Privacy protection record linking method and device, electronic equipment and storage medium

Abstract

The invention provides a privacy protection record linking method and device, electronic equipment and a storage medium, and the method comprises the steps: carrying out the noise addition of data records for each block corresponding to each database storing different data records based on an output constraint differential privacy rule, taking the data record added with the noise as a noise data record; the output constraint differential privacy rule is used for selecting to add noise to the data record in the block or perform zero noise addition to the block according to the rounding result of the Laplace noise; and based on the sliding window, performing similarity matching on each noise data record from different databases, and linking each noise data record with successful similarity matching to obtain a corresponding privacy protection record pair. According to the method and the device, while end-to-end privacy protection and efficient record linking can be ensured, the effectiveness and the reliability of the record linking can be improved, and the reliability of privacy protection in an end-to-end record linking process can be improved.

Description

Technical Field

[0001] The present application relates to the field of privacy protection record linking technology, and in particular to a privacy protection record linking method, device, electronic device and storage medium. Background Art

[0002] With the continuous development of the Internet and the rapid popularization and improvement of inter-industry databases, record information from all walks of life has shown an explosive growth trend. The phenomenon of user information being stored in the form of data records has become common. Massive amounts of information are uploaded to the server to form big data, and the data are interrelated to form records. Record linking is used more frequently and widely in life, such as screening disease records in multiple hospital databases, detecting potential risk users of multi-party loans between banks, collecting user preferences authorized by users to provide corresponding services, and as a pre-operation for federated learning. Data records often contain a large amount of sensitive information. Data records in the database will be subject to different types of privacy attacks during the record linking process, including high-precision recognition attacks, sensitive attribute reasoning attacks, etc. Even many existing privacy-preserving record linking methods often have large loopholes and deficiencies, such as the inability to provide end-to-end privacy protection and exposing sensitive attributes of record data. These problems often lead to serious data privacy leakage problems in the linking process. Therefore, studying the privacy protection issues of record linking is crucial for the future development of data science.

[0003] At present, the existing record linking methods for privacy protection include: encryption technology, data anonymization, authorized access, data sharing, and differential privacy. Among them, differential privacy is currently the most advanced privacy protection method. The differential privacy method introduces random perturbations by adding some noise to the original data to confuse the data features. It can prevent data leakage and re-identification attacks, thereby ensuring the privacy security of user data. In recent years, the application of differential privacy in the fields of artificial intelligence and big data has become more and more extensive.

[0004] However, existing privacy-preserving record linkage methods based on differential privacy cannot provide end-to-end privacy protection between different databases, and also suffer from the problem of low recall rate. Summary of the invention

[0005] In view of this, the embodiments of the present application provide a privacy protection record linking method, device, electronic device and storage medium to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of the present application provides a privacy protection record linking method, comprising: Based on the preset output constraint differential privacy rule, noise is added to the data records for each block corresponding to each database storing different data records, so that the data records added with the noise are used as noise data records; wherein the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and round each Laplace noise, and then when it is confirmed that the rounded Laplace noise is a positive value, the positive value is used as the amount of noise added to the corresponding block and noise is added to the corresponding data record in the block according to the amount, and when it is confirmed that the rounded Laplace noise is a negative value, zero noise is added to the block corresponding to the negative value; Based on the sliding window, similarity matching is performed on each of the noise data records from different databases, and each of the noise data records with successful similarity matching is linked to obtain a corresponding privacy protection record pair.

[0007] In some embodiments of the present application, the adding of noise to data records for each block corresponding to each database storing different data records based on a preset output constraint differential privacy rule, so as to use the data records added with the noise as noise data records, includes: Obtaining preset Laplace noise parameters, wherein the Laplace noise parameters include: a scale parameter and a privacy budget of a Laplace distribution; Calculate the Laplace noise corresponding to each block according to the pre-acquired data features of each block corresponding to each database, the scale parameter of the Laplace distribution and the privacy budget; Performing a rounding operation on each of the Laplace noises; If the rounded Laplace noise is a positive value, the positive value is used as the noise quantity to add noise to the data record in the corresponding block, and a noise attribute label is set for the noise, so as to convert the data record in the block to which the Laplace noise has been added into a noise data record; If the rounded Laplace noise is a negative value, zero noise is added to the block corresponding to the negative value.

[0008] In some embodiments of the present application, based on the sliding window, linking the noise data records of the blocks corresponding to the two matching parties from different databases to obtain the corresponding privacy protection record pair includes: Based on a preset sliding window, character string division and Dyss similarity coefficient calculation are performed on each of the noise data records from different databases, and each of the noise data records with successful similarity matching is linked to obtain a corresponding privacy protection record pair.

[0009] In some embodiments of the present application, based on a preset sliding window, character string division and Dyss similarity coefficient calculation are performed on each of the noise data records from different databases, and each of the noise data records with successful similarity matching is linked to obtain a corresponding privacy protection record pair, including: Performing feature matching on the blocks in different databases to obtain respective block pairs, wherein each block pair includes two blocks from different databases; For each of the block pairs, sequentially extracting two noise data records from different blocks in each of the block pairs, so as to use the noise data records as target record pairs respectively; The two noise data records in each target record pair are respectively subjected to string division and Dyss similarity coefficient calculation to obtain corresponding similarity results, and the two noise data records in the target record pair with successful similarity matching are linked according to the similarity results to obtain corresponding privacy protection record pairs.

[0010] In some embodiments of the present application, the two noise data records in each target record pair are respectively subjected to string division and Dyss similarity coefficient calculation to obtain corresponding similarity results, and the two noise data records in the target record pair that successfully match similarity are linked according to the similarity results to obtain corresponding privacy protection record pairs, including: According to a preset character length threshold, the two noise data records in the target record pair are respectively divided into character strings having a length equal to the character length threshold; Convert each of the character strings into a feature vector based on a hash function, and store each of the feature vectors corresponding to each of the noise data records in a binary Bloom filter corresponding to the noise data record one by one; Performing Dyce similarity coefficient calculation on the Bloom filters corresponding to the two noise data records in the target record pair, so as to obtain a similarity result between the two noise data records in the target record pair; It is determined whether the similarity result is equal to or greater than a similarity threshold. If so, the two noise data records in the target record pair corresponding to the similarity result are linked to obtain a corresponding privacy protection record pair.

[0011] In some embodiments of the present application, before adding noise to data records for respective blocks corresponding to respective databases storing different data records based on the preset output constraint differential privacy rule, the method further includes: dividing respective databases storing different data records into blocks based on various preset data features to obtain respective blocks corresponding to each of the databases, wherein the respective blocks corresponding to the same database correspond to the various data features in a one-to-one manner; According to the data features corresponding to each of the blocks, an index is set for each of the blocks.

