Privacy protection record linkage method and device, electronic equipment and storage medium

Abstract

This application provides a privacy-preserving record linking method, apparatus, electronic device, and storage medium. The method includes: adding noise to each block corresponding to each data record in each database storing different data records based on output-constrained differential privacy rules, so that the data records with added noise are treated as noisy data records; the output-constrained differential privacy rules are used to select whether to add noise to the data records in the block or add zero noise to the block based on the rounding result of the Laplace noise; based on a sliding window, performing similarity matching on each noisy data record from different databases, and linking the noisy data records that successfully match the similarity to obtain corresponding privacy-preserving record pairs. This application can improve the effectiveness and reliability of record linking while ensuring end-to-end privacy protection and efficient record linking, and can improve the reliability of privacy protection in the end-to-end record linking process.

Description

Technical Field

[0001] This application relates to the field of privacy-preserving record linking technology, and more particularly to privacy-preserving record linking methods, devices, electronic devices, and storage media. Background Technology

[0002] With the continuous development of the internet and the rapid popularization and improvement of inter-industry databases, the recorded information from all walks of life is experiencing explosive growth. The phenomenon of storing user information in the form of data records is now commonplace. Massive amounts of information are uploaded to servers to form big data, and the interconnected data forms records. Record linking is being used more and more frequently in daily life, for example, filtering disease records from multiple hospital databases, detecting potential risk users in interbank lending, collecting user-authorized preferences to provide corresponding services, and serving as a prerequisite for federated learning. Data records often contain a large amount of sensitive information. During record linking, data records in databases are vulnerable to various types of privacy attacks, including high-precision identification attacks and sensitive attribute inference attacks. Even many existing privacy-preserving record linking methods often have significant vulnerabilities and shortcomings, such as the inability to provide end-to-end privacy protection and the exposure of sensitive attributes of recorded data. These problems often lead to serious data privacy leaks during the linking process. Therefore, researching privacy protection issues in record linking is crucial for the future development of data science.

[0003] Currently, existing methods for protecting privacy in record-keeping include encryption, data anonymization, authorized access, data sharing, and differential privacy. Among these, differential privacy is the most advanced method. Differential privacy introduces random perturbations by adding noise to the original data, thus obfuscating its characteristics. This prevents data leakage and re-identification attacks, thereby ensuring the privacy and security of user data. In recent years, the application of differential privacy in the fields of artificial intelligence and big data has become increasingly widespread.

[0004] However, existing privacy-preserving record linking methods based on differential privacy cannot provide end-to-end privacy protection between different databases, and also suffer from low recall. Summary of the Invention

[0005] In view of this, embodiments of this application provide privacy-protected record linking methods, apparatuses, electronic devices, and storage media to eliminate or improve one or more defects existing in the prior art.

[0006] One aspect of this application provides a privacy-preserving record linking method, comprising:

[0007] Based on a preset output constraint differential privacy rule, noise is added to each block corresponding to each database storing different data records, so that the data record with added noise is regarded as a noisy data record. The output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and perform a rounding operation on each Laplace noise. Then, when it is confirmed that there is a positive value of the rounded Laplace noise, the positive value is used as the number of noises to be added to the corresponding block and the corresponding data record in the block is added with noise according to the number of noises. When it is confirmed that there is a negative value of the rounded Laplace noise, zero noise is added to the block corresponding to the negative value.

[0008] Based on a sliding window, similarity matching is performed on each of the noise data records from different databases, and the noise data records that successfully match the similarity are linked to obtain corresponding privacy-protected record pairs.

[0009] In some embodiments of this application, the step of adding noise to each block corresponding to each database storing different data records based on a preset output constraint differential privacy rule, so as to treat the data record with added noise as a noisy data record, includes:

[0010] Obtain preset Laplace noise parameters, wherein the Laplace noise parameters include: the scale parameter of the Laplace distribution and the privacy budget;

[0011] Based on the data characteristics of each block corresponding to each database obtained in advance, the scale parameter of the Laplace distribution and the privacy budget, the Laplace noise corresponding to each block is calculated.

[0012] Perform a rounding operation on each of the Laplace noise values;

[0013] If the rounded Laplace noise has a positive value, then the positive value is used as the noise quantity to add noise to the data record in the corresponding block, and a noise attribute label is set for the noise, so as to convert the data record in the block with added Laplace noise into a noise data record.

[0014] If the rounded Laplace noise has a negative value, then zero noise is added to the block corresponding to that negative value.

[0015] In some embodiments of this application, linking the noisy data records of the two corresponding blocks from different databases, which are currently being matched, based on a sliding window to obtain corresponding privacy-preserving record pairs includes:

[0016] Based on a preset sliding window, string segmentation and Dessian similarity coefficient calculation are performed on each of the noise data records from different databases. The noise data records that successfully match the similarity are linked to obtain corresponding privacy-protected record pairs.

[0017] In some embodiments of this application, the step of performing string segmentation and Dessian similarity coefficient calculation on each of the noise data records from different databases based on a preset sliding window, and linking the noise data records with successfully matched similarity to obtain corresponding privacy-protected record pairs, includes:

[0018] The blocks in different databases are feature matched to obtain block pairs, wherein each block pair contains two blocks from different databases.

[0019] For each of the block pairs, two noise data records from different blocks are extracted sequentially from each block pair, so that the noise data records are used as target record pairs respectively.

[0020] Each of the target record pairs performs string segmentation and Dyess similarity coefficient calculation on the two noisy data records to obtain the corresponding similarity results. Based on the similarity results, the two noisy data records in the target record pair that have successfully matched the similarity are linked to obtain the corresponding privacy-protected record pair.

[0021] In some embodiments of this application, the step of performing string segmentation and Dessian similarity coefficient calculation on the two noisy data records in each target record pair to obtain corresponding similarity results, and linking the two noisy data records in the target record pair that have successfully matched similarity based on the similarity results to obtain corresponding privacy-protected record pairs, includes:

[0022] Based on a preset character length threshold, the two noisy data records in the target record pair are respectively divided into strings with a length equal to the character length threshold;

[0023] Each string is converted into a feature vector based on a hash function, and each feature vector corresponding to each noise data record is stored in a binary Bloom filter that corresponds one-to-one with the noise data record.

[0024] The similarity coefficients of the Bloom filters corresponding to the two noise data records in the target record pair are calculated to obtain the similarity results between the two noise data records in the target record pair.

[0025] Determine whether the similarity result is equal to or greater than the similarity threshold. If so, link the two noisy data records in the target record pair corresponding to the similarity result to obtain the corresponding privacy-protected record pair.

[0026] In some embodiments of this application, before adding noise to each block corresponding to each data record in each database storing different data records based on a preset output constraint differential privacy rule, the method further includes:

[0027] Based on various preset data features, each database storing different data records is divided into blocks to obtain each block corresponding to each database. Each block corresponding to the same database corresponds one-to-one with each of the various data features.

[0028] An index is set for each block according to the data characteristics corresponding to each block.

