Key value data security acquisition method and system based on localized differential privacy

Abstract

The invention provides a key value data security acquisition method and system based on localized differential privacy. The method comprises the following steps: issuing preset key value data acquisition parameters to each user side through a server; each user side fills a local key value data set according to the received key field to obtain a confused key value data set, extracts one piece of key value data from the confused key value data set according to a preset probability, disturbs the extracted key value data based on a preset scoring function according to the received key field, key disturbance privacy budget and value disturbance privacy budget to obtain a disturbance result, and sends the disturbance result to the user side; the result is sent to the server; and the server performs calibration according to the key domain, the key disturbance privacy budget, the value disturbance privacy budget and the received disturbance result to obtain frequency estimation and mean value estimation of the keys of the extracted key value data. The communication overhead can be effectively reduced, and the execution speed and the accuracy of the estimation result are improved.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to a method and system for securely collecting key-value data based on localized differential privacy. Background Art

[0002] In the era of big data, service providers are keen to collect and analyze user data to assist decision-making or improve services. However, data collection operations are accompanied by privacy risks, which inevitably raises users' concerns about privacy leaks. As the demand for data collection security continues to grow, differential privacy (DP) has become a key technology for protecting user privacy data. Regardless of the prior knowledge that the attacker has, differential privacy can provide provable privacy protection. Localized differential privacy (LDP) is deployed in the data collection phase, and its privacy processing process is transferred from the service provider to the user end, thereby reducing the risk of untrusted data collectors leaking user data.

[0003] Key-value data is a typical non-structured query language (Non-SQL) hybrid data type, which has been widely used in practice. LDP intervention is required to achieve secure collection of key-value data. At present, LDP collection schemes based on unary coding and universal random response mechanism have been applied in key-value data collection, and its representative schemes include PrivKV (Privacy Key-Value), PCKV (Private Correlated Key-Value) and MLPKV (Multi-Layer Private Key-Value).

[0004] However, the PrivKV scheme has a high computational complexity due to the multiple iterations. Multiple iterations will split the privacy budget and increase the variance. PCKV, which uses unary encoding to implement key perturbations, will result in huge communication overhead in large key domains. The MLPKV scheme has the problem of a sharp drop in estimation accuracy due to excessive padding length. Summary of the invention

[0005] In order to solve the above problems in the prior art, the present invention provides a key-value data security collection method and system based on localized differential privacy. Specifically, it includes:

[0006] In a first aspect, the present invention provides a key-value data security collection method based on localized differential privacy, which is applicable to a key-value data security collection system, the system comprising a server and multiple user terminals in communication connection;

[0007] The method includes:

[0008] The server sends preset key-value data collection parameters to each client, including key domain, value domain, key perturbation privacy budget, and value perturbation privacy budget;

[0009] Each user terminal fills the local key-value data set according to the received key domain, generates an obfuscated key-value data set, and extracts a key-value data from the obfuscated key-value data set according to a preset probability. Based on a preset scoring function, according to the received key domain, key perturbation privacy budget and value perturbation privacy budget, the extracted key-value data is perturbed to obtain a perturbation result, and the perturbation result is sent to the server;

[0010] The server calibrates and obtains the frequency estimate and mean estimate of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget and the received perturbation result.

[0011] In a second aspect, the present invention further provides a key-value data security collection system, comprising: a server and a plurality of user terminals in communication connection;

[0012] The server is used to send preset key-value data collection parameters to each user terminal, including key domain, value domain, key perturbation privacy budget and value perturbation privacy budget;

[0013] Each user terminal is used to fill the local key-value data set according to the received key domain, generate an obfuscated key-value data set, and extract a key-value data from the obfuscated key-value data set according to a preset probability. Based on the preset scoring function, according to the received key domain, key perturbation privacy budget and value perturbation privacy budget, the extracted key-value data is perturbed to generate a perturbation result, and the perturbation result is sent to the server;

[0014] The server is used to calibrate the frequency estimation and mean estimation of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget and each received perturbation result.

[0015] In a third aspect, the present invention provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, any one of the methods provided in the first aspect is implemented.