[0012] In some embodiments of the present application, performing feature matching on the blocks in different databases to obtain each block pair includes: According to the indexes corresponding to the blocks in the different databases, feature matching is performed on the blocks with the same index and coming from two different databases to form corresponding block pairs.

[0013] Another aspect of the present application provides a privacy protection record linking device, comprising: A noise adding module, for adding noise to data records for each block corresponding to each database storing different data records based on a preset output constraint differential privacy rule, so as to use the data records added with the noise as noise data records; wherein the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and round each Laplace noise, and then when it is confirmed that the rounded Laplace noise is a positive value, the positive value is used as the amount of noise added to the corresponding block and noise is added to the corresponding data record in the block according to the amount, and when it is confirmed that the rounded Laplace noise is a negative value, zero noise is added to the block corresponding to the negative value; The record linking module is used to perform similarity matching on each of the noise data records from different databases based on a sliding window, and link each of the noise data records with successful similarity matching to obtain corresponding privacy protection record pairs.

[0014] The third aspect of the present application provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the privacy protection record linking method when executing the computer program.

[0015] The fourth aspect of the present application provides a computer-readable storage medium having a computer program stored thereon, which implements the privacy protection record linking method when executed by a processor.

[0016] The fifth aspect of the present application provides a computer program product, including a computer program, which implements the privacy protection record linking method when executed by a processor.

[0017] The privacy-preserving record linking method provided in the present application adds noise to data records for each block corresponding to each database storing different data records based on the output constraint differential privacy rule, so that the data records with added noise are used as noise data records; the output constraint differential privacy rule is used to select whether to add noise to the data records in the block or to add zero noise to the block according to the rounding result of the Laplace noise; based on the sliding window, similarity matching is performed on each noise data record from different databases, and each noise data record with successful similarity matching is linked to obtain corresponding privacy-preserving record pairs, which can improve the effectiveness and reliability of record linking while ensuring end-to-end privacy protection and efficient record linking, and can improve the reliability of privacy protection in the end-to-end record linking process, and can achieve a balance between the recall rate and efficiency of the record linking process, so as to achieve overall matching optimization of record linking.

[0018] Additional advantages, purposes, and features of the present application will be partially described in the following description, and will become partially apparent to those skilled in the art after studying the following, or may be learned from the practice of the present application. The purposes and other advantages of the present application can be achieved and obtained by the structures specifically pointed out in the specification and the drawings.

[0019] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present application are not limited to the above specific description, and the above and other purposes that can be achieved by the present application will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. The components in the drawings are not drawn to scale, but are only for the purpose of illustrating the principles of the present application. In order to facilitate the illustration and description of some parts of the present application, the corresponding parts in the drawings may be enlarged, that is, they may become larger relative to other components in the exemplary device actually manufactured according to the present application. In the drawings: Figure 1 This is a schematic diagram of matching optimization based on a sliding window in an example of the present application.

[0021] Figure 2 This is a first flow chart of a privacy protection record linking method in one embodiment of the present application.

[0022] Figure 3 This is a second flow chart of the privacy protection record linking method in one embodiment of the present application.

[0023] Figure 4 This is a schematic diagram of the calculation of q-tuple matching of the Diess coefficient similarity in an example of the present application.

[0024] Figure 5 This is a third flow chart of the privacy protection record linking method in one embodiment of the present application.

[0025] Figure 6 This is a fourth flow chart of the privacy protection record linking method in one embodiment of the present application.

[0026] Figure 7 The overall framework diagram of the privacy protection record linking method with sliding window in an application example of the present application is shown.

[0027] Figure 8 This is a schematic diagram of experimental comparison corresponding to the first set of experimental results in an application example of the present application.

[0028] Fig. 9 It is a schematic diagram of experimental comparison corresponding to the second set of experimental results in an application example of the present application.

[0029] Fig.10 This is a schematic diagram of experimental comparison corresponding to the third set of experimental results in an application example of the present application.

[0030] Fig.11 Schematic diagram of the structure of a privacy protection record linking device in one embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the implementation modes and the accompanying drawings. Here, the illustrative implementation modes and descriptions of the present application are used to explain the present application, but are not intended to limit the present application.

[0032] It should also be noted here that in order to avoid obscuring the present application due to unnecessary details, only the structures and / or processing steps closely related to the scheme according to the present application are shown in the accompanying drawings, while other details that are not very relevant to the present application are omitted.

[0033] It should be emphasized that the term “include / comprises” when used herein refers to the presence of features, elements, steps or components, but does not exclude the presence or addition of one or more other features, elements, steps or components.

[0034] It should also be noted that, unless otherwise specified, the term “connection” herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0035] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0036] The "data record" in record linkage refers to the description of a data item or entity in different datasets. It can be a row in a database, table, file, or other data storage structure, which contains a set of related fields or attributes. Each data record usually contains multiple features or attributes related to the entity. For example, in a census dataset, each data record may represent a person, including attributes such as name, address, age, and gender. In the medical field, each data record may represent a patient, including information such as name, birthday, height, weight, symptoms, etc. In the record linkage task, the goal is to match or link records with similar or identical attributes in different datasets to identify that they are actually the same entity. This can be achieved by comparing attribute values ​​between data records, such as using fields such as name, address, and ID number. Record linkage is very important for tasks such as data cleaning, data integration, and data analysis because it can integrate related information scattered in multiple datasets to provide a more comprehensive and consistent view of the data.

[0037] However, in real-world scenarios, data records often contain a large amount of sensitive information, such as user friend relationship information and personal preference information in social networks, patient disease information and physical condition information in hospital networks, and user financial information and wealth liability information in banking networks. Recent research shows that data records in databases are subject to different types of privacy attacks during the record linking process, including high-precision recognition attacks, sensitive attribute reasoning attacks, etc. Even many existing privacy-preserving record linking methods often have major loopholes and deficiencies, such as the inability to provide end-to-end privacy protection and the exposure of sensitive attributes of record data. These problems often lead to serious data privacy leakage problems during the linking process, so studying the privacy protection issues of record linking is crucial for the future development of data science.

[0038] Due to the rapid development of Internet technology and the resulting accumulation of data information, the risk of data privacy leakage is also increasing. As people frequently use various Internet services in various fields, their personal identity information, preference information, behavior information and other sensitive information are being continuously collected, stored and used. The recent occurrence of some large-scale data leakage incidents has also aroused strong concerns among people, enterprises and related organizations about data privacy security.

[0039] Nowadays, data privacy has become a hot research field. Various privacy protection technologies and methods continue to emerge. Common data privacy protection methods include: encryption technology, data anonymization, authorized access, data sharing, differential privacy, etc. Among them, differential privacy is currently the most advanced privacy protection method. The differential privacy method introduces random perturbations by adding some noise to the original data to confuse the data features. It can prevent data leakage and re-identification attacks, thereby ensuring the privacy security of user data. In recent years, the application of differential privacy in the fields of artificial intelligence and big data has become more and more extensive.

