Data protection method
By dividing user data sets into equivalent categories and adding differential privacy noise, the problem that K-anonymity technology cannot resist differential attacks is solved, improving the level of data privacy protection and reducing the risk of privacy leakage.
Patent Information
- Application Number
- CN202411050757.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-08-01
- Publication Date
- 2024-12-20
AI Technical Summary
The existing K-anonymity technology cannot effectively resist differential attacks, resulting in a higher risk of privacy leakage of user sensitive information after the property value changes.
Differential privacy noise is added to protect user data by dividing the user data set into equivalent classes based on the quasi-identifier and determining the number of combinations of sensitive attributes in the equivalent class.
Reduce the risk of privacy leakage caused by changes in user attribute values, improve the level of data privacy protection, and avoid differential attacks.
Smart Images
Figure CN119167414A_ABST
Abstract
Description
Technical Field
[0001] The embodiments of the present application relate to the field of data security technology, and in particular, to a data protection method. Background Art
[0002] With the growth of data volume and its widespread application, personal privacy protection becomes increasingly important. When publishing data sets, especially those involving personal or sensitive information, it is crucial to protect user privacy. K-anonymity is a privacy protection technology that ensures that in the published data set, each record has at least the same attribute set as other k-1 records, thereby hiding the identity information of individuals.
[0003] However, when some sensitive information of a user changes, an attacker can infer the user's sensitive information by comparing the two published data sets before and after the sensitive information changes. This method is not secure enough and has a high risk of privacy leakage. Summary of the invention
[0004] The embodiment of the present application provides a data protection method to at least solve the problem that the relevant privacy protection technology cannot avoid differential attacks and has insufficient security.
[0005] In order to solve the above technical problems, this application is implemented as follows:
[0006] In a first aspect, an embodiment of the present application provides a data protection method, comprising: obtaining a user data set, the user data set including user attribute values of multiple users under different individual attributes, the individual attributes including quasi-identifiers and sensitive attributes; dividing the user data set into at least one equivalence class according to the quasi-identifier, each of the equivalence classes corresponding to at least a preset number of user attribute values under the sensitive attribute; determining the number of combinations of user attribute values corresponding to the sensitive attributes in each of the equivalence classes; and performing privacy protection on the user data set by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes.
[0007] In a second aspect, an embodiment of the present application provides a data protection device, comprising: a data acquisition module, used to acquire a user data set, wherein the user data set includes user attribute values of multiple users under different individual attributes, and the individual attributes include quasi-identifiers and sensitive attributes; an equivalence class partitioning module, used to partition the user data set into at least one equivalence class according to the quasi-identifier, and each of the equivalence classes corresponds to at least a preset number of user attribute values under the sensitive attribute; a combination determination module, used to determine the number of combinations of user attribute values corresponding to the sensitive attributes in each of the equivalence classes; and a noise adding module, used to perform privacy protection on the user data set by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes.
[0008] In a third aspect, an embodiment of the present application provides an electronic device, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the programs or instructions are executed by the processor, the steps of the method described in the first aspect above are implemented.
[0009] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the method described in the first aspect above are implemented.
[0010] In a fifth aspect, an embodiment of the present application provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the steps of the method described in the first aspect above.
[0011] In an embodiment of the present application, a user data set is obtained, wherein the user data set includes user attribute values of multiple users under different individual attributes, and the individual attributes include quasi-identifiers and sensitive attributes; the user data set is divided into at least one equivalence class according to the quasi-identifier, and the sensitive attributes in each equivalence class correspond to at least a preset number of user attribute values; the number of combinations of user attribute values corresponding to the sensitive attributes in each equivalence class is determined; and the privacy of the user data set is protected by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes. In this way, by dividing the user data set into at least one equivalence class according to the quasi-identifier, it can be ensured that the users in each equivalence class have similar user attribute values under the sensitive attributes, reducing the identifiability of individual users, and at the same time determining the number of combinations of user attribute values corresponding to the sensitive attributes in each equivalence class, adding differential privacy noise to the number of combinations can reduce the risk of privacy leakage caused by changes in user attribute values, avoid differential attacks, and improve the privacy protection level of data.
[0012] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.
[0014] Figure 1 A schematic diagram of a process of a data protection method provided by an embodiment of the present application is shown;
[0015] Figure 2Another schematic diagram of a data protection method according to an embodiment of the present invention is shown;
[0016] Figure 3 One of the structural schematic diagrams of the data protection device provided in the embodiment of the present application is shown;
[0017] Figure 4 A second structural diagram of the data protection device provided in an embodiment of the present application is shown;
[0018] Figure 5 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application is shown. DETAILED DESCRIPTION
[0019] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.