[0016] Beneficial effects of the present invention:

[0017] The key-value data security collection method and system based on localized differential privacy provided by the present invention sends preset key-value data collection parameters to each user terminal through a server; each user terminal fills the local key-value data set according to the received key domain, generates an obfuscated key-value data set, and extracts a key-value data from the obfuscated key-value data set according to a preset probability. Based on the preset scoring function, the extracted key-value data is disturbed according to the received key domain, key perturbation privacy budget and value perturbation privacy budget to obtain a perturbation result, and the perturbation result is sent to the server; the server calibrates the frequency estimation and mean estimation of the key of each extracted key-value data according to the key domain, key perturbation privacy budget, value perturbation privacy budget and the received perturbation result. The present invention can effectively reduce communication overhead, improve execution speed and accuracy of estimation results, especially for the data security collection problem of massive Internet data, can effectively complete the collection task, and improve the accuracy of privacy-protected data collection statistics. The present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] Figure 1 A flowchart of a key-value data security collection method based on localized differential privacy provided by the present invention;

[0019] Figure 2 A schematic diagram of the architecture of a key-value data security collection system provided by the present invention;

[0020] Figure 3 A schematic diagram of a key-value data disturbance probability tree provided by the present invention;

[0021] Figure 4 A data flow diagram of a key-value data security collection system provided by the present invention. DETAILED DESCRIPTION

[0022] The present invention is further described in detail below with reference to specific embodiments, but the embodiments of the present invention are not limited thereto.

[0023] Traditional differential privacy technology, also known as centralized differential privacy, is usually achieved by service providers performing unified perturbation processing after data collection and storage to avoid user-level privacy leakage. This requires that the service provider must be trustworthy, but this is not always the case in reality. Unlike centralized differential privacy, local differential privacy (LDP) is deployed during the data collection phase. Its privacy processing process is transferred from the data collector to the user end, thereby reducing the risk of untrusted data collectors leaking the original data. Early research on LDP focused on statistical queries of simple types of data (such as single attribute single value), including frequency estimation of categorical data, histogram estimation, and mean estimation of numerical data. Subsequently, research was extended to the processing of structured set-valued and high-dimensional data, such as heavy hitter identification and frequent item set mining. However, the low availability of secure collection results for complex data types limits its widespread application.

[0024] At present, the LDP protection scheme for key-value data is mainly implemented through unary encoding and universal random response mechanism. Representative schemes include PrivKV, PCKV and MLPKV. PrivKV is the first proposed LDP-based key-value data collection scheme. It adopts a random response mechanism to split the key-value association perturbation into four outputs. The key problem is how to determine the associated value of the virtual key. Based on this, PrivKV improves the baseline method and proposes an iterative PrivKVM scheme. Through multiple iterations, the virtual value is corrected to make it close to the distribution of the actual value, thereby improving the accuracy. Since PrivKVM does not have a fixed number of iterations and lacks universality, an adaptive variant of PrivKVM, PrivKVM*, is proposed, which can dynamically allocate the privacy budget according to the results of each iteration to improve the convergence speed and estimation accuracy. The PCKV scheme proposes a single-round key-value data collection scheme (PCKV-UE and PCKV-GRR) and designs a padding sampling protocol to avoid the segmentation of the privacy budget. In addition, PCKV improves data utility by optimizing the privacy budget combination. The MLPKV scheme adopts a multi-layer key-value data collection framework, including a dimensionality reduction phase, a padding length estimation phase, and a frequency and mean estimation phase. MLPKV is suitable for edge computing environments and can better protect user privacy. By offloading aggregation and estimation computing tasks to edge nodes and introducing a candidate set mechanism, MLPKV can effectively reduce the original key domain and reduce communication and storage costs. MLPKV improves the local hash algorithm to adapt to edge computing scenarios and improve system efficiency and accuracy. In addition, user partitioning rather than privacy budget partitioning is used to reduce the bias caused by differences in data distribution.

