Quantile differential privacy noise adding method, device, medium, equipment and product

Abstract

A quantile differential privacy noise adding method, device, medium, equipment and product. The method comprises: obtaining a plurality of values to be aggregated according to a preset user-defined aggregation function (UDAF) expression, the UDAF being obtained by replacing a quantile function in advance, the parameters of the UDAF and the quantile function both comprising an expression and a target quantile; selecting a target value corresponding to the target quantile from the plurality of values by using a differential privacy index mechanism to obtain a quantile value of the quantile function after noise adding. In this way, the differential privacy noise adding process can be efficiently controlled, the influence of noise adding error can be reduced without affecting security, and the usability of the query result can be improved. In addition, when rewriting the SQL statement, the quantile function containing the noise adding logic is realized by the UDAF method, which can avoid the problems of complex SQL statement rewriting and high error rate of the rewritten SQL statement.

Description

Technical Field

[0001] This disclosure relates to the field of data processing technology, and more specifically, to a quantile differential privacy noise addition method, apparatus, medium, device, and product. Background Technology

[0002] Differential privacy (DP) is a privacy protection technique primarily used to protect aggregated statistical data. It can protect sensitive information while maintaining the overall statistical characteristics of the data. Its main approach is to add a suitable amount of noise to the statistical results to ensure that modifying a single record will not significantly affect the statistical outcome, aiming to solve the problem of data leakage during the statistical publication process.

[0003] For scenarios involving Structured Query Language (SQL) analysis queries, differential privacy noise enhancement primarily employs two methods: rewriting noise enhancement (mapping the noise enhancement logic into the SQL statement) and post-processing noise enhancement (adding noise after obtaining the query results). Quantiles are a common SQL aggregation function, frequently used in data analysis scenarios in advertising, finance, and other fields. To protect the privacy of detailed data in these scenarios, Laplace post-processing noise enhancement is typically used to apply differential privacy noise enhancement to the quantile function. However, this method has a relatively large noise enhancement error, affecting the usability of the query results. Summary of the Invention

[0004] This summary section is provided to briefly introduce the concepts, which will be described in detail in the detailed description section below. This summary section is not intended to identify key or essential features of the claimed technical solution, nor is it intended to limit the scope of the claimed technical solution.

[0005] In a first aspect, this disclosure provides a differential privacy noise addition method for quantiles, the method comprising:

[0006] Based on the expression of the preset user-defined aggregation function UDAF, multiple values ​​to be aggregated are obtained. The UDAF is obtained by pre-replacing the quantile function. The parameters of the UDAF and the quantile function include the expression and the target quantile.

[0007] The differential privacy index mechanism is used to select the target value corresponding to the target quantile from the plurality of values ​​to obtain the quantile value of the quantile function after adding noise.

[0008] Secondly, this disclosure provides a differential privacy noise-adding device for quantiles, the device comprising:

[0009] The acquisition module is used to acquire multiple values ​​to be aggregated according to the expression of the preset user-defined aggregation function UDAF. The UDAF is obtained by pre-replacing the quantile function, and the parameters of the UDAF and the quantile function include the expression and the target quantile.

[0010] The selection module is used to select a target value corresponding to the target quantile from the plurality of values ​​using a differential privacy index mechanism, so as to obtain the quantile value of the quantile function after adding noise.

[0011] Thirdly, this disclosure provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the differential privacy noise addition method for quantiles provided in the first aspect of this disclosure.

[0012] Fourthly, this disclosure provides an electronic device, comprising:

[0013] A storage device on which computer programs are stored;

[0014] A processing device is configured to execute the computer program in the storage device to implement the steps of the differential privacy noise addition method for quantiles provided in the first aspect of this disclosure.

[0015] Fifthly, this disclosure provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the differential privacy noise addition method for quantiles provided in the first aspect of this disclosure.

[0016] In the above technical solution, when the noise-adding point includes a quantile function, the quantile function is pre-replaced with a user-defined aggregation function (UDAF) to rewrite the SQL statement. Then, noise addition is achieved based on the exponential mechanism through the rewritten quantile function. The query result error can be controlled within a small range by adjusting the utility function and security parameters of the exponential mechanism, making the differential privacy noise addition process efficient and controllable. This reduces the impact of noise addition errors and improves the usability of the query results without compromising security. Furthermore, when rewriting the SQL statement, the quantile function containing noise-adding logic is implemented using a UDAF, rather than directly adding the exponential mechanism algorithm logic to the original query statement via SQL expressions. This avoids the problems of complex SQL statement rewriting and high error rates in the rewritten SQL statement.

[0017] Other features and advantages of this disclosure will be described in detail in the following detailed description section. Attached Figure Description

[0018] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and the originals and elements are not necessarily drawn to scale. In the drawings:

[0019] Figure 1 This is a flowchart illustrating a quantile-based differential privacy noise-adding method according to an exemplary embodiment.

[0020] Figure 2 This is a schematic diagram illustrating a quantile-based differential privacy noise addition process according to an exemplary embodiment.

[0021] Figure 3 This is a flowchart illustrating a quantile-based differential privacy noise addition method according to another exemplary embodiment.

[0022] Figure 4 This is a hierarchical diagram illustrating an SQL statement according to an exemplary embodiment.

[0023] Figure 5 This is a flowchart illustrating a quantile-based differential privacy noise addition method according to another exemplary embodiment.

[0024] Figure 6 This is a block diagram illustrating a quantile-based differential privacy noise-adding device according to an exemplary embodiment.

[0025] Figure 7 This is a schematic diagram of the structure of an electronic device according to an exemplary embodiment. Detailed Implementation

[0026] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0027] It should be understood that the steps described in the method embodiments of this disclosure may be performed in different orders and / or in parallel. Furthermore, the method embodiments may include additional steps and / or omit the steps shown. The scope of this disclosure is not limited in this respect.

[0028] The term "comprising" and its variations as used herein are open-ended inclusions, meaning "including but not limited to". The term "based on" means "at least partially based on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one additional embodiment"; the term "some embodiments" means "at least some embodiments". Definitions of other terms will be given in the description below.

