Dynamic planning solution for privacy protection evaluation

Abstract

The embodiment of the invention relates to a dynamic programming solution for privacy protection evaluation. Methods and systems for evaluating privacy protection are provided. A method includes generating a first intersection of a first data set and a second data set. The method further includes determining a partition number based on the first data set, the first intersection, and the number of iterations by: determining a privacy leak for a subset of the first data set based on the first data set, the first intersection, and the number of iterations; and determining a partition number based on privacy leakage for each of the subsets of the first data set. The method further includes partitioning the first data set into a first sub-data set and a second sub-data set using the partitioning number, and determining positive and negative membership of elements of the first sub-data set in the second data set and positive and negative membership of elements of the second sub-data set in the second data set.

Description

Technical Field

[0001] Embodiments described herein generally relate to evaluating the effectiveness of a privacy preserving protocol or algorithm. More specifically, embodiments described herein relate to a dynamic programming solution for evaluating the effectiveness of a privacy preserving protocol or algorithm. Background Art

[0002] Private Set Intersection (PSI) is one of the secure two-party or multi-party protocols or algorithms for computing intersection-related statistics, and PSI has attracted great interest in the industry. The PSI algorithm or protocol allows two or more organizations to jointly compute functions (e.g., counts, sums, etc.) on the intersection of their respective data sets without explicitly revealing the intersection to the other party. In an application, the two parties may be unwilling or unable to reveal the underlying data to the other party, but they may still want to calculate aggregate population-level measurements. The two parties want to do this while ensuring that the input data sets do not have any other content of individual users in addition to revealing these aggregate values. It should be understood that a protocol or algorithm that discloses the size, count, or cardinality of the intersection of the two parties' data sets to one or both parties may be referred to as an intersection size disclosure protocol or algorithm. Summary of the invention

[0003] Features in the embodiments disclosed herein provide a privacy-preserving effectiveness evaluation protocol, algorithm, method, and / or system for intersection size revealing protocols. Features in the embodiments disclosed herein use an optimal tree partitioning method based on dynamic programming, by, for example, recognizing the role of both positive and negative memberships in the membership inference process, broadening the range of data considered, allowing optimal branch partitioning (rather than fixed or average partitioning), using dynamic programming methods to improve efficiency, and providing a more comprehensive privacy evaluation solution under limited protocol running time (which cannot be achieved and / or is not feasible with existing methods), to enhance and improve privacy protection and / or privacy-preserving effectiveness evaluation technology or technology fields.

[0004] In an example embodiment, a method for evaluating privacy protection is provided. The method includes generating a first intersection of a first data set and a second data set. The method also includes determining a partition number based on the first data set, the first intersection, and the number of iterations in the following manner: determining a privacy leak of a subset of the first data set based on the first data set, the first intersection, and the number of iterations; and determining the partition number based on the privacy leak of each subset in the subset of the first data set. The method also includes using the partition number to partition the first data set into a first sub-data set and a second sub-data set, and determining positive membership and negative membership of elements of the first sub-data set in the second data set and positive membership and negative membership of elements of the second sub-data set in the second data set.

[0005] In another example embodiment, a privacy protection assessment system is provided. The system includes a processor and a memory, the memory being used to store a first data set and an iteration number. The processor is used to generate a first intersection of the first data set and the second data set. The processor is also used to determine a partition number based on the first data set, the first intersection, and the iteration number in the following manner: determining the privacy leakage of a subset of the first data set based on the first data set, the first intersection, and the iteration number; and determining the partition number based on the privacy leakage of each subset in the subset of the first data set. The processor is also used to use the partition number to partition the first data set into a first sub-data set and a second sub-data set, and determine the positive membership and negative membership of the elements of the first sub-data set in the second data set and the positive membership and negative membership of the elements of the second sub-data set in the second data set.

[0006] In yet another example embodiment, a non-transitory computer-readable medium having computer-executable instructions stored thereon is provided. The instructions, when executed, cause one or more processors to perform operations, the operations comprising generating a first intersection of a first data set and a second data set. The operations also include determining a partition number based on the first data set, the first intersection, and the number of iterations in the following manner: determining a privacy leak of a subset of the first data set based on the first data set, the first intersection, and the number of iterations; and determining a partition number based on the privacy leak of each subset in the subset of the first data set. The operations also include using the partition number to partition the first data set into a first sub-data set and a second sub-data set, and determining positive membership and negative membership of elements of the first sub-data set in the second data set and positive membership and negative membership of elements of the second sub-data set in the second data set. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The accompanying drawings illustrate various embodiments of the systems, methods and embodiments of various other aspects of the present disclosure. It will be understood by any person of ordinary skill in the art that the element boundaries (e.g., boxes, box groups or other shapes) shown in the figures represent an example of boundaries. In some examples, an element may be designed as multiple elements, or multiple elements may be designed as one element. In some examples, an element shown as an internal component of an element may be implemented as an external component in another element, and vice versa. Non-restrictive and non-exhaustive descriptions are described with reference to the following drawings. The components in the figures are not necessarily in scale, but emphasize the principle of explanation. In the detailed description below, the embodiments are described only as illustrations, because various changes and modifications are clear to those skilled in the art according to the detailed description below.

[0008] Figure 1 is a schematic diagram of an example privacy protection effectiveness assessment system arranged in accordance with at least some embodiments described herein.

[0009] Figure 2A is a diagram illustrating an example of a set intersection operation in accordance with at least some embodiments described herein.

[0010] Figure 2B is a schematic diagram illustrating an example of determining expected leakage of a state of a dynamic programming protocol or algorithm in accordance with at least some embodiments described herein.

[0011] Figure 3 is a schematic diagram illustrating an example of a privacy protection effectiveness evaluation algorithm according to at least some embodiments described herein.

[0012] Figure 4 is a flow chart illustrating an example process flow for evaluating the effectiveness of a privacy preservation protocol in accordance with at least some embodiments described herein.

[0013] Figure 5 is a flow chart illustrating an example process flow for determining a partitioning factor according to at least some embodiments described herein; and

[0014] Figure 6 is a schematic block diagram of an example computer system that may be used to implement electronic devices arranged in accordance with at least some embodiments described herein. DETAILED DESCRIPTION

[0015] In the following detailed description, specific embodiments of the present disclosure are described herein with reference to the drawings that form a part of the specification. In this specification and the drawings, similar reference numerals represent elements that can perform the same, similar or equivalent functions, unless the context otherwise dictates. In addition, unless otherwise specified, the description of each consecutive figure may refer to the features of one or more figures from the previous figures to provide a clearer context and a more substantial explanation of the current example embodiment. Nevertheless, the example embodiments described in the specific embodiments, the drawings, and the claims are not intended to be restrictive. Other embodiments may be utilized and other changes may be made without departing from the spirit or scope of the subject matter presented herein. It will be readily understood that, as shown in the overall description and the drawings herein, the various aspects of the present disclosure may be arranged, replaced, combined, separated and designed in various different configurations, all of which are clearly contemplated herein.

[0016] It should be understood that the disclosed embodiments are merely examples of the present disclosure, which may be embodied in various forms. Well-known functions or configurations are not described in detail to avoid obscuring the present disclosure due to unnecessary details. Therefore, the specific structural and functional details disclosed herein should not be interpreted as limiting, but only as a basis for the claims, and as a representative basis for teaching those skilled in the art to use the present disclosure in various ways in virtually any appropriately detailed structure.

[0017] In addition, the present disclosure may be described herein in terms of functional block components and various processing steps. It should be understood that such functional blocks may be implemented by any number of hardware and / or software components configured to perform the specified functions.

[0018] The scope of the present disclosure should be determined by the appended claims and their legal equivalents, rather than by the examples given herein. For example, the steps recited in any method claim may be performed in any order and are not limited to the order presented in the claims. In addition, no element is essential to the practice of the present disclosure unless specifically described herein as "critical" or "essential."

[0019] As used herein, "data set" or "dataset" is a term that may refer to an organized collection of data stored and accessed electronically. In example embodiments, a data set may refer to a database, a data table, a portion of a database or a data table, etc. It should be understood that a data set may correspond to one or more database tables, wherein each column of the database table represents a specific variable or field, and each row of the database table corresponds to a given record of the data set. The data set may list the value of each variable and / or each record of the data set. It should also be understood that a data set may additionally or alternatively refer to a set of related data and the organization of the related data. In example embodiments, each record of a data set may include (multiple) fields or (multiple) elements, such as one or more predefined or predetermined identifiers (e.g., membership identifiers, user identifiers, etc., such as a user's name, email address, phone number, a user's unique ID, etc.), and / or one or more attributes or features or values ​​associated with one or more identifiers. It should be understood that any user's (multiple) identifiers and / or user's data described in this document are allowed, licensed and / or otherwise authorized by the user for use in the embodiments described herein and their appropriate legal equivalents as understood by those skilled in the art. It should also be understood that the size, count, or cardinality of a data set may refer to the number of records (or rows, elements, etc.) of the data set.