[0029] In some embodiments of this application, the step of performing feature matching on the blocks in different databases to obtain block pairs includes:

[0030] Based on the index corresponding to each block in different databases, feature matching is performed on two blocks with the same index that come from different databases to form corresponding block pairs.

[0031] Another aspect of this application provides a privacy-preserving record linking device, comprising:

[0032] The noise addition module is used to add noise to each block corresponding to each database storing different data records based on a preset output constraint differential privacy rule, so that the data record with added noise is regarded as a noisy data record; wherein, the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and perform a rounding operation on each Laplace noise, and then, when it is confirmed that there is a positive value of the rounded Laplace noise, the positive value is used as the number of noises to be added to the corresponding block and the corresponding data record in the block is added with noise according to the number of noises, and when it is confirmed that there is a negative value of the rounded Laplace noise, zero noise is added to the block corresponding to the negative value;

[0033] The record linking module is used to perform similarity matching on various noise data records from different databases based on a sliding window, and link the noise data records that successfully match the similarity to obtain corresponding privacy-protected record pairs.

[0034] A third aspect of this application provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the privacy-preserving record linking method.

[0035] A fourth aspect of this application provides a computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the privacy-preserving record linking method described above.

[0036] A fifth aspect of this application provides a computer program product including a computer program that, when executed by a processor, implements the privacy-preserving record linking method described above.

[0037] The privacy-preserving record linking method provided in this application adds noise to each block of data records in each database storing different data records based on output-constrained differential privacy rules, treating the data records with added noise as noise data records. The output-constrained differential privacy rules are used to select whether to add noise to the data records in the block or add zero noise to the block based on the rounding result of the Laplace noise. Based on a sliding window, similarity matching is performed on each noisy data record from different databases, and the noisy data records with successful similarity matching are linked to obtain corresponding privacy-preserving record pairs. This method can improve the effectiveness and reliability of record linking while ensuring end-to-end privacy protection and efficient record linking, and can also improve the reliability of privacy protection in the end-to-end record linking process. Furthermore, it can achieve a balance between recall and efficiency in the record linking process, thereby optimizing the overall matching of record links.

[0038] Additional advantages, objectives, and features of this application will be set forth in part in the description which follows, and will in part become apparent to those skilled in the art upon review of the following description, or may be learned by practice of the application. The objectives and other advantages of this application can be realized and obtained by means of the structures specifically pointed out in the specification and drawings.

[0039] Those skilled in the art will understand that the purposes and advantages that can be achieved with this application are not limited to those specifically described above, and that the above and other purposes that this application can achieve will be more clearly understood from the following detailed description. Attached Figure Description

[0040] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, do not constitute a limitation thereof. The components in the drawings are not drawn to scale but are merely for illustrating the principles of this application. For ease of illustration and description of certain parts of this application, corresponding portions in the drawings may be enlarged, i.e., may appear larger relative to other components in an exemplary device actually manufactured according to this application. In the drawings:

[0041] Figure 1 This is a schematic diagram illustrating matching optimization based on a sliding window, as exemplified in this application.

[0042] Figure 2 This is a schematic diagram of the first process of the privacy protection record linking method in one embodiment of this application.

[0043] Figure 3 This is a schematic diagram of a second process of the privacy-protected record linking method in one embodiment of this application.

[0044] Figure 4 This is a schematic diagram illustrating the calculation of q-tuple matching for Dessian coefficient similarity in an example of this application.

[0045] Figure 5 This is a schematic diagram of the third process of the privacy-protected record linking method in one embodiment of this application.

[0046] Figure 6 This is a schematic diagram of the fourth process of the privacy-protected record linking method in one embodiment of this application.

[0047] Figure 7 This is a schematic diagram of the overall framework of the method for providing privacy-protected record links to a sliding window in an application example of this application.

[0048] Figure 8 This is a schematic diagram showing the experimental comparison of the first set of experimental results in an application example of this application.

[0049] Figure 9 This is a schematic diagram showing the experimental comparison of the second set of experimental results in an application example of this application.

[0050] Figure 10 This is a schematic diagram showing the experimental comparison of the third set of experimental results in an application example of this application.

[0051] Figure 11 This is a schematic diagram of the privacy protection record linking device in one embodiment of this application. Detailed Implementation

[0052] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the embodiments and accompanying drawings. Here, the illustrative embodiments and their descriptions are used to explain this application, but are not intended to limit it.

[0053] It should also be noted that, in order to avoid obscuring this application with unnecessary details, only the structures and / or processing steps closely related to the solution according to this application are shown in the accompanying drawings, while other details that are not closely related to this application are omitted.

[0054] It should be emphasized that the term "including / comprises" as used herein refers to the presence of a feature, element, step, or component, but does not exclude the presence or addition of one or more other features, elements, steps, or components.

[0055] It should also be noted that, unless otherwise specified, the term "connection" in this article can refer not only to a direct connection, but also to an indirect connection involving an intermediary.

[0056] In the following description, embodiments of the present application will be illustrated with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar parts, or the same or similar steps.

[0057] In record linking, a "data record" refers to a description of a data item or entity across different datasets. It can be a row in a database, table, file, or other data storage structure, containing a set of related fields or attributes. Each data record typically contains multiple features or attributes associated with that entity. For example, in a census dataset, each data record might represent a person, containing attributes such as name, address, age, and gender. In the medical field, each data record can represent a patient, containing information such as name, date of birth, height, weight, and symptoms. The goal of record linking tasks is to match or link records with similar or identical attributes across different datasets to identify that they are actually the same entity. This can be achieved by comparing attribute values ​​between data records, such as using fields like name, address, and ID number. Record linking is crucial for tasks such as data cleaning, data integration, and data analysis because it integrates relevant information scattered across multiple datasets, providing a more comprehensive and consistent view of the data.

[0058] However, in real-world scenarios, data records often contain a large amount of sensitive information, such as users' friend relationships and personal preferences in social networks, patients' disease and health information in hospital networks, and users' financial and liability information in banking networks. Recent research shows that data records in databases are vulnerable to various types of privacy attacks during the record linking process, including high-precision identification attacks and sensitive attribute inference attacks. Even many existing privacy-preserving record linking methods often have significant vulnerabilities and shortcomings, such as the inability to provide end-to-end privacy protection and the exposure of sensitive attributes of the recorded data. These problems often lead to serious data privacy leaks during the linking process. Therefore, researching privacy protection issues in record linking is crucial for the future development of data science.

[0059] With the rapid development of internet technology and the resulting massive accumulation of data, the risk of data privacy breaches is constantly increasing. As people frequently use various internet services across different sectors, their personal identity information, preference information, behavioral information, and other sensitive information are being continuously collected, stored, and utilized. Recent large-scale data breaches have also raised strong concerns among individuals, businesses, and related organizations regarding data privacy and security.

[0060] Data privacy has become a hot research area, with various privacy protection technologies and methods emerging. Common data privacy protection methods include encryption, data anonymization, authorized access, data sharing, and differential privacy. Among these, differential privacy is currently the most advanced privacy protection method. Differential privacy methods introduce random perturbations by adding noise to the original data, thus obfuscating data characteristics. This prevents data leakage and re-identification attacks, thereby ensuring the privacy and security of user data. In recent years, the application of differential privacy in the fields of artificial intelligence and big data has become increasingly widespread.