[0029] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0030] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0031] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0032] It is understood that before using the technical solutions disclosed in the various embodiments of this disclosure, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in this disclosure in an appropriate manner in accordance with relevant laws and regulations, and user authorization should be obtained.

[0033] For example, upon receiving a user's active request, a prompt message is sent to the user to explicitly inform them that the requested operation will require access to and use of their information. This allows the user to autonomously choose, based on the prompt message, whether to provide information to the software or hardware, such as the electronic device, application program, server, or storage medium performing the operations of this disclosed technical solution.

[0034] As an optional but non-limiting implementation, in response to a user's active request, sending a prompt message to the user can be done via a pop-up window, where the prompt message can be presented in text format. Furthermore, the pop-up window can also include a selection control allowing the user to choose "agree" or "disagree" to provide information to the electronic device.

[0035] It is understood that the above notification and user authorization process are merely illustrative and do not constitute a limitation on the implementation of this disclosure. Other methods that comply with relevant laws and regulations may also be applied to the implementation of this disclosure.

[0036] Meanwhile, it is understood that the data involved in this technical solution (including but not limited to the data itself, the acquisition or use of the data) shall comply with the requirements of relevant laws, regulations and related provisions.

[0037] Figure 1 This is a flowchart illustrating a quantile-based differential privacy noise addition method according to an exemplary embodiment. Figure 1 As shown, the differential privacy noise addition method for this quantile may include the following S101 and S102.

[0038] In S101, multiple values ​​to be aggregated are obtained according to the expression of the preset user-defined aggregation function UDAF. UDAF is obtained by pre-replacing the quantile function. The parameters of UDAF and quantile function are the expression and the target quantile.

[0039] In S102, the differential privacy index mechanism is used to select the target value corresponding to the target quantile from multiple values ​​to obtain the quantile function and the quantile value after adding noise.

[0040] In this disclosure, the differential privacy noise-adding method can be used to implement differential privacy noise-adding at the percentile level. This can be achieved using a user-defined aggregate function (UDAF) to implement a percentile function containing noise-adding logic. The percentile function is a statistical function used to determine the value of a specific quantile in a dataset, i.e., the target quantile value. The calculation logic of the percentile(expr,p) function is to first sort the results of expr, and then output the p-th quantile value of the sorted results. Here, expr and p are the parameters of the percentile function, expr is the expression, and p is the target quantile. For example, percentile(val,0.5) means calculating the 50th percentile value of the val column after sorting.

[0041] Here, the expression `expr` can be a reference to a column in a database table provided by the data provider, or it can be a more complex calculated expression, such as:

[0042] • Directly referencing a column name: percentile(salary,0.5), where salary is a column name in the database table.

[0043] • Use the calculation expression: percentile(salary*1.1,0.5), where salary*1.1 is an expression that multiplies each value in the salary column by 1.1.

[0044] like Figure 2As shown, differential privacy noise addition for quantiles can be achieved using a processing logic that combines a noise addition service with UDAF. Specifically, the SQL statement parsing and noise point filtering functions can be integrated separately into the noise addition service, while the differential privacy noise addition process can be integrated into the UDAF calculation, thus meeting the needs of overall SQL statement analysis and noise addition processing targeting specific noise points.

[0045] The aforementioned quantile-based differential privacy noise enhancement method can be applied to data providers. After receiving a user-input SQL statement, the data provider can use a noise enhancement service to parse the SQL statement, filter noise points, and rewrite the SQL statement to obtain a new SQL statement. Specifically, when the noise points include quantile functions, the SQL statement rewriting involves replacing the quantile functions belonging to the noise points with a preset UDAF, such as... Figure 2 As shown, the quantile function percentile(expr,p) belonging to the noise-adding point is replaced with the user-defined aggregation function dp-percentile(expr,p) to obtain a new SQL statement through the noise-adding service.

[0046] For example, replace the SQL statement "Select percentile(val,0.9)frominput_a" with "Selectdp_percentile(val,0.9)frominput_a", where input_a is a table name.

[0047] When the above-mentioned preset UDAF is included in the noise-adding points of the new SQL statement, UDAF calculation can be performed. Specifically, multiple values ​​to be aggregated can be obtained according to the expression of UDAF. Then, the differential privacy index mechanism is used to select the target value corresponding to the target quantile from the multiple values, and the target value is determined as the quantile value of the quantile function after noise addition.

[0048] In the above technical solution, when the noise-adding point includes a quantile function, the quantile function is pre-replaced with a user-defined aggregation function (UDAF) to rewrite the SQL statement. Then, noise addition is achieved based on the exponential mechanism through the rewritten quantile function. The query result error can be controlled within a small range by adjusting the utility function and security parameters of the exponential mechanism, making the differential privacy noise addition process efficient and controllable. This reduces the impact of noise addition errors and improves the usability of the query results without compromising security. Furthermore, when rewriting the SQL statement, the quantile function containing noise-adding logic is implemented using a UDAF, rather than directly adding the exponential mechanism algorithm logic to the original query statement via SQL expressions. This avoids the problems of complex SQL statement rewriting and high error rates in the rewritten SQL statement.

[0049] Furthermore, the aforementioned noise-adding service can be performed locally by the data provider or by the noise-adding service provider. In one embodiment, the noise-adding service can be performed locally by the data provider, in which case, such as... Figure 3 As shown, prior to S101 above, the differential privacy noise addition method for quantiles may further include the following S103.

[0050] In S103, in response to receiving a Structured Query Language (SQL) statement, the noisy points in the SQL statement are identified, and the quantile functions belonging to the noisy points are replaced with UDAFs to obtain a new SQL statement.

[0051] In this disclosure, the data provider can deploy a database engine locally, which is used to perform UDAF calculation operations. In this case, S101 may include: calling the local database engine to obtain multiple values ​​to be aggregated based on the UDAF expression in the new SQL statement; S102 may include: using the database engine to select a target value corresponding to the target quantile from the multiple values ​​through a differential privacy index mechanism, in order to obtain the quantile value of the quantile function after adding noise.