[0040] Existing differential privacy (DP) or indistinguishable secure two-party computation (IND-S2PC) can achieve record linkage. The record linkage between databases achieved by this method can truly display matching record pairs and output matching record pairs; at the same time, any real information cannot be disclosed, and the existence or non-existence of any single record will be hidden. However, due to the fundamental incompatibility between DP and IND-S2PC methods, and the different privacy guarantees they provide, this application introduces a weaker privacy protection method that still satisfies end-to-end privacy protection, which is used in the privacy setting of the two-party database to meet the balance between differential privacy (DP) and indistinguishable secure two-party computation (IND-S2PC).

[0041] For this method, let G = (V, E) represent a graph, where V is the set of all possible databases that may be owned, and E is the set of edges connecting adjacent databases. The privacy overhead between databases is converted into a spatial distance metric for a more intuitive display. The distance between any pair of databases is the shortest path distance in G. Intuitively, if the shortest path between databases is larger, the adversary A can distinguish between adjacent databases D. B and D B′ The greater the ability, the greater the privacy protection overhead. The following is the definition of output constrained differential privacy: Output constrained differential privacy, the computation function f of the two-party privacy-preserving record linking protocol Π: D A ×D B →O is (ε A , ε B , δ A, δ B , f) The condition for output constrained differential privacy is that for any (D B , D B' )∈N(f(D A ,·)), A satisfies the following formula: Similarly, for B and ε A and δ A Similarly, ε (epsilon) is a non-negative real number, called the upper bound of privacy loss or privacy budget, ε A is the privacy budget of client B, ε B is the privacy budget of client B; δ(delta) is a value between 0 and 1, giving a small probability that the privacy guarantee may fail, δ A is the probability of client A’s privacy guarantee failure, δ B The probability of failure to guarantee privacy for client B.

[0042] For output constrained differential privacy, it can provide better flexibility and scalability. This method can simplify the process of setting privacy protection for each query separately through a more general privacy protection setting, and can be further extended to large-scale data sets and complex queries.

[0043] Therefore, in an output constrained differential privacy method that takes into account both differential privacy (DP) and indistinguishable secure two-party computation (IND-S2PC), the record linking implemented by this method can truly display the matching record pairs and output the matching record pairs, while at the same time no real information can be disclosed.

[0044] Another technical solution is an optimized sorting and pruning spatial data indexing algorithm based on a sliding window. This method can be used to divide spatial data into different blocks or areas, and sort and prune each block or area to more quickly locate the neighbors of the query point or objects that meet the query range.

[0045] By introducing a set of decreasing thresholds, the blocks can be divided into different groups according to the noise conditions of different blocks in the data set, and the idea of ​​sliding windows can be introduced to balance the recall rate and efficiency by limiting the maximum range of window sliding, so as to achieve an overall matching optimization method.

[0046] In the process of record linking, the classified and noise-added blocks can also be sorted according to the noise introduction, so that the adjacent blocks have a higher degree of similarity. A fixed-size comparison sliding window is introduced, and the comparison of record pairs between the two databases is limited to the window, thereby limiting the comparison range and improving the efficiency of the comparison. When and only when all the data in the block at the end of the window is compared, the window continues to slide forward and the process is repeated until the end, such as Figure 1 As shown, D A , D B Represents two different databases A and database B respectively.

[0047] The following is the formula of the sliding window-based matching optimization method and the meaning of each parameter: s∈[s 1 ,s 2 ,s 3 ......], e∈[e 1 , e 2 , e 3 ......] B(D A ) and B(D B ) represents the noise count, s represents the set at the beginning of the sliding window, and e represents the set at the end of the sliding window. S，t1 Represents a matching strategy.

[0048] That is to say, in order to solve the problems existing in the existing privacy-preserving record linking methods, such as the inability to provide end-to-end privacy protection and the low recall rate, the embodiments of the present application respectively provide a privacy-preserving record linking method, a privacy-preserving record linking device for executing the privacy-preserving record linking method, a physical device, a computer-readable storage medium and a computer program product, and introduce the output constraint differential privacy rule into the record linking process, so that in the record linking process, both the real matching record pairs can be displayed and the existence or non-existence of any unmatched records can be hidden, so as to achieve end-to-end privacy protection; and at the same time, the idea of ​​sliding window is introduced to reduce the comparison missing problem at the noise threshold boundary, and the balance between recall rate and efficiency is achieved by limiting the maximum range of window sliding, so as to achieve overall matching optimization.

[0049] The details are described in detail through the following examples.

[0050] Based on this, the embodiment of the present application provides a privacy protection record linking method that can be implemented by a privacy protection record linking device, see Figure 2 The privacy protection record linking method specifically includes the following contents: Step 100: Based on the preset output constraint differential privacy rule, noise is added to the data records for each block corresponding to each database storing different data records, so that the data records added with the noise are used as noise data records; wherein the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and round each Laplace noise, and then when it is confirmed that the rounded Laplace noise is a positive value, the positive value is used as the amount of noise added to the corresponding block and noise is added to the corresponding data record in the block according to the amount, and when it is confirmed that the rounded Laplace noise is a negative value, zero noise is added to the block corresponding to the negative value.

[0051] The target person is a core person whose facial features need to be presented in the final video data, such as a main actor in a movie shooting scene.

[0052] It can be understood that the output constrained differential privacy rule can also be called the output constrained differential privacy method or model, and both can be implemented using the existing output constrained differential privacy (Output Constrained Differential Privacy) technology.

[0053] In one or more embodiments of the present application, the data record may be referred to as a record, the privacy protection record link refers to a record linking process that can achieve record privacy protection, and the end-to-end record link refers to a record link between different databases (also referred to as data sets).

[0054] In one or more embodiments of the present application, multiple data records are stored in each of the blocks. In order to further improve the efficiency and reliability of the privacy protection record linking process, the data features corresponding to the data records stored in each of the blocks are the same, which will be described in detail in subsequent embodiments.

[0055] It can be understood that the noise added to the data record can be selected as false data, and the false data refers to other data that is different from the data content in the data record, and each false data is provided with a noise attribute label, and the noise attribute label refers to the attribute used to mark the false data to distinguish the false data from the real data content in the data record, so that the false data does not match the real data.

[0056] Step 200: Based on a sliding window, similarity matching is performed on each of the noise data records from different databases, and each of the noise data records with successful similarity matching is linked to obtain a corresponding privacy protection record pair.

[0057] In step 200, the idea of ​​sliding window is introduced to optimize the matching of record pairs between databases, which can achieve better linking effect and recall rate while ensuring end-to-end privacy protection and efficient record linking.