[0020] In the field of data security technology, methods for data privacy protection usually include federated learning, trusted execution environment, k-anonymity, and l-diversity, as follows:
[0021] (1) Federated learning is to train models on local devices, only share updated model parameters, and not original personal data, which can reduce the risk of data transmission and privacy leakage. However, due to the heterogeneity of training data sources, all parties face problems such as uneven data distribution and insufficient sample size. This means that in practical applications, each participant needs to be "tailored". In the context of collaborative machine learning, different participants will have different interests. The inconsistency of these interests may affect the integrity of the participants during the training process. Due to the non-determinism of the organizational scheme in federated learning, the choice of synchronization period and the number of participants will lead to fluctuations in model adjustments and create the risk of delayed model convergence.
[0022] (2) A trusted execution environment is a secure area built in the CPU through software and hardware methods to ensure that the programs and data loaded inside are protected in terms of confidentiality and integrity. However, trusted computing relies on a secure and trusted isolation environment built by third-party hardware manufacturers, which requires the purchase of additional third-party hardware, which is costly.
[0023] (3) K-anonymity technology can ensure that each individual record stored in the published data set cannot be distinguished from other K-1 individuals in terms of sensitive attributes, and observers cannot conduct link attacks through quasi-identifiers. Although k-anonymity technology can prevent the disclosure of identity information, it cannot prevent the disclosure of attribute information, resulting in its inability to resist homogeneous attacks, background knowledge attacks, supplementary data attacks, etc.
[0024] (4) L-diversity In order to overcome the technical defects of K-anonymity, an enhanced K-anonymity model is proposed, which ensures that the sensitive attributes of each equivalence class have at least L different values, so that the attacker can confirm the sensitive information of an individual with a probability of 1 / L at most, ensuring that the user's private information cannot be inferred through background knowledge, homogeneous knowledge, etc. However, when some sensitive information of a user changes, the attacker can infer the sensitive information of the user by comparing the two published data sets before and after the sensitive information changes, so this method cannot resist differential attacks.
[0025] In response to the problems in the above-mentioned data processing process, an embodiment of the present application provides a data protection method, which divides a user data set into at least one equivalence class according to a quasi-identifier to ensure that users in each equivalence class have similar user attribute values under sensitive attributes, and at the same time determines the number of combinations of user attribute values corresponding to sensitive attributes in each equivalence class, and adds differential privacy noise to the number of combinations, which can reduce the risk of privacy leakage caused by changes in user attribute values, avoid differential attacks, and improve the level of data privacy protection.
[0026] Figure 1 A flow chart of a data protection method provided in an embodiment of the present application is shown, and the execution subject of the method can be a terminal device or a server, wherein the terminal device can be a device such as a personal computer, or a mobile terminal device such as a mobile phone or a tablet computer, and the terminal device can be a terminal device used by a user. The server can be an independent server, or a server cluster composed of multiple servers, and the server can be a background server of a certain business, or a background server of a certain platform or application (for example, a database management system, a cloud computing platform, etc.). In the embodiment of the present application, the execution subject is taken as an example to illustrate. For the case of a terminal device, it can be processed according to the following related content, which will not be repeated here. As shown in the figure, the method 100 may include the following steps:
[0027] S101: Acquire a user data set, wherein the user data set includes user attribute values of multiple users under different individual attributes, and the individual attributes include quasi-identifiers and sensitive attributes.
[0028] Among them, a quasi-identifier is an attribute that cannot be used to identify an individual, but multiple quasi-identifiers combined can be used to identify a unique individual; a sensitive attribute is an attribute that the user wants to protect.
[0029] In a specific implementation, individual attributes usually also include an identifier. Since the identifier is an attribute that can identify a unique individual, the user attribute value corresponding to the identifier is usually suppressed in the subsequent processing, for example, data masking, data replacement, data deletion, etc. For example, the user data set D = {Ex, A1, ..., A d ,s1,s2,...,s n}, where Ex is an identifier, A i (1≤i≤d) is the quasi-identifier, s is the sensitive attribute. D contains N user data (i.e., N tuples), each tuple is denoted as t k (1≤k≤N).