[0052] Specifically, such as Figure 2 As shown, after receiving the SQL statement input by the user, the data provider can parse the SQL statement, for example, by using ANTLR (another tool for language recognition) to obtain the Abstract Syntax Tree (AST) corresponding to the SQL statement. Then, based on the AST, the provider can identify the noise points in the SQL statement and select an appropriate noise-adding mechanism. Based on the identified noise points and their noise-adding mechanisms, the provider can rewrite the SQL statement. For example, if the noise point is the percentile function, its expression can be replaced from percentile(expr,p) to dp_percentile(expr,p).

[0053] ANTLR refers to an open-source parser that can automatically generate and visualize a syntax tree based on input. An AST is an abstract representation of the syntactic structure of source code. It represents the syntactic structure of a programming language in a tree-like form, where each node in the syntax tree represents a structure in the source code.

[0054] The following is a detailed explanation of the specific implementation method for identifying noise points in the SQL statement and selecting an appropriate noise-adding mechanism based on the abstract syntax tree. Specifically, this can be achieved through the following steps [1] to [3].

[0055] Step [1]: Analyze the syntax tree structure and divide it according to the nesting level.

[0056] For example, the SQL statement is as follows Figure 4 As shown, it includes two levels: level 1, level 2.1, and level 2.2.

[0057] Step [2]: Noise filtering. Specifically, the aggregation nodes that need to be noise-added can be filtered in combination with the noise-adding rules. For example, when there is nested aggregation functions, the inner layer is noise-added first, and the outer aggregation function is not noise-added. For example, sum(avg(val)+noise).

[0058] Step [3]: Analyze the type of the noise-adding node function and its internal expression type, and select a suitable noise-adding mechanism.

[0059] In another implementation, the aforementioned noise-adding service can be performed by a noise-adding service provider. That is, the data provider can utilize the noise-adding service provider's security features, such as hardware security modules or trusted execution environments, to improve data processing security. This also avoids the performance impact on the data provider caused by running the noise-adding service locally, thereby improving the data provider's SQL query performance. When the noise-adding service is performed by a noise-adding service provider, such as... Figure 5 As shown, prior to S101 above, the differential privacy noise addition method for quantiles may further include the following S104.

[0060] In S104, in response to receiving a Structured Query Language (SQL) statement, the SQL statement is sent to the noise-adding service provider, which identifies the noise-adding points in the SQL statement, replaces the quantile function belonging to the noise-adding points with UDAF, obtains a new SQL statement, and sends the new SQL statement to the data provider.

[0061] After receiving a Structured Query Language (SQL) statement input by the user, the data provider can send the SQL statement to the noise-adding service provider. Upon receiving the SQL statement, the noise-adding service provider can invoke its local database engine to obtain multiple values ​​to be aggregated based on the UDAF expression in the new SQL statement. Then, using the database engine and a differential privacy index mechanism, it selects the target value corresponding to the target quantile from the multiple values ​​to obtain the noise-adding quantile value of the quantile function. That is, S101 above may include: in response to receiving a new SQL statement, invoking the local database engine to obtain multiple values ​​to be aggregated based on the UDAF expression in the new SQL statement; S102 above may include: using the database engine and a differential privacy index mechanism to select the target value corresponding to the target quantile from the multiple values ​​to obtain the noise-adding quantile value of the quantile function.

[0062] The following is a detailed description of the specific implementation method for selecting the target value corresponding to the target quantile from multiple values ​​using the differential privacy index mechanism in S102 above. Specifically, it can be achieved through the following steps (1) to (3).

[0063] Step (1): Count the frequency of each value and construct a value-frequency pair based on the frequency of each value.

[0064] In this disclosure, such as Figure 2 As shown, after obtaining multiple values ​​through the preset UDAF expression, these values ​​can be iterated one by one to count the frequency of each value, and a value-frequency pair can be constructed based on the frequency of each value.

[0065] For example, multiple values ​​obtained through the preset UDAF expression include 1.2, 0.2, 2.2, 0.2, 1.3, 1.3, and 0.2. By counting the occurrences, it can be seen that the occurrence frequency of 1.2 and 2.2 is 1, the occurrence frequency of 0.2 is 3, and the occurrence frequency of 1.3 is 2. Thus, the following four value-frequency pairs can be constructed: (1.2, 1), (2.2, 1), (0.2, 3), and (1.3, 2).

[0066] When the magnitude of multiple values ​​obtained through the predefined UDAF expression is large, in order to improve the efficiency of constructing value-frequency pairs, these values ​​can be grouped, and for each group, the frequency of occurrence of each value in the group can be counted. Based on the frequency of occurrence of each value, a value-frequency pair corresponding to the group can be constructed. Then, the value-frequency pairs corresponding to each group can be aggregated to obtain the value-frequency pairs corresponding to the above multiple values.

[0067] Step (2): Arrange the value-frequency pairs in ascending order of value.

[0068] like Figure 2 As shown, after obtaining the value-frequency pairs, these value-frequency pairs can be arranged in ascending order of value.

[0069] For example, the number-frequency pairs include (1.2, 1), (2.2, 1), (0.2, 3), and (1.3, 2). Arranging them in ascending order of their numbers, the resulting number-frequency pairs are (0.2, 3), (1.2, 1), (1.3, 2), and (2.2, 1).

[0070] Step (3): Use the differential privacy index mechanism to select the target value corresponding to the target quantile from the sorted value-frequency pairs.

[0071] like Figure 2 As shown, after sorting the value-frequency pairs, the differential privacy index mechanism can be used to select the target value corresponding to the target quantile from the sorted value-frequency pairs, and output the target value as the query result.

[0072] In one possible implementation, the differential privacy index mechanism can be used to select the target value corresponding to the target quantile from the sorted value-frequency pairs through the following steps (31) to (34).

[0073] Step (31): Determine the sorting position of each value based on the value-frequency pairs obtained after sorting.