[0020] As used herein, "inner join" or "inner-join" is a term that may refer to an operation or function that includes combining records from data sets, particularly when there are matching values ​​in fields that are common to the data sets. For example, an inner join may be performed using a "department" data set and an "employee" data set to determine all employees in each department. It should be understood that the inner join may contain information from both data sets that is related to each other in the resultant data set (i.e., the "intersection") of the inner join operation. On the other hand, an outer join may also contain information in its resultant data set that is unrelated to the other data sets. A private inner join may refer to an inner join operation of two or more data sets that does not reveal data in the intersection of the two or more data sets.

[0021] As described herein, "set intersection" or "intersection" (of two data sets A and B) is a term in set theory, which may refer to a data set containing all elements or records of A that also belong to B, or equivalently, all elements and records of B that also belong to A. That is, the intersection of data sets A and B (denoted by A∩B) may refer to the set of all elements or records that are members of both data sets A and B. For example, x is an element or record of the intersection of data sets A and B if and only if x is both an element (or record) of A and an element (or record) of B. For example, the intersection of data sets A (e.g., {1, 2, 3}) and B (e.g., {2, 3, 4}) is, for example, the data set {2, 3}. It should be understood that a "set intersection" operation or an "intersection" operation (e.g., an inner join operation, etc.) may refer to an operation, protocol, or algorithm for obtaining, determining, or identifying the intersection of two data sets.

[0022] As described herein, the "positive membership" of an element or record in (or about) a data set may refer to the state in which the element or record is a member of the data set. That is, the positive membership of an element or record in (or about a data set) may indicate that the element or record belongs to the data set or is a member of the data set. As described herein, the "negative membership" of an element or record in (or about a data set) may refer to the state in which the element or record is not a member of the data set. That is, the negative membership of an element or record in (or about a data set) may indicate that the element or record does not belong to the data set or is not a member of the data set. In an example in which the intersection of data sets A (e.g., {1, 2, 3}) and B (e.g., {2, 3, 4}) is, for example, data set {2, 3}, elements "1", "2" and "3" have positive membership in or about data set A, and element "4" has negative membership in or about data set A. Elements "2", "3" and "4" have positive membership in or about data set B, and element "1" has negative membership in or about data set B. Elements "2" and "3" of the intersection have positive membership in or with respect to both data sets A and B.

[0023] As used herein, "leakage" or "privacy leakage" may refer to the disclosure or revelation of information that should otherwise be protected, for example, by a privacy protection protocol or algorithm. Membership leakage may refer to the disclosure or revelation of positive membership and / or negative membership of an element or record in or about a dataset. It should be appreciated that suitable mechanisms may be used to quantify leakage. Expected leakage may refer to a quantified leakage based on a probability distribution of leakage.

[0024] As used herein, "private set intersection" is a term that may refer to a secure multi-party computation cryptographic operation, algorithm, or function for two or more parties holding corresponding data sets to compare encrypted versions of those data sets in order to compute an intersection. It should be understood that for private set intersection, no party reveals data elements to the other party except for the aggregate data of the elements in the intersection.

[0025] As used herein, "MPC" or "multi-party computation" is a term that may refer to a field of cryptography whose goal is to create schemes for parties to jointly compute a function on the parties' joint inputs while keeping the respective inputs private. It should be understood that, unlike traditional cryptographic tasks where cryptography can ensure the security and integrity of communications or storage when an adversary is outside the participant's system (e.g., an eavesdropper on the sender and / or receiver), cryptography in MPC can protect the privacy of the participants relative to each other.

[0026] As described herein, "dynamic programming" is a term that may refer to an optimization method, protocol, and / or algorithm, for example, by recursively decomposing a complex problem into simpler subproblems to simplify a complex problem. For example, with dynamic programming, the problem can be optimally solved by decomposing the problem into subproblems and then recursively finding the optimal solution of the subproblem (with an optimal substructure). It should be understood that if the subproblem can be recursively nested in a larger problem, the dynamic programming method, protocol, and / or algorithm is applicable, and the value, result, or solution of the larger problem can be determined based on the value, result, or solution of the subproblem. It should also be understood that in the dynamic programming method, protocol, and / or algorithm, the value, result, or solution of the subproblem can be saved for future use. That is, the dynamic programming method, protocol, and / or algorithm attempts to solve each subproblem only once, thereby reducing the amount of computation-once the solution to a given subproblem is determined, it will be stored so that the next time the same subproblem needs to be solved, it can be directly checked, such as in a lookup table.

[0027] As described herein, "state" is a term in dynamic programming that can refer to a subproblem or a solution to a subproblem, which can represent a problem for input data that is a subset of the input to the entire problem. Dynamic programming methods, protocols, and / or algorithms can be based on a starting state of the problem and recursive relations between consecutive states. A state of a problem can represent a subsolution, such as a partial solution or a solution based on a subset of a given input. States can be built one by one based on previously built states. A dynamic programming solution can start from an initial state and then build subsequent states based on previously found states.

[0028] Figure 1 is a schematic diagram of an example privacy protection effectiveness assessment system 100 arranged in accordance with at least some embodiments described herein.

[0029] System 100 may include terminal devices 110, 120, 130 and 140, network 160 and server 150. It should be understood that Figure 1 Only illustrative numbers of terminal devices, networks, and servers are shown. The embodiments described herein are not limited to the number of terminal devices, networks, and / or servers described. That is, the number of terminal devices, networks, and / or servers described herein is only for descriptive purposes and is not intended to be limiting.

[0030] According to at least some example embodiments, terminal devices 110, 120, 130, and 140 may be various electronic devices. Various electronic devices may include, but are not limited to, mobile devices such as smartphones, tablet computers, e-book readers, laptop computers, desktop computers, and / or any other suitable electronic devices.

[0031] According to at least some example embodiments, the network 160 may be a medium for providing a communication link between the terminal devices 110, 120, 130, 140 and the server 150. The network 160 may be the Internet, a local area network (LAN), a wide area network (WAN), a local interconnect network (LIN), a cloud, etc. The network 160 may be implemented by various types of connections, such as a wired communication link, a wireless communication link, an optical fiber cable, etc.

[0032] According to at least some example embodiments, server 150 may be a server for providing various services to users using one or more of terminal devices 110, 120, 130, and 140. Server 150 may be implemented by a distributed server cluster including multiple instances of server 150, or may be implemented by a single server 150.

[0033] The user may use one or more of the terminal devices 110, 120, 130, and 140 to interact with the server 150 via the network 160. Various applications or their localized interfaces (such as social media applications, online shopping services, privacy protection effectiveness assessment applications, etc.) may be installed on the terminal devices 110, 120, 130, and 140.

[0034] It should be understood that the software application or service according to the embodiments described herein and / or according to the service provided by the service provider may be executed by the server 150 and / or the terminal devices 110, 120, 130 and 140 (hereinafter referred to as user devices). Therefore, the apparatus for the software application and / or service may be arranged in the server 150 and / or the terminal devices 110, 120, 130 and 140.

[0035] It should also be understood that when the service is not performed remotely, the system 100 may not include the network 160 but only include the terminal devices 110 , 120 , 130 , and 140 and / or the server 150 .

[0036] It should also be understood that each of the terminal devices 110, 120, 130 and 140 and / or the server 150 may include one or more processors, memory and a storage device storing one or more programs. Each of the terminal devices 110, 120, 130 and 140 and / or the server 150 may also include an Ethernet connector, a wireless fidelity receiver, etc. One or more programs, when executed by one or more processors, may cause one or more processors to perform the (multiple) methods described in any embodiment described herein. In addition, it should be understood that a computer-readable non-volatile medium may be provided according to the embodiments described herein. The computer-readable medium stores a computer program. The computer program is used to perform the (multiple) methods described in any embodiment described herein when executed by a processor.

[0037] Figure 2A is a diagram 200 illustrating an example of a set intersection operation in accordance with at least some embodiments described herein. Figure 2B is a schematic diagram 201 illustrating an example of determining an expected leakage of a state of a dynamic programming protocol or algorithm, in accordance with at least some embodiments described herein.

[0038] It should be understood that unless otherwise specified, the processing steps of Figures 200 and 201 disclosed herein may be performed by one or more processors (e.g., Figure 1 a processor of one or more of the terminal devices 110, 120, 130 and 140, Figure 1 The processor of the server 150, Figure 6 605 and / or any other suitable processor).

[0039] like Figure 2A As shown, party A has data set X, and party B has data set Y. It should be understood that the format, content, and / or arrangement of the data sets described herein are for descriptive purposes only and are not intended to be limiting.

[0040] In an example embodiment, data set X includes eight elements or records {x1, x2, x3, x4, x5, c1, c2, c3}. Data set Y includes three or more elements or records c1, c2, c3, y1, y2, y3, y4, y5...}. A set intersection operation (e.g., PSI, PSI based on MPC, etc.) of data set X and data set Y may be performed, and the resulting intersection (data set C) of data set X and data set Y includes three elements {cl, c2, c3}. It should be understood that PSI and / or PSI based on MPC algorithms or protocols may allow party A and party B to jointly calculate functions (e.g., counts, sums, etc.) on the intersection of data sets X and Y without explicitly revealing the intersection to either party. That is, the set intersection operation of data set X and data set Y may not reveal the intersection C to either party, but may reveal the size, count, or cardinality ("3" in this example) of the intersection C of data sets X and Y to one or both parties via, for example, an intersection size revealing protocol or algorithm.