[0030] In a possible implementation, in S101 above, obtaining the user data set includes:
[0031] Acquire user data of multiple users; classify the user data according to preset individual attributes to obtain user attribute values of the multiple users under different individual attributes; generate the user data set according to the user attribute values of the multiple users under different individual attributes.
[0032] The individual attribute further includes an identifier; and generating the user data set according to the user attribute values of the multiple users under different individual attributes includes:
[0033] Performing data suppression on user attribute values of the multiple users under the identifiers;
[0034] The user data set is generated according to the user attribute values after data suppression.
[0035] Exemplarily, the user data includes login time, end time, login geographic location, source Internet Protocol (IP) address, source device name, source port, source Media Access Control Address (MAC) address, destination IP address, destination port, destination MAC address, protocol, device type, browser type, application number, application name, login account, name of the login person, login type (account and password, short verification, face, etc.), whether to log in with secondary verification (two-factor authentication), login result, etc.
[0036] User data is classified according to preset individual attributes (such as identifiers, quasi-identifiers, and sensitive attributes) to obtain user attribute values of multiple users under different individual attributes. Both identifiers and quasi-identifiers can contain sensitive attribute data, see the following table:
[0037]
[0038] Then, a user data set is generated according to the user attribute values of multiple users under different individual attributes.
[0039] S102: Divide the user data set into at least one equivalence class according to the quasi-identifier, wherein the sensitive attribute in each equivalence class corresponds to at least a preset number of user attribute values.
[0040] In a specific implementation, the set of user data with the same user attribute values corresponding to all quasi-identifiers is called an equivalence class. Continuing with the above example, if there is a set of tuples with the same quasi-identifier, then the set is called an equivalence class of the user data set D, denoted as QI.
[0041] For any piece of user data, the number of user data in the equivalence class to which it belongs is not less than K, that is, at least K-1 pieces of user data have the same user attribute value of the quasi-identifier as the piece of user data. K is a threshold, which indicates the number of user data at least contained in an equivalence class. The sensitive attributes in each equivalence class must be diverse, that is, L-diversity ensures that in each equivalence class, the sensitive attributes have at least a preset number of L different values. Through L-diversity, an attacker can only confirm the sensitive attribute-related data of a user individual with a probability of 1 / L at most, thereby ensuring that the user's privacy information cannot be inferred through background knowledge, homogeneous knowledge, etc.
[0042] In a possible implementation, in S102, dividing the user data set into at least one equivalence class according to the quasi-identifier includes:
[0043] The user attribute values of the multiple users under the quasi-identifiers are generalized; and the user data set is divided into at least one equivalence class according to the generalized user attribute values.
[0044] In the embodiment of the present application, for user attribute values that need to be analyzed for big data applications in the future, directly suppressing data will seriously affect the accuracy and availability of the data analysis results. Therefore, the user attribute values can be generalized, and the user attribute values under the quasi-identifier can be replaced with semantically consistent but more general attribute data, for example, the login geographic location is generalized from the region to the province and city, the login time is generalized from the precise second level to the hour level, and the average usage time is generalized from the precise time to the time interval. Then, the user data set is divided into at least one equivalence class according to the user attribute values after generalization.
[0045] In a possible implementation, the user attribute values of the multiple users under the quasi-identifier include numerical data; and generalizing the user attribute values of the multiple users under the quasi-identifier includes:
[0046] Determine the distance between numerical data according to the distance between numerical data in its finite numerical domain;
[0047] According to the distances between the numerical data, generalization processing is performed on the numerical data of multiple users under the quasi-identifier.
[0048] In the embodiment of the present application, for numerical data, let W be a finite numerical domain (taking login time as an example, the finite numerical domain can be set to 24 hours), any numerical data v i ,v j ∈W, the distance δ between numerical data can be determined by the following formula N :
[0049]
[0050] Wherein, |W| represents the difference between the maximum value and the minimum value of the finite numerical domain W.
[0051] In another possible implementation, the user attribute values of the multiple users under the quasi-identifier include classified data; and generalizing the user attribute values of the multiple users under the quasi-identifier includes:
[0052] According to the height of the classified data in the classification tree, the distance between the classified data is determined; according to the distance between the classified data, the numerical data of multiple users under the quasi-identifier are generalized.
[0053] In the embodiment of the present application, for the classified data, let W be the classification domain, T be the classification tree on W, and any classified data v i ,v j ∈W, the distance δ between the classified data can be determined by the following formula c :
[0054]
[0055] Among them, A(v i -v j ) is the classification tree T with v i and v j The subtree with the least common ancestor of as the root, H(T) represents the height of the classification tree T.