[0074] In this disclosure, the sorting position is used to characterize the position (e.g., sequence number) of the corresponding value when multiple values ​​are sorted from smallest to largest. For each value-frequency pair obtained after sorting, the sorting position of the value in the value-frequency pair can be determined based on the frequency of occurrence of the value in each value-frequency pair preceding the value-frequency pair obtained after sorting.

[0075] Specifically, we can first determine the sum of the frequencies of occurrence in each of the preceding frequency pairs of the sorted value-frequency pair, and then add 1 to this sum to obtain the sorting position of the value in the value-frequency pair.

[0076] For example, the sorted value-frequency pairs are (0.2, 3), (1.2, 1), (1.3, 2), and (2.2, 1), where 0.2 is sorted at position 1, 1.2 at position 4, 1.3 at position 5, and 2.2 at position 7.

[0077] Step (32): Determine the utility function and sensitivity of the differential privacy index mechanism based on the sorting position and target quantile of each value.

[0078] In this disclosure, the utility function q(D,r) is used to define the quality of the output result (i.e., the numerical value) r on the dataset D.

[0079] Step (33): Determine the target position of the target value based on the utility function and sensitivity.

[0080] Step (34): Determine the target value from the sorted value-frequency pairs based on the target location.

[0081] The following is a detailed explanation of the specific implementation method for determining the utility function and sensitivity of the differential privacy index mechanism based on the sorting position and target quantile of each value in step (32) above. Specifically, it can be achieved through the following steps (321) to (325).

[0082] Step (321): Determine the number of multiple values ​​based on the frequency of each value.

[0083] Specifically, the sum of the frequencies of occurrence of each value in the sorted value-frequency pairs can be used to determine the number of values.

[0084] Step (322): Determine the quantile position corresponding to the target quantile based on the target quantile and the number of multiple values.

[0085] For example, the quantile position corresponding to the target quantile can be determined using the following equation, based on the target quantile and the number of values:

[0086] P = p*(k+1)

[0087] Where P is the quantile position corresponding to the target quantile; k is the number of values.

[0088] Step (323): Calculate the distance between each sorting position and the quantile position.

[0089] In this disclosure, for each sorting position, the absolute value of the difference between the sorting position and the quantile position corresponding to the target quantile can be determined as the distance between the sorting position and the quantile position corresponding to the target quantile.

[0090] Step (324): Based on all distances, construct the utility function of the differential privacy index mechanism so that the result of the utility function is negatively correlated with the distance.

[0091] This disclosure designs a utility function for a differential privacy index mechanism based on the distance between each sorting position and the quantile position, such that the result of the utility function is negatively correlated with the distance. That is, the farther the distance between the sorting position and the quantile position, the lower the result of the utility function and the lower the probability that the sorting position is selected. Conversely, the closer the distance between the sorting position and the quantile position, the higher the result of the utility function and the higher the probability that the sorting position is selected.

[0092] For example, q(D,r)=e -λP-d(r) , where λ is a constant greater than zero used to control the decay rate of the utility function, d(r) characterizes the ranking position of the value r, and |Pd(r)| represents the distance between the ranking position d(r) of the eigenvalue r and the quantile position P.

[0093] Step (325): Calculate the sensitivity of the utility function.

[0094] In this disclosure, the sensitivity Δq of the utility function refers to the maximum difference between the results of the utility function on two datasets D and D' that differ by one data point, where dataset D' differs from dataset D by one data point. Based on the definition of the utility function above, we find that adding / deleting a data point to the original dataset changes the quantile position corresponding to the target quantile by at most 1, meaning the sensitivity of the utility function is 1.

[0095] The following is a detailed description of the specific implementation method for determining the target position of the target value based on the utility function and sensitivity in step (33) above. Specifically, it can be achieved through the following steps (331) to (333).

[0096] Step (331): Determine multiple candidate positions from all sorted positions.

[0097] Step (332): For each candidate position, determine the selection probability of the candidate position based on the utility function and sensitivity.

[0098] In this disclosure, based on the definition of the exponential mechanism, we can consider the function e x The function form, using Calculate the probability of each candidate position being selected and normalize it to obtain the selection probability of each candidate position, where ε is the privacy budget.

[0099] Step (333): Based on the selection probability of each of the multiple candidate positions, randomly select one candidate position from the multiple candidate positions as the target position.

[0100] The following is a detailed description of the specific implementation method for determining multiple candidate positions from all sorting positions in step (331) above. Specifically, it can be implemented through various methods. In one implementation method, all sorting positions can be determined as candidate positions.

[0101] In another implementation, sorting positions whose distance from the quantile positions corresponding to the target quantile is less than a preset distance can be determined as candidate positions.

[0102] In this disclosure, based on the definition of the quantile function, it is found that adding, removing, or modifying a row in the original dataset only affects the final value within a certain range before and after the target quantile value. The target quantile value is the value at the quantile position corresponding to the target quantile among the aforementioned values. Therefore, based on this finding, the aforementioned values ​​can be filtered, and only those values ​​that have a significant impact on the query results can be selected as candidate values. Specifically, sorting positions whose distance from the quantile position corresponding to the target quantile is less than a preset distance (e.g., 5) can be determined as candidate positions.

[0103] In this implementation, filtering by multiple sorting positions allows for the selection of multiple values, thereby reducing the computational load in the application of the exponential mechanism and improving the efficiency of differential privacy noise addition. Furthermore, by selecting values ​​with a significant impact on the query results from multiple values, the probability of irrelevant values ​​being selected can be further reduced, improving the usability of the query results.

[0104] In another implementation, sorting positions whose distance to the quantile positions corresponding to the target quantile is less than a preset distance can be determined as candidate positions; if the current number of candidate positions is less than a preset number, then the quantile position of the target number can be determined as a candidate position.

[0105] In this disclosure, the target quantity is equal to the difference between the preset quantity and the current quantity. After filtering out positions within a certain range before and after the quantile position corresponding to the target quantile by distance, if the number of selected candidate positions is less than the preset quantity (e.g., 10), the quantile position corresponding to the target quantile can be used to fill the gap, thereby increasing the proportion of the target quantile value and further improving the usability of the query results.

