Local differential privacy protection mechanism supporting data authenticity verification

Abstract

The invention discloses a local differential privacy protection mechanism supporting data authenticity verification, and relates to the technical field of data privacy protection, and the mechanism comprises the steps: obtaining a to-be-noised data set, and converting the to-be-noised data set into a binary bit vector form through a Bloom filter; mapping the data into a binary bit vector B with the length of k through a bloom filter by using h hash functions; and performing permanent random response noise addition processing on the binary bit vector B to generate a binary report B'with the length of k, and replacing the original data of the data holder with the generated binary report B '. Differential privacy and digital signature technologies are combined, the requirement of privacy protection of the data holder is met, meanwhile, the requirement of the data receiver for confirming the authenticity of the data is met, and the requirements of the data holder and the data receiver can be further met.

Description

Technical Field

[0001] The present invention belongs to the technical field of data privacy protection, and specifically relates to a local differential privacy protection mechanism that supports data authenticity verification. Background Art

[0002] With the development of data mining and machine learning technologies, privacy protection of personal data has become an important issue;

[0003] For example, the anonymized data sets released by Netflix are still partially de-anonymized, endangering the identity of users. In this context, differential privacy has emerged as a new means of privacy protection. Differential privacy aims to maximize the accuracy of data queries while minimizing the chances of identifying individual records. This goal is achieved by adding interfering data (noise) to query results. The application of differential privacy is of great significance for protecting personal privacy and using data in compliance with regulations.

[0004] Differential privacy is an information security technology that aims to protect individual data from being accurately identified during statistical analysis while still providing useful summary information. It is achieved by adding random noise to the original data. The basic principle is to add a tiny random perturbation that follows a specific distribution to each individual's data when publishing query results. This perturbation is almost imperceptible to a single user, but for the entire data set, it can prevent individual data from being accurately inferred.

[0005] In practice, this requires the assumption of a reliable data center to store and protect the privacy of data, but such a trusted data center does not always exist. In order to prevent untrusted data centers from leaking private data, local differential privacy can be used to achieve this. Local differential privacy is a type of differential privacy that allows the party holding the data to perform privacy-enhancing operations on the data on a local device, rather than relying on centralized data storage and protection. Traditional differential privacy is to perform calculations in a data center and add noise; in local differential privacy, data is processed locally and random perturbations are added. This approach can reduce the risk of data transmission to the server and better meet the user's need to protect their own data.

[0006] However, in actual data interaction, not only do data holders need to protect their privacy, but data receivers also hope that the data they collect will not be tampered with and will be verified by both parties. After receiving the data, if the data holder denies the data, the data receiver cannot prove it. Even if the data holder does not deny it, if the data is tampered with during transmission, it will bring hidden dangers to the data receiver.

[0007] The concept of differential privacy was first proposed by Dwork. Data collectors can divide data into several partitions and add Laplace noise to the count of each partition. In order to adjust the level of noise, differential privacy adjusts the aggregate noise by adjusting the amount of additional noise. Differential privacy can reduce the error rate of range queries by generating private histograms in querying data. This method can indeed avoid security issues caused by data leakage. However, this method of centralizing and adding noise to the data set poses a risk of data leakage by the data collector.

[0008] To this end, the present invention proposes a local differential privacy protection mechanism that supports data authenticity verification. Summary of the invention

[0009] The present invention aims to solve at least one of the technical problems existing in the prior art. To this end, the present invention proposes a local differential privacy protection mechanism that supports data authenticity verification, which combines differential privacy and digital signature technology, and satisfies the privacy protection needs of the data holder while also satisfying the data recipient's need to confirm the authenticity of the data, and can realize the data holder's need for privacy protection and the data recipient's need for data authenticity verification in one step.

[0010] To achieve the above objectives, the present invention proposes a local differential privacy protection mechanism that supports data authenticity verification, including:

[0011] Obtain a data set to be denoised, and convert the data set to be denoised into a binary bit vector through a Bloom filter;

[0012] Use h hash functions to map the data into a binary bit vector B of length k through a Bloom filter;

[0013] The binary bit vector B is subjected to permanent random response noise processing to generate a binary report B' of length k. The generated binary report B' replaces the original data of the data holder.

[0014] Preferably, the method for performing permanent random response noise processing on a binary bit vector B comprises: creating a binary report B' with a length of k, assigning a value to the i-th bit of B' according to a parameter f, and the formula is:

[0015]

[0016] Among them, parameter f is a parameter that can be adjusted by the data holder.