[0056] According to the specific data content, select the appropriate distance δ for each quasi-identifier N or c , and finally the number of tuples contained in all equivalence classes is greater than or equal to K, which means K-anonymity is met.
[0057] In a possible implementation manner, before generalizing the user attribute values of the multiple users under the quasi-identifier, the method further includes:
[0058] According to a preset data suppression rule, data suppression is performed on the target user attribute data in the user data set;
[0059] Generalizing the user attribute values of the multiple users under the quasi-identifiers includes:
[0060] Acquire candidate user attribute data other than the target user attribute data in the user data set; and perform generalization processing on user attribute values under quasi-identifiers in the candidate user attribute data.
[0061] In the embodiment of the present application, the target user attribute data in the user data set can be suppressed, that is, the attribute is not published or all or part of the attribute data characters are removed with an asterisk "*". In a specific application, the following user attribute data can be suppressed: ID number, device IP, device name, source IP address, source port, source MAC address, destination IP address, destination port, destination MAC address.
[0062] Furthermore, in order to ensure that the sensitive attributes in each equivalence class correspond to at least a preset number L of user attribute values, the user attribute values under the sensitive attributes in each equivalence class QI may be diversified. That is, the user data set is divided into at least one equivalence class according to the generalized user attribute values, including:
[0063] The user data set is divided into at least one initial equivalence class according to the user attribute values after generalization processing; the number of user attribute values under sensitive attributes in the at least one initial equivalence class is determined; the target initial equivalence class whose number is less than the preset number is merged into other initial equivalence classes in the at least one initial equivalence class except the target initial equivalence class, until the number of user attribute values under sensitive attributes in the target initial equivalence class is not less than the preset number, thereby obtaining at least one equivalence class corresponding to the user data set.
[0064] For example, let the number of tuples in all equivalence classes be K, and count the number of different values of each sensitive attribute in each equivalence class, that is, L. If L is greater than or equal to a preset value (for example, 2), then L-diversity is met. i If L is less than 2, it will be merged into the initial equivalence class QI with user attribute values under different sensitive attributes. j In the new equivalence class QI k , if there is still L less than 2, continue to merge with other initial equivalence classes until all L are greater than or equal to 2. At this time, QI k The number of tuples contained is greater than K, which conforms to K-anonymity, and the number of user attribute values corresponding to the contained sensitive attributes is greater than or equal to 2, which conforms to L-diversity.
[0065] S103: Determine the number of combinations of user attribute values corresponding to the sensitive attributes in each of the equivalence classes.
[0066] For example, suppose there are n user attribute values s1, s2, ..., s corresponding to sensitive attributes in an equivalence class. n Among them, a sensitive attribute s m Yes m values X1, X2, ..., X lm For a piece of user data in an equivalence class, there may be L combinations of user attribute values corresponding to sensitive attributes (i.e., sensitive attribute value combinations), where L = l1*l2*...l m *...l n .
[0067] S104: adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes to protect the privacy of the user data set.
[0068] Among them, the differential privacy noise can be Laplace noise or Gaussian noise.
[0069] In the specific implementation, let the statistical number of a certain sensitive attribute value combination in the equivalence class be g. When a field of a user data changes, the number of combinations of the original attribute values of the field and the new attribute values will change. From this, other sensitive attributes of the user of this record can be inferred, which is easy to cause privacy leakage. At this time, the statistical number of each sensitive attribute value combination is added with noise that conforms to differential privacy to obtain a new statistical number g. n , using the statistical number of combinations of these sensitive attribute values g n To construct a new published data table, the new published data table complies with differential privacy, and attackers cannot infer the user's sensitive data through changes in a certain attribute value.
[0070] In a possible implementation, the above S104, adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes, includes:
[0071] Step 1041: Obtain the number of combinations of the user data set corresponding to each of the equivalence classes, and the number of noisy combinations of the noisy user data set corresponding to each of the equivalence classes, wherein the noisy user data set is a user data set when a user attribute value of a target user in the user data set changes.
[0072] In an exemplary embodiment, let the user attribute data set corresponding to the sensitive attribute in the equivalence class QI be D. When some fields of a user data item change, the sensitive attribute data set of the equivalence class QI is D'. The function for querying and counting the number of each sensitive attribute value combination in each equivalence class QI is f. Adding preset noise to the output of the query statistics function f, which conforms to the numerical distribution of the preset noise, can meet differential privacy.
