from M combination data may specifically include: firstly querying each combination data in the M combination data to determine whether the target device including the terminal device and / or the server stores the relevant characters of the corresponding combination data, that is, one or more candidate characters in the candidate set corresponding to at least one character in the corresponding combination data; illustratively, assuming that the characters contained in one combination data in the M combination data are "today it rains", and each character in the combination data is a Chinese character, then the candidate sets corresponding to each character in the combination data are all Chinese character candidate sets (about 3500 commonly used Chinese characters), and accordingly, querying the characters in the combination data to determine whether one or more Chinese characters (that is, candidate characters) in the Chinese character candidate set are stored in the target device (such as the terminal device and / or the server), so as to determine whether the target device stores the relevant characters of the combination data. Further, the combination data in the M combination data corresponding to the relevant characters stored in the target device (such as the terminal device and / or the server) are determined as Q combination data. The embodiment of the present application can simply and quickly determine the combination data (that is, Q combination data) that meets the first condition from a large amount of combination data (that is, M combination data) through local query, thereby significantly improving the performance and processing efficiency of the terminal device in processing a large amount of combination data.

[0012] In a possible implementation, determining the combination data satisfying the second condition among the Q combination data as the target combination data satisfying the preset condition may include: determining the total number of candidate characters corresponding to each combination data among the Q combination data; the total number of candidate characters is the total number of non-repeated candidate characters in multiple candidate sets corresponding to multiple characters included in the corresponding combination data; and determining the combination data whose corresponding total number of candidate characters among the Q combination data is greater than or equal to a second preset value as the target combination data satisfying the preset condition. In an embodiment of the present application, the step of determining the combination data satisfying the second condition among the Q combination data as the target combination data satisfying the preset condition may specifically include: first, for the Q combination data corresponding to the relevant characters stored in the target device (such as a terminal device and / or a server) determined from the M combination data, determine the total number of candidate characters corresponding to each combination data in the Q combination data, that is, the total number of non-repeated candidate characters in multiple candidate sets corresponding to the multiple characters contained in the corresponding combination data, where Q is an integer less than or equal to M; illustratively, assuming whether the target device (such as a terminal device and / or a server) stores the relevant characters of the combination data "It's raining today", then determine the total number of non-repeated candidate characters in the four candidate sets corresponding to the four characters "today", "day", "have" and "rain" contained in the combination data "It's raining today". Since the Chinese character candidate set corresponding to these four characters is the same, and there are 3500 candidate characters in the Chinese character candidate set, the total number of candidate characters corresponding to the combination data "It's raining today" is 3500. Then, by judging whether the total amount of candidate characters corresponding to each of the Q combined data is greater than or equal to a second preset value (e.g., 1000), it is determined whether the corresponding combined data is the target combined data that meets the preset conditions, thereby determining the combined data whose total amount of candidate characters corresponding to the Q combined data is greater than or equal to the second preset value as the target combined data that meets the preset conditions. Through the embodiment of the present application, the target combined data that meets the preset conditions can be accurately and efficiently identified from the Q combined data, so as to facilitate further judgment and splitting processing of the target combined data in the subsequent process, thereby improving the accuracy and efficiency of the data protection method in identifying the target combined data that meets the preset conditions.

[0013] In a possible implementation, the method further includes: performing noise processing on the combined data and / or the non-combined data that do not meet the preset conditions in the M combined data to generate second noise-added data, and sending the second noise-added data to the server. In the embodiment of the present application, by adding noise to the combined data and the non-combined data that do not meet the preset conditions, and sending the noise-added second noise-added data to the server for data analysis, not only can the security of the combined data and the non-combined data that do not meet the preset conditions in the collected original data of the user be protected, but also the integrity of the original data of the user can be ensured, which is conducive to the accuracy and comprehensiveness of the subsequent server's analysis and identification of all data reported by the terminal device.

[0014] In a possible implementation, the splitting of the target combined data based on the number of the candidate combined data to generate a plurality of sub-data may include: determining whether the number of the candidate combined data is greater than or equal to a third preset value; if so, splitting the target combined data into the plurality of sub-data, wherein the number of candidate combined data corresponding to the plurality of sub-data after the splitting is less than the third preset value. In the embodiment of the present application, by determining whether the number of candidate combined data corresponding to the target combined data is greater than or equal to a third preset value (e.g., 10 7 ), determine whether to split the target combination data; further, when the number of candidate combination data corresponding to the target combination data is greater than or equal to a third preset value, the target combination data is split, so that the number of candidate combination data corresponding to the multiple sub-data generated after the split is less than the third preset value. Through the embodiment of the present application, the number of corresponding candidate combination data that is too large (for example, the number of candidate combination data is greater than 10) can be targeted. 7 ) is split into target combination data, so that the number of candidate combination data corresponding to the split sub-data decreases exponentially, thereby effectively improving the accuracy of subsequent server recognition of sub-data. It should be noted that, in some embodiments, for target combination data whose number of candidate combination data is less than the third preset value, the target combination data may not be split, and the target combination data may be directly classified into the sub-data set and combined with the sub-data generated by other splits for noise addition processing in parallel to generate the first noisy data. It is understandable that different embodiments may have other different processing methods for target combination data whose number of candidate combination data is less than the third preset value, and the embodiments of the present application are not limited to this.

[0015] In a possible implementation, the performing noise processing on the multiple sub-data to generate the first noisy data may include: mapping the multiple sub-data to determine the hash data corresponding to each sub-data; performing noise processing on the hash data to generate the first noisy data. In the embodiment of the present application, the multiple sub-data generated after the splitting are first mapped to determine the hash data corresponding to each sub-data, and the hash data are noise processed, so that the first noisy data after the noise is not easy to be reversely deduced into the original data content, thereby effectively preventing data leakage and information security risks, and ensuring the integrity and security of the data during processing and transmission.

[0016] In one possible implementation, the mapping of the multiple sub-data respectively to determine the hash data corresponding to each sub-data may include: encoding each sub-data among the multiple sub-data respectively to determine the coded data corresponding to the multiple sub-data respectively, wherein the coded data includes a flag bit for distinguishing different sub-data; mapping each of the coded data based on a preset hash function to determine the hash data corresponding to each sub-data among the multiple sub-data respectively. In the embodiment of the present application, the multiple sub-data generated after the split are encoded respectively, and the coded data (for example, binary coded data) corresponding to each sub-data is determined to ensure that each sub-data is converted into a code with a unified format or structure; and each coded data includes a flag bit for distinguishing different sub-data, which can ensure that the coded data corresponding to each sub-data will not be repeated or intersected, especially for the coded data corresponding to two sub-data with the same content, for example, the coded data is "001110010" and "101110010", where the first two bits "00" and "10" of the coded data are flag bits, so even if the content of the two sub-data is the same, the coded data can be distinguished by the flag bit to avoid the repetition or intersection of the coded data, so that the coded data corresponding to the split sub-data meets the parallel combination principle of differential privacy. Further, each coded data is mapped to the corresponding hash data through a preset hash function. Since the hash value is calculated based on the coded data, it has a high degree of uniqueness and irreversibility, which means that even a slight change in the coded data will result in a completely different hash value, effectively preventing the leakage or tampering of information, and ensuring the security of user data without increasing the privacy budget.

[0017] In a second aspect, the present application provides a method for data protection, which is applied to a server. The method may include: receiving multiple noisy data sent by a terminal device, the noisy data including first noisy data, the first noisy data being obtained by the terminal device based on the number of candidate combination data corresponding to each target combination data that meets a preset condition, and performing noise processing on multiple sub-data generated after splitting the corresponding target combination data, the candidate combination data being obtained by arranging and combining candidate characters in each candidate set corresponding to the N characters contained in each target combination data, where N is an integer greater than 1; determining multiple un-noised data corresponding to the multiple noisy data, the un-noised data including the multiple sub-data; and merging the same sub-data in the multiple un-noised data to generate a merged statistical result.

[0018] In the embodiment of the present application, after the server receives multiple noisy data sent by the terminal device, the noisy data includes the first noisy data obtained by performing a noise process on the sub-data generated after the target combination data is split based on the number of candidate combination data corresponding to each target combination data that meets the preset conditions, and the corresponding multiple non-noisy data are respectively determined based on the received multiple noisy data, and the non-noisy data includes the sub-data corresponding to the first noisy data; and the same sub-data in the multiple non-noisy data are further merged to generate a merged statistical result. Through the embodiment of the present application, since the first noisy data received by the server is obtained by performing a noise process on the sub-data generated after the target combination data is split by the terminal device, and the number of candidate combination data corresponding to the split sub-data decreases exponentially, the computational complexity of the server using an algorithm (such as a regression algorithm) to identify the sub-data corresponding to the first noisy data is reduced, so that the server can more accurately analyze and identify the sub-data corresponding to the first noisy data, thereby improving the accuracy of the server in identifying data. Furthermore, the server merges the same sub-data from multiple unnoised data, and the generated statistical results will not expose the specific information of the original data, while providing an overall description of the data characteristics, thus protecting user privacy while providing necessary information support for data analysis and decision-making.

[0019] In a possible implementation, the step of determining the multiple un-noised data corresponding to the multiple noisy data may include: performing denoising on the multiple noisy data to determine the multiple hash data corresponding to the multiple noisy data; mapping the multiple hash data respectively to determine the multiple coded data corresponding to the multiple hash data; and decoding the multiple coded data respectively to determine the multiple un-noised data corresponding to the multiple coded data. In the embodiment of the present application, the step of determining the multiple un-noised data corresponding to the multiple noisy data may include: first, removing or reducing the random noise introduced in the noisy data for protecting data privacy or increasing data security through denoising, so that the generated hash data is as close as possible to the original hash data in the un-noised state; then mapping the denoised hash data to the corresponding coded data through hash mapping, and further decoding the coded data, so that the server can restore the original un-noised data corresponding to each coded data. Through the embodiment of the present application, the efficiency and accuracy of the server in converting the noisy data into the un-noised data are effectively improved, providing a reliable basis and guarantee for data processing and analysis.

[0020] In a third aspect, an embodiment of the present application provides a data protection device, which is applied to a terminal device, and the device may include:

[0021] A first determining unit is used to determine target combination data that meets a preset condition from M combination data, wherein each combination data includes multiple characters, each character corresponds to a candidate set, the candidate set includes multiple candidate characters of the same character type, the multiple candidate characters at least include the character corresponding to the candidate set, and M is an integer greater than or equal to 1;

[0022] A second determining unit is used to determine the number of candidate combination data corresponding to the target combination data based on N candidate sets corresponding to the N characters included in the target combination data, wherein the candidate combination data is obtained by arranging and combining candidate characters in each of the N candidate sets, and N is an integer greater than 1;

[0023] a splitting unit, configured to split the target combined data based on the number of the candidate combined data to generate a plurality of sub-data;

[0024] A first noise adding unit, used for performing noise adding processing on the plurality of sub-data respectively to generate first noise adding data;

[0025] A first sending unit is configured to send the first noise-added data to a server.

[0026] In a possible implementation manner, the device further includes:

[0027] An acquisition unit, used for acquiring P original data, wherein the original data includes one or more characters, and P is an integer greater than or equal to 1;

[0028] A third determining unit, configured to determine the original data whose number of characters contained in the P original data is greater than or equal to a first preset value as the combined data;

[0029] The fourth determining unit is used to determine the original data whose number of characters included in the P original data is less than the first preset value as non-combined data.

[0030] In a possible implementation manner, the first determining unit is specifically configured to:

[0031] Determine Q combined data satisfying a first condition from the M combined data, where the first condition includes a condition satisfied by characters in the combined data;

[0032] The combined data satisfying the second condition among the Q combined data are determined as target combined data satisfying the preset condition, wherein the second condition includes a condition satisfied by a candidate set corresponding to the characters in the combined data.

[0033] In a possible implementation manner, the first determining unit is specifically configured to:

[0034] For the M combination data, query whether the target device stores relevant characters of the corresponding combination data; the relevant characters include one or more candidate characters in the candidate set corresponding to at least one character in the corresponding combination data, and the target device includes the terminal device and / or the server;

[0035] Among the M combination data, the combination data corresponding to the relevant characters stored in the target device are determined to be Q combination data, where Q is an integer less than or equal to M.

[0036] In a possible implementation manner, the first determining unit is specifically configured to:

[0037] Determine the total number of candidate characters corresponding to each combination data in the Q combination data; the total number of candidate characters is the total number of non-repeated candidate characters in multiple candidate sets corresponding to multiple characters included in the corresponding combination data;

[0038] The combination data whose corresponding total amount of candidate characters in the Q combination data is greater than or equal to the second preset value is determined as the target combination data that meets the preset condition.