[0041] It should be understood that intersection operations or set intersection operations can refer to basic operations that can be performed on large data sets in situations such as MPC-based PSI operations, structured query language data set / database join operations, contact discovery, etc. It should also be understood that when an intersection operation requires input data sets from two different data owners and / or parties, the two parties may be required to compute the intersection of private data sets without disclosing the data within each data set and / or user membership. Many methods can protect user privacy by allowing the two parties to jointly compute functions (e.g., count, sum, calculate averages, etc.) on the intersection of their data sets without revealing the important (underlining) intersection data, for example, retaining the set intersection in the ciphertext. It should be understood that the cardinality of the intersection can be disclosed to one or both parties via, for example, an intersection size disclosure protocol.

[0042] It should also be understood that the intersection size revealing protocol may be subject to a set membership inference attack, i.e., an attacker (or evaluator), as a party to the intersection size revealing protocol, can eventually learn the membership of any subset of individuals / users / records from one party by continuously calling the intersection size revealing protocol. Membership can refer to the state of whether an individual or user is in the dataset of one party or the other. It should also be understood that attacking or evaluating a privacy protection protocol (such as the intersection size revealing protocol) can be used as a way to evaluate the effectiveness of such a protocol. In practical applications, existing attacks may not be effective enough because most dataset owners may only allow the intersection size revealing protocol to be run a limited number of times for their datasets within a fixed time interval. Under a certain number (e.g., limited, predetermined, etc.) of intersection size revealing protocol calls, the membership leakage caused by existing attacks may be very small or zero, while the real privacy leakage caused by a potentially more powerful attacker may be more serious. The features in the embodiments disclosed herein take into account both positive membership leakage and negative membership information, and provide a more efficient privacy protection effectiveness evaluation method within the number of times the intersection size revealing protocol is run.

[0043] It should also be understood that the MPC-based PSI operation may include one or more of the following processes: Any party (Party A and / or Party B) may shuffle and encode (or encode and shuffle) its corresponding data set X and / or Y. It should be understood that shuffling or shuffling is a term in the art, which may refer to an action or algorithm for randomly rearranging the order of, for example, records (elements, rows, etc.) of a data set. Encoding is a term in the art, and may refer to an action or algorithm for encrypting, for example, records (elements, rows, etc.) or fields (attributes, columns, etc.) of a data set based on, for example, an encryption algorithm or protocol. The parties may exchange their corresponding shuffled and encoded data sets with each other, shuffling and encoding (or encoding and shuffling) the exchanged data sets. The parties may exchange their corresponding result data sets (encoded by Party A and then encoded by Party B, or encoded by Party B and then encoded by Party A) with each other. That is, both party A and party B have data set X (encoded by both party A and party B) and data set Y (encoded by both party A and party B), but may not know the contents of these data sets because each party may have its own encryption key to encode the data sets. Either or both parties may perform an intersection operation based on data set X (encoded by both party A and party B) and data set Y (encoded by both party A and party B) to generate or obtain an intersection. The contents of the intersection are unknown to either party (because each party may have its own encryption key to encode the data set, which may result in an unknown intersection), but the size, count or cardinality of the intersection may be known to either or both parties. It should be understood that the intersection may be used for further processing, such as generating secret shares, collecting secret shares, and / or generating results by combining collected secret shares. The above-mentioned MPC-based PSI operation (returning or revealing the cardinality of the intersection and / or the cardinality of only the intersection) may refer to a PSI-CA (private set intersection cardinality) operation.

[0044] Return to reference Figure 2A , a PSI-CA operation may be performed on dataset X and dataset Y, and the cardinality of the intersection (and only the cardinality of the intersection) C may be revealed to either or both parties. That is, after the PSI-CA operation between dataset X and dataset Y, party A may know that “3” of “8” elements or records in dataset X (without knowing which “3” elements or records) may have positive membership in or with respect to dataset Y, while “5” of “8” elements or records in dataset X (without knowing which “5” elements or records) may have negative membership in or with respect to dataset Y.

[0045] Figure 2B Shown based on Figure 2A An example of determining expected leakage of states for a dynamic programming protocol or algorithm based on the cardinality of the intersection disclosed in 201.

[0046] like Figure 2A and Figure 2B As shown, it is known or disclosed that (Party A's) dataset X has in or about dataset Y ( Figure 2B The current state (“state” will be in Figure 3 ) can be represented as a tuple (8, 3, τ), where 8 is the number of sizes (or counts, cardins, etc.) of dataset X (denoted by “|X|”), 3 is the number of sizes of intersections C (i.e., the number of elements or records in dataset X that have positive membership in or with respect to dataset Y), and τ is the remaining number of invocations of the protocol (e.g., the privacy-preserving protocol or the intersection-size-revealing protocol to be evaluated).

[0047] In the example embodiment, to simplify the explanation of the process of determining the expected leakage of a state, it is assumed that τ is equal to 1, and the current state is (8, 3, 1). The expected leakage of the current state can be expressed as the maximum expected leakage of all possible groupings or partitions of the sub-data sets based on the partition factor or number K.

[0048] For example, the partition factor K can be an integer from 1 to a lower limit (or upper limit) of (|X|+1) / 2. When K=1, the data set X can be partitioned (using the partition factor K) into 1 element and 7 (|X|-K) elements. The 1 element can have positive membership (in or about data set Y) or negative membership (in or about data set Y), and each case (positive membership or negative membership) can have expected leakage. The expected leakage of the grouping (1 element and 7 elements) can be determined as the aggregation of each expected leakage of each case in the grouping.

[0049] In an example embodiment, when K=2, data set X can be divided (using a partition factor K) into 2 elements and 6 (|X|-K) elements. The 2 elements can both have positive membership (in or with respect to data set Y, see Figure 2B 250), all have negative membership (in or about dataset Y, see Figure 2B 230), or has one positive membership and one negative membership (in or about dataset Y, see Figure 2B240), each case (230, 240, 250) may have an expected leakage. The expected leakage of the grouping (2 elements and 6 elements) may be determined as a summary of each expected leakage (230, 240, 250) of the grouping. Each expected leakage of the cases 230, 240, and 250 may be determined by the probability distribution of the cases 230, 240, 250 and their corresponding leakage. For example, for the case 230, the probability or probability distribution of the case 230 may be determined based on the combination.

[0050] It should be understood that "combination" is a term in mathematics and can refer to selecting items from a set with different members, so the order of selection does not matter (unlike permutations). The k combinations of a set n are subsets of n with k different elements, denoted by, for example, C(n, k).

[0051] Return to reference Figure 2B , the likelihood or likelihood distribution of case 230 can be determined or represented as C(5,2) / C(8,2), where C(5,2) indicates that 2 negative members are selected from all 5 negative members (i.e., the element has negative membership in data set Y), and C(8,2) indicates that two members are selected from all 8 members (i.e., the element has positive membership or negative membership in data set Y). The leakage of case 230 can be determined or represented as the number of known memberships (positive or negative) (2 negative memberships). That is, the expected leakage of case 230 is 2×C(5,2) / C(8,2)=0.714.

[0052] The likelihood or likelihood distribution of case 240 can be determined or represented as (C(5,1)×C(3,1)) / C(8,2), where C(5,1) indicates selecting 1 negative member among all 5 negative members (i.e., an element with negative membership in data set Y), C(3,1) indicates selecting 1 positive member among all 3 positive members (i.e., an element with positive membership in data set Y), and C(8,2) indicates selecting 2 members among all 8 positive members (i.e., an element with positive membership or negative membership in data set Y). The leakage of case 240 can be determined or represented as the number of known memberships (positive or negative) (since there is 1 positive member and 1 negative member, the membership cannot be determined and the leakage number is 0). That is, the expected leakage of case 230 is 0×(C(5,1)×C(3,1)) / C(8,2)=0.

[0053] The likelihood or likelihood distribution of case 250 can be determined or represented as C(3,2) / C(8,2), where C(3,2) indicates that 2 positive members are selected from all 3 positive members (i.e., the element has positive membership in data set Y), and C(8,2) indicates that 2 members are selected from all 8 members (i.e., the element has positive membership or negative membership in data set Y). The leakage of case 250 can be determined or represented as the known number of memberships (positive or negative) (2 positive memberships). That is, the expected leakage of case 250 is 2×C(3,2) / C(8,2)=0.214.

[0054] Therefore, the expected leakage of the groupings (2 elements and 6 elements) can be determined as the sum of each expected leakage of the groupings (230, 240, 250), which is 0.714+0+0.214=0.928.

[0055] Similarly, the likelihood or likelihood distribution of case 210 can be determined or represented as C(5,4) / C(8,4), where C(5,4) indicates that 4 negative members are selected from all 5 negative members (i.e., the element has negative membership in data set Y), and C(8,4) indicates that 4 members are selected from all 8 members (i.e., the element has positive membership or negative membership in data set Y). The leakage of case 210 can be determined or represented as the known number of memberships (positive or negative) (4 negative memberships). That is, the expected leakage of case 210 is 4×C(5,4) / C(8,4)=0.285.