[0017] Preferably, the result of replacing the original data of the data holder satisfies differential privacy ε∞ and complies with the following formula:

[0018] Preferably, the data holder receives a request from the data recipient, creates an array S of length k, and initializes all values to 0;

[0019] Assign a value to the i-th bit of the array S according to the parameters q and p, and the assignment method is:

[0020]

[0021] Among them, the parameters q and p are parameters that can be adjusted by the data holder, and the resulting S is sent to the data recipient.

[0022] Preferably, the S satisfies differential privacy ε1 and follows the formula:

[0023]

[0024] Among them,

[0025] Preferably, the method for the local device of the data holder to generate a public-private key pair using an asymmetric encryption algorithm is as follows:

[0026] The data holder device selects two large prime numbers P and Q, and calculates n. Among them, the number of digits of n is the length of the key;

[0027] Calculate the Euler's totient function φ(n) = (p - 1)(q - 1), and select an integer e that satisfies 1 < e < φ(n) and is relatively prime to φ(n);

[0028] Calculate the modular inverse d of e with respect to φ(n), ed ≡ 1 (mod φ(n));

[0029] (e, n) is used as the public key, and (d, n) is used as the private key.

[0030] Preferably, the data holder device obtains the public key and the private key;

[0031] Encrypt the temporary random response based on the private key to obtain a digital signature D;

[0032] The data recipient obtains the public key.

[0033] Preferably, the encryption method of the digital signature D is: s = sig private-key (x) ≡ x d mod n.

[0034] Preferably, the data holder sends the temporary random response S and the digital signature D as a data report to the data recipient;

[0035] The data recipient decrypts the digital signature based on the data report and the public key, and the decryption method is: x' ≡ s e mod n.

[0036] Preferably, a comparison is made between the decrypted value and the content summary generated by the temporary random response to determine whether data collection is completed;

[0037] If the comparison results are inconsistent, resend the request;

[0038] If the comparison results are consistent, data collection is completed;

[0039] The comparison method is:

[0040] If the comparison result is x'≡xmodn, the signature is valid;

[0041] If the comparison result is x'≠xmodn, the signature is invalid.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. Combining differential privacy and digital signature technology not only meets the privacy protection needs of data holders, but also meets the needs of data recipients to confirm the authenticity of data, and can meet the needs of data holders and data recipients in one step;

[0044] 2. Double noise is used to protect data privacy. The data sent to the data receiver is a temporary random response S. Even if the temporary random response B is leaked or obtained by an attacker, only the permanent random response B' can be observed.

[0045] 3. The non-repudiation of data is achieved through digital signatures. In actual data interaction, the data recipient needs the authorization of the data holder to use the data, and the digital signature itself represents the authorization of the data holder. Therefore, the data recipient does not need to worry about the data holder denying the data after receiving it. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is the mechanism model diagram of the present invention;

[0047] Figure 2 It is a data conversion schematic diagram of the present invention;

[0048] Figure 3 It is a schematic diagram of the permanent random response of the present invention;

[0049] Figure 4 It is a schematic diagram of temporary random response of the present invention;

[0050] Figure 5 It is a data verification schematic diagram of the present invention;

[0051] Figure 6 It is a schematic diagram of the accuracy and recall rate of noise data under different hash functions in the present invention;

[0052] Figure 7 It is a schematic diagram of the accuracy and recall rate of noise data under the first bit vector of different lengths in the present invention;

[0053] Figure 8 Schematic diagram of the accuracy and recall rate of noise data under the second bit vector of different lengths in the present invention;

[0054] Fig. 9 It is a schematic diagram of the accuracy and recall rate of noise data under the third bit vector of different lengths in the present invention;

[0055] Fig.10 It is the time required to crack keys of different lengths in the present invention. DETAILED DESCRIPTION

[0056] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0057] Example

[0058] like Figure 1 As shown, a local differential privacy protection mechanism supporting data authenticity verification includes: obtaining a data set to be noisy, and converting the data set to be noisy into a binary bit vector through a Bloom filter; that is, after the data holder inputs his or her private data into a local device, the data holder converts the device data into a binary bit vector on the local device; using h hash functions to map the data into a binary bit vector B with a length of k through a Bloom filter; performing permanent random response noisy processing on the binary bit vector B to generate a binary report B' with a length of k, and the generated binary report B' replaces the original data of the data holder; that is, it mainly consists of three parts, namely stage 1.2.3; Figure 1 It is the overall picture of the whole mechanism; the work of phase one is that the user's local device converts the user data into a string of binary bit vectors through a random response mechanism; the work of phase two we use is that the data holder's device generates the corresponding digital signature and public key private key pair; the data holder uses the private key to encrypt the data summary to generate a unique digital signature; then the data holder will disclose the public key to the data recipient for verification; the work of phase three is that the data recipient verifies the data after receiving it and takes corresponding actions based on the results.