[0058] From the above description, it can be seen that the privacy-preserving record linking method provided in the embodiment of the present application optimizes the matching of record pairs between databases of two mutually untrusting parties by outputting a constrained differential privacy model and introducing the idea of ​​a sliding window. It is possible to achieve better linking effect and recall rate while ensuring end-to-end privacy protection and efficient record linking. Through the above method, it is possible to output real data that meets the matching rules while protecting the privacy security of unmatched data under the premise of strong privacy protection of shared differential privacy.

[0059] In order to further implement output constraint differential privacy protection for blocks and prevent false data noise from matching real data, a more general privacy protection setting is used to simplify the process of setting individual privacy protection for each query, and it can be further extended to large-scale data sets and complex queries. In a privacy protection record linking method provided in an embodiment of the present application, see Figure 3 , step 100 in the privacy protection record linking method specifically includes the following contents: Step 110: Obtain preset Laplace noise parameters, wherein the Laplace noise parameters include: a scale parameter of the Laplace distribution and a privacy budget.

[0060] Step 120: Calculate the Laplace noise corresponding to each block according to the pre-acquired data features of each block corresponding to each database, the scale parameter of the Laplace distribution and the privacy budget.

[0061] Step 130: performing a rounding operation on each of the Laplace noises.

[0062] Step 140: If the rounded Laplace noise is a positive value, use the positive value as the noise amount to add noise to the data records in the corresponding block, and set a noise attribute label for the noise to convert the data records in the block to which the Laplace noise has been added into noise data records.

[0063] And, step 150: if the rounded Laplace noise is a negative value, adding zero noise to the block corresponding to the negative value.

[0064] Specifically, adding noise is an important step in privacy protection. In this process, noise that satisfies the output constraint differential privacy is added to the already divided blocks, so that the data set has the ability to resist privacy attacks, thereby achieving privacy protection. This application uses the Laplace noise mechanism commonly used in differential privacy to introduce randomness into the query results, hide the specific value of individual data, and make it impossible for attackers to accurately infer individual data, thereby protecting the privacy of individual data.

[0065] For differential privacy: Assume there is a random algorithm M, S is the set of all possible output results of M, and Pr[] represents the probability. For any two adjacent data sets D and D', the difference between the two data sets is that there is only one different record, if the probability distribution of the two adjacent sets meets the following constraints: Pr[M(D)∈S]≤e ε Pr[M(D′)∈S] Algorithm M is said to provide ε differential privacy protection.

[0066] The Laplace noise Y used in this application is: The parameter Δf is set to represent the sensitivity and ε is the privacy budget. The calculation formula of the noise in satisfying differential privacy is as follows: Through the above analysis, the Gaussian noise introduced in this application can ensure that the algorithm satisfies differential privacy protection for each user. Due to the characteristics of differential privacy noise itself, differential privacy is not sensitive to the existence of a certain data, that is, it cannot display any matching data pair. This application adopts a new method of introducing noise: adding a Laplace distributed false data noise to each data block. When the introduced noise is negative, the output constraint is performed, so that this design provides corresponding output constraint differential privacy protection to the original data.

[0067] Based on this, an example of steps 110 to 150 is as follows: (1) Determine the parameters of the Laplace noise, including the scale parameter ΔB of the Laplace distribution and the privacy budget ε. The scale parameter ΔB controls the diffusion degree of the noise, and the privacy parameter ε controls the privacy protection level. For ΔB, this application sets it as the ratio of the sensitivity Δf to the privacy budget ε.

[0068] (2) Determine the range of noise according to the characteristics of the data set (i.e., block) to which noise is to be added. This application adds noise by adding false data to the block. The specific method of adding noise is as follows: according to the data characteristics, sensitivity, and privacy budget, a Laplace noise is calculated for each block, and the generated noise is rounded. The integer is used as the amount of noise added to the block. When the noise is a negative value, a negative amount of noise data cannot be added to the data set. At this time, this application imposes output constraints on the noise added to the data set. When the noise is a negative number, no noise is added to the block, that is, zero noise is added, so the range of noise is a non-negative integer that satisfies the Laplace distribution. This method is used to complete output constraint differential privacy protection for blocks.

[0069] (3) Generate and add noise records: For the attributes of each noise record to be added (i.e., noise data record), the noise record finally generated by the present application can satisfy the attribute characteristic interval in the block in which it is located, and can also exist as false data without matching any real data. By randomly generating and analyzing the attribute characteristics of the interval, false data that meets the attribute characteristic interval of the block is generated, and a unique flag attribute is added to the false data so that the false data does not match the real data.

[0070] In order to further improve the effectiveness and reliability of the link, in a privacy protection record linking method provided in an embodiment of the present application, see Figure 3 , step 200 in the privacy protection record linking method specifically includes the following contents: Step 210: Based on a preset sliding window, character string division and Dyss similarity coefficient calculation are performed on each of the noise data records from different databases, and each of the noise data records with successful similarity matching is linked to obtain a corresponding privacy protection record pair.

[0071] Specifically, the record linking process is an important part of this application. The record linking process of this application adopts the Dice coefficient similarity sim D A method for q-tuple matching (i.e. string segmentation).

[0072] The q-tuple is based on the character-level n-tuple model, which cuts the text into continuous substrings of n characters and processes and compares them as features. In this application, it is used to compare the similarity of text, string or set data to calculate the similarity between two sets. For two sets A and B, the Dice coefficient is defined as the ratio between the size of their intersection and the size of their union, and its calculation formula is as follows.

[0073] Among them, |A| represents the size of set A, |B| represents the size of set B, and |A∩B| represents the size of the intersection of A and B. For example, Figure 4 As shown, b 1 ,b 1 are two different Bloom filters, x 1 , x 2 represents the number of bits 1 in the two Bloom filters (i.e. Figure 4 ), c represents the number of bits 1 in the same position in the two Bloom filters (i.e. Figure 4 "number of common 1-bits (bold)"), sim D Represents the similarity between two Bloom filters, which is the Dice coefficient similarity between two words in this case.

[0074] In order to further limit the scope of comparison, reduce the number of comparisons, and avoid traversing and comparing the entire data set, thereby reducing the overall time complexity, in a privacy protection record linking method provided in an embodiment of the present application, see Figure 5 , step 210 in the privacy protection record linking method specifically includes the following contents: Step 211: Perform feature matching on the blocks in different databases to obtain block pairs, wherein each block pair includes two blocks from different databases.

[0075] Step 212: For each of the block pairs, extract the two noise data records from different blocks in each of the block pairs in sequence, so as to use the noise data records as target record pairs respectively.

[0076] Step 213: Perform string division and Dyss similarity coefficient calculation on the two noise data records in each target record pair to obtain corresponding similarity results, and link the two noise data records in the target record pair that have successfully matched similarity based on the similarity results to obtain a corresponding privacy protection record pair.