[0056] The likelihood or likelihood distribution of case 220 can be determined or represented as (C(5,3)×C(3,1)) / C(8,4), where C(5,3) indicates that 3 negative members are selected from all 5 negative members, C(3,1) indicates that 1 positive member is selected from all 3 positive members, and C(8,4) indicates that 4 members are selected from all 8 members (i.e., the element has positive membership or negative membership in data set Y). The leakage of case 220 can be determined or represented as the number of known memberships (positive or negative) (since there is 1 positive member and 3 negative members, the membership cannot be determined and the leakage number is 0). That is, the expected leakage of case 230 is 0×(C(5,3)×C(3,1)) / C(8,4)=0.

[0057] Therefore, the expected leakage of the group (4 elements and 4 elements) can be determined as the sum of each expected leakage of the group (210, 220), which is 0.285+0=0.285.

[0058] Similarly, the expected leakage of the grouping (1 element and 7 elements) and the expected leakage of the grouping (3 elements and 5 elements) can be determined based on the above description. The expected leakage of the current state (8, 3, 1) can be expressed as the maximum expected leakage of all possible groupings of the sub-datasets ((1 and 7), (2 and 6), (3 and 5), (4 and 4)) (for groups 230, 240 and 250 is 0.928), and the optimal partitioning factor or number K is 2 (for groups (2 and 6)).

[0059] It should be understood that Figure 2B The method, protocol or algorithm described in for determining expected leakage of a state (e.g., current state, etc.) may be found in Figure 3 Used in.

[0060] Figure 3 is a schematic diagram illustrating an example of a privacy protection effectiveness evaluation algorithm 300 in accordance with at least some embodiments described herein.

[0061] It should be understood that, unless otherwise specified, the processing steps of the algorithm 300 disclosed herein may be performed by one or more processors (e.g., Figure 1 a processor of one or more of the terminal devices 110, 120, 130 and 140, Figure 1 The processor of the server 150, Figure 6 605 and / or any other suitable processor).

[0062] In an example embodiment, Party A has a data set X (including multiple elements, rows, or records), and Party B has a data set Y (including multiple elements, rows, or records). It should be understood that the format, content, and / or arrangement of the data sets described herein are for descriptive purposes only and are not intended to be limiting. Party A is an evaluator of the effectiveness of the privacy protection protocol and / or the intersection size revealing protocol. That is, Party A can try the various attack techniques disclosed herein or run algorithms to reveal as many elements of data set X as possible in or about the membership (positive membership or negative membership) of data set Y to evaluate the effectiveness of the privacy protection protocol.

[0063] In an example embodiment, the size or count or cardinality of dataset X may be represented as |X|, and the cardinality of dataset Y may be represented as |Y|. It should be understood that "cardinality" is a term in mathematics, and it may refer to a measure of the size of a set, meaning the number of elements in a set (or rows, records, etc. in a dataset). The cardinality of the intersection between dataset X and dataset Y may be represented as |X∩Y|. In the context of an intersection size revealing protocol, a party receiving the intersection size (cardinality of the intersection) obtains a measure of similarity between its own dataset and the dataset of the other party. Given that a party can freely choose its own protocol dataset, the party may strategically evaluate the dataset of the other party according to its interests (e.g., evaluating the effectiveness of a privacy protection protocol, etc.).

[0064] In an example embodiment, party A (evaluator, attacker, etc.) can initiate a privacy-preserving evaluation and can participate as a party multiple times in running or executing an intersection size revealing protocol or algorithm. During each protocol or algorithm execution, the evaluator (e.g., party A, etc.) can select its input and obtain the intersection size (cardinality of the intersection) from its input data set and party B's data set. The evaluator is allowed to repeatedly participate in the privacy-preserving protocol or algorithm call with the same party (e.g., party B, etc.) under a query budget (e.g., a predefined number of times to run or execute the intersection size revealing protocol or algorithm). Party A (evaluator) can have a set of target elements or records and aims to determine its membership status (e.g., positive membership or negative membership) in party B's data set. Based on different applications, the evaluator may be interested in different membership information (e.g., positive membership or negative membership, etc.). Party A can adaptively design an evaluation strategy to maximize the expected return (e.g., the maximum number of positive membership or negative membership of elements in party B's data set). It should be understood that the effectiveness of the evaluator depends on the ability to repeatedly call the protocol with party B. In actual situations, the number of calls (invoke, run, execute, etc.) of the protocol may be limited due to constraints (e.g., a predetermined number or budget, etc.). Such constraints may limit the ability of the evaluator to perform an exhaustive search and reduce the accuracy of the inferred dataset members. Features of the embodiments disclosed herein may provide an effective algorithm (or method, protocol, etc.) for quantitatively evaluating membership leakage in such dataset intersection operations, and / or may maximize the number of memberships (positive membership or negative membership) of elements of dataset X in or about dataset Y as much as possible to evaluate the effectiveness of the privacy-preserving protocol within such constraints.

[0065] Return to reference Figure 3 , Figure 3An example of a privacy protection effectiveness evaluation algorithm 300 using a dynamic programming solution is shown, providing a state at box 320. It should be understood that "state" is a term in dynamic programming, and it can refer to the number of variables required to calculate the best result at a particular time. That is, a state is a combination of variables that can change at different times. It should be understood that the greater the number of states, the greater the depth of the recursive solution, and the more storage is required to cache the state results to avoid recalculation.

[0066] In an example embodiment, the state at block 320 may be a tuple including three variables: (|N|, C N ,τ), where N is a dataset derived from dataset X (e.g., dataset X, a subset of dataset X, etc.), |N| is the size or cardinality of dataset N, and C N is the cardinality of the intersection between dataset N and dataset Y (i.e., all elements of the intersection have positive membership in dataset Y), and τ is a constraint (the size of the intersection reveals the maximum allowed number of invocations of the protocol). It should be understood that Figure 2B As described in , different values ​​of the partition factor (or partition number) K may lead to different membership inference scenarios with different expected leakage. N ,τ),Γ k (|N|,C N ,τ) can refer to the state (|N|, C N ,τ). For the state (|N|,C N ,τ), the optimal partition factor K (which is the partition rule function θ(|N|,C N ,τ) can be determined as argmax k Γ k (|N|,C N ,τ), which is the partition factor k (among all possible partition factors) that results in the maximum or largest expected leakage. Figure 2B It is described how to determine the expected leakage E for each partition factor k among all possible partition factors. The maximum or largest expected leakage can be expressed as Γ(|N|,C N ,τ), namely Γ K (|N|,C N ,τ).

[0067] In an exemplary embodiment, Φ(|N|,C N ) represents the minimum number of expected protocol runs (the minimum number of calls to the protocol revealed by the intersection size) required for the evaluator to infer the membership of an element of the dataset N, where C NHas positive membership. Φ(|N|,C N ) can be determined as

[0068] In the example embodiment, the current data set N is divided using the division factor K to generate two sub-data sets: (left child / partition, with K elements) and (Right child / partition, with |N|-K elements). It should be understood that the (optimal) partition factor K can be obtained for the state (|N|, C N ,τ) (among all possible partitioning factors).

[0069] It should be understood that the first K elements positive members in (i.e., elements with positive membership in dataset Y) (i.e., dataset and the PSI-CA results of the dataset Y) can be expressed as a random variable C L , whose probability distribution is Pr(C L =c) = C(C N ,c)×C(|NC N |, Kc) / C(N, K), where C(C N , c) indicates that in all C N Select c positive members from among the positive members (e.g., elements that have positive membership in the dataset Y), C(|NC N |, Kc) indicates that in all |NC N | negative members to select Kc negative members, C(N, K) indicates to select K members from all N members (i.e., elements have positive membership or negative membership in data set Y). Figure 2B As stated in the CL It can be based on positive membership (a random variable C with probability distribution L ) to determine that the positive member is also a data set and the PSI-CA results of dataset Y. That is, the expected leakage E of the corresponding state CL Can be determined or expressed as a known number of memberships (positive or negative).

[0070] It should also be understood that the maximum or largest expected leakage Γ K (|N|,C N ,τ) can be derived by recursive function calls. For example, after partitioning with the partition factor K, by selecting the left child The total expected leakage becomes If Φ(K,CL )>=τ-1, then it can be (1)E CL [Γ(K,C L ,τ-1)], otherwise it can be (2)K+E CL [Γ(|N|-K,C N -C L ,τ-Φ(K,C L ))].

[0071] Similarly, by selecting the right child The total expected leakage becomes If Φ(|N|-K, C N -C L )>=τ-1, which can be (1)E CL [Γ(|N|-K,C N -C L ,τ-1)], otherwise it can be (2)|N|-K+E CL [Γ(K,C L ,τ-Φ(|N|-K,C N -C L ))].

[0072] Therefore, Γ K (|N|,C N , τ) can be expressed as

[0073] Return to reference Figure 3 , after the first PSI-CA operation (e.g., between dataset X and dataset Y, see Figure 2A description), we can determine the initial state (|N|, C N , τ), where |N| is the size of dataset N derived from dataset X (the initial content in dataset N can be the content of dataset X of party A), C N is the cardinality of the resulting intersection of the PSI-CA operations, and τ is the remaining constraint (e.g., the remaining number of times PSI-CA can be called).