[0106] The following is a detailed description of the specific implementation method for determining the target value from the sorted value-frequency pairs based on the target location in step (34) above. Specifically, this can be achieved through various implementation methods. In one implementation method, the value corresponding to the target location can be determined from the sorted value-frequency pairs as the target value.

[0107] Specifically, the process can begin by comparing the frequency of the first value-frequency pair in the sorted value-frequency pairs with the target position. If the frequency of the first value-frequency pair is greater than or equal to the target position, the value in the first value-frequency pair is determined as the value corresponding to the target position, and this value is designated as the target value. If the frequency of the first value-frequency pair is less than the target position, the sum of the frequencies of the first two value-frequency pairs in the sorted value-frequency pairs is compared with the target position. If this sum of frequencies is greater than or equal to the target position, the value in the second value-frequency pair in the sorted value-frequency pairs is determined as the value corresponding to the target position, and this value is designated as the target value. If this sum of frequencies is less than the target position, the sum of the frequencies of the first three value-frequency pairs in the sorted value-frequency pairs is compared with the target position, and so on, until the target value is found.

[0108] For example, if the target position is 5, and the sorted value-frequency pairs are (0.2, 3), (1.2, 1), (1.3, 2), (2.2, 1), then the target value is 1.3.

[0109] For example, if the target position is 2, the sorted value-frequency pairs are (0.2, 3), (1.2, 1), (1.3, 2), and (2.2, 1), then the target value is 0.2.

[0110] In another implementation, the target value can be determined from the sorted value-frequency pairs according to the target location through the following steps (341) to (346).

[0111] Step (341): Determine the value corresponding to the target position from the sorted value-frequency pairs and use it as the first value.

[0112] Step (342): Determine whether the first value comes from the last value-frequency pair in the sorted value-frequency pairs.

[0113] In this disclosure, if the first value is not from the last value-frequency pair in the sorted value-frequency pairs, then the following steps (343) to (345) are performed; if the first value is from the last value-frequency pair in the sorted value-frequency pairs, then the following step (346) is performed.

[0114] Step (343): Determine the value corresponding to the next position of the target position from the sorted value-frequency pairs as the second value, and generate a random number in the range of (0, 1).

[0115] Step (344): Use random numbers to perturb the difference between the second value and the first value.

[0116] For example, the perturbation result is the result of a random number multiplied by (the second value and the first value).

[0117] Step (345): The sum of the perturbation processing result and the first value is determined as the target value.

[0118] Step (346): Determine the first value as the target value.

[0119] In the above implementation, perturbing the differential privacy noise-adding result using a random function can further improve data privacy.

[0120] Figure 6 This is a block diagram illustrating a quantile-based differential privacy noise-adding device according to an exemplary embodiment. Figure 6 As shown, the differential privacy noise-adding device 300 for this quantile includes:

[0121] The acquisition module 301 is used to acquire multiple values ​​to be aggregated according to the preset expression of the user-defined aggregation function UDAF, wherein the UDAF is obtained by pre-replacing the quantile function, and the parameters of the UDAF and the quantile function include the expression and the target quantile.

[0122] The selection module 302 is used to select a target value corresponding to the target quantile from the plurality of values ​​using a differential privacy index mechanism, so as to obtain the quantile value of the quantile function after adding noise.

[0123] In the above technical solution, when the noise-adding point includes a quantile function, the quantile function is pre-replaced with a user-defined aggregation function (UDAF) to rewrite the SQL statement. Then, noise addition is achieved based on the exponential mechanism through the rewritten quantile function. The query result error can be controlled within a small range by adjusting the utility function and security parameters of the exponential mechanism, making the differential privacy noise addition process efficient and controllable. This reduces the impact of noise addition errors and improves the usability of the query results without compromising security. Furthermore, when rewriting the SQL statement, the quantile function containing noise-adding logic is implemented using a UDAF, rather than directly adding the exponential mechanism algorithm logic to the original query statement via SQL expressions. This avoids the problems of complex SQL statement rewriting and high error rates in the rewritten SQL statement.

[0124] Optionally, the selection module 302 includes:

[0125] The statistics submodule is used to count the frequency of occurrence of each value and construct value-frequency pairs based on the frequency of occurrence of each value.

[0126] The sorting submodule is used to arrange the value-frequency pairs in ascending order of the values;

[0127] The selection submodule is used to select the target value corresponding to the target quantile from the sorted value-frequency pairs using the differential privacy index mechanism.

[0128] Optionally, the selection submodule includes:

[0129] The first determining submodule is used to determine the sorting position of each of the values ​​based on the sorted value-frequency pairs, wherein the sorting position is used to characterize the position of the corresponding value when the plurality of values ​​are sorted in ascending order.

[0130] The second determining submodule is used to determine the utility function of the differential privacy index mechanism and the sensitivity of the utility function based on the sorting position of each value and the target quantile.

[0131] The third determining submodule is used to determine the target position of the target value based on the utility function and the sensitivity.

[0132] The fourth determining submodule is used to determine the target value from the sorted value-frequency pairs based on the target position.

[0133] Optionally, the second determining submodule includes:

[0134] The fifth determining submodule is used to determine the number of the plurality of values ​​based on the frequency of occurrence of each value.

[0135] The sixth determining submodule is used to determine the quantile position corresponding to the target quantile based on the target quantile and the quantity;

[0136] The first calculation submodule is used to calculate the distance between each of the sorting positions and the quantile positions respectively;

[0137] A submodule is constructed to build a utility function for the differential privacy index mechanism based on all the distances, such that the result of the utility function is negatively correlated with the distance;

[0138] The second calculation submodule is used to calculate the sensitivity of the utility function.

[0139] Optionally, the third determining submodule includes:

[0140] The seventh determining submodule is used to determine multiple candidate positions from all the sorted positions;

[0141] The eighth determining submodule is used to determine the selection probability of each candidate position based on the utility function and the sensitivity.

[0142] The random selection submodule is used to randomly select one candidate position from the multiple candidate positions as the target position based on the selection probability of each candidate position.