[0025] However, the PrivKV scheme has a high computational complexity due to the use of multiple iterations. Multiple iterations will split the privacy budget and expand the variance. PCKV, which uses unary coding to implement key perturbations, will cause huge communication overhead in large key domains. The MLPKV scheme has the problem that the estimation accuracy drops sharply due to the excessive padding length. In order to solve the problems existing in the prior art, the present invention provides a non-interactive key-value data collection method, which completes statistical analysis in a single round, effectively reduces communication overhead, and improves execution efficiency. The multiple iterations of the PrivKV scheme will not only split the privacy budget and expand the variance, but also its random uniform sampling will lead to poor mean estimation results in large key domains. In the PCKV scheme, the uncertainty of the padding length affects the actual deployment. PCKV-UE, which implements key perturbations based on unary coding, will cause huge communication overhead in large key domains. Similarly, due to the natural defects of the general random response mechanism, the key frequency estimation of DCKV-GRR based on GRR in large key domains will also have large deviations. The MLPKV scheme requires all users to stay online, which not only wastes resources but also does not conform to practical applications. In addition, MLPKV also has the problem of a sharp drop in estimation accuracy due to excessive padding length. The key-value data security collection method based on localized differential privacy provided by the present invention, on the one hand, solves the problems of low perturbation efficiency and poor estimation accuracy in the large-scale key domain LDP data collection process through agglomerative perturbation based on key perturbation probability; on the other hand, the method can fill the local key-value domain of the user end according to the preset key-value domain, thereby improving the privacy of the data and further improving the estimation accuracy.

[0026] Figure 1 The present invention provides a flowchart of a key-value data security collection method based on localized differential privacy. The method is applied to Figure 2 The key-value data security collection system shown in FIG. Figure 2 As shown, the system includes a server 21 and a plurality of client terminals 22 which are communicatively connected.

[0027] like Figure 1 As shown, the method includes:

[0028] S101. The server sends preset key-value data collection parameters to each user terminal.

[0029] Among them, the parameters include key domain, value domain, key perturbation privacy budget and value perturbation privacy budget.

[0030] The server can be any type of server without any specific limitation.

[0031] The server sends preset parameters to each user terminal, which can be sent actively periodically or at a specific time; it can also send preset parameters to each user terminal in response to a sending instruction, which can be directly input by the user to the server or sent by the user terminal to the server.

[0032] Optionally, before the server sends the preset key-value data collection parameters to each user terminal, the server also includes initializing the key-value data collection parameters.

[0033] For example, the key field in the key-value data collection parameter is represented as represents the number of keys in the key domain. The value domain is represented by Correspondingly, the values ​​in the local key-value data owned by the user are evenly mapped to the value range [1,-1].

[0034] Assuming the privacy budget of the perturbation scheme is ε, the key perturbation privacy budget can be expressed as: ε1 = ε.

[0035] The value perturbation privacy budget can be expressed as:

[0036]

[0037] Here, e represents a natural constant and ln(·) represents a natural logarithm.

[0038] S102. Each user terminal fills a local key-value data set according to the received key domain to obtain an obfuscated key-value data set, and extracts a key-value data from the obfuscated key-value data set according to a preset probability. Based on a preset scoring function, according to the received key domain, the key perturbation privacy budget and the value perturbation privacy budget, the extracted key-value data is perturbed to obtain a perturbation result, and the perturbation result is sent to the server.

[0039] In a possible implementation, each user terminal fills a local key-value data set according to the received key domain to generate an obfuscated key-value data set, including the following steps A1-A3:

[0040] A1. Traverse all the keys in the key range and filter out the keys that do not belong to the local key-value data set.

[0041] A2. Build a virtual key value data set based on the filtered keys.

[0042] Among them, the key value of each key in the virtual key value data set is 0.

[0043] A3. Obtain an obfuscated key value data set based on the virtual key value set and the local key value data set.

[0044] The following is a detailed description of steps A1-A3 using a specific example:

[0045] The client is based on a local key-value data set With key field If any key k in the key domain i satisfy Then construct virtual key value data <k i ,0>, and put it into the virtual key value data set This is repeated until all keys in the key domain are traversed, and then the virtual key value data set is For local key-value datasets After filling, the obfuscated key-value dataset is obtained, among which the local key-value dataset is the real key value data set, the virtual key value set A virtual key-value data set.

[0046] In a possible implementation, each user terminal extracts a key value data from the obfuscated key value data set according to a preset probability, and the extracted key value data comes from the local key value data set. The probability is:

[0047]

[0048] The extracted key value data comes from the virtual key value set The probability is: 1-ρ.