[0077] In order to further efficiently link two similar record pairs with high quality and ensure end-to-end differential privacy between users during the linking process, in a privacy-preserving record linking method provided in an embodiment of the present application, see Figure 6 Step 213 in the privacy protection record linking method specifically includes the following contents: Step 2131: According to a preset character length threshold, the two noise data records in the target record pair are respectively divided into character strings with a length equal to the character length threshold.

[0078] Step 2132: Convert each of the character strings into a feature vector based on a hash function, and store each of the feature vectors corresponding to each of the noise data records in a binary Bloom filter that corresponds one-to-one to the noise data record.

[0079] Step 2133: perform Dyss similarity coefficient calculation on the Bloom filters corresponding to the two noise data records in the target record pair to obtain a similarity result between the two noise data records in the target record pair.

[0080] Step 2134: Determine whether the similarity result is equal to or greater than a similarity threshold. If so, link the two noise data records in the target record pair corresponding to the similarity result to obtain a corresponding privacy protection record pair.

[0081] If not, the two noise data records in the target record pair are not linked.

[0082] In an example of step 2131 to step 2134, the specific process is: (1) Word segmentation: Each data record is segmented into character-level substrings of length q. For example, when q = 3, a string record "John Smith" can be segmented into ["Joh", "ohn", "hn", "nS", "Sm", "Smi", "mit", "ith"].

[0083] (2) Feature representation: For each data record, its divided string of length q is converted into a feature vector through a hash function and stored in a binary Bloom filter (BF), where one feature vector corresponds to a unique q-tuple substring.

[0084] (3) Dyss coefficient similarity calculation: The Bloom filters generated by the two data records are compared by Dyss coefficient similarity, where |A| is the number of bit positions 1 in the first Bloom filter, and |B| is the number of bit positions 1 in the second Bloom filter. |A∩B| is the number of bits that are 1 in the same bit position in the two Bloom filters.

[0085] (4) Similarity threshold setting: Set a similarity threshold according to application requirements. If the similarity between two records exceeds the similarity threshold, they can be considered to be the same entity. For example, if the similarity threshold is set to 0.8, then Figure 4 The two strings b in 1 and b 2 resemblance.

[0086] In order to put similar records that may match into the same block before linking the records, that is, to group the records in the data set according to certain characteristics, so that the calculation time complexity of entity comparison can be reduced after the records are grouped, thereby improving the efficiency of linking or matching, in a privacy protection record linking method provided in an embodiment of the present application, see Figure 3 The privacy protection record linking method may further include the following contents before step 100: Step 010: Based on various preset data features, each database storing different data records is divided into blocks to obtain blocks corresponding to each of the databases, wherein each block corresponding to the same database corresponds one-to-one to each of the data features.

[0087] Step 020: According to the data features corresponding to each of the blocks, an index is set for each of the blocks.

[0088] Correspondingly, in order to greatly reduce the amount of computation for entity comparison, thereby improving the efficiency of record linkage or entity matching. Since only the comparison needs to be performed within the same block pair, unnecessary comparison operations can be effectively reduced, which can improve the speed and efficiency of the overall processing. At the same time, the block partitioning operation also helps to reduce the probability of incorrect matching and linkage, and can improve the accuracy of record linkage to a certain extent. See Figure 6 In a privacy protection record linking method provided in an embodiment of the present application, step 211 specifically includes the following contents: Step 2111: According to the indexes corresponding to the blocks in the different databases, feature matching is performed on the blocks with the same index and coming from two different databases to form corresponding block pairs.

[0089] Specifically, data chunking is used as a preprocessing step in the record linking process. The main purpose is to put similar records that may be matched into the same block before linking the records, that is, to group the records in the data set according to certain characteristics, so that the computational time complexity of entity comparison can be reduced after the records are grouped, thereby improving the efficiency of linking or matching.

[0090] An example of a specific operation process of step 010 and step 020 is as follows: (1) Data splitting and grouping: First, the records in the database are split and grouped according to preset data features. The data features can be name, address, ID number, age, etc. The specific features selected depend on the application scenario and the characteristics of the dataset. Records in the same group have similar data features and are more likely to belong to the same entity.

[0091] (2) Group index: For each group, an index structure can be created to support fast query. According to the Laplace noise added in the next section, the index structure is used to group the records after the data grouping process has been completed according to the noise threshold from large to small to achieve group indexing.

[0092] (3) Linking or matching: For the record pairs to be linked or matched in other databases, the same features are used to group them, and the corresponding index structure is used to determine the possible identical groups. Then, only the record pairs that appear in the same group are compared physically. In this way, the comparison scope is limited, the number of comparisons is reduced, and the traversal and comparison of the entire data set is avoided, thereby reducing the overall time complexity.

[0093] To further illustrate the above embodiment, the present application also provides a specific application example of the privacy protection record linking method based on a sliding window, see Figure 7 , where DB represents different databases, B1 to B3 represent different blocks after the database is divided into blocks, and m(a, b) represents the similar records matched by the sliding window record linkage method. It is divided into two main design parts, namely the output constrained differential privacy framework and the record linkage process. The output constrained differential privacy framework is further divided into two parts: data segmentation and noise addition. The above three parts are described as follows: S1: Data segmentation (also called block segmentation): According to the data characteristics of the records themselves, a large amount of data in the original database is divided into blocks corresponding to its characteristics; In the process of record linking, a sliding window method based on noise threshold is adopted. Similar records that may match are classified into the same block, and the added noise is classified by the deciles threshold.

[0094] S2: Add noise: Add Laplace distributed differential privacy noise to each block to achieve end-to-end privacy protection; Among them, the protection of output constrained differential privacy is introduced. Noise is added by introducing false data. The noise distribution is Gaussian distribution. When the introduced noise value is greater than zero, the noise is rounded as the number of noise data introduced in the block. The distribution and addition of noise are as follows: η i + =max(η i , 0), η i =Lap(ε,δ,B).

[0095] η i + The amount of noise added to each block; η iis Gaussian noise; ε (epsilon) is a non-negative real number, called the upper bound of privacy loss or privacy budget; δ (delta) is a value between 0 and 1, giving a small probability that the privacy guarantee may fail; B represents the sensitivity of the query, which quantifies the maximum impact that a change to a single record may have on the query result.

[0096] The noise record finally generated can not only satisfy the attribute feature interval in the block where it is located, but also exist as false data without matching any real data.

[0097] Analyze the attribute characteristics of the block interval and generate the data characteristics randomly through Gaussian distribution. basic i For the data distribution benchmark of block i, generate fake data that meets the attribute feature interval of the i-th block, and add unique flag attributes to the fake data so that the fake data does not match the real data. After the generation is completed, put the generated fake data record into the i-th block to complete the addition of noise records.