[0039] In a possible implementation manner, the device further includes:

[0040] A second noise adding unit, configured to perform noise adding processing on the combined data that does not meet the preset condition and / or the non-combined data in the M combined data, so as to generate second noisy data;

[0041] The second sending unit is used to send the second noise-added data to the server.

[0042] In a possible implementation, the splitting unit is specifically used to:

[0043] Determining whether the number of candidate combination data is greater than or equal to a third preset value;

[0044] If so, the target combined data is split into the multiple sub-data, wherein the number of candidate combined data corresponding to the multiple sub-data after splitting is less than the third preset value.

[0045] In a possible implementation manner, the first noise adding unit is specifically configured to:

[0046] Mapping the plurality of sub-data respectively to determine hash data corresponding to each sub-data;

[0047] The hash data is subjected to noise addition processing to generate the first noise added data.

[0048] In a possible implementation manner, the first noise adding unit is specifically configured to:

[0049] Encode each of the plurality of sub-data respectively to determine the coded data respectively corresponding to the plurality of sub-data, wherein the coded data includes a flag bit for distinguishing different sub-data;

[0050] The respective encoded data are mapped based on a preset hash function to determine hash data corresponding to each sub-data in the plurality of sub-data.

[0051] In a fourth aspect, an embodiment of the present application provides a data protection device, which is applied to a server, and the device may include:

[0052] A receiving unit, configured to receive a plurality of noise-added data sent by a terminal device, wherein the noise-added data includes first noise-added data, which is obtained by performing noise-added processing on a plurality of sub-data generated after the terminal device splits the corresponding target combination data based on the number of candidate combination data corresponding to each target combination data satisfying a preset condition, wherein the candidate combination data is obtained by arranging and combining candidate characters in each candidate set of N candidate sets corresponding to the N characters contained in each target combination data, where N is an integer greater than 1;

[0053] a determining unit, configured to determine a plurality of un-noised data corresponding to the plurality of noisy data, wherein the un-noised data includes the plurality of sub-data;

[0054] The merging unit is used to merge the same sub-data in the plurality of non-noised data to generate a merged statistical result.

[0055] In a possible implementation manner, the determining unit is specifically configured to:

[0056] Performing noise reduction processing on the multiple noise-added data to determine multiple hash data corresponding to the multiple noise-added data;

[0057] Mapping the plurality of hash data respectively to determine a plurality of coded data corresponding to the plurality of hash data;

[0058] The plurality of encoded data are decoded respectively to determine a plurality of non-noised data corresponding to the plurality of encoded data.

[0059] In a fifth aspect, the present application provides a terminal device, which may include a processor and a memory, wherein the memory is used to store programs and various data, and the processor is used to call the program code stored in the memory so that the terminal device executes a method in any possible implementation of the first aspect above.

[0060] In a sixth aspect, the present application provides a server, which may include a processor and a memory, wherein the memory is used to store programs and various data, and the processor is used to call the program code stored in the memory so that the terminal device executes the method in any possible implementation of the second aspect above.

[0061] In the seventh aspect, the present application provides a computer-readable storage medium, which stores a computer program, and when the computer program is executed by a processor, it implements the method in any possible implementation of the first aspect above, or implements the method in any possible implementation of the second aspect above.

[0062] In an eighth aspect, an embodiment of the present application provides a computer program, which may include instructions. When the computer program is run on a computer, the computer executes a method in any possible implementation of the first aspect above, or executes a method in any possible implementation of the second aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1A It is a schematic diagram of determining corresponding candidate combination data based on combination data provided by an embodiment of the present application.

[0064] Figure 1B It is a schematic diagram of determining candidate combined data corresponding to split sub-data based on combined data provided by an embodiment of the present application.

[0065] Figure 1C This is a schematic diagram of the parallel combination principle of differential privacy provided in an embodiment of the present application.

[0066] Figure 2 It is a schematic diagram of a system architecture applicable to a data protection method provided in an embodiment of the present application.

[0067] Figure 3A It is a schematic diagram of the hardware structure of a terminal device 100 provided in an embodiment of the present application.

[0068] Figure 3B It is a software structure block diagram of a terminal device 100 provided in an embodiment of the present application.

[0069] Figure 4 It is a schematic structural diagram of a server 200 provided in an embodiment of the present application.

[0070] Figure 5 It is a schematic flowchart of data protection provided in an embodiment of the present application.

[0071] Fig. 6A It is a flowchart of a data protection method provided in an embodiment of the present application.

[0072] Figure 6B It is a schematic diagram of determining related characters corresponding to combined data provided by an embodiment of the present application.

[0073] Figure 7 It is a flowchart of another data protection method provided in an embodiment of the present application.

[0074] Fig. 8A It is a specific flow chart of a mode selection module 1011 in a terminal device 100 provided in an embodiment of the present application.

[0075] Figure 8B It is a specific flow chart of a combined data processing module 1012 in a terminal device 100 provided in an embodiment of the present application.

[0076] Figure 8C It is a specific flow chart of a parallel sub-data mapping module 1013 in a terminal device 100 provided in an embodiment of the present application.

[0077] Fig.8D It is a schematic diagram of a noise adding process of a noise adding module 1014 in a terminal device 100 provided in an embodiment of the present application.

[0078] Fig. 8E It is a specific flow chart of the regression data mapping module 203 and the mapping data statistics module 204 in the server 200 provided in an embodiment of the present application.

[0079] Fig. 9 It is a structural diagram of a data protection device 900 provided in an embodiment of the present application.

[0080] Fig.10 It is a structural diagram of a data protection device 1000 provided in an embodiment of the present application.

[0081] Fig.11 It is a structural diagram of another terminal device 100 provided in an embodiment of the present application.

[0082] Fig.12 It is a structural diagram of another server 200 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0083] The embodiments of the present application are described below in conjunction with the drawings in the embodiments of the present application.

[0084] The terms used in the following embodiments of the present application are only for the purpose of describing specific embodiments, and are not intended to be used as limitations on the embodiments of the present application. As used in the specification and the appended claims of the embodiments of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include plural expressions, unless there is a clear indication to the contrary in the context. It should also be understood that the term "and / or" used in the embodiments of the present application refers to and includes any or all possible combinations of one or more listed items.

[0085] The terms "first", "second", "third" and "fourth" etc. in the specification and claims of the present application and the drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0086] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0087] The term "user interface (UI)" in the following embodiments of the present application refers to a medium interface for interaction and information exchange between an application or operating system and a user, which realizes the conversion between the internal form of information and the form acceptable to the user. The user interface is a source code written in a specific computer language such as Java and extensible markup language (XML). The interface source code is parsed and rendered on an electronic device and finally presented as content that the user can recognize. The commonly used form of user interface is a graphical user interface (GUI), which refers to a user interface related to computer operations that is displayed in a graphical manner. It can be a visual interface element such as text, icons, buttons, menus, tabs, text boxes, dialog boxes, status bars, navigation bars, widgets, etc. displayed on the display screen of an electronic device.

[0088] First, some terms in the present application are explained to facilitate those skilled in the art to understand the embodiments of the present application.

[0089] (1) Differential Privacy (DP) is a privacy protection technology that balances data availability and individual privacy by introducing controllable noise during data analysis. Differential privacy introduces randomness into the data set, making the differences between query results for different individuals blurry and unreliable. These random operations allow useful statistical information to be extracted from the data set while protecting privacy. Differential privacy technology can be divided into two categories. In traditional application scenarios, a data center is required to collect and publish analytical data, which is called centralized differential privacy (CDP), while if private data is processed locally, it is called local differential privacy (LDP). For centralized differential privacy protection technology, a trusted third-party data collector is required to perform privacy processing on the data analysis results, while for local differential privacy technology, each user can process individual data independently, that is, the privacy processing process is transferred from the data collector to the individual user end, so the intervention of a trusted third party is no longer required, and the privacy attacks that may be caused by untrusted third-party data collectors are also avoided.

[0090] (2) The privacy budget is a numerical value, usually denoted by ε, which reflects the maximum information leakage allowed by the privacy protection technology. For example, for any localized differential privacy function , the domain is , the value range is , for any input , output , both have:

[0091]

[0092] Among them, the localized differential privacy technology ensures that the algorithm satisfies localized differential privacy by controlling the similarity of the output results of any two records, that is, the output is the same. , the attacker cannot confirm that the input is still The smaller the privacy budget ε is, the higher the similarity between the output results of any two records is, the smaller the maximum information leakage allowed by the privacy protection technology is, and the stronger the privacy protection is; vice versa.

[0093] (3) Candidate Set (CS): In differential privacy technology, candidate sets are usually used to describe a set of possible data values. For example, for a candidate set of Chinese characters, it can be understood as a set of predefined Chinese character sets, and the user’s real data value can be anonymized into one of these predefined character sets.

[0094] (4) Candidate combination data: In differential privacy technology, candidate combination data refers to a set of possible data sets that are pre-defined or enumerated in order to manage and process the combination form of data. For example, the candidate set corresponding to a Chinese character contains 3,500 different Chinese characters. Then for the combination data consisting of two Chinese characters, the number of candidate combination data will be 3,500 × 3,500.

[0095] (5) The parallel combination principle of differential privacy is mainly about the parallel principle of input data sets. Define the element x in the database set D protected by the differential privacy algorithm to be defined on the set R, that is, , so there is .make is a partition of the set R, which satisfies the following conditions:

[0096]

[0097] Assume that the combined data D can be split into sub-data , when all sub-data satisfy ε-differential privacy, that is, sub-data satisfy , then the differential privacy algorithm under the parallel combination of the combined data D satisfies ε-differential privacy.

[0098] (6) Hash Map (HM): In differential privacy protection technology, hash map is an important technical means for mapping original data to a hash value of fixed length (also called hash data). This technology is widely used in privacy protection because hash functions have the characteristics of irreversibility and determinism, which can help hide the details of the original data while maintaining the consistency and verifiability of data mapping.

[0099] First, the technical problems that this application specifically aims to solve are analyzed and proposed.

[0100] In order to improve the end-user experience, it is necessary to collect user data for intelligent analysis. For example, the server (also called the cloud or cloud server) collects multiple user data sent by the terminal device to analyze and improve the user experience. However, in the above data collection process, privacy data is always a controversial point. For example, when collecting topics that users are concerned about or applications installed on the user's terminal, the user's privacy information may be touched, such as geographic location, writing habits, etc. In order to prevent user privacy leakage, differential privacy technology can be used to protect the user behavior data that needs to be counted.

[0101] In the prior art, one method is that the terminal device splits the user data into combinations of equal length, scrambles each combination, and reports the scrambled combination to the server for analysis; the other method is that the terminal device scrambles the entire combination and one of the fragments of the combination and reports them to the server, and then the server analyzes the reported data based on the relevant information of the fragment and the whole.

[0102] However, if the combination as a whole or one of its fragments is scrambled, it will cause the differential privacy to send intersecting data, thereby increasing the privacy budget and making it more likely to have a privacy leak. If the combined data is simply split and scrambled, the split combinations may still have repeated combinations, causing data to intersect, failing to meet the parallel combination principle of differential privacy, thereby increasing the privacy budget and making it more likely to have a privacy leak. At the same time, for combination type data (that is, combination data) with too many characters, if the number of candidate combination data formed by the combination type data is too large (for example, the number of candidate combination data is greater than 10), the combination type data may be too large to be considered a privacy leak. 7 ), and the amount of data of this combination type is small (for example, the amount of data is less than 10 4 ), the server's algorithm recognition effect on the combined type of data is limited. Using the above two existing technologies to process user data and report it to the server for analysis may increase the risk of user privacy leakage and affect the accuracy of the server's recognition of reported data. Therefore, how to provide a data protection method that can improve the accuracy of server recognition data while ensuring the security of user data has become an urgent problem to be solved.