[0143] Optionally, the seventh determining submodule includes:

[0144] The ninth determining submodule is used to determine the sorting position where the distance between the quantile position corresponding to the target quantile is less than a preset distance as the candidate position.

[0145] Optionally, the seventh determining submodule further includes:

[0146] The tenth determining submodule is used to determine the quantile position of the target number as the candidate position if the current number of the candidate positions is less than the preset number, wherein the target number is equal to the difference between the preset number and the current number.

[0147] Optionally, the fourth determining submodule is used to determine the value corresponding to the target position from the sorted value-frequency pairs, as the target value.

[0148] Optionally, the fourth determining submodule includes:

[0149] The eleventh determining submodule is used to determine the value corresponding to the target position from the sorted value-frequency pairs, as the first value;

[0150] The twelfth determining submodule is used to determine, if the first value is not from the last value-frequency pair in the sorted value-frequency pairs, the value corresponding to the next position of the target position from the sorted value-frequency pairs, as the second value, and generate a random number in the range (0, 1).

[0151] The perturbation processing submodule is used to perturb the difference between the second value and the first value using the random number;

[0152] The thirteenth determination submodule is used to determine the target value by summing the disturbance processing result with the first value.

[0153] Optionally, the fourth determining submodule further includes:

[0154] The fourteenth determining submodule is used to determine the first value as the target value if the first value comes from the last value-frequency pair.

[0155] Optionally, the quantile differential privacy noise-adding device 300 further includes:

[0156] The sending module is configured to, in response to receiving a Structured Query Language (SQL) statement, send the SQL statement to a noise-adding service provider, so that the noise-adding service provider can identify the noise-adding points in the SQL statement, replace the quantile function belonging to the noise-adding points with the UDAF, obtain a new SQL statement, and send the new SQL statement to the data provider;

[0157] The acquisition module 301 is used to, in response to receiving the new SQL statement, call the local database engine to obtain multiple values ​​to be aggregated based on the expression of the UDAF in the new SQL statement;

[0158] The selection module 302 is used to select a target value corresponding to the target quantile from the plurality of values ​​through the database engine using the differential privacy index mechanism.

[0159] This disclosure also provides a computer-readable medium having a computer program stored thereon, which, when executed by a processing device, implements the steps of the differential privacy noise addition method for quantiles provided in this disclosure.

[0160] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the differential privacy noise addition method for quantiles provided in this disclosure.

[0161] The following is for reference. Figure 7 The diagram illustrates a structural schematic of an electronic device (e.g., a terminal device or a server) 600 suitable for implementing embodiments of the present disclosure. The terminal device in the embodiments of the present disclosure may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 7 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments disclosed herein.

[0162] like Figure 7As shown, electronic device 600 may include a processing device (e.g., a central processing unit, a graphics processor, etc.) 601, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 602 or a program loaded from storage device 608 into random access memory (RAM) 603. RAM 603 also stores various programs and data required for the operation of electronic device 600. Processing device 601, ROM 602, and RAM 603 are interconnected via bus 604. Input / output (I / O) interface 605 is also connected to bus 604.

[0163] Typically, the following devices can be connected to I / O interface 605: input devices 606 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 607 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 608 including, for example, magnetic tapes, hard disks, etc.; and communication devices 609. Communication device 609 allows electronic device 600 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 7 An electronic device 600 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively.

[0164] In particular, according to embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of this disclosure include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 609, or installed from a storage device 608, or installed from a ROM 602. When the computer program is executed by the processing device 601, it performs the functions defined in the methods of embodiments of this disclosure.

[0165] It should be noted that the computer-readable medium described in this disclosure can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this disclosure, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in connection with an instruction execution system, apparatus, or device. In this disclosure, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0166] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0167] The aforementioned computer-readable medium may be included in the aforementioned electronic device; or it may exist independently and not assembled into the electronic device.

[0168] The aforementioned computer-readable medium carries one or more programs. When the aforementioned one or more programs are executed by the electronic device, the electronic device causes the electronic device to: obtain multiple values ​​to be aggregated according to a preset user-defined aggregation function (UDAF) expression, wherein the UDAF is obtained by pre-replacing a quantile function, and the parameters of the UDAF and the quantile function both include the expression and the target quantile; and select a target value corresponding to the target quantile from the multiple values ​​using a differential privacy index mechanism to obtain the noisy quantile value of the quantile function.

[0169] Computer program code for performing the operations of this disclosure can be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, and C++, as well as conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0170] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0171] The modules described in the embodiments of this disclosure can be implemented in software or hardware. The names of the modules do not necessarily limit the module itself; for example, a selection module can also be described as "a module that uses a differential privacy index mechanism to select a target value corresponding to the target quantile from the plurality of values ​​to obtain the noisy quantile value of the quantile function."

[0172] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0173] In the context of this disclosure, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0174] According to one or more embodiments of this disclosure, Example 1 provides a quantile differential privacy noise addition method, the method comprising:

[0175] Based on the expression of the preset user-defined aggregation function UDAF, multiple values ​​to be aggregated are obtained. The UDAF is obtained by pre-replacing the quantile function. The parameters of the UDAF and the quantile function include the expression and the target quantile.

[0176] The differential privacy index mechanism is used to select the target value corresponding to the target quantile from the plurality of values ​​to obtain the quantile value of the quantile function after adding noise.

[0177] According to one or more embodiments of this disclosure, Example 2 provides the method of Example 1, wherein selecting a target value corresponding to the target quantile from the plurality of values ​​using a differential privacy index mechanism includes:

[0178] Count the frequency of occurrence of each of the above values, and construct value-frequency pairs based on the frequency of occurrence of each of the above values;

[0179] Arrange the value-frequency pairs in ascending order of value;

[0180] The target value corresponding to the target quantile is selected from the sorted value-frequency pairs using the differential privacy index mechanism.