[0049] Among them, ρ represents the probability that the extracted key-value data comes from the local key-value data set, Indicates the number of key-value data in the local key-value data set. Indicates the number of keys in the key field.

[0050] Optionally, within any set, data is sampled evenly.

[0051] In order to maintain the correlation between keys and values, the processing object is always the complete key-value data. In other words, the keys and values ​​of the extracted key-value data should correspond to each other.

[0052] This method can not only reduce the consumption of privacy budget by sampling key-value data, but also reduce the communication cost from Reduced to O(1), where O(·) represents the complexity function. The sampling probability of the real key-value data is The sampling probability of the virtual key value is After the user completes filling in the key-value data, two data sets are obtained, namely the local key-value data set including the real data and a virtual key set including constructed virtual key data For example, from the local key-value dataset with probability ρ Extract key-value data from the local key-value data. Then the probability of sampling a real key value data is According to the probability of 1-ρ, from the virtual key value data set Extract key value data and virtual key value data set Length is Then the probability of sampling a virtual key value data is

[0053] If the number of local key-value data Very small, that is Based on the above probabilities, the sampling probability of the real key-value data is close to 1. In the worst case, the real key-value data is still sampled with a high probability, thereby ensuring the validity of the sampling results and further ensuring the accuracy of the estimation results.

[0054] In one possible implementation, each user terminal perturbs the extracted key-value data based on a preset scoring function, according to the received key domain, key perturbation privacy budget and value perturbation privacy budget, to obtain a perturbation result, including: each user terminal scores all keys in the key domain through a preset scoring function, and normalizes the scoring results to a key perturbation probability, determines the value perturbation probability according to the key perturbation probability and the value of the extracted key-value data, and completes the perturbation processing of the extracted key-value data based on the value perturbation probability to obtain a perturbation result.

[0055] Among them, the scoring function is expressed as:

[0056]

[0057] where k′ represents any key in the key domain, ε1 represents the key perturbation privacy budget, and d(k,k′) represents the distance between key k and key k′, which is defined as e represents a natural constant, and ||·||1 represents the 1-norm.

[0058] Optionally, the probability of perturbing a key to the original key is expressed as:

[0059]

[0060] Among them, η k represents the perturbation probability of key k being the original key, Represents the key field.

[0061] Optionally, the probability of perturbing a key with another key value is expressed as:

[0062]

[0063] Among them, η i Indicates that the key k is perturbed to any key k other than the original key i The perturbation probability, d(k,k i) represents key k i The distance from key k is defined as e represents a natural constant, and ||·||1 represents the 1-norm.

[0064] By observing the perturbation probabilities of the original key and other key value outputs, it can be seen that any key is perturbed with a high probability as a neighboring key, and the original key output has the highest probability, achieving a condensed perturbation effect.

[0065] Optionally, the value perturbation probability is expressed as:

[0066]

[0067] Among them, v represents the value of the key extracted by the user, and ε2 represents the value perturbation privacy budget.

[0068] Further, in a possible implementation, each user terminal performs a perturbation process on the extracted key-value data based on the value perturbation probability, including: when each user terminal perturbs the key k to the original key, the value associated with the key k is output as The probability is p, and the output is The probability is 1-p; perturb key k to any key k other than the original key i When , the value associated with key k is output as The probability and output are The probability of

[0069] The specific disturbance process can be further seen in Figure 3 The key-value data perturbation probability tree is shown in Figure 1. Figure 3 As shown, the original key-value data follows the perturbation protocol, using η k and 1-η k The perturbation is performed and the real key value data or virtual key value data is output after the perturbation. The perturbation result of the key determines the perturbation of its associated value. When the key k is perturbed to the original key k, its associated value v is calculated according to its positive value v + or negative value v - Perturb with probability p, where Otherwise the associated value v is The probability of being perturbed into or

[0070] S103. The server calibrates and obtains the frequency estimate and mean estimate of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget and each received perturbation result.

[0071] In a possible implementation, the server calibrates the frequency estimate and mean estimate of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget, and the received perturbation results, including B1 and B2:

[0072] B1. The server aggregates the disturbance results sent by each client to obtain the perturbation frequency of each key.

[0073] B2. The server calibrates the frequency estimate of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget, the received perturbation results, and the perturbation frequencies of each key.