[0103] In response to the above technical problems, the present application provides a data protection method, which can split and identify the combined type data when the number of candidate sets of combined type data is large but the amount of original data is low, and the combined type data needs to be processed for differential privacy protection, so that the split sub-data meets the parallel combination principle of differential privacy, while the number of corresponding candidate combined data decreases exponentially, thereby improving the accuracy of server recognition data without increasing the privacy budget. For example, see Figure 1A , Figure 1A is a schematic diagram of determining corresponding candidate combination data based on combination data provided by an embodiment of the present application, for example Figure 1AAs shown in the figure, the combined data {005, 323, 490, 053, 790} is composed of 5 characters (assuming that the number of candidate characters in the candidate set corresponding to each character is 1000), wherein the candidate characters in the candidate set corresponding to each character can be represented by 000, 001, 002, ..., 999 respectively, and each character in the combined data is taken from the characters in the 1000 candidate characters (the combined data may include repeated characters), then the candidate combined data corresponding to the combined data {005, 323, 490, 053, 790} is as follows: Figure 1A As shown, the number of candidate combination data X = 1000 5 , which means X=10 15 Candidate combination data. If the complete data of the combination data {005, 323, 490, 053, 790} is directly differentially private, then based on 10 15 The combination data {005, 323, 490, 053, 790} may not achieve the expected regression effect (the recognition rate of high-frequency combinations> 50%). Therefore, by using the data protection method provided in the embodiment of the present application, the combination data {005, 323, 490, 053, 790} can be split into sub-data. For example, see Figure 1B , Figure 1B Schematic diagram of determining candidate combined data corresponding to the split sub-data based on combined data provided by an embodiment of the present application. Figure 1B As shown, assuming that the combined data {005, 323, 490, 053, 790} is split according to the rules of splitting in sequence according to the position of the characters, the sub-data after the split consists of 2 or 1 characters (it can also be split according to other rules, and the sub-data after the split can contain other more / fewer characters, which is not limited in the embodiment of the present application), generating three sub-data {005, 323}, {490, 053}, and {790}, and the number of candidate characters in the candidate set corresponding to each character in each sub-data is 1000, and the candidate characters in each candidate set can be represented by 000, 001, 002, ..., 999 respectively. Accordingly, the number of candidate combined data corresponding to these sub-data (that is, {005, 323}, {490, 053}, {790}) is X=1000 2 +1000, which is 10 6 +1000 candidate sets, the number of candidate combination data corresponding to the whole combination data {005, 323, 490, 053, 790} is X = 10 15Compared with the candidate combination data, the number of candidate combination data of the split sub-data decreases exponentially; and different identifiers are added to these split sub-data {005, 323}, {490, 053}, {790} respectively, so that there will be no intersection in the split sub-data, that is, the split sub-data satisfies the parallel combination principle of differential privacy. For example, please refer to Figure 1C , Figure 1C Schematic diagram of a parallel combination principle of differential privacy provided by an embodiment of the present application. Figure 1C As shown in Figure 1, the parallel combination principle of differential privacy is mainly about the parallel principle of input data sets. Assume that the element x in the database set D protected by the differential privacy algorithm is defined on the set R, that is, , so there is .make is a partition of R that satisfies the following conditions:

[0104]

[0105] Assume that the combined data D can be split into sub-data , when all sub-data satisfy ε-differential privacy, that is, sub-data satisfy , then the differential privacy algorithm under the parallel combination of the combined data D satisfies ε-differential privacy, thereby improving the accuracy of server recognition data without increasing the privacy budget.

[0106] It can be understood that for the specific description of the data protection method provided in the embodiment of the present application, reference can be made to the specific description in the following method embodiment, which will not be repeated here.

[0107] In order to facilitate the introduction of the data protection method provided by the embodiment of the present application, the system architecture on which the embodiment of the present application is based is first described.

[0108] For example, Figure 2 1 is a schematic diagram of a system architecture applicable to a data protection method provided in an embodiment of the present application. The system architecture may include a terminal device 100 and a server 200.

[0109] The terminal device 100 may also be referred to as user equipment (UE), mobile station (MS), mobile terminal (MT), etc., and is a device that provides voice / data connectivity to users, such as a handheld device with wireless connection function, a vehicle-mounted device, etc. At present, some examples of the terminal device 100 may be: a mobile phone, a tablet computer, a laptop computer, a PDA, a mobile internet device (MID), a wearable device, a virtual reality (VR) device, an augmented reality (AR) device, a wireless terminal in industrial control, a wireless terminal in self driving, a wireless terminal in remote medical surgery, a wireless terminal in smart grid, a wireless terminal in transportation safety, a wireless terminal in smart city, a wireless terminal device in smart home, etc.

[0110] The terminal device 100 in the embodiment of the present application can use the data stored in the terminal device 100 as the reported user data according to the user experience plan or other AI services, or obtain user data from other devices for reporting. In some embodiments, the terminal device 100 can report data according to preset rules, wherein the preset rules can be multiple, for example, it can include: when the terminal device 100 leaves the factory, it can be set to report the software name installed on the terminal device once every week, so that the terminal device can send the software name of all software installed on the terminal device as the reported user data to the server 200 every week. For another example, the terminal device 100 can also receive a reporting request when receiving the reporting request, for example, the terminal device 100 can receive the reporting request sent by the server 200, and the reporting request can carry the data information to be reported, and then the terminal device 100 obtains the data corresponding to the data information indicated by the reporting request as the reported user data.

[0111] In some embodiments, the user data reported in the embodiments of the present application may include any characters, and in particular may be Chinese characters, which may be reported according to their binary codes.

[0112] The server 200 may refer to a network device, for example, and the server 200 may also be referred to as a cloud side, a cloud side, a cloud side device, a cloud side server, etc.

[0113] A communication connection is established between the server 200 and the terminal device 100. The communication connection can be, for example, any wireless communication method based on a communication technology standard, such as long term evolution (LTE) communication, vehicle to everything (V2X), the fifth generation of mobile communication technology (5G), and communication methods that may exist in the future. This embodiment of the application is not limited to this.

[0114] Based on the above system architecture, the terminal device and server involved in the embodiments of the present application are introduced below.

[0115] For example, Figure 3A A schematic diagram of the hardware structure of a terminal device 100 provided in an embodiment of the present application is shown.

[0116] like Figure 3A As shown, the terminal device 100 may include a processor 101, a memory 102, a wireless communication module 103, a mobile communication module 104, an antenna 103A, an antenna 104A, a power switch 105, a sensor module 106, a focus motor 107, a camera 108, a display screen 109, etc. Among them, the sensor module 106 may include a gyroscope sensor 106A, an acceleration sensor 106B, an ambient light sensor 106C, an image sensor 106D, a distance sensor 106E, etc. Among them, the wireless communication module 103 may include a WLAN communication module, a Bluetooth communication module, etc. The above multiple parts can transmit data through a bus.

[0117] The processor 101 is the control center of the terminal device 100. It uses various interfaces and lines to connect various parts of the entire terminal device 100. By running or executing software programs and / or modules stored in the memory 102, and calling data stored in the memory 102, it executes various functions of the terminal device 100 and processes data, thereby controlling the terminal device 100 as a whole. Optionally, the processor 101 may include one or more processing units, for example: the processor 101 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), a controller, a video codec, a digital signal processor (digital signal processor, DSP), a baseband processor, and / or a neural-network processing unit (neural-network processing unit, NPU), etc. Among them, different processing units can be independent devices or integrated in one or more processors.

[0118] The memory 102 can be used to store software programs and modules. The processor 101 executes various functional applications and data processing of the terminal device 100 by running the software programs and modules stored in the memory 102. The memory 102 may include, but is not limited to, a read-only memory (ROM), a static random access memory (SRAM), a synchronous dynamic random access memory (SDRAM), or a random access memory (RAM). Further, the memory 102 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the terminal device 100 (such as audio data, a phone book, etc.), etc. Optionally, the memory 102 may also be set inside the processor 101 to store instructions and data. In addition, the processor 101 can enable the terminal device 100 to execute the control method of the prior art and the control method provided in the embodiment of the present application, or other applications and data processing by running instructions stored in the memory 102.

[0119] The wireless communication function of the terminal device 100 can be implemented through the antenna 103A, the antenna 104A, the mobile communication module 104, the wireless communication module 103, the modem processor and the baseband processor.

[0120] Antenna 103A and antenna 104A can be used to transmit and receive electromagnetic wave signals. Each antenna in terminal device 100 can be used to cover a single or multiple communication frequency bands. Different antennas can also be reused to improve antenna utilization.

[0121] The mobile communication module 104 can provide solutions for wireless communications including 2G / 3G / 4G / 5G, etc., applied to the terminal device 100. The mobile communication module 104 may include at least one filter, a switch, a power amplifier, a low noise amplifier (LNA), etc. The mobile communication module 104 can receive electromagnetic waves through the antenna 104A, and filter, amplify, etc. the received electromagnetic waves, and transmit them to the modulation and demodulation processor for demodulation. The mobile communication module 104 can also amplify the signal modulated by the modulation and demodulation processor, and convert it into electromagnetic waves for radiation through the antenna 104A.

[0122] The modulation and demodulation processor may include a modulator and a demodulator. The modulator is used to modulate the low-frequency baseband signal to be transmitted into a medium-high frequency signal. The demodulator is used to demodulate the received electromagnetic wave signal into a low-frequency baseband signal. The demodulator then transmits the demodulated low-frequency baseband signal to the baseband processor for processing. After the low-frequency baseband signal is processed by the baseband processor, it is transmitted to the application processor. The application processor outputs a sound signal through an audio device, or displays an image or video through the display screen 109.

[0123] The wireless communication module 103 can provide wireless communication solutions including wireless local area networks (WLAN), Bluetooth (BT), global navigation satellite system (GNSS), frequency modulation (FM), near field communication (NFC), infrared (IR), etc., applied to the terminal device 100. The wireless communication module 103 can be one or more devices integrating at least one communication processing module. The wireless communication module 103 receives electromagnetic waves via the antenna 103A, modulates the frequency of the electromagnetic wave signal and performs filtering, and sends the processed signal to the processor 101. The wireless communication module 103 can also receive the signal to be sent from the processor 101, modulate the frequency of the signal, amplify it, and convert it into electromagnetic waves for radiation through the antenna 103A.

[0124] The power switch 105 may be used to control the supply of power to the terminal device 100 .

[0125] The gyroscope sensor 106A can be used to determine the motion posture of the terminal device 100. In some embodiments, the angular velocity of the terminal device 100 around three axes (i.e., x, y, and z axes) can be determined by the gyroscope sensor 106A. The gyroscope sensor 106A can be used for anti-shake shooting. For example, when the shutter is pressed, the gyroscope sensor 106A detects the angle of the terminal device 100 shaking, calculates the distance that the lens module needs to compensate based on the angle, and allows the lens to offset the shaking of the terminal device 100 through reverse movement to achieve anti-shake. The gyroscope sensor 106A can also be used for navigation and somatosensory game scenes.

[0126] The acceleration sensor 106B can detect the magnitude of the acceleration of the terminal device 100 in various directions (generally three axes). When the terminal device 100 is stationary, the magnitude and direction of gravity can be detected. It can also be used to identify the posture of the terminal device. For example, the acceleration sensor 106B can be applied to applications such as horizontal and vertical screen switching, pedometers, etc.

[0127] The ambient light sensor 106C is used to sense the brightness of the ambient light. The terminal device 100 can adaptively adjust the brightness of the display screen 109 according to the sensed brightness of the ambient light. The ambient light sensor 106C can also be used to automatically adjust the white balance when taking pictures.

[0128] The image sensor 106D, also known as a photosensitive element, can utilize the photoelectric conversion function of the photoelectric device to convert the light image on the photosensitive surface into an electrical signal that is proportional to the light image. The image sensor can be a charge coupled device (CCD) sensor or a complementary metal-oxide-semiconductor (CMOS) sensor.

[0129] The distance sensor 106E can be used to measure the distance. The terminal device 100 can measure the distance by infrared or laser. In some shooting scenarios, the terminal device 100 can use the distance sensor 106E to measure the distance to achieve fast focusing.

[0130] The focus motor 107 can be used for fast focusing. The terminal device 100 can control the movement of the lens through the focus motor 107 to achieve automatic focusing.

[0131] The terminal device 100 can realize the shooting function through the ISP, the camera 108, the video codec, the GPU, the display screen 109 and the application processor.

[0132] The ISP is used to process the data fed back by the camera 108. For example, when taking a photo, the shutter is opened, and the light is transmitted to the camera photosensitive element through the lens. The light signal is converted into an electrical signal, and the camera photosensitive element transmits the electrical signal to the ISP for processing and converts it into an image visible to the naked eye. The ISP can also perform algorithm optimization on the noise and brightness of the image. The ISP can also optimize the exposure, color temperature and other parameters of the shooting scene. In some embodiments, the ISP can be set in the camera 108.

[0133] The camera 108 can be used to capture still images or videos. The object generates an optical image through the lens and projects it onto the image sensor. The image sensor can convert the optical signal into an electrical signal, and then transmit the electrical signal to the ISP to convert it into a digital image signal. The ISP can output the digital image signal to the DSP for processing. The DSP converts the digital image signal into an image signal in a standard RGB, YUV or other format. In some embodiments, the terminal device 100 may include 1 or N cameras 108, where N is a positive integer greater than 1.