[0073] Step 1042: determining data change sensitivity according to the number of noise-added combinations and the number of combinations corresponding to each of the equivalence classes, wherein the data change sensitivity is used to characterize the degree of influence of changes in user attribute values on the number of combinations;
[0074] The data change sensitivity of the query statistical function f is set to Δf, that is, the change of the user attribute value of the target user affects the number of combinations corresponding to each equivalence class:
[0075] Δf=max D,D' ||f(D)-f(D')|| p ;
[0076] Among them, p is 1, which is a norm.
[0077] Step 1043: Adjust the noise amount of the preset noise based on the sensitivity of the data change, add the adjusted preset noise to the number of combinations until the number of combinations after adding noise meets the preset differential privacy condition, obtain the differential privacy noise, and add the differential privacy noise to the number of combinations corresponding to each of the equivalence classes.
[0078] In the embodiment of the present application, the preset noise is Laplace noise as an example, the expected value is a, and the variance is 2b 2 The probability density function of the Laplace noise is:
[0079]
[0080] in,
[0081] In the function f(D)=(x1,x2,...x d ) T Adding Laplace noise, we get an output function A(D):
[0082]
[0083] At this time, the output function A(D) satisfies the differential privacy condition:
[0084] Pr[A(D)=O]≤e ε *Pr[A(D')=O];
[0085] Among them, O is the discrete set of output results, Pr is the corresponding probability, ε is used to control the probability ratio of the output function A(D) obtaining the same output on two adjacent data sets, and ε is usually very small, such as 0.01, 0.1, ln2, ln3, etc.
[0086] In a possible implementation, in the above S104, after adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes to protect the privacy of the user data set, the step further includes:
[0087] Add differential privacy noise to the number of combinations corresponding to each of the equivalence classes to obtain the number of noisy combinations corresponding to each of the equivalence classes; and construct a published data set based on the number of noisy combinations corresponding to each of the equivalence classes.
[0088] Continuing with the above example, a certain sensitive attribute value combination P in the equivalence class QI is obtained through the output function A(D) to obtain the query statistics g after adding differential privacy noise P , then the number of P in the published data set is g P The output function A(D) is used to calculate the number of each sensitive attribute value combination in each equivalence class and construct the release data set.
[0089] Figure 2 Another flow chart of the data protection method provided in the embodiment of the present application is shown. As shown in the figure, the above data protection method includes the following steps:
[0090] Input: an original user data set, which includes user data of multiple users;
[0091] Step 201: Data classification, dividing user data into identifiers, quasi-identifiers, and user attribute values corresponding to sensitive attributes;
[0092] Step 202: Data generalization, generalizing some user attribute values;
[0093] Step 203: constructing equivalence classes, dividing the user data set into at least one equivalence class according to the quasi-identifier, and each equivalence class has at least a preset number of user attribute values corresponding to the sensitive attribute;
[0094] Step 204: Diversify the user attribute values corresponding to the sensitive attributes;
[0095] Step 205: Generate a sensitive attribute combination (i.e., a combination of user attribute values corresponding to the sensitive attributes in each equivalence class mentioned above);
[0096] Step 206: adding differential privacy noise after counting the number of sensitive attribute combinations;
[0097] Step 207: construct a release data set according to the statistical quantity of the new sensitive attribute combination;
[0098] Output: Release dataset.
[0099] The embodiment of the present application provides a data protection method, which obtains a user data set, wherein the user data set includes user attribute values of multiple users under different individual attributes, and the individual attributes include quasi-identifiers and sensitive attributes; divides the user data set into at least one equivalence class according to the quasi-identifier, and the sensitive attributes in each equivalence class correspond to at least a preset number of user attribute values; determines the number of combinations of user attribute values corresponding to the sensitive attributes in each equivalence class; and performs privacy protection on the user data set by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes. In this way, the risk of privacy leakage caused by changes in user attribute values can be reduced, and the level of privacy protection of data can be improved.