[0059] Specifically, the device of the data holder uses h hash functions to map the data v to a binary bit vector B of length k through a Bloom filter; illustratively, the Bloom filter of this embodiment is composed of a group of very long binary vectors and a series of random mapping functions (hash functions), and the specific form is a group of arrays [1,1,0,1,0,…,1,0] with only values ​​of 0 or 1; because the data structure of the Bloom filter only needs to store "0" and "1", the data occupies less storage space.

[0060] The data holder device adds noise to the binary bit vector B. Specifically, the device first creates a binary report B' of length k and assigns a value to the i-th bit of B' according to the parameter f. The specific method is as follows: The parameter f is a parameter that can be adjusted by the data holder. The result of this noise addition is called a permanent random response, which is stored on the local device.

[0061] For example, see Figure 1 and Figure 2 As shown in , after the data holder inputs his private data into the device, the device will add noise to the data. This noise meets the definition of differential privacy. First, use Figure 2 In the method shown, the local device converts the data holder data vi into a binary vector [0, 1]n through a Bloom filter to convert data 1 and data 2. This conversion process can be expressed as vi→[0, 1]n. The position of the data on the vector is calculated by h hash functions. Figure 2 There are two hash functions, so h=2. According to the calculated value, the value of the position corresponding to the value is changed to 1. For example, data 1 is calculated by hash function 1 and hash function 2 to obtain result 1 and set the corresponding value to 1. Data 2 is calculated by hash function 1 and hash function 2 to obtain result 2 and set the corresponding value to 1. If the value of the corresponding position is 1 after the position is calculated, no operation is required. In this way, all data of the data holder's device is calculated into the binary bit vector in a cycle. This vector can reflect whether the data privacy data exists in the set. If the vector shows that the data holder's data is not in the set, it is determined that the data is not in the set;

[0062] The permanent random response will replace the original data of the data holder; the purpose is that this method can protect the original data of the data holder to the greatest extent, making it difficult for attackers to distinguish between real signal bits and noise signal bits. Even if the adversary obtains the data report intercepted by the data receiver, it can only observe these permanent random responses through the report.

[0063] It should be noted that this result of permanently replacing the original data of the data holder satisfies differential privacy ε∞ and complies with the following formula:

[0064] The data holder receives a request from the data receiver, creates an array S of length k, and initializes all values ​​to 0. The i-th bit of the array S is assigned a value according to the parameters q and p. The specific assignment method is as follows: Parameters q and p are parameters that can be controlled by the data holder. This noise addition is called a temporary random response, and the result S is sent to the data receiver.

[0065] For example, see Figure 2 As shown in the figure, after the data holder obtains the binary bit vector B through the Bloom filter, the local device will use the random response mechanism to perturb the binary bit vector [0, 1]n of length n. According to the parameter f, the value of each bit is perturbed as follows Figure 3 The device assigns values ​​according to the rules. After processing the value of each bit according to the corresponding probability, the binary bit vector B' is obtained. For example, if the value of position 1 of B is 1, then the probability that B' has f / 2 values ​​at this position is 0, the probability of f / 2 is 1, and the probability of 1-f is that B' has the same value as B. If the value of position 2 of B is 0, then the probability that B' has f / 2 values ​​at this position is 1, the probability of f / 2 is 1, and the probability of 1-f is that B' has the same value as B. This process is repeated until the bit vector B' is generated. This vector is called a permanent random response. Unless the data holder updates the data on the device, this B' permanent random response is stored in the local device for a long time and is used to replace the original binary bit vector B.

[0066] The purpose is that this noise addition method can make it difficult for attackers to track data holders through a small number of data reports. This provides strong short-term privacy protection to a certain extent.