[0061] Existing differential privacy (DP) or indistinguishable secure two-way computation (IND-S2PC) methods can achieve record linking. Record linking between databases using these methods can realistically display and output matching record pairs; simultaneously, no real information can be disclosed, and the existence or absence of any individual record is hidden. However, due to the fundamental incompatibility between DP and IND-S2PC methods, and the different privacy guarantees they provide, this application introduces a weaker privacy protection method that still satisfies end-to-end privacy requirements for privacy settings in both databases, thus achieving a balance between differential privacy (DP) and indistinguishable secure two-way computation (IND-S2PC).

[0062] For this method, let G = (V, E) represent a graph, where V is the set of all possible databases and E is the set of edges connecting adjacent databases. The privacy overhead between databases is transformed into a spatial distance metric for a more intuitive representation. The distance between any pair of databases is the shortest path distance in G. Intuitively, the larger the shortest path distance between databases, the better adversary A can distinguish between adjacent databases. and The greater the capability, the greater the privacy protection overhead required. The following is the definition of output-constrained differential privacy:

[0063] Output-constrained differential privacy, the computation function f of the two-party privacy-preserving record linking protocol Π: × →O is ( , , , f) The condition for output-constrained differential privacy is that for any ( ')∈N (f ( A satisfies the following formula:

[0064]

[0065] Similarly, for B and and Similarly, ε (epsilon) is a non-negative real number, called the upper bound of the privacy loss or the privacy budget. δ (delta) is a value between 0 and 1, giving a small probability that privacy guarantees may fail. The probability of failure to guarantee privacy for client A. The probability of failure to guarantee privacy for client B.

[0066] For output-constrained differential privacy, it can provide better flexibility and scalability. This method can simplify the process of setting individual privacy protection settings for each query through more general privacy protection settings, and can be further extended to large-scale datasets and complex queries.

[0067] Therefore, in an output-constrained differential privacy method that balances differential privacy (DP) and indistinguishable secure two-way computation (IND-S2PC), the record links implemented using this method can realistically display matching record pairs and output the matching record pairs, while at the same time, no real information can be disclosed.

[0068] Another technical solution is a sliding window-based optimized sorting and pruning spatial data indexing algorithm. This method can divide spatial data into different blocks or regions, and sort and prune each block or region to more quickly locate the nearest neighbor of the query point or the object that meets the query range.

[0069] By introducing a set of decreasing thresholds, blocks can be divided into different groups based on the noise levels of different blocks in the dataset. Furthermore, by introducing the concept of a sliding window and limiting the maximum range of the window's sliding, a trade-off between recall and efficiency can be struck to achieve an overall matching optimization method.

[0070] During the recording process, already categorized and noise-infused blocks can be sorted based on the noise level, resulting in higher similarity between adjacent blocks. A fixed-size sliding comparison window is introduced, limiting the comparison of record pairs between two databases to this window. This restricts the comparison range and improves efficiency. The window continues to slide forward only after all data in the block at the end of the window has been compared, repeating the process until the end. Figure 1 As shown, where , These represent two different databases, A and B.

[0071] The following are the formulas for the sliding window-based matching optimization method and the meanings of each parameter:

[0072]

[0073]

[0074] B(D A ) and B(D B ) represents the noise count, s represents the set at the beginning of the sliding window, and e represents the set at the end of the sliding window. This represents the matching strategy.

[0075] In other words, to address the problems of existing privacy-preserving record linking methods, such as the inability to provide end-to-end privacy protection and low recall rates, this application provides a privacy-preserving record linking method, a privacy-preserving record linking device for executing the method, a physical device, a computer-readable storage medium, and a computer program product. It introduces output-constrained differential privacy rules into the record linking process, enabling the display of truly matching record pairs while hiding the presence or absence of any non-matching records, thereby achieving end-to-end privacy protection. Simultaneously, it introduces the concept of a sliding window to reduce the problem of missing comparisons at noise threshold boundaries. By limiting the maximum sliding range of the window, a balance is struck between recall and efficiency to achieve overall matching optimization.

[0076] The following examples will provide a detailed description.

[0077] Based on this, embodiments of this application provide a privacy-protected record linking method that can be implemented by a privacy-protected record linking device, see [link to relevant documentation]. Figure 2 The privacy protection record linking method specifically includes the following:

[0078] Step 100: Based on a preset output constraint differential privacy rule, noise is added to each block corresponding to each database storing different data records, so that the data record with added noise is regarded as a noisy data record; wherein, the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and perform a rounding operation on each Laplace noise, and then, when it is confirmed that there is a positive value of the rounded Laplace noise, the positive value is used as the number of noises to be added to the corresponding block and noise is added to the corresponding data record in the block according to the number, and when it is confirmed that there is a negative value of the rounded Laplace noise, zero noise is added to the block corresponding to the negative value.

[0079] It is understandable that output-constrained differential privacy rules can also be called output-constrained differential privacy methods or models, and can all be implemented using existing output-constrained differential privacy techniques.

[0080] In one or more embodiments of this application, the data record may be simply referred to as a record, the privacy-preserving record link refers to a record linking process that enables record privacy protection, and an end-to-end record link refers to a record link between different databases (also known as datasets).

[0081] In one or more embodiments of this application, each block stores multiple data records. In order to further improve the efficiency and reliability of the privacy protection record linking process, the data characteristics of each data record stored in each block are the same, which will be described in detail in subsequent embodiments.

[0082] It is understood that the noise added to the data record can be fake data. The fake data refers to other data that is different from the data content in the data record. Each fake data has a noise attribute label. The noise attribute label is an attribute used to mark the fake data to distinguish it from the real data content in the data record, so that the fake data does not match the real data.

[0083] Step 200: Based on a sliding window, perform similarity matching on each of the noise data records from different databases, and link the noise data records that successfully match the similarity to obtain corresponding privacy-protected record pairs.

[0084] In step 200, the concept of a sliding window is introduced to optimize the matching of record pairs between databases. This enables better link performance and recall while ensuring end-to-end privacy protection and efficient record linking.

[0085] As described above, the privacy-preserving record linking method provided in this application optimizes the matching of record pairs between two mutually untrusted databases by using an output-constrained differential privacy model and incorporating the concept of a sliding window. This method achieves better linking performance and recall while ensuring end-to-end privacy protection and efficient record linking. Through this method, it achieves both robust privacy protection through shared differential privacy and the output of real data that meets the matching rules, while also protecting the privacy of mismatched data.

[0086] To further achieve differential privacy protection for block output constraints and prevent fake data noise from matching real data, a more general privacy protection setting simplifies the process of setting individual privacy protection settings for each query. This can be further extended to large-scale datasets and complex queries. In a privacy-protected record linking method provided in this application embodiment, see [link to relevant documentation]. Figure 3 Step 100 in the privacy protection record linking method specifically includes the following:

[0087] Step 110: Obtain preset Laplace noise parameters, wherein the Laplace noise parameters include: the scale parameter of the Laplace distribution and the privacy budget.