[0134] The video codec is used to compress or decompress digital images. The terminal device 100 may support one or more image codecs. In this way, the terminal device 100 can open or save pictures or videos in multiple encoding formats.

[0135] The terminal device 100 can realize the display function through a GPU, a display screen 109 application processor, etc. The GPU is a microprocessor for image processing, connecting the display screen 109 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. The processor 101 may include one or more GPUs, which execute program instructions to generate or change display information.

[0136] The display screen 109 is used to display images, videos, etc. The display screen 109 includes a display panel. The display panel can be a liquid crystal display (LCD), an organic light-emitting diode (OLED), an active-matrix organic light-emitting diode or an active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (FLED), Miniled, MicroLed, Micro-oLed, a quantum dot light-emitting diode (QLED), etc. In some embodiments, the terminal device 100 may include 1 or N display screens 109, where N is a positive integer greater than 1.

[0137] It is to be understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on the terminal device 100. In other embodiments of the present application, the terminal device 100 may include more or fewer components than shown in the figure, or combine some components, or split some components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0138] The software system of the terminal device 100 may adopt a layered architecture, an event-driven architecture, a micro-kernel architecture, a micro-service architecture, or a cloud architecture. The present application embodiment takes a mobile operating system with a layered architecture as an example to exemplify the software structure of the terminal device 100.

[0139] Figure 3B It is a software structure block diagram of a terminal device 100 provided in an embodiment of the present application.

[0140] The layered architecture divides the software into several layers, each with clear roles and division of labor. The layers communicate with each other through software interfaces. In some embodiments, the mobile operating system is divided into four layers, from top to bottom: application layer, application framework layer / core service layer, system library and runtime, and kernel layer.

[0141] The application layer can include a series of application packages. Figure 3B As shown, the application package may include applications such as camera, gallery, calendar, call, map, navigation, WLAN, Bluetooth, music, video, short message, etc.

[0142] The application framework layer provides an application programming interface (API) and a programming framework for the applications in the application layer. The application framework layer includes some predefined functions.

[0143] like Figure 3B As shown, the application framework layer may include a window manager, a content provider, a view system, a phone manager, a resource manager, a notification manager, a differential privacy module, and the like.

[0144] The window manager is used to manage window programs. The window manager can obtain the display screen size, determine whether there is a status bar, lock the screen, capture the screen, etc.

[0145] Content providers are used to store and retrieve data and make it accessible to applications. The data may include videos, images, audio, calls made and received, browsing history and bookmarks, phone books, etc.

[0146] The view system includes visual controls, such as controls for displaying text, controls for displaying images, etc. The view system can be used to build applications. A display interface can be composed of one or more views. For example, a display interface including a text notification icon can include a view for displaying text and a view for displaying images.

[0147] The phone manager is used to provide communication functions of the terminal device 100, such as management of call status (including connection, disconnection, etc.).

[0148] The resource manager provides various resources for applications, such as localized strings, icons, images, layout files, video files, and so on.

[0149] The notification manager enables applications to display notification information in the status bar. It can be used to convey notification-type messages and can disappear automatically after a short stay without user interaction. For example, the notification manager is used to notify download completion, message reminders, etc. The notification manager can also be a notification that appears in the system top status bar in the form of a chart or scroll bar text, such as notifications of applications running in the background, or a notification that appears on the screen in the form of a dialog window. For example, a text message is displayed in the status bar, a prompt sound is emitted, the terminal device vibrates, the indicator light flashes, etc.

[0150] The differential privacy module can be used to execute part or all of the steps of the data protection method provided in the embodiment of the present application on the terminal device side. For the specific description of the data protection method provided in the embodiment of the present application on the terminal device side, please refer to the relevant description in the following method embodiment, which will not be repeated here.

[0151] The runtime can refer to all code libraries, frameworks, etc. required for the program to run. For example, for the C language, the runtime includes a series of function libraries required for the C program to run. For the Java language, in addition to the core library, the runtime also includes the virtual machine required for the Java program to run. The above core library may include the function functions that the Java language needs to call.

[0152] The system library may include multiple functional modules, such as surface manager, media library, 3D graphics processing library (such as OpenGL ES), 2D graphics engine (such as SGL), etc.

[0153] The surface manager is used to manage the display subsystem and provide the fusion of 2D and 3D layers for multiple applications.

[0154] The media library supports playback and recording of a variety of commonly used audio and video formats, as well as static image files, etc. The media library can support a variety of audio and video encoding formats, such as: MPEG4, H.264, MP3, AAC, AMR, JPG, PNG, etc.

[0155] The 3D graphics processing library is used to implement 3D graphics drawing, image rendering, compositing, and layer processing.

[0156] A 2D graphics engine is a drawing engine for 2D drawings.

[0157] The kernel layer is the layer between hardware and software. The kernel layer contains at least display driver, camera driver, audio driver, and sensor driver.

[0158] For example, Figure 4 A schematic structural diagram of a server 200 provided in an embodiment of the present application is shown. The server 200 may include, but is not limited to, a data acquisition module 201, a differential aggregation denoising regression module 202, a regression data mapping module 203, a mapping data statistics module 204, etc., wherein the differential aggregation denoising regression module 202 may further specifically include an aggregation summary module 2021, a denoising module 2022, and a regression module 2023.

[0159] In some embodiments, the data acquisition module 201 is used to communicate with the terminal device 100, and can be specifically used to receive the noisy data sent by the terminal device 100. The differential aggregation denoising regression module 202 can be used to perform aggregation processing, denoising processing and linear regression processing on the noisy data after acquiring the noisy data sent by the terminal device 100 through the aggregation summary module 2021, denoising module 2022 and regression module 2023 specifically included therein, so as to restore the noisy data reported by the terminal device 100 to the corresponding hash data respectively. The regression data mapping module 203 is used to perform hash mapping on the determined hash data respectively to determine the coded data corresponding to each hash data respectively. The mapping data statistics module 204 is used to decode the mapped encoded data respectively to determine the un-noised data corresponding to each of the encoded data, wherein the un-noised data includes multiple sub-data obtained by splitting the combined data and sent by the terminal device 100, and further merge the same sub-data in the determined un-noised data to generate a merged statistical result, so that the statistical result can be used to generate various reports later, for example, information such as the usage rate of a certain software, the average number of uses per person, the retention rate, the time period distribution and the number of uses distribution.

[0160] It should be noted that Figure 4The module types included in the server 200 shown are only examples. In actual applications, the server 200 may also include more / fewer other types of modules. Different modules can be used to perform different functions, which is not limited in the embodiments of the present application.

[0161] In order to better understand the data protection method provided in the embodiment of the present application, the following is an exemplary introduction to the data flow between the various functional modules in the terminal device 100 and the server 200.

[0162] For example, see Figure 5 , Figure 5 A schematic flow chart of data protection provided in an embodiment of the present application. Figure 5 As shown, the execution subject of the process may include the corresponding Figure 3A and Figure 3B The terminal device 100 shown and the corresponding Figure 4 When the terminal device 100 obtains the original data that needs differential privacy protection, it first identifies or judges the original data through the mode selection module 1011 in the differential privacy module 110, determines the type of the original data, and selects the corresponding differential privacy mode. On the one hand, for the combined data that meets the conditions in the original data (that is, the target combined data), the combined data that meets the conditions is split by the combined data processing module 1012 in the differential privacy module 110, and the sub-data obtained after the split is further mapped into non-intersecting hash data (the hash data can be binary encoded data) by the parallel sub-data mapping module 1013 in the differential privacy module 110, and then the mapped hash data is noised by the noisy module 1014 in the differential privacy module 110, and the noisy hash data (that is, the first noisy data) is sent to the server 200 (that is, the noisy data is uploaded to the cloud); on the other hand, for the data that does not meet the conditions in the original data (that is, non-combined data and / or combined data that does not meet the preset conditions), the noise is directly processed by the noisy module 1014 in the differential privacy module 110, and the noisy data (that is, the second noisy data) is sent to the server 200 (that is, the noisy data is uploaded to the cloud). In some embodiments, the algorithm used by the noise adding module 1014 to add noise to data that does not meet the conditions in the original data (that is, non-combined data and / or combined data that does not meet the preset conditions) may be the same as or different from the algorithm used to add noise to combined data that meets the conditions in the original data (that is, target combined data), and the embodiments of the present application are not limited to this.

[0163] Further, after the server 200 obtains the noise-added data sent by the terminal device 100 through the data acquisition module 201, the server 200 transmits the collected noise-added data to the differential aggregation denoising regression module 202 for processing. Figure 5 As shown, in the differential aggregation denoising regression module 202, the noisy data is first aggregated by the aggregation summary module 2021, and then the aggregated noisy data is denoised by the denoising module 2022, and then the denoised data is subjected to linear regression processing by the regression module 2023, and the regression data finally outputted is the hash data corresponding to the noisy data. Further, the regression data (that is, the hash data) is hash mapped by the regression data mapping module 203, so as to determine the coded data corresponding to each hash data. Finally, the mapped coded data is decoded by the mapping data statistics module 204 to determine the un-noised data corresponding to each coded data, and the un-noised data includes a plurality of sub-data obtained by splitting the combined data sent by the terminal device 100, and further the same sub-data in the determined un-noised data are merged to generate the merged statistical results.

[0164] Among them, the specific processing process of the terminal device 100 on the original data through various modules, and the specific processing process of the server 200 on the noisy data reported by the terminal device 100 will be introduced below and will not be repeated here.

[0165] Based on the above Figure 2 The system architecture described, Figure 3A and Figure 3B The hardware and software architecture of the terminal device 100 is provided, Figure 4 The structure of the server 200 is provided, and Figure 5 The data flow between the various functional modules in the terminal device 100 and the server 200, combined with the image processing method provided in the embodiment of the present application, specifically analyzes and solves the technical problems raised in the present application.

[0166] For example, see Fig. 6A , Fig. 6A is a flow chart of a data protection method provided in an embodiment of the present application, which can be applied to the above Figure 2 The system architecture mainly includes the method steps for interaction between the terminal device 100 and the server 200. The terminal device 100 can be applied to the above Figure 3A and Figure 3B The hardware and software architecture of the terminal device 100 provided by Fig. 6A The method flow steps S601-S605 shown in FIG. 2 can be applied to Figure 4The structure of the server 200 is provided to support and execute Fig. 6A The method flow steps S606-S608 are shown in FIG.

[0167] Step S601: The terminal device 100 determines target combination data satisfying a preset condition from M combination data.

[0168] Specifically, the terminal device 100 determines the target combination data that meets the preset conditions from M combination data through the mode selection module 1011, each combination data includes multiple characters (especially Chinese characters), each character corresponds to a candidate set, each candidate set includes multiple candidate characters of the same character type, and the multiple candidate characters at least include the character corresponding to the candidate set, and M is an integer greater than or equal to 1. For example, for a combination data "8 o'clock in the morning" composed of 3 Chinese characters and 1 numeric character, each character corresponds to a candidate set, and the Chinese character candidate set corresponding to each Chinese character at least includes the corresponding Chinese character, such as 3500 commonly used Chinese characters; and the candidate set corresponding to the numeric characters in the combination data is a numeric candidate set that at least includes the number "8". In some embodiments, the characters in the embodiments of the present application can be any characters (such as English characters, numeric characters, etc.), and the embodiments of the present application are not limited to this.

[0169] In a possible implementation, the method also includes: obtaining P original data, the original data including one or more of the characters, P being an integer greater than or equal to 1; determining the original data in which the number of characters contained in the P original data is greater than or equal to a first preset value as the combined data; and determining the original data in which the number of characters contained in the P original data is less than the first preset value as non-combined data.

[0170] Specifically, the embodiment of the present application obtains P original data collected by the terminal device 100 through the mode selection module 1011, and then determines whether the original data is combined data by judging whether the number of characters contained in the original data is greater than or equal to a first preset value (for example, 2), so as to facilitate subsequent different processing for the combined data and non-combined data, so as to improve the accuracy and efficiency of the data protection method for processing different types of data.

[0171] In a possible implementation, determining the target combination data satisfying a preset condition from M combination data may include: determining Q combination data satisfying a first condition from the M combination data, wherein the first condition includes a condition satisfied by the characters in the combination data; and determining the combination data satisfying a second condition from the Q combination data as the target combination data satisfying the preset condition, wherein the second condition includes a condition satisfied by a candidate set corresponding to the characters in the combination data.