[0098] S3: Record linkage: A q-tuple matching record linkage method based on Dyss coefficient similarity is used to achieve a linkage process with higher recall based on a sliding window.

[0099] In the process of record linking, a sliding window is used to realize the matching process between record pairs, and the linking process is completed by limiting the window size. The expression of the sliding window is: s∈[s 1 ,s 2 ,s 3 .....], e∈[e 1 , e 2 , e 3 ......] B(D A ) and B(D B ) represents the noise count, s represents the set at the beginning of the sliding window, and e represents the set at the end of the sliding window. S，t1 Represents a matching strategy.

[0100] The descending order of the introduced noise can be used as the moving order of the sliding window; the greater the introduced noise, the more possible matching record pairs; the smaller the introduced noise, the fewer possible matching record pairs. When the recall rate of the screened record pairs reaches a certain value, the movement of the sliding window is stopped to improve the recall rate of the overall record linkage process.

[0101] Specifically, in S3, a fixed-size comparison sliding window is introduced, and the comparison of record pairs between the two databases is limited to this window to eliminate the comparison missing problem at the threshold boundary of S&P (classification and pruning method). By limiting the maximum range of window sliding, that is, s i , e i To make a trade-off between recall and efficiency. And, based on the q-tuple matching record link of Dyss coefficient similarity, for two record pairs from different databases, the text of the record is cut into continuous substrings of q characters, and used as features. The string of length q is converted into a feature vector through a hash function and saved in a binary Bloom filter, where one feature vector corresponds to a unique q-tuple substring. After the record pair is completely placed in the Bloom filter, the final Dyss coefficient similarity of the record pair is calculated as: |A| is the number of 1s in the first Bloom filter, and similarly |B| is the number of 1s in the second Bloom filter. |A∩B| is the number of 1s in the same position in both Bloom filters.

[0102] Among them, in a specific example of S1 above, the data block operation is used as a preprocessing step of the record linking process. The main purpose is to put similar records that may be matched into the same block before linking the records, that is, to group the records in the data set according to certain characteristics, so that after the records are grouped, the computational time complexity of entity comparison can be reduced, thereby improving the efficiency of linking or matching.

[0103] The specific operation process is as follows: (1) Data splitting and grouping: First, the records in the data set are split and grouped according to preset features. The features can be name, address, ID number, age, etc. The specific features selected depend on the application scenario and the characteristics of the data set. Records in the same group have similar features and are more likely to belong to the same entity.

[0104] (2) Group index: For each group, an index structure can be created to support fast query. In this application example, based on the Laplace noise added in the next section, the index structure is used to group the records that have completed the data grouping process according to the noise threshold from large to small to achieve group indexing.

[0105] (3) Linking or matching: For the record pairs to be linked or matched in other databases, the same features are used to group them, and the corresponding index structure is used to determine the possible identical groups. Then, only the record pairs that appear in the same group are compared physically. In this way, the scope of comparison is limited, the number of comparisons is reduced, and the traversal and comparison of the entire data set is avoided, thereby reducing the overall time complexity.

[0106] The block partitioning operation can greatly reduce the amount of computation for entity comparison, thereby improving the efficiency of record linking or entity matching. Since only comparisons need to be performed within the same group, unnecessary comparison operations can be effectively reduced, improving the speed and efficiency of the overall processing. At the same time, the block partitioning operation also helps reduce the probability of incorrect matching and linking, and improves accuracy to a certain extent.

[0107] Among them, in a specific example of S2 above, adding noise is an important step in privacy protection. In this process, noise that satisfies the output constraint differential privacy is added to the already divided blocks, so that the data set has the ability to resist privacy attacks, thereby achieving privacy protection. This application example uses the Laplace noise mechanism commonly used in differential privacy to introduce randomness in the query results, hide the specific value of individual data, and make it impossible for attackers to accurately infer individual data, thereby protecting the privacy of individual data. The specific operation process is performed as follows: (1) Determine the parameters of the Laplace noise, including the scale parameter ΔB of the Laplace distribution and the privacy budget ε. The scale parameter ΔB controls the diffusion degree of the noise, and the privacy parameter ε controls the privacy protection level. For ΔB, this application example sets it as the ratio of the sensitivity Δf to the privacy budget ε.

[0108] (2) Determine the range of noise based on the characteristics of the data set to which noise is to be added. This application example adds noise by adding false data to the block. The specific method of adding noise is as follows: according to the data characteristics, sensitivity and privacy budget, a Laplace noise is calculated for each block, and the generated noise is rounded. The integer is used as the amount of noise added to the block. When the noise is a negative value, it is impossible to add negative noise data to the data set. At this time, this application example imposes output constraints on the noise added to the data set. When the noise is a negative number, no noise is added to the block, that is, zero noise is added. Therefore, the range of noise is a non-negative integer that satisfies the Laplace distribution. This method completes output constraint differential privacy protection for blocks.

[0109] (3) Generate and add noise records: For each attribute of the noise record to be added, the noise record finally generated by this application example can not only meet the attribute feature interval in the block where it is located, but also exist as false data without matching any real data. By randomly generating and analyzing the attribute features of the interval, false data that meets the attribute feature interval of the block is generated, and a unique flag attribute is added to the false data so that the false data does not match the real data.

[0110] In the specific example of S3 above, the record linking process is an important part of this application example. The record linking process of this application example adopts the Dice coefficient similarity sim D The q-tuple matching record linking method.

[0111] The specific process of the q-tuple matching record linking method based on the Dice coefficient similarity in this application example is as follows: (1) Word segmentation: Each record is segmented into character-level substrings of length q. For example, when q = 3, a string record "John Smith" can be segmented into ["Joh", "ohn", "hn", "nS", "Sm", "Smi", "mit", "ith"].

[0112] (2) Feature representation: For each record, its divided string of length q is converted into a feature vector through a hash function and stored in a binary Bloom filter (BF), where one feature vector corresponds to a unique q-tuple substring.

[0113] (3) Dyss coefficient similarity calculation: The Bloom filters generated by the two records are compared by Dyss coefficient similarity, where |A| is the number of bits that are 1 in the first Bloom filter, and |B| is the number of bits that are 1 in the second Bloom filter. |A∩B| is the number of bits that are 1 in the same bit position in both Bloom filters.

[0114] (4) Threshold setting: Set a similarity threshold according to application requirements. If the similarity of two records exceeds the threshold, they can be considered to be the same entity. If the threshold is set to 0.8, then Figure 4 The two strings in are similar.

[0115] The above is the specific implementation of privacy-preserving record linking in this application example. Through the above methods, this application example can efficiently link two similar record pairs with high quality, and ensure end-to-end differential privacy between users during the linking process.