[0088] Step 120: Calculate the Laplace noise corresponding to each block based on the data characteristics of each block in each database obtained in advance, the scale parameter of the Laplace distribution and the privacy budget.

[0089] Step 130: Perform a rounding operation on each of the Laplace noises.

[0090] Step 140: If the rounded Laplace noise has a positive value, then add noise to the data record in the corresponding block using the positive value as the noise quantity, and set a noise attribute label for the noise, so as to convert the data record in the block with added Laplace noise into a noise data record.

[0091] And, step 150: if there is a negative value in the rounded Laplace noise, then zero noise is added to the block corresponding to the negative value.

[0092] Specifically, adding noise is a crucial step in privacy protection. This process involves adding noise that satisfies differential privacy output constraints to already segmented blocks, enabling the dataset to resist privacy attacks and thus achieving privacy protection. This application employs the Laplace noise mechanism commonly used in differential privacy to introduce randomness into the query results, hiding the specific values ​​of individual data and preventing attackers from accurately inferring individual data, thereby protecting the privacy of individual data.

[0093] For differential privacy: Suppose there is a random algorithm M, S is the set of all possible outputs of M, and Pr[ ] represents the probability. For any two adjacent datasets D and D', the difference between the two datasets is that there is only one different record. If the probability distributions of the two adjacent sets satisfy the following constraints:

[0094]

[0095] Then it is said that algorithm M provides - Differential privacy protection.

[0096] The Laplace noise Y used in this application: The parameter Δf represents the sensitivity. This represents the privacy budget. The noise is calculated to satisfy differential privacy as follows:

[0097]

[0098]

[0099]

[0100]

[0101]

[0102] The above analysis shows that the Gaussian noise introduced in this application can ensure that the algorithm satisfies differential privacy protection for each user. Due to the inherent characteristics of differential privacy noise, differential privacy is not sensitive to the existence of any data, that is, it cannot show any matching data pair. This application adopts a new method of introducing noise: adding a Laplace-distributed dummy data noise to each data block. When the introduced noise is negative, output constraints are applied, so that this design provides corresponding output constraints for differential privacy protection of the original data.

[0103] Based on this, an example of steps 110 to 150 is as follows:

[0104] (1) Determine the parameters of the Laplace noise, including the scale parameter ΔB of the Laplace distribution and the privacy budget. The scale parameter ΔB controls the degree of noise propagation, while the privacy parameter... To control the level of privacy protection, this application sets ΔB as the ratio of sensitivity Δf to the privacy budget. The ratio of .

[0105] (2) Determine the range of noise based on the characteristics of the dataset (i.e., the block) to which noise is to be added. This application adds noise by adding fake data to the block. The specific method of adding noise is as follows: based on the data characteristics, sensitivity, and privacy budget, a Laplace noise is calculated for each block. The generated noise is rounded down, and the integer is used as the number of noises added to that block. When the noise is negative, it is not possible to add a negative number of noise data to the dataset. In this case, this application applies an output constraint to the noise added to the dataset. When the noise is negative, no noise is added to the block, i.e., zero noise is added. Therefore, the range of noise is a non-negative integer that satisfies the Laplace distribution. This method completes the differential privacy protection of the block's output constraint.

[0106] (3) Generating and adding noise records: For the attributes of each noise record to be added (i.e., noise data record), the noise record finally generated by this application can both satisfy the attribute feature interval in its block and exist as fake data without matching any real data. By randomly generating and analyzing the attribute features of the interval, fake data that conforms to the attribute feature interval of the block is generated, and unique flag attributes are added to the fake data so that the fake data does not match the real data.

[0107] To further improve the effectiveness and reliability of the link, a privacy-protected record linking method is provided in this application embodiment, see [link to relevant documentation]. Figure 3Step 200 in the privacy protection record linking method specifically includes the following:

[0108] Step 210: Based on a preset sliding window, perform string segmentation and Dessian similarity coefficient calculation on each of the noise data records from different databases, and link the noise data records that successfully match the similarity to obtain the corresponding privacy-protected record pairs.

[0109] Specifically, the record linking process is an important part of this application, and the record linking process in this application adopts a similarity based on the Dice coefficient. The method of matching q-tuples (i.e. string partitioning).

[0110] The q-tuple, based on a character-level n-tuple model, segments text into consecutive n-character substrings and uses these substrings as features for processing and comparison. In this application, it is used to compare the similarity of text, strings, or set data to calculate the degree of similarity between two sets. For two sets A and B, the Dess coefficient is defined as the ratio between the size of their intersection and the size of their union, and its calculation formula is as follows.

[0111]

[0112] in, Indicate the size of set A. Indicate the size of set B. This represents the size of the intersection of A and B, with a specific example as follows: Figure 4 As shown, where , These are two different Bloom filters. , Represents the number of bit 1s in the two Bloom filters (i.e. Figure 4 In the phrase "number of 1-bits", c represents the number of 1 bits at the same position in the two Bloom filters (i.e., Figure 4 The phrase "number of common 1-bits (bold)" is mentioned. This represents the similarity between two Bloom filters, which in this case is the Dessian similarity coefficient between the two words.

[0113] To further limit the scope of comparison, reduce the number of comparisons, and avoid traversing and comparing the entire dataset, thereby reducing the overall time complexity, a privacy-preserving record linking method is provided in this application embodiment, see [link to relevant documentation]. Figure 5 Step 210 in the privacy protection record linking method specifically includes the following:

[0114] Step 211: Perform feature matching on the blocks in different databases to obtain block pairs, wherein each block pair contains two blocks from different databases.

[0115] Step 212: For each block pair, extract the two noise data records from different blocks in each block pair in sequence, so as to use the noise data records as target record pairs respectively.

[0116] Step 213: Perform string segmentation and Dessian similarity coefficient calculation on the two noisy data records in each target record pair to obtain the corresponding similarity results, and link the two noisy data records in the target record pair that have successfully matched the similarity based on the similarity results to obtain the corresponding privacy-protected record pair.

[0117] To further efficiently link two similar record pairs with high quality and ensure end-to-end differential privacy between users during the linking process, a privacy-preserving record linking method is provided in this application embodiment, see [link to relevant documentation]. Figure 6 Step 213 in the privacy protection record linking method specifically includes the following:

[0118] Step 2131: According to the preset character length threshold, divide the two noise data records in the target record pair into strings with a length of the character length threshold.

[0119] Step 2132: Based on the hash function, each string is converted into a feature vector, and each feature vector corresponding to each noise data record is stored in a binary Bloom filter that corresponds one-to-one with the noise data record.

[0120] Step 2133: Calculate the Dyess similarity coefficient for the Bloom filter corresponding to each of the two noise data records in the target record pair to obtain the similarity result between the two noise data records in the target record pair.