[0074] In an example embodiment, the partition rule function θ(|N|, C N , τ), which outputs the optimal partition factor K. Then the data set N is divided into and It should be understood that it is possible to determine Total expected leakage And it can be determined Total expected leakage assumed has a higher total expected leakage, then at block 330 (e.g., in the data set and dataset Y), we can select the sub-item / partition with higher total expected leakage As input to the next PSI-CA operation. Member C L (That is, a random variable C with probability distribution L ) may be determined at block 330 based on the result intersection of the PSI-CA operation. L =0 (no positive member, that is, all negative members) or C L =K (all positive members, ie, no negative members), then in box 340, the data set Zpos containing all positive members may be updated to include the newly identified positive members, and / or the data set Zneg containing all negative members may be updated to include the newly identified negative members.

[0075] In the example embodiment, if C L Not equal to 0 and C L is not equal to K, then the state at block 320 (|N|, C N ,τ) can be updated as ( and Y, τ-1), and the process may continue / repeat from update state 320, for example to determine a new partitioning factor K'.

[0076] In an example embodiment, the child / partition with the lower total expected leakage (e.g., the right child / partition) ) can be queued into a priority queue at box 310, where the queue is ordered so that when the current state has been processed, the node with the highest priority (i.e., highest total expected leakage) in the queue can be dequeued first to update the state (as the new state) at box 320.

[0077] In short, if Figure 3 As shown, the expected leakage of the current state at block 320 may depend on the partition factor K. For a given partition factor K=k, the privacy-preserving effectiveness assessment protocol or algorithm described herein may select from the left child / partition or the right child / partition based on their corresponding expected leakage values. The privacy-preserving assessment protocol or algorithm may then select the child / partition with the largest expected leakage value as the new input for the next PSI-CA operation at block 330, demoting the other child / partition to the priority queue at block 310. Assuming the left child / partition Than right child / division With larger expected leakage, we use the partition factor K to partition the dataset N into and Thereafter, the privacy-preserving assessment protocol or algorithm may invoke the PSI-CA operation at block 330 and receive the intersection C L If CL =0, then the input data set None of the elements in belong to the intersection, and Zneg is updated to If C L =K, then input data set All elements in belong to the intersection, and Zpos is updated to Except for these two cases, the new C L Together with K and τ-1, we form the new state for evaluation / attack (K, C L , τ-1).

[0078] It should be understood that once the expected leakage for a parent node is determined, all expected leakages of its child nodes (i.e., partitions) may be available, since they are an intermediate step in determining the parent node. That is, in order to determine Γ(|N|, C N ,τ), all Γ(|N|',C' N ,τ') are all required, where 1<=|N|'<=|N|, 1<=C' N <=C N , 00<τ'<τ. When the privacy-preserving effectiveness evaluation protocol or algorithm proceeds, any observation of the true number of positive memberships in the current node is included. Therefore, the policy space of Γ only needs to be determined once offline and can be directly used for further retrieval.

[0079] Figure 4 400 is a flow chart illustrating an example process flow 400 for evaluating the effectiveness of a privacy protection protocol according to at least some embodiments described herein. It should be understood that the process flow 400 disclosed herein may include: Figure 2A , Figure 2B and Figure 3 One or more of the processes described in .

[0080] It should be understood that, unless otherwise specified, the process flow 400 disclosed herein may be executed by one or more processors (e.g., Figure 1 a processor of one or more of the terminal devices 110, 120, 130 and 140, Figure 1 The processor of the server 150, Figure 6 605 and / or any other suitable processor).

[0081] It should also be understood that the processing flow 400 may include one or more operations, actions, or functions, as shown in one or more of blocks 410, 420, 430, 440, 450, 460, 470, 480, 490, and 495. These various operations, functions, or actions may correspond, for example, to software, program code, or program instructions executable by a processor that cause these functions to be performed. Although shown as discrete blocks, obvious modifications may be made, for example, two or more blocks may be reordered; more blocks may be added; and various blocks may be divided into more blocks, combined into fewer blocks, or eliminated depending on the desired implementation. It should be understood that prior to the processing flow 400, operations including initialization and the like may be performed. For example, system parameters and / or application parameters may be initialized. The processing flow 400 may begin at block 410.

[0082] At block 410 (Initialize), the processor may perform or proceed with a number of initialization processes. In an example embodiment, the processor may receive, obtain, or provide a data set X containing a target element or record (e.g., for the evaluator, Party A). The target element (i.e., the element in data set X) is the element for which the evaluator is attempting to identify membership (e.g., positive membership or negative membership in data set Y for Party B). The processor may also receive, obtain, or provide a predetermined intermediate result θ containing all intermediate results for the optimal partitioning factor (see Figure 5 Description of ). The processor may further receive, obtain or provide a constraint τ (i.e., the maximum allowed number or remaining number of calls to the PSI-CA protocol or the privacy protection protocol to be evaluated). In addition, the processor may initialize the classified dataset Zpos (for storing identified / classified positive members) to an empty dataset, and initialize the classified dataset Zneg (for storing identified / classified negative members) to an empty dataset. The processor may also perform, call, implement, run or execute PSI-CA operations on datasets X and Y; obtain, receive or generate the cardinality of the resulting intersection Cx; and reduce the constraint number τ by 1 (τ=τ-1). It should be understood that the cardinality of the intersection Cx may indicate how many positive members dataset X has. The processor may further initialize the node {(C X , X)} is added to a queue (eg, a priority queue, etc.) or queued. Processing may proceed from block 410 to block 420.

[0083] At block 420 (Process Nodes in Queue), the processor may execute a loop (e.g., a "while" loop) until the queue (e.g., a priority queue, etc.) is empty. The processor may select the highest priority node (i.e., the node with the highest expected leakage) as the current node (C N , N) out of the queue, and such nodes are processed at block 430. Processing may proceed from block 420 to block 430.

[0084] At block 430 (Evaluate with Constraints), the processor may execute a loop (eg, a "while" loop) until (1) the condition 0 < C N <|N| is not satisfied, or (2) condition τ>0 is not satisfied. That is, the loop can end, and the membership (positive membership or negative membership) of all elements in the data set N is marked as positive (C N =|N|) or negative (C N =0), or the constrained number limit is reached (i.e., each time a PSI-CA operation is called, the number τ decreases by 1, and τ decreases until it reaches 0).

[0085] In block 430, the first processing step is block 440. At block 440 (Determine Split Factor), the processor may determine the partition factor from the current state (|N|), C N ,τ) of the partition rule function θ (i.e., θ(|N|), C N , τ)) receives, obtains or generates output (partition factor K). Figure 5 The processor can divide the data set N (using the partition factor K) into two sub-data sets (with K elements) and (having |N|-K elements.) Processing may proceed from block 440 to block 450 .

[0086] At block 450 (determine priority), the processor may prioritize the data set. Perform, call, implement, run or execute PSI-CA operation with dataset Y; obtain, receive or generate result intersection C L and reduce the constraint number τ by 1 (τ=τ-1). It should be understood that the intersection C L The cardinality of the dataset can indicate How many positive members it has. The number of positive members can be expressed as C N -C L The processor can also determine two sub-data sets and The priority (i.e., expected leakage) of the two sub-datasets is determined by Figure 3 ). Processing may proceed from block 450 to block 460.

[0087] At block 460 (Queue Low Priority Nodes), the processor may queue nodes with lower priority (e.g., ) (see description of block 450 , assuming the right child / partition has a lower priority) is queued into a queue (eg, a priority queue). Processing may proceed from block 460 to block 470 .

[0088] At block 470 (Process High Priority Node), the processor may, for example, set the higher priority node as the current node (C L , N) to process nodes with higher priority (e.g., ) (See description of block 450, assuming the left child / partition has a higher priority). Processing may proceed from block 470 to the beginning of block 430 until the loop of block 430 ends. Processing may then proceed from either block 470 or 430 to block 480.

[0089] At block 480 (Update Classification Set), the processor may update the classification data sets Zneg and Zpos by: N = 0, then none of the elements in the input data set N belongs to the intersection, and Zneg is updated to Zneg∪N; if C N =|N|, then all elements in the input data set N belong to the intersection, and Zpos is updated to Zpos∪N. Processing can proceed from block 480 to the beginning of block 420 until the loop of block 420 ends. Then, processing can proceed from block 480 or 420 to block 490.

[0090] At block 490 (return classified set), the processor may return the classified data sets Zneg and Zpos as outputs of the privacy protection protocol evaluation algorithm. The processor may also evaluate the effectiveness of a privacy protection protocol (e.g., a PSI-CA protocol) by measuring the number of positive members in the data set Zpos and / or the number of negative members in the data set Zneg. The greater the number in Zneg and / or Zpos, the less effective the privacy protection protocol (to be evaluated) may be given the same constraints (e.g., the number of maximum allowed calls to the privacy protection protocol to be evaluated). Processing may proceed from block 490 to block 495.