[0172] Specifically, the step of the terminal device 100 determining the target combination data satisfying the preset conditions from the M combination data through the mode selection module 1011 may specifically include: first, filtering out Q combination data satisfying the first condition from the M combination data through the condition satisfied by the characters in the combination data (that is, the first condition), and then filtering out the target combination data satisfying the preset conditions from the Q combination data through the condition satisfied by the candidate set corresponding to the characters in the combination data (that is, the second condition), so that the terminal device 100 can accurately and efficiently determine the target combination data satisfying the preset conditions from a large amount of combination data, so as to improve the accuracy and processing efficiency of the data processing process.

[0173] In a possible implementation, determining Q combination data satisfying the first condition from the M combination data may include: querying, for the M combination data, whether relevant characters of the corresponding combination data are stored in the target device; the relevant characters include one or more candidate characters in a candidate set corresponding to at least one character in the corresponding combination data, and the target device includes the terminal device and / or the server; among the M combination data, the combination data corresponding to the relevant characters stored in the target device are determined to be Q combination data, where Q is an integer less than or equal to M.

[0174] Specifically, the step of determining Q combination data satisfying the first condition from the M combination data by the mode selection module 1011 of the terminal device 100 may specifically include first querying each combination data in the M combination data to determine whether the target device including the terminal device and / or the server stores the relevant characters of the corresponding combination data, that is, one or more candidate characters in the candidate set corresponding to at least one character in the corresponding combination data. For example, see Figure 6B , Figure 6B is a schematic diagram of determining the relevant characters corresponding to the combination data provided by the embodiment of the present application. Assuming that the characters contained in one of the M combination data are "today it rains", the combination data "today it rains" can be represented by the numbers corresponding to the various Chinese characters included therein, for example, Figure 6BAs shown, the combined data can be represented by {0032, 1290, 2999, 1010}, and each Chinese character in the combined data corresponds to the same Chinese character candidate set including 3500 commonly used Chinese characters, and the Chinese character candidate set can be represented by {0000, 0001, 0002, ..., 3499}. Then, the embodiment of the present application can determine whether the target device stores the corresponding characters of the corresponding combined data by querying whether the target device (such as the terminal device 100 and / or the server 200) stores at least one character in the combined data (that is, at least one of the four Chinese characters of "Today there is rain") and one or more characters in the candidate set (that is, the Chinese character candidate set {0000, 0001, 0002, ..., 3499}). Further, query each combined data in the M combined data, and determine the combined data in the M combined data that stores the corresponding characters in the target device (such as the terminal device and / or the server) as Q combined data. The embodiment of the present application can simply and quickly determine the combination data (that is, Q combination data) that meets the first condition from a large amount of combination data (that is, M combination data) through local query, thereby significantly improving the performance and processing efficiency of the terminal device in processing a large amount of combination data.

[0175] In a possible implementation, determining the combination data satisfying the second condition among the Q combination data as the target combination data satisfying the preset condition may include: determining the total number of candidate characters corresponding to each combination data among the Q combination data; the total number of candidate characters is the total number of non-repeated candidate characters in multiple candidate sets corresponding to multiple characters included in the corresponding combination data; and determining the combination data whose corresponding total number of candidate characters among the Q combination data is greater than or equal to a second preset value as the target combination data satisfying the preset condition.

[0176] Specifically, regarding the step in which the terminal device 100 determines the combination data satisfying the second condition among the Q combination data as the target combination data satisfying the preset condition through the mode selection module 1011, it may specifically include: first, for the Q combination data corresponding to the relevant characters stored in the target device (such as the terminal device and / or the server) determined from the M combination data, determine the total number of candidate characters corresponding to each combination data in the Q combination data, that is, the total number of non-repeated candidate characters in the multiple candidate sets corresponding to the multiple characters contained in the corresponding combination data, Q being an integer less than or equal to M; illustratively, assuming that the target device (such as the terminal device and / or the server) stores the relevant characters of the combination data "It's raining today", then determine the total number of non-repeated candidate characters in the four candidate sets corresponding to the four characters "today", "day", "have" and "rain" contained in the combination data "It's raining today", that is, determine Figure 6B The total number of non-repeated candidate characters in the four Chinese character candidate sets corresponding to the combined data {0032, 1290, 2999, 1010} shown, and the Chinese character candidate set corresponding to each Chinese character in the combined data is {0000, 0001, 0002, ..., 3499}, so the total number of non-repeated candidate characters corresponding to the combined data is 3500. Then, by judging whether the total number of candidate characters corresponding to each combined data in the Q combined data is greater than or equal to the second preset value (for example, 1000), it is determined whether the corresponding combined data is the target combined data that meets the preset conditions, so that the combined data whose corresponding total number of candidate characters in the Q combined data is greater than or equal to the second preset value is determined as the target combined data that meets the preset conditions. Through the embodiment of the present application, the target combined data that meets the preset conditions can be accurately and efficiently identified from the Q combined data, so as to facilitate further judgment and splitting processing for the target combined data in the subsequent process, thereby improving the accuracy and efficiency of the data protection method in identifying the target combined data that meets the preset conditions.

[0177] Step S602: the terminal device 100 determines the number of candidate combination data corresponding to the target combination data based on the N candidate sets corresponding to the N characters included in the target combination data.

[0178] Specifically, since the target combination data may contain too many corresponding candidate combination data (for example, the number of candidate combination data is greater than 10 7 ), and directly performing differential privacy processing on the combination data with too many candidate combination data and reporting it to the server for analysis will increase the difficulty for the server to accurately identify the corresponding combination data from a large number of candidate combination data, thereby affecting the accuracy of the server in identifying the combination data. Therefore, the terminal device 100 determines the number of candidate combination data corresponding to the target combination data through the combination data processing module 1012 according to the N candidate sets corresponding to the N characters contained in the target combination data, so as to determine whether it is necessary to split the target combination data to reduce the number of candidate combination data. Among them, the candidate combination data is obtained by arranging and combining the candidate characters in each of the N candidate sets contained in the target combination data, and N is an integer greater than 1. For example, assuming that the N characters contained in the target combination data are "It's raining today", and the candidate set corresponding to each character contained in the target combination data is a Chinese character candidate set including 3500 commonly used Chinese characters, then the 3500 Chinese characters (that is, candidate characters) in each of the 4 Chinese character candidate sets corresponding to the target combination data are arranged and combined, and the number of candidate combination data obtained is X=3500. 2; The embodiment of the present application only takes the target combination data "It will rain today" as an example, and exemplarily introduces a method for determining the number of candidate combination data corresponding to the target combination data based on N candidate sets corresponding to the N characters contained in the target combination data. In some embodiments, the target combination data may include more / fewer numbers and / or types of characters (including but not limited to Chinese characters). Accordingly, the method for determining the candidate combination data corresponding to the target combination data may also be different, and the embodiment of the present application does not limit this.

[0179] Step S603: the terminal device 100 splits the target combined data based on the number of candidate combined data to generate multiple sub-data.

[0180] Specifically, the terminal device 100, through the combined data processing module 1012, splits the target combined data with a corresponding excessive number of candidate combined data according to the preset splitting rule based on the number of calculated candidate combined data, so that the number of candidate combined data corresponding to the multiple sub-data generated after the splitting is greatly reduced, thereby reducing the difficulty of the subsequent server to accurately identify the corresponding sub-data from the candidate combined data corresponding to the sub-data, so as to improve the accuracy of the server to identify the data. It can be understood that the preset splitting rule in the embodiment of the present application can be determined according to actual business needs, for example, it can be equal-length data splitting, or it can be other splitting methods, and the embodiment of the present application is not limited to this.

[0181] In a possible implementation, the target combined data is split based on the number of the candidate combined data to generate multiple sub-data, which may include: determining whether the number of the candidate combined data is greater than or equal to a third preset value; if so, splitting the target combined data into the multiple sub-data, wherein the number of candidate combined data corresponding to the multiple sub-data after splitting is less than the third preset value.

[0182] Specifically, the terminal device 100 determines through the combined data processing module 1012 whether the number of candidate combined data corresponding to the target combined data is greater than or equal to a third preset value (for example, 10 7 ), determine whether to split the target combination data; further, when the number of candidate combination data corresponding to the target combination data is greater than or equal to a third preset value, split the target combination data so that the number of candidate combination data corresponding to the multiple sub-data generated after splitting is less than the third preset value. Through the embodiment of the present application, the number of corresponding candidate combination data that is too large (for example, the number of candidate combination data is greater than 10) can be targeted. 7) is split, so that the number of candidate combination data corresponding to the split sub-data decreases exponentially, thereby effectively improving the accuracy of subsequent server recognition of sub-data. It should be noted that, in some embodiments, for target combination data whose number of candidate combination data is less than the third preset value, the target combination data may not be split, and the target combination data may be directly classified into a sub-data set, and noise processing is performed in parallel with other sub-data generated by splitting to generate first noisy data. It is understandable that different embodiments may have other different processing methods for target combination data whose number of candidate combination data is less than the third preset value, and the embodiments of the present application are not limited to this.

[0183] Step S604: the terminal device 100 performs noise addition processing on the plurality of sub-data respectively to generate first noisy data.

[0184] Specifically, the terminal device 100 can perform noise addition processing on each sub-data through the parallel sub-data mapping module 1013 and the noise addition module 1014 to generate first noisy data, thereby effectively protecting the user's privacy information in the original data and ensuring the security of the user data.

[0185] In a possible implementation, the noise processing of the multiple sub-data respectively to generate the first noisy data may include: mapping the multiple sub-data respectively to determine the hash data corresponding to each sub-data; and noise processing the hash data to generate the first noisy data.

[0186] Specifically, the terminal device 100 first maps the multiple sub-data generated after the splitting through the parallel sub-data mapping module 1013, determines the hash data corresponding to each sub-data, and further performs noise processing on these hash data through the noise adding module 1014, so that the first noisy data after the noise is not easy to be reversely deduced from the original data content, thereby effectively preventing data leakage and information security risks, and ensuring the integrity and security of the data during the processing and transmission process.

[0187] In one possible implementation, the mapping of the multiple sub-data respectively to determine the hash data corresponding to each sub-data may include: encoding each sub-data among the multiple sub-data respectively to determine the coded data corresponding to the multiple sub-data respectively, wherein the coded data includes a flag bit for distinguishing different sub-data; mapping each of the coded data based on a preset hash function to determine the hash data corresponding to each sub-data among the multiple sub-data respectively.

[0188] Specifically, the terminal device 100 encodes the multiple sub-data generated after the splitting through the parallel sub-data mapping module 1013, and determines the coded data (for example, binary coded data) corresponding to each sub-data, so as to ensure that each sub-data is converted into a code with a unified format or structure; and each coded data includes a flag bit for distinguishing different sub-data, which can ensure that the coded data corresponding to each sub-data will not be repeated or intersected, especially for the coded data corresponding to two sub-data with the same content, for example, the coded data are "001110010" and "101110010", where the first two bits of the coded data "00" and "10" are flag bits. Therefore, even if the contents of the two sub-data are the same, the coded data can be distinguished by the flag bit to avoid duplication or intersection of the coded data, so that the coded data corresponding to the split sub-data satisfies the parallel combination principle of differential privacy. Further, through the parallel sub-data mapping module 1013, each encoded data is mapped to corresponding hash data according to a preset hash function. Since the hash value is calculated based on the encoded data, it is highly unique and irreversible, which means that even a slight change in the encoded data will result in a completely different hash value, effectively preventing information leakage or tampering, and ensuring the security of user data without increasing the privacy budget.

[0189] Step S605 : the terminal device 100 sends the first noise-added data to the server 200 .

[0190] Furthermore, the terminal device 100 sends the generated noisy sub-data (ie, the first noisy data) to the server 200 for analysis and processing through the noisy module 1014 to ensure the security of the data transmission process.

[0191] In a possible implementation, the method further includes: performing noise processing on the combined data that does not meet the preset condition and / or the non-combined data in the M combined data to generate second noisy data, and sending the second noisy data to the server.

[0192] Specifically, the terminal device 100 can also add noise to the combined data and / or non-combined data that do not meet the preset conditions through the noise adding module 1014, and send the second noisy data after adding noise to the server 200 for data analysis, which can not only protect the security of the combined data and non-combined data that do not meet the preset conditions in the collected original data of the user, but also ensure the integrity of the original data of the user, which is conducive to the accuracy and comprehensiveness of the subsequent server's analysis and identification of all data reported by the terminal device. It can be understood that in some embodiments, the algorithm for adding noise to the hash data corresponding to the split sub-data by the noise adding module 1014 and the algorithm for adding noise to the combined data and / or non-combined data that do not meet the preset conditions can be the same or different, and the embodiments of the present application are not limited to this.