[0121] Step 2134: Determine whether the similarity result is equal to or greater than the similarity threshold. If so, link the two noisy data records in the target record pair corresponding to the similarity result to obtain the corresponding privacy-protected record pair.

[0122] If not, the two noise data records in the target record pair will not be linked.

[0123] In one example of steps 2131 to 2134, the specific process is as follows:

[0124] (1) Tokenization: Each data record is tokenized and divided into character-level substrings of length q. For example, when q=3, the string record "John Smith" can be divided into ["Joh", "ohn", "hn", "nS", "Sm", "Smi", "mit", "ith"].

[0125] (2) Feature representation: For each data record, the pre-divided string of length q is converted into a feature vector by a hash function and stored in a binary Bloom Filter (BF). Each feature vector corresponds to a unique q-tuple substring.

[0126] (3) Dyess coefficient similarity calculation: The Dyess coefficient similarity is compared between the Bloom filters generated from the two data records, where |A| is the number of 1 bits in the first Bloom filter, and similarly, |B| is the number of 1 bits in the second Bloom filter. This represents the number of times the same bit position is 1 in both Bloom filters.

[0127] (4) Similarity Threshold Setting: Set a similarity threshold according to application requirements. If the similarity between two records exceeds this threshold, they can be considered as the same entity. For example, if the similarity threshold is set to 0.8, then... Figure 4 The two strings b1 and b2 in the text are similar.

[0128] To group potentially matching similar records into the same block before linking them—that is, to group records in the dataset according to certain features—and thus reduce the computational complexity of entity comparison after grouping, thereby improving the efficiency of linking or matching, a privacy-preserving record linking method is provided in this application embodiment. (See [link to relevant documentation]). Figure 3 The privacy protection record linking method, prior to step 100, specifically includes the following:

[0129] Step 010: Based on preset data features, divide each database storing different data records into blocks to obtain each block corresponding to each database. Each block corresponding to the same database corresponds one-to-one with each of the data features.

[0130] Step 020: Set an index for each block according to the data characteristics corresponding to each block.

[0131] Correspondingly, to significantly reduce the computational load of entity comparison and thus improve the efficiency of record linking or entity matching, since comparisons only need to be performed within the same block pair, unnecessary comparison operations can be effectively reduced, improving the overall processing speed and efficiency. Simultaneously, block partitioning operations also help reduce the probability of incorrect matches and links, which can improve the accuracy of record links to a certain extent. See [link to relevant documentation]. Figure 6 In the privacy-protected record linking method provided in this application embodiment, step 211 specifically includes the following:

[0132] Step 2111: Based on the index corresponding to each block in different databases, perform feature matching on two blocks with the same index that come from different databases to form corresponding block pairs.

[0133] Specifically, data segmentation is a preprocessing step in the record linking process. Its main purpose is to group potentially matching similar records into the same block before linking them. This involves grouping records in the dataset according to certain features, reducing the computational complexity of entity comparisons and thus improving the efficiency of linking or matching.

[0134] The specific operation process for one example of steps 010 and 020 is as follows:

[0135] (1) Data splitting and grouping: First, the records in the database are split and grouped according to the preset data features. The data features can be name, address, ID number and age, etc. The specific features selected depend on the application scenario and the characteristics of the dataset itself. Records in the same group have similar data features and have a high probability of belonging to the same entity.

[0136] (2) Grouped Index: For each group, an index structure can be created to support fast querying. Based on the Laplace noise situation added in the next section, this application implements a grouped index for the records after the data grouping process has been completed, according to the noise threshold grouping from large to small.

[0137] (3) Linking or matching: For record pairs to be linked or matched in other databases, group them using the same features and determine potentially identical groups using the corresponding index structure. Then, only record pairs appearing in the same group are compared. In this way, the scope of comparison is limited, the number of comparisons is reduced, and the traversal and comparison of the entire dataset is avoided, thereby reducing the overall time complexity.

[0138] To further illustrate the above embodiments, this application also provides a specific application example of a privacy-preserving record linking method based on a sliding window, see [link to relevant documentation]. Figure 7Here, DB represents different databases, B1 to B3 represent different blocks after the database is divided, and m(a,b) represents similar records matched by the sliding window record linking method. The design consists of two main parts: the output constraint differential privacy framework and the record linking process. The output constraint differential privacy framework is further divided into data segmentation and noise addition. The specific details of these three parts are as follows:

[0139] S1: Data Blocking (also known as Block Segmentation): Based on the data characteristics of the records themselves, a large amount of data in the original database is divided into blocks corresponding to its characteristics;

[0140] In the recording linking process, a sliding window method based on noise thresholds was employed. Similar records that might match were classified into the same block, and a decimal threshold was used to classify the added noise.

[0141] S2: Add noise: Add Laplace-distributed differential privacy noise to each block to achieve end-to-end privacy protection;

[0142] This involves introducing output-constrained differential privacy protection by introducing dummy data to add noise. The noise distribution follows a Gaussian distribution, and when the introduced noise value is greater than zero, the noise is rounded down to determine the amount of noise data introduced into the block. The distribution and addition of noise are as follows: = max( ,0), ∼=Lap(ε,δ,∆B).

[0143] The amount of noise added to each block; ε is Gaussian distributed noise; ε (epsilon) is a non-negative real number called the upper bound of the privacy loss or privacy budget; δ (delta) is a value between 0 and 1, giving a small probability that the privacy guarantee may fail; ∆B represents the query sensitivity, which quantifies the maximum impact that a change to a single record may have on the query results.

[0144] The resulting noise records can satisfy the attribute feature range of their respective blocks, and can also exist as fake data without matching any real data.

[0145] Analyzing the attribute characteristics of block intervals, the data features are distributed using a Gaussian distribution that satisfies... , As the data distribution benchmark for block i, generate fake data that conforms to the attribute feature range of the i-th block, and add unique flag attributes to the fake data so that the fake data does not match the real data. After generation, put the generated fake data records into the i-th block to complete the addition of noise records.

[0146] S3: Record Linking: A record linking method based on q-tuple matching using the Dess coefficient similarity is adopted, and a linking process with higher recall is achieved based on a sliding window.

[0147] In the recording linking process, a sliding window is used to match record pairs, and the linking process is completed by limiting the window size. The expression for the sliding window is:

[0148]

[0149]

[0150] B(D A ) and B(D B ) represents the noise count, s represents the set at the beginning of the sliding window, and e represents the set at the end of the sliding window. This represents the matching strategy.

[0151] The sliding window can be moved in descending order of the introduced noise levels. The greater the introduced noise, the more possible matching record pairs there are; the smaller the introduced noise, the fewer possible matching record pairs there are. When the recall rate of the selected record pairs reaches a certain value, the movement of the sliding window is stopped to improve the overall recall rate of the record linking process.