[0181] According to one or more embodiments of this disclosure, Example 3 provides the method of Example 2, wherein selecting the target value corresponding to the target quantile from the sorted value-frequency pairs using a differential privacy index mechanism includes:

[0182] Based on the value-frequency pairs obtained after sorting, the sorting position of each value is determined, wherein the sorting position is used to characterize the position of the corresponding value when the multiple values ​​are sorted in ascending order;

[0183] Based on the sorting position of each value and the target quantile, the utility function of the differential privacy index mechanism and the sensitivity of the utility function are determined.

[0184] The target position of the target value is determined based on the utility function and the sensitivity.

[0185] The target value is determined from the sorted value-frequency pairs based on the target location.

[0186] According to one or more embodiments of this disclosure, Example 4 provides the method of Example 3, wherein determining the utility function of the differential privacy index mechanism and the sensitivity of the utility function based on the sorting position of each said value and the target quantile includes:

[0187] The number of the plurality of values ​​is determined based on the frequency of occurrence of each of the values;

[0188] Based on the target quantile and the quantity, determine the quantile position corresponding to the target quantile;

[0189] Calculate the distance between each of the sorting positions and the quantile positions;

[0190] Based on all the distances, a utility function for the differential privacy index mechanism is constructed such that the result of the utility function is negatively correlated with the distance;

[0191] Calculate the sensitivity of the utility function.

[0192] According to one or more embodiments of this disclosure, Example 5 provides the method of Example 3, wherein determining the target location of the target value based on the utility function and the sensitivity includes:

[0193] Multiple candidate positions are determined from all the sorted positions;

[0194] For each candidate position, the selection probability of that candidate position is determined based on the utility function and the sensitivity.

[0195] Based on the selection probability of each of the multiple candidate positions, a candidate position is randomly selected from the multiple candidate positions as the target position.

[0196] According to one or more embodiments of this disclosure, Example 6 provides the method of Example 5, wherein determining a plurality of candidate positions from all said sorting positions includes:

[0197] The sorting positions whose distance from the quantile position corresponding to the target quantile is less than a preset distance are determined as the candidate positions.

[0198] According to one or more embodiments of this disclosure, Example 7 provides the method of Example 6, wherein determining a plurality of candidate positions from all the sorted positions further includes:

[0199] If the current number of candidate positions is less than a preset number, then the quantile position of the target number is determined as the candidate position, wherein the target number is equal to the difference between the preset number and the current number.

[0200] According to one or more embodiments of this disclosure, Example 8 provides the method of Example 3, wherein determining the target value from the sorted value-frequency pairs based on the target position includes:

[0201] The value corresponding to the target position is determined from the value-frequency pairs obtained after sorting, and is used as the target value.

[0202] According to one or more embodiments of this disclosure, Example 9 provides the method of Example 3, wherein determining the target value from the sorted value-frequency pairs based on the target position includes:

[0203] From the sorted value-frequency pairs, determine the value corresponding to the target position and use it as the first value;

[0204] If the first value is not from the last value-frequency pair in the sorted value-frequency pairs, then determine the value corresponding to the next position of the target position from the sorted value-frequency pairs as the second value, and generate a random number in the range of (0, 1).

[0205] The difference between the second value and the first value is perturbed using the random number.

[0206] The sum of the perturbation processing result and the first value is determined as the target value.

[0207] According to one or more embodiments of this disclosure, Example 10 provides the method of Example 9, wherein determining the target value from the sorted value-frequency pairs based on the target position further includes:

[0208] If the first value comes from the last value-frequency pair, then the first value is determined as the target value.

[0209] According to one or more embodiments of this disclosure, Example 11 provides a method as described in any one of Examples 1-10, the method being applied to a data provider, the method further comprising:

[0210] In response to receiving a Structured Query Language (SQL) statement, the SQL statement is sent to a noise-adding service provider, which identifies noise-adding points in the SQL statement, replaces the quantile function belonging to the noise-adding points with the UDAF, obtains a new SQL statement, and sends the new SQL statement to the data provider.

[0211] The step of obtaining multiple values ​​to be aggregated based on the expression of the preset user-defined aggregation function UDAF includes:

[0212] In response to receiving the new SQL statement, the local database engine is invoked to obtain multiple values ​​to be aggregated based on the expression of the UDAF in the new SQL statement;

[0213] The step of selecting the target value corresponding to the target quantile from the plurality of values ​​using the differential privacy index mechanism includes:

[0214] The database engine uses a differential privacy index mechanism to select a target value from the plurality of values ​​that corresponds to the target quantile.

[0215] According to one or more embodiments of this disclosure, Example 12 provides a quantile differential privacy noise-adding device, the device comprising:

[0216] The acquisition module is used to acquire multiple values ​​to be aggregated according to the expression of the preset user-defined aggregation function UDAF. The UDAF is obtained by pre-replacing the quantile function, and the parameters of the UDAF and the quantile function include the expression and the target quantile.

[0217] The selection module is used to select a target value corresponding to the target quantile from the plurality of values ​​using a differential privacy index mechanism, so as to obtain the quantile value of the quantile function after adding noise.

[0218] According to one or more embodiments of the present disclosure, Example 13 provides a computer-readable medium having a computer program stored thereon that, when executed by a processing device, implements the steps of the method described in any one of Examples 1-11.

[0219] According to one or more embodiments of this disclosure, Example 14 provides an electronic device comprising:

[0220] A storage device on which computer programs are stored;

[0221] A processing device for executing the computer program in the storage device to implement the steps of any one of the methods in Examples 1-11.

[0222] According to one or more embodiments of the present disclosure, Example 15 provides a computer program product including a computer program that, when executed by a processor, implements the steps of the method described in any one of Examples 1-11.

[0223] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features disclosed in this disclosure that have similar functions.

[0224] Furthermore, while the operations are described in a specific order, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order. In certain environments, multitasking and parallel processing may be advantageous. Similarly, while several specific implementation details are included in the above discussion, these should not be construed as limiting the scope of this disclosure. Certain features described in the context of individual embodiments may also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in multiple embodiments.