[0100] Figure 3 FIG. 1 shows one of the structural diagrams of the data protection device provided in the embodiment of the present application. The device can implement the following Figure 1 or Figure 2 In the embodiment shown, all or part of the content, the data protection device 300 includes:
[0101] A data acquisition module 310 is used to acquire a user data set, wherein the user data set includes user attribute values of multiple users under different individual attributes, wherein the individual attributes include quasi-identifiers and sensitive attributes;
[0102] An equivalence class division module 320, configured to divide the user data set into at least one equivalence class according to the quasi-identifier, wherein the sensitive attribute in each equivalence class corresponds to at least a preset number of user attribute values;
[0103] A combination determination module 330, used to determine the number of combinations of user attribute values corresponding to the sensitive attributes in each of the equivalence classes;
[0104] The noise adding module 340 is used to perform privacy protection on the user data set by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes.
[0105] In a possible implementation, the data acquisition module 310, when used to acquire the user data set, is specifically used to:
[0106] Get user data for multiple users;
[0107] Classifying the user data according to preset individual attributes to obtain user attribute values of the multiple users under different individual attributes;
[0108] The user data set is generated according to the user attribute values of the multiple users under different individual attributes.
[0109] In a possible implementation, the individual attribute further includes an identifier; and the data acquisition module 310, when used to generate the user data set according to the user attribute values of the multiple users under different individual attributes, is specifically used to:
[0110] Performing data suppression on user attribute values of the multiple users under the identifiers;
[0111] The user data set is generated according to the user attribute values after data suppression.
[0112] In a possible implementation, the equivalence class division module 320, when used to divide the user data set into at least one equivalence class according to the quasi-identifier, is specifically used to:
[0113] Performing generalization processing on the user attribute values of the multiple users under the quasi-identifier;
[0114] The user data set is divided into at least one equivalence class according to the generalized user attribute values.
[0115] In a possible implementation, the user attribute values of the multiple users under the quasi-identifier include numerical data; the equivalence class partitioning module 320, when used to generalize the user attribute values of the multiple users under the quasi-identifier, is specifically used to:
[0116] Determine the distance between numerical data according to the distance between numerical data in its finite numerical domain;
[0117] According to the distances between the numerical data, generalization processing is performed on the numerical data of multiple users under the quasi-identifier.
[0118] In another possible implementation, the user attribute values of the multiple users under the quasi-identifier include categorized data; the equivalence class partitioning module 320, when used to generalize the user attribute values of the multiple users under the quasi-identifier, is specifically used to:
[0119] Determine the distance between categorized data according to their height in the classification tree;
[0120] According to the distance between the classified data, generalization processing is performed on the numerical data of multiple users under the quasi-identifier.
[0121] In a possible implementation, the equivalence class division module 320, before being used to generalize the user attribute values of the multiple users under the quasi-identifier, is further used to:
[0122] According to a preset data suppression rule, data suppression is performed on the target user attribute data in the user data set;
[0123] The equivalence class division module 320, when used to generalize the user attribute values of the multiple users under the quasi-identifier, is specifically used to:
[0124] Acquire attribute data of candidate users other than the target user attribute data in the user data set;
[0125] The user attribute values under the quasi-identifier in the candidate user attribute data are generalized.
[0126] In a possible implementation, the equivalence class division module 320, when used to divide the user data set into at least one equivalence class according to the user attribute value after generalization processing, is specifically used to:
[0127] Dividing the user data set into at least one initial equivalence class according to the generalized user attribute values;
[0128] Determining the number of user attribute values under the sensitive attribute in the at least one initial equivalence class;
[0129] The target initial equivalence classes whose number is less than the preset number are merged into other initial equivalence classes in the at least one initial equivalence class except the target initial equivalence class, until the number of user attribute values under the sensitive attributes in the target initial equivalence class is not less than the preset number, thereby obtaining at least one equivalence class corresponding to the user data set.
[0130] In a possible implementation, the noise adding module 340, when used to add differential privacy noise to the number of combinations corresponding to each of the equivalence classes, is specifically used to:
[0131] Acquire the number of combinations of the user data set corresponding to each of the equivalence classes, and the number of noisy combinations of the noisy user data set corresponding to each of the equivalence classes, wherein the noisy user data set is a user data set when a user attribute value of a target user in the user data set changes;
[0132] Determine data change sensitivity according to the number of noise-added combinations and the number of combinations corresponding to each of the equivalence classes, wherein the data change sensitivity is used to characterize the degree of influence of changes in user attribute values on the number of combinations;
[0133] The noise amount of the preset noise is adjusted based on the sensitivity of the data change, and the adjusted preset noise is added to the number of combinations until the number of combinations after adding noise meets the preset differential privacy condition, and the differential privacy noise is obtained, and the differential privacy noise is added to the number of combinations corresponding to each of the equivalence classes.