[0152] Specifically, S3 introduces a fixed-size comparison sliding window and restricts the comparison of record pairs between two databases to this window. This eliminates the missing comparison problem at the threshold boundary of S&P (Classification and Pruning) by limiting the maximum range of the window's sliding. , This involves balancing recall and efficiency. Furthermore, based on the Dessian similarity coefficient, q-tuple matching of record links is performed. For record pairs from two different databases, the text of the records is split into q consecutive substrings, which are used as features. These q-character substrings are then converted into feature vectors using a hash function and stored in a binary Bloom filter. Each feature vector corresponds to a unique q-tuple substring. After completely processing the record pair in the Bloom filter, the final Dessian similarity coefficient of the record pair is calculated as follows: |A| represents the number of 1s in the first Bloom filter, and similarly, |B| represents the number of 1s in the second Bloom filter. This represents the number of times the same position is equal to 1 in both Bloom filters.

[0153] In one specific example of S1 above, data segmentation is a preprocessing step in the record linking process. Its main purpose is to group potentially matching similar records into the same block before linking them. This involves grouping records in the dataset according to certain features, reducing the computational time complexity of entity comparison after grouping, thereby improving the efficiency of linking or matching.

[0154] The specific operation procedure is as follows:

[0155] (1) Data splitting and grouping: First, the records in the dataset are split and grouped according to preset features. These features can be name, address, ID number, age, etc. The specific features selected depend on the application scenario and the characteristics of the dataset itself. Records in the same group have similar features and have a high probability of belonging to the same entity.

[0156] (2) Grouped Index: For each group, an index structure can be created to support fast querying. In this application example, based on the Laplace noise situation added in the next section, the index structure is grouped according to the noise threshold grouping of the records after the data grouping process has been completed to implement grouped index.

[0157] (3) Linking or matching: For record pairs to be linked or matched in other databases, the same features are used to group them, and the corresponding index structure is used to determine the potentially identical groups. Then, entity comparison is performed only on record pairs that appear in the same group. In this way, the scope of comparison is limited, the number of comparisons is reduced, and the traversal and comparison of the entire dataset is avoided, thereby reducing the overall time complexity.

[0158] Block partitioning significantly reduces the computational load of entity comparisons, thereby improving the efficiency of record linking or entity matching. Since comparisons are only performed within the same group, unnecessary comparison operations are effectively reduced, improving overall processing speed and efficiency. Simultaneously, block partitioning also helps reduce the probability of incorrect matches and links, improving accuracy to some extent.

[0159] In one specific example of S2 above, adding noise is a crucial step in privacy protection. This process involves adding noise that satisfies differential privacy output constraints to already segmented blocks, enabling the dataset to resist privacy attacks and thus achieving privacy protection. This application example employs the Laplace noise mechanism commonly used in differential privacy to introduce randomness into the query results, hiding the specific values ​​of individual data and preventing attackers from accurately inferring individual data, thereby protecting individual data privacy. The specific operation flow is as follows:

[0160] (1) Determine the parameters of the Laplace noise, including the scale parameter ΔB of the Laplace distribution and the privacy budget. The scale parameter ΔB controls the degree of noise propagation, while the privacy parameter... To control the privacy protection level, this application example sets ΔB to the sensitivity Δf and the privacy budget. The ratio of .

[0161] (2) Determine the range of noise based on the characteristics of the dataset to which noise is to be added. In this application example, noise is added by adding fake data to blocks. The specific method of adding noise is as follows: based on data characteristics, sensitivity, and privacy budget, a Laplace noise is calculated for each block. The generated noise is rounded down, and the integer is used as the number of noises added to that block. When the noise is negative, it is not possible to add a negative number of noise data to the dataset. In this case, this application example applies an output constraint to the noise added to the dataset. When the noise is negative, no noise is added to the block, i.e., zero noise is added. Therefore, the range of noise is a non-negative integer that satisfies the Laplace distribution. This method completes the differential privacy protection of the block output constraint.

[0162] (3) Generating and adding noise records: For the attributes of each noise record to be added, the noise record ultimately generated in this application example can both satisfy the attribute feature interval in its block and exist as fake data without matching any real data. By randomly generating and analyzing the attribute features of the interval, fake data that conforms to the attribute feature interval of the block is generated, and unique flag attributes are added to the fake data so that the fake data does not match the real data.

[0163] In one specific example of S3 above, the recording linking process is an important part of this application instance. The recording linking process in this application instance uses Dice coefficient similarity. The method for matching q-tuples to link records.

[0164] The specific process of the q-tuple matching record linking method based on Dessian coefficient similarity in this application example is as follows:

[0165] (1) Tokenization: Each record is tokenized into character-level substrings of length q. For example, when q=3, the string record "John Smith" can be segmented into ["Joh", "ohn", "hn", "nS", "Sm", "Smi", "mit", "ith"].

[0166] (2) Feature representation: For each record, the pre-divided string of length q is converted into a feature vector by a hash function and stored in a binary Bloom Filter (BF), where each feature vector corresponds to a unique q-tuple substring.

[0167] (3) Calculation of Dyess coefficient similarity: The Dyess coefficient similarity is compared between the Bloom filters generated from the two records, where |A| is the number of 1 bits in the first Bloom filter, and similarly, |B| is the number of 1 bits in the second Bloom filter. This represents the number of times the same bit position is 1 in both Bloom filters.

[0168] (4) Threshold setting: Set a similarity threshold according to application requirements. If the similarity between two records exceeds the threshold, they can be considered as the same entity. For example, if the threshold is set to 0.8, then... Figure 4 The two strings in the text are similar.

[0169] The above describes the specific implementation of privacy-protected record linking in this application example. Through this method, this application example can efficiently link two similar record pairs with high quality, ensuring end-to-end differential privacy between users during the linking process.

[0170] Furthermore, during the record linking process, the widely used synthetic dataset Abt and Buy product dataset (AB) and the real dataset Australian Bureau of Statistics (ABS) were used for experimental verification. The number of secure comparisons and link quality were used as the recording objectives of this application.

[0171] For link quality, this application example uses widely used metrics such as precision and recall, along with a trade-off between the two, fscore, to compare all methods. The calculation methods for precision, recall, and fscore are as follows:

[0172] O Π As a result of the matching output, O ΠIt can only be incorrect in two cases—partially matching pairs (a, b) ∈ In O Π F does not exist in ( N ), and some non-matching pairs (a, b). Appeared in O Π China (F) P Therefore, this paper uses recall and precision as metrics to quantify the accuracy of protocol Π, and their calculations are as follows:

[0173] Recall rate:

[0174]

[0175] Accuracy:

[0176]

[0177] The fscore, a metric for weighing these two factors, is calculated as follows:

[0178]

[0179] Regarding link efficiency, the overhead of calculating the matching process in this application involves communication and computation costs. This application assumes that the length of each record in the database is O(1); that is, it does not change with n = max(| |,| The cost of communication and computation is bounded by the output size, Ω(M), where M = | This application example calculates the number of link matches performed during the linking process and uses this as the communication overhead during the matching process; it also measures the time required to complete each match and uses this as the computational cost of a single match.

[0180] The specific characteristics of the data in the two datasets after preliminary processing are shown in Table 1.

[0181] Table 1 Dataset Characteristics

[0182]

[0183] The performance of the method in this application will be illustrated below by analyzing experimental data.