[0193] Step S606 : the server 200 receives a plurality of noise-added data sent by the terminal device 100 .

[0194] Specifically, the server 200 receives multiple noisy data sent by the terminal device 100 through the data acquisition module 201, and the noisy data includes the first noisy data obtained by the terminal device performing noisy processing on the sub-data generated after splitting the target combination data based on the number of candidate combination data corresponding to each target combination data that meets the preset conditions, wherein the candidate combination data is obtained by arranging and combining candidate characters in each candidate set corresponding to the N characters contained in each target combination data, and N is an integer greater than 1.

[0195] Step S607: the server 200 determines a plurality of non-noised data corresponding to the plurality of noisy data.

[0196] Specifically, the server 200 can respectively determine the multiple un-noised data corresponding to the multiple received noisy data through the differential aggregation denoising regression module 202, and the un-noised data includes the sub-data corresponding to the first noisy data. Through the embodiment of the present application, since the first noisy data received by the server is obtained by performing a noise process on the sub-data generated after the terminal device splits the target combined data, and the number of candidate combined data corresponding to the split sub-data decreases exponentially, the computational complexity of the server using an algorithm (such as a regression algorithm) to identify the sub-data corresponding to the first noisy data is reduced, so that the server can more accurately analyze and identify the sub-data corresponding to the first noisy data, thereby improving the accuracy of the server in identifying data.

[0197] In one possible implementation, determining the multiple un-noised data corresponding to the multiple noisy data may include: performing denoising processing on the multiple noisy data to determine the multiple hash data corresponding to the multiple noisy data; mapping the multiple hash data respectively to determine the multiple encoded data corresponding to the multiple hash data; and decoding the multiple encoded data respectively to determine the multiple un-noised data corresponding to the multiple encoded data.

[0198] Specifically, regarding how the server 200 determines the multiple un-noised data corresponding to the multiple noisy data, the steps may specifically include: firstly, aggregating, denoising, and regressing the multiple noisy data through the differential aggregation denoising regression module 202, removing or reducing the random noise introduced in the noisy data for protecting data privacy or increasing data security, so that the generated hash data is as close as possible to the original hash data in the un-noised state; then, the denoised hash data is hash mapped through the regression data mapping module 203, so as to map the multiple hash data to the corresponding encoded data respectively, and further, the mapped encoded data is decoded through the mapping data statistics module 204, so that the server can recover the original un-noised data corresponding to each encoded data. Through the embodiments of the present application, the efficiency and accuracy of the server in converting the noisy data into the un-noised data is effectively improved, providing a reliable basis and guarantee for data processing and analysis.

[0199] Step S608: the server 200 merges the same sub-data in the plurality of non-noised data to generate a merged statistical result.

[0200] Specifically, the server 200 merges the same sub-data in multiple un-noised data through the mapping data statistics module 204. The generated statistical results will not expose the specific information of the original data, and at the same time can provide an overall description of the data characteristics, while protecting user privacy and providing necessary information support for data analysis and decision-making.

[0201] See also Figure 7 , Figure 7 is a flow chart of another data protection method provided in an embodiment of the present application, which can be applied to the above Figure 2 The system architecture mainly includes the method steps for interaction between the terminal device 100 and the server 200. The terminal device 100 can be applied to the above Figure 3A and Figure 3B The hardware and software architecture of the terminal device 100 provided by Figure 7 The method flow steps S701-S715 shown in FIG. 1 , the server 200 can be applied to Figure 4 The structure of the server 200 is provided to support and execute Figure 7 The method flow steps S716-S720 are shown in FIG.

[0202] Step S701: The terminal device 100 obtains P original data.

[0203] Specifically, the original data acquired by the terminal device 100 includes one or more characters (especially Chinese characters, and may also include one or more other types of characters), and P is an integer greater than or equal to 1.

[0204] Optionally, the terminal device classifies the original data based on the number of characters contained in the P original data, and different processing flows correspond to different types of original data.

[0205] Case 1:

[0206] Step S702A: The terminal device 100 determines the original data whose number of characters in the P original data is greater than or equal to the first preset value as the combined data. After step S702A, the process proceeds to steps S703 to S713.

[0207] Specifically, the terminal device 100 compares the number of characters of each of the P original data with the first preset value through the mode selection module 1011, thereby determining the original data whose number of characters contained in the P original data is greater than or equal to the first preset value as the combined data. For example, the first preset value may be 2, and the terminal device 100 determines the original data containing 2 or more characters in the P original data as the combined data.

[0208] Case 2:

[0209] Step S702B: The terminal device 100 determines the original data whose number of characters in the P original data is less than the first preset value as non-combined data. After step S702B, the process proceeds to step S714-step S715.

[0210] Specifically, the terminal device 100 compares the number of characters of each of the P original data with the first preset value through the mode selection module 1011, thereby determining the original data whose number of characters contained in the P original data is less than the first preset value as non-combined data. For example, the first preset value can be 2, and the terminal device 100 determines the original data containing only a single character in the P original data as non-combined data.

[0211] Step S703: the terminal device 100 queries the target device for the M combination data to see whether the corresponding characters of the combination data are stored.

[0212] The relevant characters include one or more candidate characters in a candidate set corresponding to at least one character in the corresponding combination data, and the target device includes the terminal device 100 and / or the server 200 .

[0213] Step S704: The terminal device 100 determines the combination data of the M combination data, which have corresponding characters stored in the target device, as Q combination data.

[0214] Wherein, Q is an integer less than or equal to M. Specifically, for a detailed description of how the terminal device 100 determines Q combined data satisfying the first condition from the M combined data in steps S703-S704, see the above Fig. 6A The relevant description of step S601 in will not be repeated here.

[0215] Step S705: the terminal device 100 determines the total number of candidate characters corresponding to each combination data in the Q combination data.

[0216] The total number of candidate characters is the total number of non-repeated candidate characters in multiple candidate sets corresponding to the multiple characters included in the corresponding combination data.

[0217] Step S706: The terminal device 100 determines the combination data whose corresponding total number of candidate characters in the Q combination data is greater than or equal to the second preset value as the target combination data that meets the preset condition.

[0218] Specifically, the detailed description of how the terminal device 100 determines the target combination data satisfying the preset conditions from the Q combination data in the above steps S705-S706 can be found in the above Fig. 6A The relevant description of step S601 in will not be repeated here.

[0219] In some embodiments, based on the above Figure 7 The method steps described in steps S701 to S706 in the above Figure 5 The mode selection module 1011 included in the terminal device 100 is, illustratively, Fig. 8A FIG. 1 is a schematic diagram showing a specific flow chart of a mode selection module 1011 in a terminal device 100 provided in an embodiment of the present application. Fig. 8AAs shown, in the mode selection module 1011, the terminal device 100 first determines whether the acquired original data is combined data, for example, by determining whether the number of characters included in the original data is greater than or equal to a first preset value (for example, 2), to determine whether the original data is combined data; if so, then further query the elements in the combined data (that is, the characters included), and determine whether the terminal device and / or the server stores the relevant characters of the combined data by determining whether one or more candidate characters in the candidate set corresponding to each character in the combined data are stored in the terminal device and / or the server. If so, then calculate the number of elements of the combined data (that is, the total number of non-repeated candidate characters in multiple candidate sets corresponding to multiple characters included in the combined data) and determine whether the number of combined elements is greater than or equal to a second preset value (for example, 1000) to determine the processing mode corresponding to the combined data. If so, the combined data is the target combined data that meets the preset conditions, and the corresponding processing steps in the processing mode 1 are as follows, and the processing mode 1 may include but is not limited to the following processing steps of step S707 to step S712. Accordingly, for the original data whose judgment result is not combined data (that is, non-combined data), and / or the combined data of whether the relevant characters of the combined data are not found in the terminal device and / or the server, and / or the combined data of which the calculated number of elements is less than the second preset value, the corresponding processing steps in processing mode 2 may include but are not limited to the processing steps of the following steps S714-S715.

[0220] It can be understood that the embodiment of the present application only exemplarily introduces a possible implementation method of the processing flow of the mode selection module 1011 in the terminal device 100. In some embodiments, the mode selection module 1011 may also include other more / fewer processing steps, which is not limited by the embodiment of the present application.

[0221] Step S707: the terminal device 100 determines the number of candidate combination data corresponding to the target combination data based on the N candidate sets corresponding to the N characters included in the target combination data.

[0222] Specifically, the candidate combination data is obtained by arranging and combining the candidate characters in each of the N candidate sets, where N is an integer greater than 1. For a detailed description of step S707, please refer to the above Fig. 6A The relevant description of step S602 in will not be repeated here.

[0223] Step S708: the terminal device 100 determines whether the number of candidate combination data is greater than or equal to a third preset value.

[0224] Further, the terminal device 100 determines through the combined data processing module 1012 whether the number of candidate combined data corresponding to the target combined data is greater than or equal to a third preset value (for example, 10 7 ), to determine whether to split the target combination data.

[0225] Step S709: If yes, the terminal device 100 splits the target combined data into multiple sub-data.

[0226] The number of candidate combined data corresponding to the multiple sub-data generated after the splitting is less than the third preset value. Specifically, the above steps S708-S709 describe the specific steps of the terminal device 100 splitting the target combined data into multiple sub-data based on the number of candidate combined data, and the relevant description of the above step S603 can be referred to, which will not be repeated here.

[0227] Optionally, based on the above Figure 7 The specific steps of splitting the target combined data into multiple sub-data based on the number of candidate combined data described in steps S708-S709 can be applied to the above Figure 5 The combined data processing module 1012 in the terminal device 100 shown in FIG. In some embodiments, the specific processing flow of the combined data processing module 1012 can be found in Figure 8B , Figure 8B FIG. 1 is a schematic diagram showing a specific flow chart of a combined data processing module 1012 in a terminal device 100 provided in an embodiment of the present application. Figure 8B As shown, for the received combination data (that is, the target combination data that meets the preset conditions), the number of candidate combination data corresponding to the combination data is first calculated. For example, for a combination data composed of characters of the same type (such as Chinese characters) with a combination length (that is, the number of characters included) of n, and the number of characters in the candidate set corresponding to each character in the combination data is m, then the number of candidate combination data corresponding to the combination data is X=m n . Further determine whether the calculated X is greater than or equal to a threshold (that is, a third preset value, such as 10 7 ), if yes, the combined data is split, and the specific splitting method can be determined according to the actual business needs, for example, it can be split into equal-length data, and then the multiple sub-data after the split are calculated and judged until the number of candidate combined data corresponding to the multiple sub-data generated after the split is less than the threshold (that is, the third preset value, for example, 10 7), and the sub-data after the split that meets the requirements are classified into the sub-data set. For the target combined data whose number of candidate combined data corresponding to the combined data is less than the threshold (that is, the third preset value), the target combined data may not be split, and the target combined data may be directly classified into the sub-data set.

[0228] It can be understood that the embodiment of the present application only exemplarily introduces a possible implementation method of the specific processing flow of the combined data processing module 1012 in the terminal device 100. In some embodiments, the specific flow of the combined data processing module 1012 may also include other implementation methods, which is not limited by the embodiment of the present application.

[0229] Step S710: the terminal device 100 encodes each sub-data in the plurality of sub-data respectively to determine the coded data corresponding to the plurality of sub-data respectively.

[0230] The coded data includes a flag bit for distinguishing different sub-data.

[0231] Step S711: the terminal device 100 maps each coded data based on a preset hash function to determine hash data corresponding to each sub-data in the plurality of sub-data.

[0232] Step S712: The terminal device 100 performs noise processing on the hash data to generate first noisy data.

[0233] Step S713: the terminal device 100 sends the first noise-added data to the server 200 .

[0234] Specifically, the above steps S710 to S713 describe the specific steps of encoding, mapping and noise processing of the multiple sub-data after splitting by the terminal device 100 through the parallel sub-data mapping module 1013 and the noise adding module 1014, generating the first noisy data and sending it to the server 200, and the specific description thereof can be referred to the above Fig. 6A The relevant descriptions of steps S604 to S605 in will not be repeated here.