[0067] It is worth mentioning that this result S satisfies differential privacy ε1 and complies with the following formula:

[0068] in, Because it has been randomized twice, the probability of 1 being observed in the report is a function of q, p, and f;

[0069] For example, see Figure 3 As shown in , when the data collector needs data, it will send a request to the data holder's device; and after the data holder receives the request, its device will disturb B' again; Figure 4As shown in the figure, the local device of the data holder allocates a bit array S and initializes each bit to 0. Then, the local device assigns values to the corresponding positions of the array S according to the value of each bit of B'. The specific rule is that if the value of the i-th (1 ≤ i ≤ n) bit B' = 1, the probability that the corresponding value of the array S is 1 is q; if B' = 0, the probability that the corresponding value of the array S is 1 is p. The two parameters p and q represent the probability of the value being 1. For example, if the value of B' at position 1 is 0, then the probability that the value of S at position 1 is 1 is p; if the value of B' at position 2 is 1, then the probability that the value of S at position 2 is 1 is q. The obtained S is called the temporary random response and is used as the data sent to the data collector.

[0070] The local device of the data holder uses the asymmetric encryption algorithm to generate a public-private key pair (private-key, public-key). The data holder device selects two large prime numbers P and Q and calculates n. The number of digits of n is the length of the key. Calculate the Euler's totient function φ(n) = (p - 1)(q - 1). Select an integer e such that 1 < e < φ(n) and e is relatively prime to φ(n). Calculate the modular inverse d of e with respect to φ(n), that is, find an integer d such that ed ≡ 1 (mod φ(n)). The public key is (e, n), and the private key is (d, n). The specific process is shown in Algorithm1.

[0071] After the data holder device obtains the public key and the private key, it uses the private key private-key to encrypt the temporary random response to obtain the digital signature D, and then publishes the public key public-key to the data receiver. The digital signature is encrypted by the data holder using the private key for the noise data. The encryption method is as follows: s = sig private-key (x) ≡ x d mod n; Through the above method, a digital signature can be obtained, and this digital signature will be sent to the data receiver together with the temporary random response.

[0072] The data holder sends the temporary random response S and the digital signature D to the data receiver as a data report. After the data receiver obtains the data report, it decrypts the digital signature using the public key public-key. The decryption method is as follows: x' ≡ s e mod n;

[0073] The specific process is as Figure 5As shown, the data holder generates a data report for acceptance by the data receiver. The data report includes a digital signature and a temporary random response S. First, the data holder's device generates a content summary, and then the data holder's device generates a pair of public and private keys. The private key is owned by the data holder. The purpose is to ensure the uniqueness and non-repudiation of the digital signature. The data receiver uses the public key to confirm the authenticity of the data and prevent the data holder from denying it. This step uses asymmetric encryption technology. Then the data holder uses the private key to generate a digital signature based on the temporary random response S. Finally, the data and the digital signature are sent to the data receiver together as a data report. The data receiver is responsible for verification using the public key. After receiving the data report, the data receiver uses the public key issued by the data holder to decrypt the digital signature and compare it with the summary generated by the data in the data report. The data receiver will confirm the authenticity of the data based on the comparison results.

[0074] Compare the decrypted value with the content summary generated by the temporary random response. If the results are inconsistent, resend the request. If the results are consistent, the data collection is completed. The specific comparison method is as follows: x'≡xmodn and x'≠xmodn; if the comparison result satisfies the formula x'≡xmodn, the signature is valid, and if the comparison result is x'≠xmodn, the signature is invalid.

[0075] For example, see Figure 6 As shown, Figure 6 The accuracy and recall of the data after adding noise under different numbers of hash functions. The x-axis is the number of functions used, and the y-axis is the recall and accuracy values. We conducted three sets of experiments to observe the effects of different hash functions on accuracy and recall. Figure 6 It can be seen that when other parameters f, q, p, and k remain unchanged, the three figures all show that increasing the number of hash functions h will significantly reduce both the accuracy and recall. This shows that if the data holder wants to control the accuracy and recall of the data report, they can do so by adjusting the number of hash functions.

[0076] See also Figure 7 , Figure 8 and Fig. 9 As shown, Figure 7 , Figure 8 and Fig. 9It is the influence of the accuracy and recall of the data after adding noise under different vector group sizes. The X-axis is the size of the vector group, and the Y-axis is the value of the accuracy and recall. We conducted three sets of experiments, observing the accuracy and recall values ​​of different vector groups when the parameters such as q, p, k, and h remain unchanged. We found that the changes in accuracy and recall in each of the three sets of experiments were different. In the first set of experiments, the recall rate fluctuated significantly, and the overall recall rate increased with the increase of the vector group size, and the accuracy rate did not change significantly. The second figure shows that as the size of the vector group changes, the accuracy and recall rate show a downward trend. The third figure shows that as the vector group changes, both the recall rate and the accuracy rate fluctuate greatly. Therefore, it can be judged that adjusting the size of the vector group does not affect the accuracy and recall of the noise data.