[0116] In addition, when performing record linking, the widely used synthetic dataset Abtand Buy product dataset (AB) and the real dataset Australian Bureau of Statistics (ABS) are used for experimental verification. In the linking process, the number of security comparisons and the link quality are used as the record targets of this application.

[0117] For link quality, this application example uses the widely used metrics accuracy (Precision), recall (Recall) and the trade-off indicator fscore to compare all methods. The calculation methods of Precision, Recall and fscore are as follows: O Π As a result of matching the output, O Π It can be incorrect only in two cases - a partial match (a, b)∈ In O Π does not exist in (F N ), and some non-matching pairs Appeared in O Π Medium (F P ). Therefore, this paper uses recall and precision as metrics to quantify the accuracy of protocol Π, which are calculated as: Recall: Accuracy: The trade-off measure fscore is calculated as follows: For link efficiency, the overhead of computing the matching process in this application will involve communication and computational costs. This application assumes that the length of each record in the database is O(1); that is, it will not increase with n=max(|D A |,|D B |). The communication and computation costs are lower bounded by the output size, Ω(M), where This application example calculates the number of link matches during the link process and uses this as the communication overhead during the matching process; and measures the time required to complete each match and uses this as the computational cost of a single match. The specific characteristics of the data in the two sets of data after preliminary processing are shown in Table 1.

[0118] Table 1 Dataset characteristics Dataset Number of records Number of attributes AB 50，000 9 ABS 250，000 13 The performance of the method of the present application is illustrated below by analyzing the experimental data.

[0119] The first set of comparative experiments is an experimental comparison of the time cost between the matching optimization method based on sliding window and the APC method. The experiment calculates the time cost of the matching optimization method based on sliding window and the APC method at different data volumes, and observes the change of the time cost curve as the data volume increases.

[0120] The results of the first group of experiments are as follows Figure 8 As shown in the figure, as the amount of data increases, the slope of the curve of the APC method is about twice that of the matching optimization method based on the sliding window. For the APC method, its communication and computational overhead, that is, the time complexity, is O(n 2 ), so the experimental results verify that the time complexity of the sliding window-based matching optimization method designed by the application is O(n k ), k<2, which is the cost of a sub-quadratic function, which is consistent with the time complexity of O(n*logn) in the theoretical reasoning stage.

[0121] The second set of experiments is a curve showing the accuracy change of the sliding window-based matching optimization method under sliding windows of different sizes. This application demonstrates the impact of the sliding window size on the recall rate through the experiments in this section.

[0122] The results of the second set of experiments are as follows Fig. 9 As shown in the figure, as the window continues to increase, the recall rate and accuracy are also continuously improving. When the window is small, the accuracy grows rapidly. As the window increases, the growth rate gradually slows down and gradually converges.

[0123] The matching optimization method based on sliding windows introduces the idea of ​​sliding windows to make a trade-off between accuracy and efficiency, and achieves an improvement in accuracy at the expense of some efficiency. This method will be approximately equivalent to the APC method, with the highest time complexity and convergence in recall. In the experiment, this application selected the number of windows at the recall convergence value of 90% as the window size of the experiment to ensure a higher accuracy and less additional time overhead.

[0124] The third group of experiments is the recall comparison between the matching optimization method based on sliding window and the classification and pruning method. Fig.10 As shown, this application has obtained experimental results of the recall rate of the two methods through multiple experiments. Through this set of experiments, the recall rate of this method is 7% better than that of the original method, which verifies the superiority of the matching optimization method based on the sliding window in terms of recall rate.

[0125] It can be seen from the above tests that the matching optimization record linking method based on sliding window provided by this application example can provide higher link quality and link efficiency while ensuring end-to-end privacy protection.

[0126] From the software level, the present application also provides a privacy protection record linking device for executing all or part of the privacy protection record linking method, see Fig.11, the privacy protection record linking device specifically includes the following contents: a noise adding module 10, which is used to add noise to data records for each block corresponding to each database storing different data records based on a preset output constraint differential privacy rule, so as to use the data records added with the noise as noise data records; wherein the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and round each Laplace noise, and then when it is confirmed that the rounded Laplace noise is a positive value, the positive value is used as the amount of noise added to the corresponding block and noise is added to the corresponding data record in the block according to the amount, and when it is confirmed that the rounded Laplace noise is a negative value, zero noise is added to the block corresponding to the negative value; The record linking module 20 is used to perform similarity matching on each of the noise data records from different databases based on a sliding window, and link each of the noise data records with successful similarity matching to obtain a corresponding privacy protection record pair.

[0127] The embodiment of the privacy protection record linking device provided in the present application can be specifically used to execute the processing flow of the embodiment of the privacy protection record linking method in the above embodiment. Its functions are not repeated here, and reference can be made to the detailed description of the above privacy protection record linking method embodiment.

[0128] The part of the privacy protection record linking device that performs the privacy protection record linking can be completed in the server or the client device. The specific selection can be based on the processing capability of the client device and the limitations of the user's usage scenario. This application does not limit this. If all operations are completed in the client device, the client device may also include a processor for specific processing of the privacy protection record linking.

[0129] The client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side, and other implementation scenarios may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, or a server cluster consisting of multiple servers, or a server structure of a distributed device.

[0130] The server and the client device may communicate with each other using any suitable network protocol, including network protocols that have not yet been developed on the date of filing this application. The network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Of course, the network protocols may also include, for example, RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer) protocols used on top of the above protocols.

[0131] From the above description, it can be seen that the privacy protection record linking device provided in the embodiment of the present application can improve the effectiveness and reliability of record linking while ensuring end-to-end privacy protection and efficient record linking, and can improve the reliability of privacy protection in the end-to-end record linking process, and can achieve a balance between the recall rate and efficiency of the record linking process, so as to achieve overall matching optimization of record linking.

[0132] The embodiment of the present application also provides an electronic device, which may include a processor, a memory, a receiver and a transmitter, wherein the processor is used to execute the privacy protection record linking method mentioned in the above embodiment, wherein the processor and the memory may be connected via a bus or other means, such as by bus connection. The receiver may be connected to the processor and the memory via wired or wireless means.

[0133] The processor may be a central processing unit (CPU). The processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or a combination of the above chips.

[0134] As a non-transitory computer-readable storage medium, the memory can be used to store non-transitory software programs, non-transitory computer executable programs and modules, such as program instructions / modules corresponding to the privacy protection record linking method in the embodiment of the present application. The processor executes various functional applications and data processing of the processor by running the non-transitory software programs, instructions and modules stored in the memory, that is, the privacy protection record linking method in the above method embodiment is implemented.

[0135] The memory may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created by the processor, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory may optionally include a memory remotely arranged relative to the processor, and these remote memories may be connected to the processor via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0136] The one or more modules are stored in the memory, and when executed by the processor, perform the privacy protection record linking method in the embodiment.