[0235] Optionally, based on the above Figure 7 The specific process described in step S710-step S711 can be applied to the above Figure 5 The parallel sub-data mapping module 1013 in the terminal device 100 is shown in FIG. 1013. In some embodiments, the specific processing flow of the combined data processing module 1012 can be found in FIG. Figure 8C , Figure 8C FIG. 1 shows a specific flow chart of a parallel sub-data mapping module 1013 in a terminal device 100 provided in an embodiment of the present application. Figure 8CAs shown, the sub-data a, sub-data b, sub-data c, and sub-data d generated after splitting are encoded respectively to determine the coded data 1, coded data 2, coded data 3, and coded data 4 corresponding to the sub-data a, sub-data b, sub-data c, and sub-data d, respectively, wherein the coded data 1, coded data 2, coded data 3, and coded data 4 can be binary coded data to ensure that each sub-data is converted into a code with a unified format or structure; and each coded data includes a flag bit for distinguishing different sub-data to ensure that the coded data corresponding to each sub-data will not be repeated or intersected. Further, based on a preset hash function, the coded data 1, coded data 2, coded data 3, and coded data 4 are mapped respectively to determine the corresponding hash data 1, hash data 2, hash data 3, and hash data 4. Since the data protected by the embodiment of the present application is defined on the set R, and is a partition of R, when the coded data 1, coded data 2, coded data 3, and coded data 4 corresponding to sub-data a, sub-data b, sub-data c, and sub-data d all satisfy ε-differential privacy, that is, When there is no intersection, the calculated hash data 1, hash data 2, hash data 3, and hash data 4 satisfy ε-differential privacy, thereby improving the accuracy of server data recognition without increasing the privacy budget.

[0236] It can be understood that the embodiment of the present application only exemplarily introduces a possible implementation method of the specific processing flow of the parallel sub-data mapping module 1013 in the terminal device 100. In some embodiments, the parallel sub-data mapping module 1013 can also process more / less sub-data, and its specific flow can also include other implementation methods, which are not limited by the embodiment of the present application.

[0237] For example, regarding the above Figure 5 For the specific processing flow of the noise adding module 1014 in the terminal device 100 shown in FIG. Fig.8D , Fig.8D 1 is a schematic diagram of a noise adding process of a noise adding module 1014 in a terminal device 100 provided in an embodiment of the present application. The main function of the noise adding module 1014 is to scramble the input hash data. The noise adding module 1014 is applicable to various types of local differential privacy algorithms (such as Google Rappor algorithm), such as Fig.8D As shown, in the hash data after noise addition, the 0 / 1 at certain positions is converted. It can be understood that the embodiment of the present application only exemplarily introduces a possible algorithm noise addition process of the noise addition module 1014. In some embodiments, the noise addition module 1014 can also use different noise addition algorithms for different types of hash data for noise addition, and the embodiment of the present application is not limited to this.

[0238] Step S714: the terminal device 100 performs noise processing on the combined data and / or non-combined data that do not meet the preset conditions in the M combined data to generate second noisy data.

[0239] Step S715: the terminal device 100 sends the second noise-added data to the server 200.

[0240] Specifically, for the determined terminal device 100, the non-combined data and / or the combined data that does not meet the preset conditions are directly denoised through the noise adding module 1014 to generate the second noisy data, that is, for the combined data of whether the relevant characters of the combined data are not found in the terminal device 100 and / or the server 200, and / or the combined data whose calculated number of elements is less than the second preset value, the noise is directly added to generate the second noisy data. The noisy second noisy data is further sent to the server 200 for analysis through the noise adding module 1014. It can be understood that there is no clear order between the above steps S707-step S712 and steps S714-step S715. Steps S707-step S712 can be executed before / after steps S714-step S715, and can also be executed simultaneously with steps S714-step S715. The embodiments of the present application are not limited to this.

[0241] Step S716: The server 200 receives a plurality of noise-added data sent by the terminal device.

[0242] Specifically, the server 200 receives multiple noisy data sent by the terminal device 100 through the data acquisition module 201, wherein the noisy data includes first noisy data, which is obtained by the terminal device 100, based on the number of candidate combination data corresponding to each target combination data that meets the preset conditions, by performing noisy processing on multiple sub-data generated after splitting the corresponding target combination data, and the candidate combination data is obtained by arranging and combining candidate characters in each candidate set corresponding to the N characters contained in each target combination data, where N is an integer greater than 1.

[0243] Step S717: the server 200 performs noise reduction processing on the multiple noisy data to determine multiple hash data corresponding to the multiple noisy data.

[0244] Step S718: The server 200 maps the multiple hash data respectively to determine the multiple encoded data corresponding to the multiple hash data.

[0245] Step S719: the server 200 decodes the plurality of encoded data respectively to determine a plurality of non-noised data corresponding to the plurality of encoded data.

[0246] Specifically, the above steps S717 to S719 describe the specific steps of the server 200 determining the multiple non-noised data corresponding to the multiple noisy data through the differential aggregation denoising regression module 202, and the specific description thereof can be found in the above Fig. 6A The relevant description of step S607 in will not be repeated here.

[0247] Step S720: the server 200 merges the same sub-data in the plurality of non-noised data to generate a merged statistical result.

[0248] Specifically, step S720 is similar to the above Fig. 6A The step S608 in is similar to that in the above Fig. 6A The relevant description of step S608 in will not be repeated here.

[0249] For example, based on the above Figure 7 The specific process described in step S717-step S720 in the above Figure 5 The regression data mapping module 203 and the mapping data statistics module 204 in the server 200 are shown in FIG. In some embodiments, the specific processing flow of the regression data mapping module 203 and the mapping data statistics module 204 can be found in FIG. Fig. 8E , Fig. 8E FIG. 2 shows a specific flow chart of a regression data mapping module 203 and a mapping data statistics module 204 in a server 200 provided in an embodiment of the present application. Fig. 8E As shown, the aggregated and regressed hash data are mapped respectively by the regression data mapping module 203, such as Fig. 8E The 1000 hash data 1, 500 hash data 2, 300 hash data 3, 200 hash data 4, and 700 hash data 5 shown in are hash mapped respectively to determine the 1000 coded data 1 corresponding to the 1000 hash data 1, the 500 coded data 2 corresponding to the 500 hash data 2, the 300 coded data 3 corresponding to the 300 hash data 3, the 200 hash data 4 corresponding to the 200 hash data 4, and the 700 coded data 5 corresponding to the 700 hash data 5. Further, the mapped coded data are decoded respectively by the mapping data statistics module 204 to restore the corresponding sub-data, and the same sub-data are statistically merged to finally obtain the merged statistical value of each sub-data. Fig. 8EAs shown, 1000 coded data 1, 500 coded data 2, 300 coded data 3, 200 hash data 4, and 700 coded data 5 are decoded respectively to obtain the corresponding statistical number of sub-data, wherein the sub-data corresponding to coded data 1 and coded data 5 are the same, so 1700 sub-data a, 500 sub-data b, 300 sub-data c, and 200 sub-data d are obtained by statistics, thereby obtaining the combined statistical results of each sub-data. It can be understood that the embodiment of the present application only exemplarily introduces a possible implementation method of processing data by the regression data mapping module 203 and the mapping data statistics module 204 in the server 200. In some embodiments, the regression data mapping module 203 and the mapping data statistics module 204 can also process more / less hash data, which is not limited by the embodiment of the present application.

[0250] The method of the embodiment of the present application is described in detail above, and the device provided by the embodiment of the present application is introduced next.

[0251] See also Fig. 9 , Fig. 9 1 is a schematic diagram of the structure of a data protection device 900 provided in an embodiment of the present application. The data protection device 900 can be applied to a terminal device 100, and the data protection device 900 can include a first determination unit 901, a second determination unit 902, a splitting unit 903, a first noise adding unit 904, and a first sending unit 905, wherein each unit is described in detail as follows.

[0252] A first determining unit 901 is used to determine target combination data that meets a preset condition from M combination data, wherein each combination data includes multiple characters, each character corresponds to a candidate set, the candidate set includes multiple candidate characters of the same character type, the multiple candidate characters include at least the character corresponding to the candidate set, and M is an integer greater than or equal to 1;

[0253] A second determining unit 902 is used to determine the number of candidate combination data corresponding to the target combination data based on N candidate sets corresponding to the N characters included in the target combination data, wherein the candidate combination data is obtained by arranging and combining candidate characters in each of the N candidate sets, and N is an integer greater than 1;

[0254] A splitting unit 903 is used to split the target combined data based on the number of the candidate combined data to generate a plurality of sub-data;

[0255] A first noise adding unit 904, configured to perform noise adding processing on the plurality of sub-data respectively to generate first noise adding data;

[0256] The first sending unit 905 is configured to send the first noisy data to a server.

[0257] In a possible implementation manner, the device further includes:

[0258] An acquisition unit, used for acquiring P original data, wherein the original data includes one or more characters, and P is an integer greater than or equal to 1;

[0259] A third determining unit, configured to determine the original data whose number of characters contained in the P original data is greater than or equal to a first preset value as the combined data;

[0260] The fourth determining unit is used to determine the original data whose number of characters included in the P original data is less than the first preset value as non-combined data.

[0261] In a possible implementation manner, the first determining unit 901 is specifically configured to:

[0262] Determine Q combined data satisfying a first condition from the M combined data, where the first condition includes a condition satisfied by characters in the combined data;

[0263] The combined data satisfying the second condition among the Q combined data are determined as target combined data satisfying the preset condition, wherein the second condition includes a condition satisfied by a candidate set corresponding to the characters in the combined data.

[0264] In a possible implementation manner, the first determining unit 901 is specifically configured to:

[0265] For the M combination data, query whether the target device stores relevant characters of the corresponding combination data; the relevant characters include one or more candidate characters in the candidate set corresponding to at least one character in the corresponding combination data, and the target device includes the terminal device 100 and / or the server 200;

[0266] Among the M combination data, the combination data corresponding to the relevant characters stored in the target device are determined to be Q combination data, where Q is an integer less than or equal to M.

[0267] In a possible implementation manner, the first determining unit 901 is specifically configured to:

[0268] Determine the total number of candidate characters corresponding to each combination data in the Q combination data; the total number of candidate characters is the total number of non-repeated candidate characters in multiple candidate sets corresponding to multiple characters included in the corresponding combination data;

[0269] The combination data whose corresponding total amount of candidate characters in the Q combination data is greater than or equal to the second preset value is determined as the target combination data that meets the preset condition.

[0270] querying each character in each of the M combined data respectively to determine whether the terminal device and / or the server stores relevant characters of the corresponding combined data; the relevant characters include one or more candidate characters in the candidate set corresponding to each character in the corresponding combined data;

[0271] For the Q combination data in which the relevant characters are stored in the terminal device and / or the server determined from the M combination data, determining the total number of non-repeated candidate characters in multiple candidate sets corresponding to the multiple characters included in each combination data in the Q combination data, where Q is an integer less than or equal to M;

[0272] Determine whether the total amount of the non-repeated candidate characters corresponding to each combination data in the Q combination data is greater than or equal to a second preset value;

[0273] The combination data whose total amount of the non-repeated candidate characters corresponding to the Q combination data is greater than or equal to the second preset value is determined as the target combination data satisfying the preset condition.

[0274] In a possible implementation manner, the device further includes:

[0275] A second noise adding unit, configured to perform noise adding processing on the combined data that does not meet the preset condition and / or the non-combined data in the M combined data, so as to generate second noisy data;

[0276] The second sending unit is used to send the second noise-added data to the server.

[0277] In a possible implementation, the splitting unit 903 is specifically configured to:

[0278] Determining whether the number of candidate combination data is greater than or equal to a third preset value;

[0279] If so, the target combined data is split into the multiple sub-data, wherein the number of candidate combined data corresponding to the multiple sub-data generated after the splitting is less than the third preset value.

[0280] In a possible implementation, the first noise adding unit 904 is specifically configured to:

[0281] Mapping the plurality of sub-data respectively to determine hash data corresponding to each sub-data;

[0282] The hash data is subjected to noise addition processing to generate the first noise added data.

[0283] In a possible implementation, the first noise adding unit 904 is specifically configured to:

[0284] Encode each of the plurality of sub-data respectively to determine the coded data respectively corresponding to the plurality of sub-data, wherein the coded data includes a flag bit for distinguishing different sub-data;

[0285] The respective encoded data are mapped based on a preset hash function to determine hash data corresponding to each sub-data in the plurality of sub-data.

[0286] It should be noted that the functions of the various units in the data protection device 900 described in the embodiment of the present application can be found in the relevant description of the above method embodiment, and will not be repeated here.

[0287] See also Fig.10 , Fig.10 1 is a schematic diagram of a data protection device 1000 provided in an embodiment of the present application. The data protection device 1000 can be applied to a server 200, and can include a receiving unit 1001, a determining unit 1002, and a merging unit 1003, wherein each unit is described in detail as follows.