[0184] The first set of comparative experiments compares the time overhead of the sliding window-based matching optimization method and the APC method. The experiments calculate the time overhead of the sliding window-based matching optimization method and the APC method at different data volumes and observe how the time overhead curves change as the data volume increases.

[0185] The results of the first group of experiments are as follows: Figure 8As shown, the slope of the curve for the APC method is approximately twice that of the sliding window-based matching optimization method as the amount of data increases. Furthermore, the communication and computational overhead, i.e., the time complexity, for the APC method is O(…). Therefore, the experimental results verify that the time complexity of the sliding window-based matching optimization method proposed in the application is O(n). k < 2, which is the cost of the quadratic function, which is consistent with the time complexity of O(n*logn) in the theoretical reasoning stage.

[0186] The second set of experiments shows the accuracy variation curves of the sliding window-based matching optimization method under different sliding window sizes. This application demonstrates the impact of the sliding window size on the recall rate through the experiments in this section.

[0187] The results of the second group of experiments are as follows: Figure 9 As shown, as the window size increases, recall and accuracy also increase. When the window size is small, accuracy increases rapidly, but as the window size increases, the growth rate gradually slows down and eventually converges.

[0188] The sliding window-based matching optimization method strikes a balance between accuracy and efficiency by introducing the sliding window concept. It achieves improved accuracy at the expense of some efficiency, making it approximately equivalent to the APC method, maximizing time complexity while achieving convergence in recall. In our experiments, we selected the window size at 90% of the recall convergence value to ensure high accuracy with minimal additional time overhead.

[0189] The third set of experiments compares the recall rates of sliding window-based matching optimization methods with classification and pruning methods. Figure 10 As shown, this application obtained experimental results on the recall of two methods through multiple experiments. Through this set of experiments, the method outperformed the original method by 7% in terms of recall, verifying the superiority of the sliding window-based matching optimization method in terms of recall.

[0190] As can be seen from the above tests, the sliding window-based matching optimization record linking method provided in this application example can provide high link quality and link efficiency while ensuring end-to-end privacy protection.

[0191] From a software perspective, this application also provides a privacy-preserving record linking apparatus for performing all or part of the privacy-preserving record linking method, see [link to relevant documentation]. Figure 11 The privacy protection record linking device specifically includes the following:

[0192] The noise addition module 10 is used to add noise to each block corresponding to each database storing different data records based on a preset output constraint differential privacy rule, so that the data record with added noise is regarded as a noisy data record; wherein, the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and perform a rounding operation on each Laplace noise, and then, when it is confirmed that there is a positive value of the rounded Laplace noise, the positive value is used as the number of noises to be added to the corresponding block and the corresponding data record in the block is added with noise according to the number, and when it is confirmed that there is a negative value of the rounded Laplace noise, zero noise is added to the block corresponding to the negative value;

[0193] The record linking module 20 is used to perform similarity matching on each of the noise data records from different databases based on a sliding window, and link the noise data records that have successfully matched the similarity to obtain corresponding privacy-protected record pairs.

[0194] The embodiments of the privacy-protected record linking device provided in this application can be used to execute the processing flow of the privacy-protected record linking method embodiments described above. Its functions will not be repeated here, but can be referred to the detailed description of the privacy-protected record linking method embodiments described above.

[0195] The privacy-protected record linking device can perform the privacy-protected record linking function either on a server or on a client device. The choice depends on the processing power of the client device and limitations of the user's usage scenario. This application does not impose any limitations in this regard. If all operations are performed on the client device, the client device may further include a processor for the specific processing of the privacy-protected record linking.

[0196] The aforementioned client device may have a communication module (i.e., a communication unit) that can communicate with a remote server to achieve data transmission with the server. The server may include a server on the task scheduling center side; in other implementation scenarios, it may also include a server on an intermediate platform, such as a server on a third-party server platform that has a communication link with the task scheduling center server. The server may include a single computer device, a server cluster consisting of multiple servers, or a distributed server structure.

[0197] The server and the client device can communicate using any suitable network protocol, including those not yet developed as of the date of this application. Such network protocols may include, for example, TCP / IP, UDP / IP, HTTP, HTTPS, etc. Furthermore, such network protocols may also include RPC (Remote Procedure Call Protocol) and REST (Representational State Transfer Protocol) protocols used on top of the aforementioned protocols.

[0198] As can be seen from the above description, the privacy-protected recording link device provided in this application embodiment can improve the effectiveness and reliability of the recording link while ensuring end-to-end privacy protection and efficient recording link, and can improve the reliability of privacy protection in the end-to-end recording link process, and can achieve a balance between recall rate and efficiency in the recording link process, so as to achieve overall matching optimization of the recording link.

[0199] This application also provides an electronic device, which may include a processor, a memory, a receiver, and a transmitter. The processor is used to execute the privacy-protected record linking method mentioned in the above embodiments. The processor and the memory can be connected via a bus or other means, taking a bus connection as an example. The receiver can be connected to the processor and the memory via wired or wireless means.

[0200] The processor can be a central processing unit (CPU). The processor can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, or combinations of the above types of chips.

[0201] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs, non-transitory computer-executable programs, and modules, such as the program instructions / modules corresponding to the privacy-preserving record linking method in the embodiments of this application. The processor executes various functional applications and data processing by running the non-transitory software programs, instructions, and modules stored in the memory, thereby implementing the privacy-preserving record linking method in the above method embodiments.

[0202] The memory may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created by the processor, etc. Furthermore, the memory may include high-speed random access memory and non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, the memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0203] The one or more modules are stored in the memory, and when executed by the processor, the privacy-protected record linking method in the embodiment is executed.

[0204] In some embodiments of this application, the user equipment may include a processor, a memory, and a transceiver unit. The transceiver unit may include a receiver and a transmitter. The processor, memory, receiver, and transmitter may be connected via a bus system. The memory is used to store computer instructions, and the processor is used to execute the computer instructions stored in the memory to control the transceiver unit to send and receive signals.

[0205] As one implementation method, the functions of the receiver and transmitter in this application can be implemented by transceiver circuits or dedicated transceiver chips, and the processor can be implemented by dedicated processing chips, processing circuits or general-purpose chips.

[0206] As another implementation approach, the server provided in this application embodiment can be implemented using a general-purpose computer. That is, the program code implementing the processor, receiver, and transmitter functions is stored in memory, and the general-purpose processor implements the processor, receiver, and transmitter functions by executing the code in memory.

[0207] This application also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the steps of the aforementioned privacy-preserving record linking method. The computer-readable storage medium can be a tangible storage medium, such as random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, floppy disks, hard disks, removable storage disks, CD-ROMs, or any other form of storage medium known in the art.

[0208] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the aforementioned privacy-protected record linking method.

[0209] Those skilled in the art will understand that the exemplary components, systems, and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. When implemented in hardware, it can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. The programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave.

[0210] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0211] In this application, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or in place of features of other embodiments.