[0134] In one possible implementation, Figure 4 As shown, the data protection device 300 further includes:
[0135] The data publishing module 350 is used to add differential privacy noise to the number of combinations corresponding to each of the equivalence classes to obtain the number of noisy combinations corresponding to each of the equivalence classes; and construct a published data set according to the number of noisy combinations corresponding to each of the equivalence classes.
[0136] The embodiment of the present application provides a data protection device, including a data acquisition module, an equivalence class division module, a combination determination module and a noise adding module; the data acquisition module acquires a user data set, wherein the user data set includes user attribute values of multiple users under different individual attributes, and the individual attributes include quasi-identifiers and sensitive attributes; the equivalence class division module divides the user data set into at least one equivalence class according to the quasi-identifier, and the sensitive attributes in each of the equivalence classes correspond to at least a preset number of user attribute values; the combination determination module determines the number of combinations of user attribute values corresponding to the sensitive attributes in each of the equivalence classes; the noise adding module performs privacy protection on the user data set by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes. In this way, by dividing the user data set into at least one equivalence class according to the quasi-identifier, it can be ensured that the users in each equivalence class have similar user attribute values under the sensitive attributes, reducing the identifiability of individual users, and at the same time determining the number of combinations of user attribute values corresponding to the sensitive attributes in each equivalence class, adding differential privacy noise to the number of combinations can reduce the risk of privacy leakage caused by changes in user attribute values, avoid differential attacks, and improve the privacy protection level of data.
[0137] Figure 5 The hardware structure diagram of the electronic device provided by the embodiment of the present application is shown. Referring to the figure, at the hardware level, the electronic device 500 includes a processor 510, and optionally, includes an internal bus 520, a network interface 530, and a memory 540. Among them, the memory 540 may include a memory 541, such as a high-speed random access memory (Random-Access Memory, RAM), and may also include a non-volatile memory 542 (non-volatile memory), such as at least one disk storage, etc. Of course, the electronic device 500 may also include hardware required for other services.
[0138] The processor 510, the network interface 530 and the memory may be connected to each other via an internal bus 520, which may be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bidirectional arrow is used in the figure, but it does not mean that there is only one bus or one type of bus.
[0139] The memory 540 stores programs. Specifically, the programs may include program codes, and the program codes include computer operation instructions. The memory 540 may include a memory 541 and a non-volatile memory 542 , and provide instructions and data to the processor 510 .
[0140] The processor 510 reads the corresponding computer program from the non-volatile memory 542 into the memory and then runs it, forming a device for locating the target user at the logical level. The processor 510 executes the program stored in the memory and specifically performs: Figure 1 or Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.
[0141] The above application Figure 1 or Figure 2 The method disclosed in the illustrated embodiment can be applied to the processor 510 or implemented by the processor 510. The processor 510 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit or software instructions in the processor 510. The above processor 510 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application can be directly embodied as a hardware decoding processor for execution, or a combination of hardware and software modules in the decoding processor for execution. The software module can be located in a storage medium mature in the art such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory, or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory, and the processor reads the information in the memory and completes the steps of the above method in combination with its hardware.
[0142] The computer device can also execute the methods described in the foregoing method embodiments, and realize the functions and beneficial effects of the methods described in the foregoing method embodiments, which will not be repeated here.
[0143] Of course, in addition to software implementation, the electronic device 500 of the present application does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.
[0144] The embodiment of the present application also provides a computer-readable storage medium, wherein the computer-readable medium stores one or more programs, and when the one or more programs are executed by an electronic device including multiple application programs, the electronic device executes Figure 1 or Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.
[0145] The computer-readable storage medium includes a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.
[0146] Furthermore, an embodiment of the present application also provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the following process is implemented: Figure 1 or Figure 2 The method disclosed in the illustrated embodiment realizes the functions and beneficial effects of each method described in the foregoing method embodiments, which will not be described in detail here.
[0147] The embodiments of the present application can be applied to various electronic device collaboration or interconnection scenarios, including: collaboration and interconnection between mobile phones and laptops / tablet computers; collaboration and interconnection between mobile terminals and smart TVs / displays; collaboration and interconnection between mobile phones or tablet computers and in-car entertainment systems; collaboration and interconnection between mobile terminals and smart conference systems, etc., so as to meet the needs of users in various scenarios such as smart homes, smart offices, and smart travel.