[0137] In some embodiments of the present application, the user equipment may include a processor, a memory, and a transceiver unit, which may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected through a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0138] As an implementation method, the functions of the receiver and the transmitter in the present application can be considered to be implemented through a transceiver circuit or a dedicated chip for transceiver, and the processor can be considered to be implemented through a dedicated processing chip, a processing circuit or a general chip.

[0139] As another implementation method, it is possible to use a general-purpose computer to implement the server provided in the embodiment of the present application, that is, to store the program code for implementing the functions of the processor, receiver, and transmitter in a memory, and the general-purpose processor implements the functions of the processor, receiver, and transmitter by executing the code in the memory.

[0140] The embodiment of the present application also provides a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the aforementioned privacy protection record linking method are implemented. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the technical field.

[0141] An embodiment of the present application also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of the aforementioned privacy protection record linking method.

[0142] It should be understood by those skilled in the art that the exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0143] It should be clear that the present application is not limited to the specific configuration and processing described above and shown in the figures. For the sake of simplicity, a detailed description of the known method is omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of the present application is not limited to the specific steps described and shown, and those skilled in the art can make various changes, modifications and additions, or change the order between the steps after understanding the spirit of the present application.

[0144] In the present application, features described and / or illustrated for one embodiment may be used in the same manner or in a similar manner in one or more other embodiments, and / or combined with features of other embodiments or replace features of other embodiments.

[0145] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the embodiments of the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A privacy protection record linking method, characterized in that: include: Based on a preset output-constrained differential privacy rule, noise is added to data records for each block corresponding to each database storing different data records, so that the data records added with the noise are used as noise data records; wherein the output-constrained differential privacy rule is used to calculate the Laplace noise corresponding to each block and round each Laplace noise; then, when it is confirmed that the rounded Laplace noise is positive, the positive value is used as the amount of noise added to the corresponding block and noise is added to the corresponding data record in the block according to the amount; and when it is confirmed that the rounded Laplace noise is negative, zero noise is added to the block corresponding to the negative value; Based on a sliding window, similarity matching is performed on each of the noise data records from different databases, and each of the noise data records with successful similarity matching is linked to obtain corresponding privacy protection record pairs.

2. The privacy protection record linking method according to claim 1, characterized in that: The method of adding noise to data records for each block corresponding to each database storing different data records based on a preset output constrained differential privacy rule, so as to treat the data records with the added noise as noise data records, includes: Obtaining preset Laplace noise parameters, wherein the Laplace noise parameters include: a scale parameter of a Laplace distribution and a privacy budget; Calculate the Laplace noise corresponding to each block based on the pre-acquired data features of each block corresponding to each database, the scale parameter of the Laplace distribution, and the privacy budget; performing a rounding operation on each of the Laplace noises; If the rounded Laplace noise is a positive value, adding noise to the data record in the corresponding block using the positive value as the noise amount, and setting a noise attribute label for the noise, so as to convert the data record in the block to which the Laplace noise has been added into a noise data record; If the rounded Laplace noise is a negative value, zero noise is added to the block corresponding to the negative value.

3. The privacy protection record linking method according to claim 1, characterized in that: The step of linking the noise data records of the blocks corresponding to two matching parties, which are from different databases, based on the sliding window to obtain a corresponding privacy-preserving record pair includes: Based on a preset sliding window, character string segmentation and Dyce similarity coefficient calculation are performed on each of the noise data records from different databases, and each of the noise data records with successful similarity matching is linked to obtain corresponding privacy protection record pairs.

4. The privacy protection record linking method according to claim 3, characterized in that: The method of performing string segmentation and Dyss similarity coefficient calculation on each of the noise data records from the different databases based on a preset sliding window, and linking each of the noise data records with successful similarity matching to obtain corresponding privacy-preserving record pairs, includes: performing feature matching on the blocks in the different databases to obtain block pairs, wherein each block pair includes two blocks from different databases; For each of the block pairs, sequentially extracting two noise data records from different blocks in each of the block pairs, so as to use the noise data records as target record pairs; The two noise data records in each target record pair are respectively subjected to string division and Dyss similarity coefficient calculation to obtain corresponding similarity results, and the two noise data records in the target record pair with successful similarity matching are linked according to the similarity results to obtain a corresponding privacy protection record pair.

5. The privacy protection record linking method according to claim 4, characterized in that: The step of performing string segmentation and Dyss similarity coefficient calculation on the two noise data records in each target record pair to obtain corresponding similarity results, and linking the two noise data records in the target record pair that have successfully matched similarity based on the similarity results to obtain corresponding privacy-preserving record pairs includes: According to a preset character length threshold, dividing the two noise data records in the target record pair into respective character strings having a length equal to the character length threshold; Converting each of the character strings into a feature vector based on a hash function, and storing each of the feature vectors corresponding to each of the noise data records in a binary Bloom filter corresponding one-to-one to the noise data record; performing Dyss similarity coefficient calculation on the Bloom filters corresponding to the two noise data records in the target record pair to obtain a similarity result between the two noise data records in the target record pair; Determine whether the similarity result is equal to or greater than a similarity threshold; if so, link the two noise data records in the target record pair corresponding to the similarity result to obtain a corresponding privacy protection record pair.

6. The privacy protection record linking method according to claim 4, characterized in that: Before adding noise to data records for respective blocks corresponding to respective databases storing different data records based on the preset output-constrained differential privacy rule, the method further includes: Based on various preset data features, each database storing different data records is divided into blocks to obtain blocks corresponding to each database, wherein each block corresponding to the same database corresponds one-to-one to each data feature; An index is set for each of the blocks according to the data features corresponding to each of the blocks.

7. The privacy protection record linking method according to claim 6, characterized in that: The performing feature matching on the blocks in different databases to obtain respective block pairs includes: According to the indexes corresponding to the blocks in the different databases, feature matching is performed on the blocks with the same index but coming from two different databases to form corresponding block pairs.

8. A privacy protection record linking device, characterized in that: include: a noise addition module configured to add noise to data records for each block corresponding to each database storing different data records based on a preset output-constrained differential privacy rule, so as to treat the data records with the noise added as noisy data records; wherein the output-constrained differential privacy rule is configured to calculate the Laplace noise corresponding to each block and round each Laplace noise; and then, when it is determined that the rounded Laplace noise is positive, use the positive value as the amount of noise added to the corresponding block and add noise to the corresponding data records in the block based on the amount; and when it is determined that the rounded Laplace noise is negative, add zero noise to the block corresponding to the negative value; The record linking module is used to perform similarity matching on each of the noise data records from different databases based on a sliding window, and link each of the noise data records that have successfully been similarly matched to obtain corresponding privacy-preserving record pairs.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the privacy protection record linking method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the privacy protection record linking method according to any one of claims 1 to 7 is implemented.

Images