[0212] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to the embodiments of this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for linking privacy-protected records, characterized in that, include: Based on a preset output constraint differential privacy rule, noise is added to each block corresponding to each database storing different data records, so that the data record with added noise is regarded as a noisy data record. The output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and perform a rounding operation on each Laplace noise. Then, when it is confirmed that there is a positive value of the rounded Laplace noise, the positive value is used as the number of noises to be added to the corresponding block and the corresponding data record in the block is added with noise according to the number of noises. When it is confirmed that there is a negative value of the rounded Laplace noise, zero noise is added to the block corresponding to the negative value. Based on a sliding window, similarity matching is performed on each of the noise data records from different databases, and the noise data records that successfully match the similarity are linked to obtain corresponding privacy-protected record pairs; The method of linking the noisy data records from the corresponding blocks of two different databases, which are currently being matched, using a sliding window to obtain corresponding privacy-preserving record pairs includes: Based on a preset sliding window, string segmentation and Dessian similarity coefficient calculation are performed on each of the noise data records from different databases. The noise data records that successfully match the similarity are linked to obtain the corresponding privacy-protected record pairs. The method, based on a preset sliding window, performs string segmentation and Dyess similarity coefficient calculation on each of the noise data records from different databases, and links the noise data records that successfully match in similarity to obtain corresponding privacy-protected record pairs, including: The blocks in different databases are feature matched to obtain block pairs, wherein each block pair contains two blocks from different databases. For each of the block pairs, two noise data records from different blocks are extracted sequentially from each block pair, so that the noise data records are used as target record pairs respectively. Each of the target record pairs performs string segmentation and Dyess similarity coefficient calculation on the two noisy data records to obtain the corresponding similarity results. Based on the similarity results, the two noisy data records in the target record pair that have successfully matched the similarity are linked to obtain the corresponding privacy-protected record pair. The step of performing string segmentation and Dessian similarity coefficient calculation on the two noisy data records in each target record pair to obtain the corresponding similarity results, and linking the two noisy data records in the target record pair that have successfully matched the similarity based on the similarity results to obtain the corresponding privacy-protected record pair, includes: Based on a preset character length threshold, the two noisy data records in the target record pair are respectively divided into strings with a length equal to the character length threshold; Each string is converted into a feature vector based on a hash function, and each feature vector corresponding to each noise data record is stored in a binary Bloom filter that corresponds one-to-one with the noise data record. The similarity coefficients of the Bloom filters corresponding to the two noise data records in the target record pair are calculated to obtain the similarity results between the two noise data records in the target record pair. Determine whether the similarity result is equal to or greater than the similarity threshold. If so, link the two noisy data records in the target record pair corresponding to the similarity result to obtain the corresponding privacy-protected record pair.

2. The privacy-protected record linking method according to claim 1, characterized in that, The pre-defined output constraint differential privacy rule adds noise to each block corresponding to each database storing different data records, so that the data record with added noise is regarded as a noisy data record, including: Obtain preset Laplace noise parameters, wherein the Laplace noise parameters include: the scale parameter of the Laplace distribution and the privacy budget; Based on the data characteristics of each block corresponding to each database obtained in advance, the scale parameter of the Laplace distribution and the privacy budget, the Laplace noise corresponding to each block is calculated. Perform a rounding operation on each of the Laplace noise values; If the rounded Laplace noise has a positive value, then the positive value is used as the noise quantity to add noise to the data record in the corresponding block, and a noise attribute label is set for the noise, so as to convert the data record in the block with added Laplace noise into a noise data record. If the rounded Laplace noise has a negative value, then zero noise is added to the block corresponding to that negative value.

3. The privacy-protected record linking method according to claim 1, characterized in that, Before adding noise to each block corresponding to each data record in each database storing different data records based on the preset output constraint differential privacy rule, the method further includes: Based on various preset data features, each database storing different data records is divided into blocks to obtain each block corresponding to each database. Each block corresponding to the same database corresponds one-to-one with each of the various data features. An index is set for each block according to the data characteristics corresponding to each block.

4. The privacy-protected record linking method according to claim 3, characterized in that, The step of performing feature matching on the blocks in different databases to obtain block pairs includes: Based on the index corresponding to each block in different databases, feature matching is performed on two blocks with the same index that come from different databases to form corresponding block pairs.

5. A privacy-protected recording link device, characterized in that, include: The noise addition module is used to add noise to each block corresponding to each database storing different data records based on a preset output constraint differential privacy rule, so that the data record with added noise is regarded as a noisy data record; wherein, the output constraint differential privacy rule is used to calculate the Laplace noise corresponding to each block and perform a rounding operation on each Laplace noise, and then, when it is confirmed that there is a positive value of the rounded Laplace noise, the positive value is used as the number of noises to be added to the corresponding block and the corresponding data record in the block is added with noise according to the number of noises, and when it is confirmed that there is a negative value of the rounded Laplace noise, zero noise is added to the block corresponding to the negative value; The record linking module is used to perform similarity matching on each of the noise data records from different databases based on a sliding window, and link the noise data records that successfully match the similarity to obtain corresponding privacy-protected record pairs; The method of linking the noisy data records from the corresponding blocks of two different databases, which are currently being matched, using a sliding window to obtain corresponding privacy-preserving record pairs includes: Based on a preset sliding window, string segmentation and Dessian similarity coefficient calculation are performed on each of the noise data records from different databases. The noise data records that successfully match the similarity are linked to obtain the corresponding privacy-protected record pairs. The method, based on a preset sliding window, performs string segmentation and Dyess similarity coefficient calculation on each of the noise data records from different databases, and links the noise data records that successfully match in similarity to obtain corresponding privacy-protected record pairs, including: The blocks in different databases are feature matched to obtain block pairs, wherein each block pair contains two blocks from different databases. For each of the block pairs, two noise data records from different blocks are extracted sequentially from each block pair, so that the noise data records are used as target record pairs respectively. Each of the target record pairs performs string segmentation and Dyess similarity coefficient calculation on the two noisy data records to obtain the corresponding similarity results. Based on the similarity results, the two noisy data records in the target record pair that have successfully matched the similarity are linked to obtain the corresponding privacy-protected record pair. The step of performing string segmentation and Dessian similarity coefficient calculation on the two noisy data records in each target record pair to obtain the corresponding similarity results, and linking the two noisy data records in the target record pair that have successfully matched the similarity based on the similarity results to obtain the corresponding privacy-protected record pair, includes: Based on a preset character length threshold, the two noisy data records in the target record pair are respectively divided into strings with a length equal to the character length threshold; Each string is converted into a feature vector based on a hash function, and each feature vector corresponding to each noise data record is stored in a binary Bloom filter that corresponds one-to-one with the noise data record. The similarity coefficients of the Bloom filters corresponding to the two noise data records in the target record pair are calculated to obtain the similarity results between the two noise data records in the target record pair. Determine whether the similarity result is equal to or greater than the similarity threshold. If so, link the two noisy data records in the target record pair corresponding to the similarity result to obtain the corresponding privacy-protected record pair.

6. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the privacy-protected record linking method as described in any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the privacy-preserving record linking method as described in any one of claims 1 to 4.

Images