[0288] A receiving unit 1001 is used to receive a plurality of noisy data sent by a terminal device, wherein the noisy data includes first noisy data, which is obtained by performing a noise process on a plurality of sub-data generated after the terminal device splits the corresponding target combination data based on the number of candidate combination data corresponding to each target combination data satisfying a preset condition, and the candidate combination data is obtained by arranging and combining candidate characters in each candidate set of N candidate sets corresponding to N characters contained in each target combination data, where N is an integer greater than 1;

[0289] A determining unit 1002 is configured to determine a plurality of un-noised data corresponding to the plurality of noisy data, wherein the un-noised data includes the plurality of sub-data;

[0290] The merging unit 1003 is used to merge the same sub-data in the multiple non-noised data to generate a merged statistical result.

[0291] In a possible implementation manner, the determining unit 1002 is specifically configured to:

[0292] Performing noise reduction processing on the multiple noise-added data to determine multiple hash data corresponding to the multiple noise-added data;

[0293] Mapping the plurality of hash data respectively to determine a plurality of coded data corresponding to the plurality of hash data;

[0294] The plurality of encoded data are decoded respectively to determine a plurality of non-noised data corresponding to the plurality of encoded data.

[0295] It should be noted that the functions of the various units in the data protection device 1000 described in the embodiment of the present application can be found in the relevant description of the above method embodiment, and will not be repeated here.

[0296] See also Fig.11 , Fig.11 1 is a schematic diagram of the structure of another terminal device 100 provided in an embodiment of the present application. Fig.11 As shown, the terminal device 100 may include at least one processor 1101 and a memory 1102. Specifically, the memory 1102 is used to store program instructions. The processor 1101 is used to call the program instructions stored in the memory 1102 so that the terminal device 100 can execute the steps in the data protection method provided in the embodiment of the present application. The description of its various components and related steps can be referred to above, and will not be repeated here.

[0297] It should be noted that the terminal device 100 provided in the embodiment of the present application may also include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or any combination of software and hardware.

[0298] See also Fig.12 , Fig.12 2 is a schematic diagram of the structure of another server 200 provided in an embodiment of the present application. Fig.12 As shown, the server 200 may include at least one processor 1201 and a memory 1202. Specifically, the memory 1202 is used to store program instructions. The processor 1201 is used to call the program instructions stored in the memory 1202, so that the server 200 can execute the steps in the data protection method provided in the embodiment of the present application. The description of its various components and related steps can refer to the above, and will not be repeated here.

[0299] It should be noted that the server 200 provided in the embodiment of the present application may also include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or any combination of software and hardware.

[0300] It is understandable that the apparatus and method provided in the above application embodiments can be implemented in other ways. For example, the system embodiments described above are merely schematic. For example, the division of the above modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0301] An embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable storage medium may store a program, and when the computer program is executed by a processor, it implements part or all of the steps of any one of the data protection methods recorded in the above method embodiments.

[0302] An embodiment of the present application also provides a computer program, which includes instructions. When the computer program is executed by a computing device, the computing device can execute part or all of the steps of any one of the above-mentioned data protection methods.

[0303] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0304] As used in the above embodiments, the term "when..." may be interpreted to mean "if..." or "after..." or "in response to determining..." or "in response to detecting...", depending on the context. Similarly, the phrases "upon determining..." or "if (the stated condition or event) is detected" may be interpreted to mean "if determining..." or "in response to determining..." or "upon detecting (the stated condition or event)" or "in response to detecting (the stated condition or event)", depending on the context.

[0305] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity of description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, some steps may be performed in other orders or simultaneously, or some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application. It should also be noted that the features and functions of two or more devices disclosed in the present invention can be concretized in one device. Conversely, the features and functions of a device described above can be further divided into being concretized by multiple devices.

[0306] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the present application is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0307] Those skilled in the art can understand that to implement all or part of the processes in the above-mentioned embodiments, the processes can be completed by computer programs to instruct related hardware, and the programs can be stored in computer-readable storage media. When the programs are executed, they can include the processes of the above-mentioned method embodiments. The aforementioned storage media include: ROM or random access memory RAM, magnetic disk or optical disk and other media that can store program codes.

[0308] In short, the above description is only an embodiment of the technical solution of this application, and is not intended to limit the protection scope of this application. Any modification, equivalent replacement, improvement, etc. made according to the disclosure of this application shall be included in the protection scope of this application.

Claims

1. A data protection method, characterized in that: Applied to a terminal device, the method comprises: Determine target combination data satisfying a preset condition from M combination data, wherein each combination data includes multiple characters, each character corresponds to a candidate set, the candidate set includes multiple candidate characters of the same character type, the multiple candidate characters include at least the character corresponding to the candidate set, and M is an integer greater than or equal to 1; Based on N candidate sets corresponding to N characters included in the target combination data, determine the number of candidate combination data corresponding to the target combination data, wherein the candidate combination data is obtained by arranging and combining candidate characters in each of the N candidate sets, and N is an integer greater than 1; Based on the number of the candidate combined data, split the target combined data to generate a plurality of sub-data; The multiple sub-data are noise-added respectively to generate first noisy data, and the first noisy data is sent to a server; the noise-added processing includes encoding and identifying the sub-data to determine the encoded data, and adding random noise processing to the encoded data, wherein the encoded data includes a flag bit for distinguishing different sub-data.

2. The method according to claim 1, characterized in that The method further comprises: Acquire P original data, where the original data includes one or more of the characters, and P is an integer greater than or equal to 1; Determine the original data whose number of characters is greater than or equal to a first preset value among the P original data as the combined data; The original data whose number of characters in the P original data is less than the first preset value is determined as non-combined data.

3. The method according to claim 1, characterized in that The step of determining target combination data satisfying a preset condition from the M combination data includes: Determine Q combined data satisfying a first condition from the M combined data, where the first condition includes a condition satisfied by characters in the combined data; The combined data satisfying the second condition among the Q combined data are determined as target combined data satisfying the preset condition, wherein the second condition includes a condition satisfied by a candidate set corresponding to the characters in the combined data.

4. The method according to claim 3, characterized in that The step of determining Q combined data satisfying a first condition from the M combined data comprises: For the M combination data, query whether the target device stores relevant characters of the corresponding combination data; the relevant characters include one or more candidate characters in the candidate set corresponding to at least one character in the corresponding combination data, and the target device includes the terminal device and / or the server; Among the M combination data, the combination data corresponding to the relevant characters stored in the target device are determined to be Q combination data, where Q is an integer less than or equal to M.

5. The method according to claim 3, characterized in that: The step of determining the combined data satisfying the second condition among the Q combined data as the target combined data satisfying the preset condition comprises: Determine the total number of candidate characters corresponding to each combination data in the Q combination data; the total number of candidate characters is the total number of non-repeated candidate characters in multiple candidate sets corresponding to multiple characters included in the corresponding combination data; The combination data whose corresponding total amount of candidate characters in the Q combination data is greater than or equal to the second preset value is determined as the target combination data that meets the preset condition.

6. The method according to claim 2, characterized in that The method further comprises: For the combined data that does not meet the preset condition and / or the non-combined data in the M combined data, noise processing is performed to generate second noisy data, and the second noisy data is sent to the server.

7. The method according to any one of claims 1 to 5, characterized in that: The step of splitting the target combined data based on the number of the candidate combined data to generate a plurality of sub-data includes: Determining whether the number of candidate combination data is greater than or equal to a third preset value; If so, the target combined data is split into the multiple sub-data, wherein the number of candidate combined data corresponding to the multiple sub-data after splitting is less than the third preset value.

8. The method according to any one of claims 1 to 5, characterized in that: The performing noise addition processing on the plurality of sub-data respectively to generate first noise added data comprises: Mapping the plurality of sub-data respectively to determine hash data corresponding to each sub-data; The hash data is subjected to noise addition processing to generate the first noise added data.

9. The method according to claim 8, characterized in that The mapping of the plurality of sub-data to determine the hash data corresponding to each sub-data includes: Encode each of the plurality of sub-data respectively to determine the coded data respectively corresponding to the plurality of sub-data, wherein the coded data includes a flag bit for distinguishing different sub-data; The respective encoded data are mapped based on a preset hash function to determine hash data corresponding to each sub-data in the plurality of sub-data.

10. A data protection method, characterized in that: Applied to a server, the method comprises: Receive multiple noise-added data sent by a terminal device, the noise-added data including first noise-added data, the first noise-added data being obtained by performing noise-added processing on multiple sub-data generated after the corresponding target combination data is split based on the number of candidate combination data corresponding to each target combination data satisfying a preset condition by the terminal device, the candidate combination data being obtained by arranging and combining candidate characters in each candidate set of N candidate sets corresponding to N characters contained in each target combination data, where N is an integer greater than 1; the candidate set includes multiple candidate characters of the same character type, and the multiple candidate characters at least include characters corresponding to the candidate set; the noise-added processing includes encoding and identifying the sub-data to determine the encoded data, and adding random noise processing to the encoded data, wherein the encoded data includes a flag bit for distinguishing different sub-data; Determine a plurality of un-noised data corresponding to the plurality of noisy data, wherein the un-noised data includes the plurality of sub-data; The same sub-data in the plurality of non-noised data are merged to generate a merged statistical result.

11. The method according to claim 10, characterized in that The determining a plurality of non-noised data corresponding to the plurality of noisy data comprises: Performing noise reduction processing on the multiple noise-added data to determine multiple hash data corresponding to the multiple noise-added data; Mapping the plurality of hash data respectively to determine a plurality of coded data corresponding to the plurality of hash data; The plurality of encoded data are decoded respectively to determine a plurality of non-noised data corresponding to the plurality of encoded data.

12. A data protection device, characterized in that: Applied to a terminal device, the device comprises: A first determining unit is used to determine target combination data that meets a preset condition from M combination data, wherein each combination data includes multiple characters, each character corresponds to a candidate set, the candidate set includes multiple candidate characters of the same character type, the multiple candidate characters at least include the character corresponding to the candidate set, and M is an integer greater than or equal to 1; A second determining unit is used to determine the number of candidate combination data corresponding to the target combination data based on N candidate sets corresponding to the N characters included in the target combination data, wherein the candidate combination data is obtained by arranging and combining candidate characters in each of the N candidate sets, and N is an integer greater than 1; a splitting unit, configured to split the target combined data based on the number of the candidate combined data to generate a plurality of sub-data; A first noise adding unit, configured to perform noise adding processing on the plurality of sub-data respectively to generate first noisy data; the noise adding processing includes encoding and marking the sub-data to determine the coded data, and adding random noise processing to the coded data, wherein the coded data includes a flag bit for distinguishing different sub-data; A first sending unit is configured to send the first noise-added data to a server.

13. A data protection device, characterized in that: Applied to a server, the device comprises: A receiving unit, configured to receive a plurality of noise-added data sent by a terminal device, wherein the noise-added data includes first noise-added data, wherein the first noise-added data is obtained by performing noise-added processing on a plurality of sub-data generated after the corresponding target combination data is split based on the number of candidate combination data corresponding to each target combination data satisfying a preset condition by the terminal device, wherein the candidate combination data is obtained by arranging and combining candidate characters in each candidate set of N candidate sets corresponding to the N characters contained in each target combination data, where N is an integer greater than 1; the candidate set includes a plurality of candidate characters of the same character type, and the plurality of candidate characters at least include a character corresponding to the candidate set; the noise-added processing includes encoding and identifying the sub-data to determine the encoded data, and adding random noise processing to the encoded data, wherein the encoded data includes a flag bit for distinguishing different sub-data; a determining unit, configured to determine a plurality of un-noised data corresponding to the plurality of noisy data, wherein the un-noised data includes the plurality of sub-data; The merging unit is used to merge the same sub-data in the plurality of non-noised data to generate a merged statistical result.

14. A terminal device, characterized in that: The terminal device includes a processor and a memory, wherein the memory is used to store programs and various data, and the processor is used to call the program code stored in the memory so that the terminal device executes the method according to any one of claims 1-9.

15. A server, characterized in that: The server includes a processor and a memory, wherein the memory is used to store programs and various data, and the processor is used to call the program code stored in the memory so that the server executes the method according to claim 10 or 11.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method described in any one of claims 1 to 9 is implemented, or the method described in claim 10 or 11 is implemented.

17. A computer program product, characterized in that The computer program product includes instructions, and when the instructions are executed by a computer, the computer is caused to execute the method according to any one of claims 1 to 9, or implement the method according to claim 10 or 11.

Images