[0091] In box 495 (update privacy protection protocol), the processor may improve the privacy protection protocol to be evaluated by at least one of the following: (1) adding (multiple) noises to data set Y, (2) reducing the maximum allowed number of calls (τ) of the privacy protection protocol to be evaluated, (3) based on the evaluation of the privacy protection protocol (e.g., PSI-CA protocol), adding (multiple) noises to the intersection result when performing a PSI-CA operation between data set Y and data set Y, and so on.

[0092] Figure 5 is a flow chart illustrating an example process flow 500 for determining a partitioning factor according to at least some embodiments described herein. It should be understood that the process flow 500 disclosed herein may include: Figure 2B and Figure 3It should also be understood that the processing flow 500 disclosed herein may provide a protocol or algorithm for generating intermediate variables (eg, partitioning factors, etc.) using a dynamic programming method.

[0093] It should be understood that, unless otherwise specified, the process flow 500 disclosed herein may be executed by one or more processors (e.g., Figure 1 a processor of one or more of the terminal devices 110, 120, 130 and 140, Figure 1 The processor of the server 150, Figure 6 605 and / or any other suitable processor).

[0094] It should also be understood that the process flow 500 may include one or more operations, actions, or functions, as shown in one or more of blocks 510, 520, 530, 540, 550, 560, 570, 580, 590, and 595. These various operations, functions, or actions may correspond, for example, to software, program code, or program instructions executable by a processor that cause these functions to be performed. Although shown as discrete blocks, obvious modifications may be made, for example, two or more blocks may be reordered; more blocks may be added; and various blocks may be divided into more blocks, combined into fewer blocks, or eliminated, depending on the desired implementation.

[0095] It should be understood that, before processing flow 500, operations including initialization may be performed. For example, system parameters and / or application parameters may be initialized. In an example embodiment, storage space for variables Γ and Φ may be created or generated. Γ(|N|, C N ,τ) can refer to the state (|N|,C N ,τ) (grouping of . Φ(|N|,CN) is provided to represent the minimum number of expected protocol runs (the minimum number of calls to the protocol that the intersection size reveals) required for the evaluator to infer membership of an element of dataset N, where C for a given element N has positive membership. In an example embodiment, variables Γ and Φ may be initialized, for example, as a hash table (or other suitable data structure), where the key of Γ is (|N|, C N ,τ), the key of Φ is (|N|,C N). The value of Γ(1,1,0) is 1, indicating that the expected leakage value of the state (1,1,0) is 1, where the state indicates 1 member in dataset N, 1 positive member in the intersection of dataset N and dataset Y, and the number of remaining PSI-CA protocol calls is 0. The value of Γ(1,0,0) is 1, indicating that the expected leakage value of the state (1,0,0) is 1, where the state indicates 1 member in dataset N, 0 positive members in the intersection of dataset N and dataset Y (or 1 negative member because |N| is 1), and the number of remaining PSI-CA protocol calls is 0. The value of Φ(1,1) is 0, indicating that there is 1 member in dataset N, 1 positive member in the intersection (of dataset N and dataset Y), and there is no need to run the PSI-CA protocol, so the minimum number of expected PSI-CA protocol runs is 0. The value of Φ(1, 0) is 1, indicating that there is 1 member in dataset N and 0 positive members in the intersection (of dataset N and dataset Y), so the minimum number of expected PSI-CA protocol runs is 1 (the evaluator needs to run this number of times to infer the membership of an element of dataset N).

[0096] After initializing system parameters and / or application parameters, process flow 500 may begin at block 510. It should be understood that a processor for process flow 500 may obtain, receive, or accept the following inputs: the size (|N|) of data set N (derived from data set X of party A), the membership of elements in the intersection (of data set N and data set Y of party B) (C|), and the number of members in the intersection (of data set N and data set Y of party B). N ), and the constraint τ (the remaining number of calls of the PSI-CA protocol or the privacy protection protocol to be evaluated). Processing flow 500 may be an optimal tree partitioning algorithm based on dynamic programming.

[0097] At block 510 (OUTPUT EXISTS?), the processor may check the partition rule function θ(|N|, C N ,τ) (i.e., the optimal partitioning factor) already exists (e.g., in a memory or storage device). If the output exists, processing can proceed from block 510 to block 595. If the output does not exist, processing can proceed from block 510 to block 520.

[0098] At block 520 (initialization), the processor may set the state (|N|, C N ,τ) of the expected leakage Γ(|N|,C N ,τ) is initialized to 0 (no leakage is expected initially), and the partition rule function θ(|N|,C N ,τ) is initialized to 0 (partition factor is 0, indicating that there is no initial partition), and the minimum number of expected protocol runs (the minimum number of calls that the intersection size reveals the protocol) Φ(|N|,C N) is initialized to |N| (if for each element in data set N, the PSI-CA protocol is performed to determine its membership). Processing may proceed from block 520 to block 530.

[0099] At block 530 (process all possible k), the processor may execute a loop (e.g., a "for" loop) with all possible k as a condition until all possible k are processed. The condition may be "1 <= k <= (|N|+1) / 2", indicating that the integer k starts from 1 and has a lower limit (or upper limit) of (|N|+1) / 2.

[0100] Within block 530, the first processing step is block 540. At block 540 (Determine Expected Leakage for Left Child), the processor may partition the data set N into left children / partitions using the current partition factor k. and right child / partition The processor can also determine the total expected leakage of the left child If Φ(k,C L )>=τ-1, the total expected leakage can be (1)E CL [Γ(k,C L ,τ-1)], otherwise it can be (2)k+E CL [Γ(|N|-k,C N -C L ,τ-Φ(k,C L ))]. See Figure 3 Processing may proceed from block 540 to block 550 .

[0101] At block 550 (Determine Expected Leakage for Right Child), the processor may determine the right child The total expected leakage of N -C L )>=τ-1, the total expected leakage can be (1)E CL [Γ(|N|-k,C N -C L ,τ-1)], otherwise it can be (2)|N|-k+E CL [Γ(k,C L ,τ-Φ(|N|-k,C N -C L ))]. See Figure 3 Processing may proceed from block 550 to block 560.

[0102] At block 560 (determine expected leakage for current k), the processor may convert the maximum or largest expected leakage Γ(|N|, C N ,τ-1) is determined as Processing may proceed from block 560 to the beginning of block 530 until the loop of block 530 is complete. Processing may then proceed from either block 560 or 530 to block 570.

[0103] At block 570 (Determine Split Factor), for a state (|N|, C N ,τ), the processor can use the partition rule function θ(|N|,C N The optimal partition factor K of the output of τ is determined as argmax k Γ k (|N|,C N , τ), which is the partition factor k (among all possible partition factors) that produces the maximum or largest expected leakage. Processing may proceed from block 570 to block 580.

[0104] At block 580 (Are all members identified?), the processor may check the condition “Γ(|N|, C N ,τ)>=|N|” is satisfied / established / true to check whether all members (positive membership or negative membership) in the data set N are identified. If this condition is evaluated to be true, processing can proceed from box 580 to box 590. If this condition is evaluated to be false, processing can proceed from box 580 to box 595.

[0105] At block 590 (update expected number of protocol runs), the processor may update the minimum number of expected protocol runs (the minimum number of calls to the protocol revealed by the intersection size) Φ(|N|, C N ) is set to Φ(|N|, C N ) and τ (i.e., min{Φ(|N|,C N ,τ}) to update the expected number of protocol runs. Processing can proceed from block 590 to block 595.

[0106] At block 595 (return output), the processor may determine the output based on the input state (|N|, C N ,τ) output partition rule function θ(|N|,C N ,τ) is the optimal partitioning factor K.

[0107] It should be understood that the features in the embodiments disclosed herein can quantify the privacy leakage of sets (or data sets) of intersection size revealing protocols (e.g., PSI-CA, etc.) (such as membership privacy leakage, etc.). The features in the embodiments disclosed herein can also utilize positive and negative membership elements, thereby significantly improving the efficiency of membership measurement. The features in the embodiments disclosed herein can further provide asymmetric partitioning (e.g., dynamic partitioning, non-fixed partitioning, etc.) of the tree structure during the evaluation / attack process, which can improve the overall effectiveness. It should be understood that fixed partitioning or symmetric partitioning always divides or partitions a node into fixed or symmetric partitions (e.g., each sub-item / partition has the same number of elements), while asymmetric partitioning or dynamic partitioning divides or partitions a node based on a partitioning factor that, for example, results in, for example, maximum expected leakage. In addition, the features in the embodiments disclosed herein can provide an optimal tree partitioning solution that is strategically determined by employing dynamic programming in the processing.

[0108] Figure 6 An electronic device (eg, Figure 1 Schematic diagram of an example computer system 600 (one of the servers or terminal devices shown). It should be understood that providing Figure 6 The computer system shown is for illustration only and is not intended to limit the functionality and applicability of the embodiments described herein.