[0074] In one possible implementation, the frequency estimate of the key of the extracted key-value data is expressed as:

[0075]

[0076] in, represents the frequency estimate corresponding to key k, represents the frequency of key k obtained by the server aggregating the perturbation results sent by each client, represents the number of keys in the key domain, η k represents the perturbation probability of key k being the original key.

[0077] In one possible implementation, the server aggregates the perturbation results and the mean estimate of the calibration key is expressed as:

[0078]

[0079] in, represents the mean estimate of the values ​​associated with key k, Indicates that the associated value in each perturbation result is The number of Indicates that the associated value in each perturbation result is The number of n represents the number of users. represents the frequency estimate of key k, and ε2 represents the value perturbation privacy budget.

[0080] Specifically, after receiving the perturbation results from all clients, the server calculates and calibrates the frequency and mean of each key. For frequency estimation, the server receives the perturbation results from all clients to calculate the frequency of each key. in The real frequency of key k is defined as f k , each bond has probability η k Output the original key, in 1-η k The probability of outputting other keys. After perturbation, The expectation is expressed as Therefore, the frequency estimate after key k calibration is The associated value in the perturbation result corresponding to the server statistics key k is and The number of and The frequency estimate for key k is

[0081] The key-value data security collection method based on localized differential privacy provided by the present invention sends preset key-value data collection parameters to each user terminal through a server; each user terminal fills a local key-value data set according to the received key domain, generates an obfuscated key-value data set, and extracts a key-value data from it according to a preset probability, and based on a preset scoring function, disturbs the extracted key-value data according to the received key domain, key perturbation privacy budget and value perturbation privacy budget, obtains a perturbation result, and sends the result to the server; the server calibrates the frequency estimation and mean estimation of the key of each extracted key-value data according to the key domain, key perturbation privacy budget, value perturbation privacy budget and each received perturbation result. The present invention can effectively reduce communication overhead, improve execution speed and the accuracy of estimation results, especially for the data security collection problem of massive Internet data, can effectively complete the collection task, and improve the accuracy of privacy-protected data collection statistics.

[0082] The present invention also provides a key-value data security collection system based on localized differential privacy, such as Figure 2 The system shown in the figure includes: a server 21 and multiple user terminals 22 connected in communication. The data flow of the system is as follows: Figure 4 As shown, the data processing process can be specifically referred to the contents of the above method embodiment, which will not be described in detail here.

[0083] Specifically, the server 21 is used to send preset parameters to each user terminal, and the parameters include a key domain, a value domain, a key perturbation privacy budget, and a value perturbation privacy budget.

[0084] Each user terminal 22 is used to fill a local key-value data set according to the received key domain, obtain an obfuscated key-value data set, and extract a key-value data from the obfuscated key-value data set according to a preset probability, and based on a preset scoring function, according to the received key domain, the key perturbation privacy budget and the value perturbation privacy budget, perturb the extracted key-value data to obtain a perturbation result, and send the perturbation result to the server.

[0085] The server 21 is used to calibrate and obtain the frequency estimation and mean estimation of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget and each received perturbation result.

[0086] The present invention also provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the steps provided in the above method embodiment are implemented.

[0087] As for the system / storage medium embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the specific contents and beneficial effects and other related matters can be referred to the partial description of the method embodiment.

[0088] The terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the features. In the description of the present invention, the meaning of "plurality" is two or more, unless otherwise clearly and specifically defined.

[0089] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A key-value data secure collection method based on localized differential privacy, characterized in that: Applied to a key-value data collection system, the system comprises a server and a plurality of user terminals in communication connection; The method comprises: The server sends preset key-value data collection parameters to each of the user terminals, wherein the parameters include a key domain, a value domain, a key perturbation privacy budget, and a value perturbation privacy budget; Each of the user terminals fills a local key-value data set according to the received key domain to obtain an obfuscated key-value data set, extracts a key-value data from the obfuscated key-value data set according to a preset probability, and perturbs the extracted key-value data based on a preset scoring function according to the received key domain, the key perturbation privacy budget, and the value perturbation privacy budget to obtain a perturbation result, and sends the perturbation result to the server; The server calibrates and obtains a frequency estimate and a mean estimate of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget and the received perturbation result.