[0077] See also Fig.10 As shown in the figure, it takes time to crack digital signatures of different digits. The X-axis is the number of digits in the digital signature, and the Y-axis is the time it takes to crack the signature. Fig.10 It can be seen that when the number of digital signature bits reaches 16 bits, the time required to crack it increases significantly. Therefore, in order to reduce the possibility of digital signatures being cracked, the number of bits of the digital signature needs to be at least 16 bits.

[0078] In addition, the parts of the above-mentioned technical solutions provided in the embodiments of the present application that are consistent with the implementation principles of the corresponding technical solutions in the prior art are not described in detail to avoid excessive redundancy.

[0079] The specific implementation modes as described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation mode of the present invention and is not intended to limit the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

[0080] The above preset parameters or preset thresholds are all set by technicians in this field according to actual conditions or obtained through large-scale data simulation.

[0081] The above embodiments are only used to illustrate the technical method of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical method of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical method of the present invention.

Claims

1. A local differential privacy protection mechanism supporting data authenticity verification, characterized in that: Including: Obtain the dataset to be noise-added, and convert the dataset to be noise-added into the form of a binary bit vector through a Bloom filter; Use h hash functions to map the data to a binary bit vector B of length k through a Bloom filter; Perform permanent random response noise addition processing on the binary bit vector B to generate a binary report B' of length k, and the generated binary report B' replaces the original data of the data holder.

2. A local differential privacy protection mechanism supporting data authenticity verification according to claim 1, characterized in that: The method for performing permanent random response noise addition processing on the binary bit vector B includes: creating a binary report B' of length k, and assigning a value to the i-th bit of B' according to the parameter f. The formula is: Among them, the parameter f is a parameter that the data holder can adjust.

3. A local differential privacy protection mechanism supporting data authenticity verification according to claim 1, characterized in that: The result of replacing the original data of the data holder satisfies the differential privacy ε∞ and complies with the following formula:

4. A local differential privacy protection mechanism supporting data authenticity verification according to claim 1, characterized in that: The data holder receives a request from the data receiver, creates an array S of length k, and initializes all values to 0; Assign a value to the i-th bit of the array S according to the parameters q and p. The assignment method is: Among them, the parameters q and p are parameters that the data holder can control, and the result S is sent to the data receiver.

5. A local differential privacy protection mechanism supporting data authenticity verification according to claim 4, characterized in that: The S satisfies differential privacy ε1 and complies with the formula: in, 6. A local differential privacy protection mechanism supporting data authenticity verification according to claim 5, characterized in that: The method for the data holder's local device to generate a public-private key pair using an asymmetric encryption algorithm is: The data holder device selects two large prime numbers P and Q, and calculates n. Among them, the number of digits of n is the length of the key; Calculate the Euler's totient function φ(n) = (p - 1)(q - 1), and select an integer e that satisfies 1 < e < φ(n) and e is relatively prime to φ(n); Calculate the modular inverse d of e with respect to φ(n), ed ≡ 1 (mod φ(n)); (e, n) is used as the public key, and (d, n) is used as the private key.

7. A local differential privacy protection mechanism supporting data authenticity verification according to claim 6, characterized in that: The data holder device obtains the public key and the private key; Encrypt the temporary random response based on the private key to obtain a digital signature D; The data receiver obtains the public key.

8. A local differential privacy protection mechanism supporting data authenticity verification according to claim 7, characterized in that: The encryption method of digital signature D is: s = sig private-key (x)≡x d modn.

9. A local differential privacy protection mechanism supporting data authenticity verification according to claim 8, characterized in that: The data holder sends the temporary random response S and the digital signature D to the data receiver as a data report; The data receiver decrypts the digital signature based on the data report and the public key. The decryption method is: x'≡s e modn.

10. A local differential privacy protection mechanism supporting data authenticity verification according to claim 8, characterized in that: Based on the comparison between the content summary generated from the decrypted value and the temporary random response, determine whether the data collection is completed; If the comparison result is inconsistent, resend the request; If the comparison result is consistent, the data collection is completed; The comparison method is: If the comparison result is x' ≡ x mod n, the signature is valid; If the comparison result is x' ≠ x mod n, the signature is invalid.

Images