[0109] As shown, the computer system 600 may include a central processing unit (CPU) 605. The CPU 605 may perform various operations and processes based on a program stored in a read-only memory (ROM) 610 or a program loaded from a storage device 640 to a random access memory (RAM) 615. The RAM 615 may also store various data and programs required for the operation of the system 600. The CPU 605, the ROM 610, and the RAM 615 may be connected to each other via a bus 620. An input / output (I / O) interface 625 may also be connected to the bus 620.

[0110] Components connected to the I / O interface 625 may also include input devices 630, including keyboards, mice, digital pens, drawing boards, etc.; output devices 635, including displays such as liquid crystal displays (LCDs), speakers, etc.; storage devices 640, including hard disks, etc.; and communication devices 645, including network interface cards such as LAN cards, modems, etc. The communication device 645 may perform communication processing via networks such as the Internet, WAN, LAN, LIN, clouds, etc. In one embodiment, a drive 650 may also be connected to the I / O interface 625. Removable media 655 such as magnetic disks, optical disks, magneto-optical disks, semiconductor memories, etc. may be installed on the drive 650 as needed, so that a computer program read from the removable media 655 may be installed in the storage device 640.

[0111] It should be understood that reference Figure 4 and Figure 5 The processes described in the flowcharts and / or the processes described in other figures may be implemented as computer software programs or hardware. A computer program product may include a computer program stored in a computer-readable non-volatile medium. The computer program includes program code for executing the methods shown in the flowcharts and / or GUIs. In this embodiment, the computer program may be downloaded and installed from a network via a communication device 645, and / or may be installed from a removable medium 655. The computer program, when executed by a central processing unit (CPU) 605, may implement the above-mentioned functions specified in the methods in the embodiments disclosed herein.

[0112] It should be understood that the disclosure and other solutions, examples, embodiments, modules and functional operations described in this document can be implemented in digital electronic circuit systems, or in computer software, firmware or hardware, including the structures disclosed in this document and their structural equivalents, or in a combination of one or more of them. The disclosed embodiments and other embodiments can be implemented as one or more computer program products, i.e., one or more modules of computer program instructions encoded on a computer-readable medium, for execution by a data processing device or for controlling the operation of the data processing device. The computer-readable medium can be a machine-readable storage device, a machine-readable storage substrate, a memory device, a composition of matter that affects a machine-readable propagation signal, or a combination of one or more of them. The term "data processing device" includes all devices, equipment and machines for processing data, including, for example, a programmable processor, a computer or multiple processors or computers. In addition to hardware, the device may also include code that creates an execution environment for the computer program in question, for example, code that constitutes processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of them.

[0113] A computer program (also referred to as a program, software, software application, script, or code) may be written in any form of programming language, including compiled or interpreted languages, and may be deployed in any manner, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program does not necessarily correspond to a file in a file system. A program may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple coordinated files (e.g., files storing one or more modules, subroutines, or portions of code). A computer program may be deployed to execute on one computer or on multiple computers located at one site or distributed across multiple sites and interconnected by a communications network.

[0114] The processes and logic flows described in this document may be performed by one or more programmable processors executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows may also be performed by, and apparatus may also be implemented as, special purpose logic circuitry, such as field programmable gate arrays, application specific integrated circuits, and the like.

[0115] For example, processors suitable for executing computer programs include general and special microprocessors, and any one or more processors of any kind of digital computer. Typically, the processor will receive instructions and data from a read-only memory or a random access memory or both. The basic elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. In general, a computer will also include one or more large-capacity storage devices for storing data, such as magneto-optical disks, magneto-optical disks, or optical disks, or operably coupled to receive data from or transmit data to, or both. However, a computer need not have such a device. Computer-readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices, such as erasable programmable read-only memory, electrically erasable programmable read-only memory, and flash memory devices; disks, such as internal hard disks or removable disks; magneto-optical disks; and optical disk read-only memory and digital video disk read-only memory disks. The processor and memory can be supplemented by a dedicated logic circuit system, or incorporated into a dedicated logic circuit system.

[0116] It should be understood that different features, variations and multiple different embodiments have been shown and described in various details. The content sometimes described in this application according to specific embodiments is only for illustrative purposes, and is not intended to limit or imply that the content envisioned is only one specific embodiment or multiple specific embodiments. It should be understood that the present disclosure is not limited to any single specific embodiment or the variants listed. Those skilled in the art will think of many modifications, variations and other embodiments, and these modifications, variations and other embodiments are intended to and are actually covered by the present disclosure. In fact, the scope of the present disclosure should be determined by the appropriate legal interpretation and understanding of the present disclosure, including equivalents understood by those skilled in the art based on the complete disclosure that exists at the time of submission.

[0117] aspect:

[0118] It should be understood that any aspects may be combined with each other.

[0119] Aspect 1. A method for evaluating privacy protection, the method comprising: generating a first intersection of a first data set and a second data set; determining a partition number based on the first data set, the first intersection and the number of iterations in the following manner: determining a privacy leakage for a subset of the first data set based on the first data set, the first intersection and the number of iterations, and determining the partition number based on the privacy leakage for each subset in the subset of the first data set; using the partition number to partition the first data set into a first sub-data set and a second sub-data set; and determining positive membership and negative membership of elements of the first sub-data set in the second data set and positive membership and negative membership of elements of the second sub-data set in the second data set.

[0120] Aspect 2. The method according to aspect 1 further includes: evaluating a privacy protection protocol based on the number of positive memberships and the number of negative memberships of the elements of the first data set in the second data set.

[0121] Aspect 3. A method according to Aspect 1 or 2, wherein the determination of positive membership and negative membership of elements of the first sub-dataset in the second data set and the determination of positive membership and negative membership of elements of the second sub-dataset in the second data set includes: determining a priority level for each of the first sub-dataset and the second sub-dataset; queuing the first sub-dataset or the second sub-dataset having a lower priority level; and determining the positive membership and negative membership of elements of the first sub-dataset or the second sub-dataset having a higher priority level.

[0122] Aspect 4. The method according to Aspect 3 further includes: dequeuing the first sub-dataset or the second sub-dataset having the lower priority level; and determining the positive membership and negative membership of the elements of the first sub-dataset or the second sub-dataset having the lower priority level.

[0123] Aspect 5. A method according to Aspect 3 or 4, wherein the determination of the priority level for each of the first sub-dataset and the second sub-dataset includes: determining a privacy leakage for each of the first sub-dataset and the second sub-dataset, wherein the priority level for each of the first sub-dataset and the second sub-dataset is determined based on the privacy leakage for each of the first sub-dataset and the second sub-dataset.

[0124] Aspect 6. A method according to any one of Aspects 1 to 5, wherein the generation of the first intersection comprises: reducing the number of iterations; and updating a state for the first data set, wherein the state comprises a size of the first intersection and the number of iterations.

[0125] Aspect 7. The method according to any one of Aspects 1 to 6 further includes: generating a second intersection of the first sub-dataset and the second data set; reducing the number of iterations; and updating a state for each of the first sub-dataset and the second sub-dataset, wherein the state includes the size of the second intersection and the number of iterations.

[0126] Aspect 8. A privacy protection assessment system, the system comprising: a memory for storing a first data set and a number of iterations; a processor for: generating a first intersection of the first data set and a second data set; determining a partition number based on the first data set, the first intersection and the number of iterations in the following manner: determining a privacy leakage for a subset of the first data set based on the first data set, the first intersection and the number of iterations, and determining the partition number based on the privacy leakage for each subset in the subset of the first data set; using the partition number to partition the first data set into a first sub-dataset and a second sub-dataset; and determining the positive membership and negative membership of the elements of the first sub-dataset in the second data set and the positive membership and negative membership of the elements of the second sub-dataset in the second data set.

[0127] Aspect 9. The system according to aspect 8, wherein the processor is further configured to: evaluate a privacy preservation protocol based on the number of positive memberships and the number of negative memberships of elements of the first data set in the second data set.

[0128] Aspect 10. A system according to Aspect 8 or 9, wherein the processor is further used to: determine a priority level for each of the first sub-dataset and the second sub-dataset; queue the first sub-dataset or the second sub-dataset having a lower priority level; and determine the positive membership and negative membership of the elements of the first sub-dataset or the second sub-dataset having a higher priority level.

[0129] Aspect 11. A system according to Aspect 10, wherein the processor is further used to: dequeue the first sub-dataset or the second sub-dataset having the lower priority level; and determine the positive membership and negative membership of the elements of the first sub-dataset or the second sub-dataset having the lower priority level.

[0130] Aspect 12. A system according to Aspect 10 or 11, wherein the processor is further used to: determine a privacy leak for each of the first sub-dataset and the second sub-dataset, wherein the priority level for each of the first sub-dataset and the second sub-dataset is determined based on the privacy leak for each of the first sub-dataset and the second sub-dataset.

[0131] Aspect 13. A system according to any one of Aspects 8 to 12, wherein the processor is further used to: reduce the number of iterations; and update a state for the first data set, wherein the state includes the size of the first intersection and the number of iterations.

[0132] Aspect 14. A system according to any one of Aspects 8 to 13, wherein the processor is further used to: generate a second intersection of the first sub-dataset and the second data set; reduce the number of iterations; and update a state for each of the first sub-dataset and the second sub-dataset, wherein the state includes the size of the second intersection and the number of iterations.