[0225] Although the subject matter has been described using language specific to structural features and / or methodological logic, it should be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or actions described above. Rather, the specific features and actions described above are merely illustrative forms of implementing the claims. Regarding the apparatus in the above embodiments, the specific manner in which the various modules perform their operations has been described in detail in the embodiments relating to the method, and will not be elaborated upon here.

Claims

1. A method for differentially private noise addition for quantiles, the method comprising: The method is applied to a data provider, and the method comprises: In response to receiving a structured query language (SQL) statement, sending the SQL statement to a noise adding service provider to identify a noise point in the SQL statement by the noise adding service provider, replacing a quantile function belonging to the noise point with a preset user-defined aggregate function (UDAF), obtaining a new SQL statement, and sending the new SQL statement to the data provider, wherein the UDAF and parameters of the quantile function both comprise an expression of the UDAF and a target quantile; In response to receiving the new SQL statement, obtaining a plurality of values to be aggregated according to the expression of the UDAF in the new SQL statement; Using a differential privacy exponential mechanism to select a target value corresponding to the target quantile from the plurality of values to obtain a quantile value of the quantile function after noise adding.

2. The method of claim 1, wherein, The method of using the differential privacy exponential mechanism to select the target value corresponding to the target quantile from the plurality of values comprises: Counting a frequency of occurrence of each value, and constructing a value-frequency pair according to the frequency of occurrence of each value; Arranging the value-frequency pairs in ascending order of values; Using the differential privacy exponential mechanism to select the target value corresponding to the target quantile from the value-frequency pairs after sorting.

3. The method of claim 2, wherein, The method of using the differential privacy exponential mechanism to select the target value corresponding to the target quantile from the value-frequency pairs after sorting comprises: Determining a sorting position of each value according to the value-frequency pairs after sorting, wherein the sorting position is used to represent a position of the corresponding value when the plurality of values are sorted in ascending order; Determining a utility function of the differential privacy exponential mechanism and a sensitivity of the utility function according to the sorting position of each value and the target quantile; Determining a target position of the target value according to the utility function and the sensitivity; Determining the target value from the value-frequency pairs after sorting according to the target position.

4. The method of claim 3, wherein, The method of determining the utility function of the differential privacy exponential mechanism and the sensitivity of the utility function according to the sorting position of each value and the target quantile comprises: Determining a number of the plurality of values according to the frequency of occurrence of each value; Determining a quantile position corresponding to the target quantile according to the target quantile and the number; Calculating a distance between each sorting position and the quantile position, respectively; Constructing a utility function of the differential privacy exponential mechanism according to all the distances, so that a result of the utility function is in a negative correlation with the distances; Calculating the sensitivity of the utility function.

5. The method of claim 3, wherein, The method of determining the target position of the target value according to the utility function and the sensitivity comprises: Determining a plurality of candidate positions from all the sorting positions; For each candidate position, determining a selection probability of the candidate position according to the utility function and the sensitivity; randomly selecting a candidate position from the plurality of candidate positions as the target position according to selection probabilities of the plurality of candidate positions.

6. The method of claim 5, wherein, The determining the plurality of candidate positions from all the sorted positions comprises: determining the sorted positions with distances to the quantile position corresponding to the target quantile less than a preset distance as the candidate positions.

7. The method of claim 6, wherein, The determining the plurality of candidate positions from all the sorted positions further comprises: if the current number of the candidate positions is less than a preset number, determining a target number of the quantile positions as the candidate positions, wherein the target number is equal to the difference between the preset number and the current number.

8. The method of claim 3, wherein, The determining the target value from the sorted value-frequency pairs according to the target position comprises: determining a value corresponding to the target position from the sorted value-frequency pairs as the target value.

9. The method of claim 3, wherein, The determining the target value from the sorted value-frequency pairs according to the target position comprises: determining a value corresponding to the target position from the sorted value-frequency pairs as a first value; if the first value is not from the last value-frequency pair in the sorted value-frequency pairs, determining a value corresponding to the next position of the target position from the sorted value-frequency pairs as a second value, and generating a random number in the range of (0, 1); performing perturbation processing on the difference between the second value and the first value by using the random number; determining the sum of the perturbation processing result and the first value as the target value.

10. The method of claim 9, wherein, The determining the target value from the sorted value-frequency pairs according to the target position further comprises: if the first value is from the last value-frequency pair, determining the first value as the target value.

11. The method according to any one of claims 1-10, characterized in that, The obtaining a plurality of values to be aggregated according to the expression of the UDAF in the new SQL statement in response to receiving the new SQL statement comprises: in response to receiving the new SQL statement, invoking a local database engine to obtain a plurality of values to be aggregated according to the expression of the UDAF in the new SQL statement; The selecting a target value corresponding to the target quantile from the plurality of values by using a differential privacy exponential mechanism comprises: selecting a target value corresponding to the target quantile from the plurality of values by using a differential privacy exponential mechanism through the database engine.

12. A differential privacy noise-adding device for quantiles, characterized in that, The apparatus is applied to a data provider, and the apparatus comprises: a sending module configured to, in response to receiving a structured query language (SQL) statement, send the SQL statement to a noised service provider, so that the noised service provider identifies a noised point in the SQL statement, replaces a quantile function belonging to the noised point with a preset user-defined aggregation function (UDAF), obtains a new SQL statement, and sends the new SQL statement to the data provider, wherein the UDAF and the parameter of the quantile function both comprise an expression of the UDAF and a target quantile; an obtaining module, configured to, in response to receiving the new SQL statement, obtain a plurality of values to be aggregated according to an expression of the UDAF in the new SQL statement; a selecting module, configured to select a target value corresponding to the target quantile from the plurality of values by using a differential privacy exponential mechanism, to obtain a noisy quantile value of the quantile function.

13. A computer readable medium having stored thereon a computer program, characterized in that The computer program, when executed by a processing apparatus, implements the steps of the method of any one of claims 1-11.

14. An electronic device, comprising: comprising: a storage device having stored thereon a computer program; a processing apparatus configured to execute the computer program in the storage device to implement the steps of the method of any one of claims 1-11.

15. A computer program product comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the steps of the method of any one of claims 1-11.

Images