2. The method according to claim 1, characterized in that: Each of the user terminals fills a local key value data set according to the received key domain to obtain an obfuscated key value data set, including: Each of the user terminals traverses all the keys in the key domain, filters out the keys that are not in the local key value dataset, and builds a virtual key value dataset based on the filtered keys. According to the virtual key value dataset and the local key value dataset, the obfuscated key value dataset is obtained, and the key value of each key in the virtual key value dataset is 0.

3. The method according to claim 1 or 2, characterized in that: Each of the user terminals extracts a key-value data from the obfuscated key-value data set according to a preset probability, including: Each of the user terminals extracts a key-value data from the obfuscated key-value data set according to a preset probability, wherein the probability that the extracted key-value data comes from the local key-value data set is: The probability that the extracted key value data comes from the virtual key value data set is: 1-ρ, ρ represents the probability that the extracted key-value data comes from the local key-value data set, l represents the number of key values ​​in the local key-value data set, Indicates the number of keys in the key field.

4. The method according to claim 1 or 2, characterized in that: Each of the user terminals perturbs the extracted key-value data based on a preset scoring function, according to the received key domain, the key perturbation privacy budget, and the value perturbation privacy budget, to obtain a perturbation result, including: Each of the user terminals scores all the keys in the key domain by using a preset scoring function, and normalizes the scoring results into a key perturbation probability, determines a value perturbation probability according to the key perturbation probability and the value of the extracted key-value data, and performs perturbation processing on the extracted key-value data based on the value perturbation probability to generate a perturbation result; The scoring function is expressed as: where k′ represents any key in the key domain, ε1 represents the key perturbation privacy budget, and d(k,k′) represents the distance between key k and key k′, which is defined as e represents a natural constant, and ||·||1 represents the 1-norm.

5. The method according to claim 4, characterized in that The probability of a key perturbation being the original key is expressed as: Among them, η k represents the key perturbation probability of key k being perturbed to the original key, represents the key domain; The probability of perturbing a key to another key is expressed as: Among them, η i Indicates that key k is perturbed to any key k except the original key i The perturbation probability, d(k,k i ) represents key k i The distance from key k is defined as e represents a natural constant, and ||·||1 represents the 1-norm.

6. The method according to claim 5, characterized in that The value perturbation probability is expressed as: Where v represents the value associated with the key extracted by the user, and ε2 represents the value perturbation privacy budget; Each of the user terminals completes the disturbance processing of the extracted key-value data based on the value disturbance probability, including: When each of the user terminals perturbs the key k to the original key, the value associated with the key k is output as The probability is p, and the output is The probability is 1-p; the key k is disturbed to any key k other than the original key i When the value associated with the key k is output as The probability and output are The probability of 7. The method according to claim 1 or 2, characterized in that: The frequency estimate of the key of the extracted key-value data is expressed as: in, represents the frequency estimate of key k, represents the frequency of key k obtained by the server aggregating the perturbation results sent by each client, represents the number of keys in the key domain, η k represents the perturbation probability of key k being the original key.

8. The method according to claim 1 or 2, characterized in that: The mean estimate of the key of the extracted key-value data is expressed as: in, Represents the mean estimate of the value associated with key k, r1 * Indicates that the associated value in each perturbation result is The number of * Indicates that the associated value in each perturbation result is The number of n represents the number of user terminals. represents the frequency estimate of key k, and ε2 represents the value perturbation privacy budget.

9. A key-value data security collection system, characterized in that: A server and multiple clients including communication connections; The server is used to send preset key-value data collection parameters to each of the user terminals, wherein the parameters include a key domain, a value domain, a key perturbation privacy budget, and a value perturbation privacy budget; Each of the user terminals is configured to fill a local key-value data set according to the received key domain, generate an obfuscated key-value data set, extract a key-value data from the obfuscated key-value data set according to a preset probability, perturb the extracted key-value data based on a preset scoring function, according to the received key domain, the key perturbation privacy budget and the value perturbation privacy budget, generate a perturbation result, and send the perturbation result to the server; The server is used to calibrate the frequency estimation and mean estimation of the key of each extracted key-value data according to the key domain, the key perturbation privacy budget, the value perturbation privacy budget and the received perturbation results.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 8 is implemented.

Images