[0133] Aspect 15. A non-transitory computer-readable medium having computer-executable instructions stored thereon, wherein the computer-executable instructions, when executed, cause one or more processors to perform operations, the operations comprising: generating a first intersection of a first data set and a second data set; determining a partition number based on the first data set, the first intersection, and the number of iterations in the following manner: determining a privacy leakage for a subset of the first data set based on the first data set, the first intersection, and the number of iterations, and determining the partition number based on the privacy leakage for each subset in the subset of the first data set; using the partition number to partition the first data set into a first sub-data set and a second sub-data set; and determining positive membership and negative membership of elements of the first sub-data set in the second data set and positive membership and negative membership of elements of the second sub-data set in the second data set.

[0134] Aspect 16. The computer-readable medium of aspect 15, wherein the operations further comprise: evaluating a privacy preservation protocol based on a number of positive memberships and a number of negative memberships of elements of the first data set in the second data set.

[0135] Aspect 17. A computer-readable medium according to Aspect 15 or 16, wherein the determination of positive membership and negative membership of elements of the first sub-dataset in the second data set and positive membership and negative membership of elements of the second sub-dataset in the second data set includes: determining a priority level for each of the first sub-dataset and the second sub-dataset; queuing the first sub-dataset or the second sub-dataset having a lower priority level; and determining the positive membership and negative membership of elements of the first sub-dataset or the second sub-dataset having a higher priority level.

[0136] Aspect 18. A computer-readable medium according to Aspect 17, wherein the operation further includes: dequeuing the first sub-dataset or the second sub-dataset having the lower priority level; and determining the positive membership and negative membership of the elements of the first sub-dataset or the second sub-dataset having the lower priority level.

[0137] Aspect 19. A computer-readable medium according to Aspect 17 or 18, wherein the determination of the priority level for each of the first sub-dataset and the second sub-dataset includes: determining a privacy leak for each of the first sub-dataset and the second sub-dataset, wherein the priority level for each of the first sub-dataset and the second sub-dataset is determined based on the privacy leak for each of the first sub-dataset and the second sub-dataset.

[0138] Aspect 20. A computer-readable medium according to any one of Aspects 15 to 19, wherein the generation of the first intersection comprises: reducing the number of iterations; and updating a state for the first data set, wherein the state comprises a size of the first intersection and the number of iterations.

[0139] The terms used in this specification are intended to describe specific embodiments and are not intended to be limiting. Unless expressly stated otherwise, the terms "a", "an" and "the" also include plural forms. The terms "comprises" and / or "comprising" when used in this specification specify the presence of the features, wholes, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, wholes, steps, operations, elements and / or components.

[0140] With respect to the foregoing description, it should be understood that changes in detail may be made without departing from the scope of the present disclosure, especially in the construction materials used and the shapes, sizes and arrangements of the parts. This specification and the described embodiments are exemplary only, with the true scope and spirit of the present disclosure being indicated by the following claims.

Claims

1. A method for evaluating privacy protection, the method comprising: Generate a first intersection of the first data set and the second data set; The partition number is determined based on the first data set, the first intersection, and the number of iterations in the following manner: determining a privacy leak for a subset of the first data set based on the first data set, the first intersection, and the number of iterations, and determining the partition number based on the privacy leakage for each subset of the subsets of the first data set; Using the partition number, partition the first data set into a first sub-data set and a second sub-data set; as well as Positive membership and negative membership of elements of the first sub-data set in the second data set and positive membership and negative membership of elements of the second sub-data set in the second data set are determined.

2. The method according to claim 1, further comprising: A privacy preserving protocol is evaluated based on the number of positive memberships and the number of negative memberships of elements of the first data set in the second data set.

3. The method of claim 1 , wherein the determining of positive and negative membership of elements of the first sub-data set in the second data set and positive and negative membership of elements of the second sub-data set in the second data set comprises: determining a priority level for each of the first sub-data set and the second sub-data set; queuing the first sub-dataset or the second sub-dataset having a lower priority level; as well as The positive membership and the negative membership of the elements of the first sub-data set or the second sub-data set having a higher priority level are determined.

4. The method according to claim 3, further comprising: dequeueing the first sub-dataset or the second sub-dataset having the lower priority level; as well as Positive membership and negative membership of elements of the first sub-data set or the second sub-data set having the lower priority level are determined.

5. The method of claim 3, wherein the determining of the priority level for each of the first sub-data set and the second sub-data set comprises: determining a privacy leak for each of the first sub-dataset and the second sub-dataset, Wherein the priority level for each of the first sub-data set and the second sub-data set is determined based on the privacy leakage for each of the first sub-data set and the second sub-data set.

6. The method of claim 1, wherein the generating of the first intersection comprises: reducing the number of iterations; as well as A state for the first data set is updated, wherein the state includes a size of the first intersection and the number of iterations.

7. The method according to claim 1, further comprising: generating a second intersection of the first sub-dataset and the second data set; reducing the number of iterations; as well as updating a state for each of the first sub-data set and the second sub-data set, The state includes the size of the second intersection and the number of iterations.

8. A privacy protection evaluation system, the system comprising: A memory, used to store the first data set and the number of iterations; Processor for: generating a first intersection of the first data set and the second data set; The partition number is determined based on the first data set, the first intersection, and the number of iterations in the following manner: determining a privacy leak for a subset of the first data set based on the first data set, the first intersection, and the number of iterations, and determining the partition number based on the privacy leakage for each subset of the subsets of the first data set; Using the partition number, partition the first data set into a first sub-data set and a second sub-data set; as well as Positive membership and negative membership of elements of the first sub-data set in the second data set and positive membership and negative membership of elements of the second sub-data set in the second data set are determined.

9. The system of claim 8, wherein the processor is further configured to: A privacy preserving protocol is evaluated based on the number of positive memberships and the number of negative memberships of elements of the first data set in the second data set.

10. The system of claim 8, wherein the processor is further configured to: determining a priority level for each of the first sub-data set and the second sub-data set; queuing the first sub-dataset or the second sub-dataset having a lower priority level; and The positive membership and the negative membership of the elements of the first sub-data set or the second sub-data set having a higher priority level are determined.

11. The system of claim 10, wherein the processor is further configured to: dequeueing the first sub-dataset or the second sub-dataset having the lower priority level; and Positive membership and negative membership of elements of the first sub-data set or the second sub-data set having the lower priority level are determined.

12. The system of claim 10, wherein the processor is further configured to: determining a privacy leak for each of the first sub-dataset and the second sub-dataset, Wherein the priority level for each of the first sub-data set and the second sub-data set is determined based on the privacy leakage for each of the first sub-data set and the second sub-data set.

13. The system of claim 8, wherein the processor is further configured to: reducing the number of iterations; and A state for the first data set is updated, wherein the state includes a size of the first intersection and the number of iterations.

14. The system of claim 8, wherein the processor is further configured to: generating a second intersection of the first sub-dataset and the second data set; reducing the number of iterations; and updating a state for each of the first sub-data set and the second sub-data set, The state includes the size of the second intersection and the number of iterations.

15. A non-transitory computer readable medium having computer executable instructions stored thereon, the computer executable instructions, when executed, causing one or more processors to perform operations comprising: Generate a first intersection of the first data set and the second data set; The partition number is determined based on the first data set, the first intersection, and the number of iterations in the following manner: determining a privacy leak for a subset of the first data set based on the first data set, the first intersection, and the number of iterations, and determining the partition number based on the privacy leakage for each subset of the subsets of the first data set; Using the partition number, partition the first data set into a first sub-data set and a second sub-data set; as well as Positive membership and negative membership of elements of the first sub-data set in the second data set and positive membership and negative membership of elements of the second sub-data set in the second data set are determined.

16. The computer-readable medium of claim 15, wherein the operations further comprise: A privacy preserving protocol is evaluated based on the number of positive memberships and the number of negative memberships of elements of the first data set in the second data set.

17. The computer-readable medium of claim 15, wherein the determining of positive and negative membership of elements of the first sub-data set in the second data set and positive and negative membership of elements of the second sub-data set in the second data set comprises: determining a priority level for each of the first sub-data set and the second sub-data set; queuing the first sub-dataset or the second sub-dataset having a lower priority level; as well as The positive membership and the negative membership of the elements of the first sub-data set or the second sub-data set having a higher priority level are determined.

18. The computer-readable medium of claim 17, wherein the operations further comprise: dequeueing the first sub-dataset or the second sub-dataset having the lower priority level; as well as Positive membership and negative membership of elements of the first sub-data set or the second sub-data set having the lower priority level are determined.

19. The computer-readable medium of claim 17, wherein the determining of the priority level of each of the first sub-data set and the second sub-data set comprises: determining a privacy leak for each of the first sub-dataset and the second sub-dataset, Wherein the priority level for each of the first sub-data set and the second sub-data set is determined based on the privacy leakage for each of the first sub-data set and the second sub-data set.

20. The computer-readable medium of claim 15, wherein the generating of the first intersection comprises: reducing the number of iterations; as well as A state for the first data set is updated, wherein the state includes a size of the first intersection and the number of iterations.

Images