[0148] In short, the above is only a preferred embodiment of the present application and does not limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.
[0149] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.
[0150] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.
[0151] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.
[0152] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.
Claims
1. A data protection method, characterized in that: include: Acquire a user data set, wherein the user data set includes user attribute values of multiple users under different individual attributes, wherein the individual attributes include quasi-identifiers and sensitive attributes; Dividing the user data set into at least one equivalence class according to the quasi-identifier, wherein the sensitive attribute in each equivalence class corresponds to at least a preset number of user attribute values; Determine the number of combinations of user attribute values corresponding to the sensitive attributes in each of the equivalence classes; The privacy of the user data set is protected by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes.
2. The method according to claim 1, characterized in that: The obtaining of the user data set includes: Get user data for multiple users; Classifying the user data according to preset individual attributes to obtain user attribute values of the multiple users under different individual attributes; The user data set is generated according to the user attribute values of the multiple users under different individual attributes.
3. The method according to claim 2, characterized in that The individual attribute further includes an identifier; and generating the user data set according to the user attribute values of the multiple users under different individual attributes includes: Performing data suppression on user attribute values of the multiple users under the identifiers; The user data set is generated according to the user attribute values after data suppression.
4. The method according to claim 1, characterized in that: The dividing the user data set into at least one equivalence class according to the quasi-identifier comprises: Performing generalization processing on the user attribute values of the multiple users under the quasi-identifier; The user data set is divided into at least one equivalence class according to the generalized user attribute values.
5. The method according to claim 4, characterized in that The user attribute values of the multiple users under the quasi-identifier include numerical data; and the generalization of the user attribute values of the multiple users under the quasi-identifier includes: Determine the distance between numerical data according to the distance between numerical data in its finite numerical domain; According to the distances between the numerical data, generalization processing is performed on the numerical data of multiple users under the quasi-identifier.
6. The method according to claim 4, characterized in that The user attribute values of the multiple users under the quasi-identifier include classified data; and the generalization processing of the user attribute values of the multiple users under the quasi-identifier includes: Determine the distance between categorized data according to their height in the classification tree; According to the distance between the classified data, generalization processing is performed on the numerical data of multiple users under the quasi-identifier.
7. The method according to claim 4, characterized in that Before generalizing the user attribute values of the multiple users under the quasi-identifier, the method further includes: According to a preset data suppression rule, data suppression is performed on the target user attribute data in the user data set; The generalizing the user attribute values of the multiple users under the quasi-identifier includes: Acquire attribute data of candidate users other than the target user attribute data in the user data set; The user attribute values under the quasi-identifier in the candidate user attribute data are generalized.
8. The method according to claim 4, characterized in that The dividing the user data set into at least one equivalence class according to the generalized user attribute values includes: Dividing the user data set into at least one initial equivalence class according to the generalized user attribute values; Determining the number of user attribute values under the sensitive attribute in the at least one initial equivalence class; The target initial equivalence classes whose number is less than the preset number are merged into other initial equivalence classes in the at least one initial equivalence class except the target initial equivalence class, until the number of user attribute values under the sensitive attributes in the target initial equivalence class is not less than the preset number, thereby obtaining at least one equivalence class corresponding to the user data set.
9. The method according to claim 1, characterized in that: The adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes includes: Acquire the number of combinations of the user data set corresponding to each of the equivalence classes, and the number of noisy combinations of the noisy user data set corresponding to each of the equivalence classes, wherein the noisy user data set is a user data set when a user attribute value of a target user in the user data set changes; Determine data change sensitivity according to the number of noise-added combinations and the number of combinations corresponding to each of the equivalence classes, wherein the data change sensitivity is used to characterize the degree of influence of changes in user attribute values on the number of combinations; The noise amount of the preset noise is adjusted based on the sensitivity of the data change, and the adjusted preset noise is added to the number of combinations until the number of combinations after adding noise meets the preset differential privacy condition, and the differential privacy noise is obtained, and the differential privacy noise is added to the number of combinations corresponding to each of the equivalence classes.
10. The method according to any one of claims 1 to 9, characterized in that: After the privacy protection of the user data set is performed by adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes, the method further includes: Adding differential privacy noise to the number of combinations corresponding to each of the equivalence classes to obtain the number of noisy combinations corresponding to each of the equivalence classes; A published data set is constructed according to the number of noise addition combinations corresponding to each of the equivalence classes.