Data Query Method, System, Device and Medium Based on Shuffle Differential Privacy

Abstract

One or more embodiments of this specification provide a data query method, system, device, and medium based on shuffled differential privacy. The system includes: a shuffler, an analyzer, and a client holding private data; the client obtains a policy query set, where the policy query set is a proper subset of the original query set; based on the private data held by itself and the differential privacy algorithm, each query item in the policy query set is answered, and an answer message for the policy query set is generated and sent to the shuffler. The shuffler anonymizes and shuffles the answer message sent by the client, forms a message queue, and sends it to the analyzer. The analyzer determines the query results of all query items in the policy query set based on the message queue and the differential privacy algorithm; based on the mapping relationship between the original query set and the policy query set, the query results of all query items in the policy query set are converted into the query results of all query items in the original query set.

Description

Technical Field

[0001] One or more embodiments of this specification relate to the technical field of privacy protection, and in particular, to a data query method, system, electronic device, computer-readable storage medium, and computer program product based on shuffle differential privacy. Background Art

[0002] In the scenario of data query based on shuffle differential privacy, related methods usually independently execute the shuffle protocol for a single query. The user side needs to separately generate response messages for each query and inject noise to protect individual privacy. However, when it comes to large-scale continuous range queries, the user side needs to participate in all query items, resulting in a linear increase in the number of message transmissions of a single user with the query scale. Especially in the case of a large data domain, the communication overhead rises sharply. Summary of the Invention

[0003] In view of this, one or more embodiments of this specification provide a data query method, system, electronic device, computer-readable storage medium, and computer program product based on shuffle differential privacy.

[0004] To achieve the above object, one or more embodiments of this specification provide the following technical solutions:

[0005] According to the first aspect of one or more embodiments of this specification, a data query system based on shuffle differential privacy is proposed, including a shuffler, an analyzer, and a user side holding private data;

[0006] The user side is configured to obtain a policy query set, which is a proper subset of the original query set. The original query set is used to describe all interval queries that need to be answered in the data domain where the private data is located, and the query results of the query items in the original query set other than the policy query set can be linearly combined by the query results of at least two query items in the policy query set; answer each query item in the policy query set based on the private data held by itself and the differential privacy algorithm, generate the response message of the policy query set, and send it to the shuffler;

[0007] The shuffler is configured to perform anonymization shuffling on the response message sent by the user side to form a message queue, and send the message queue to the analyzer;

[0008] The analyzer is configured to determine the query results of all query items in the policy query set based on the message queue and the differential privacy algorithm; convert the query results of all query items in the policy query set into the query results of all query items in the original query set based on the mapping relationship between the original query set and the policy query set.

[0009] According to a second aspect of the embodiments of the present specification, a data query method based on shuffle differential privacy is provided, which is applied to a user terminal in a data query system; the method includes:

[0010] Obtain a policy query set, where the policy query set is a proper subset of the original query set, the original query set is used to describe all interval queries that need to be answered in the data domain where the private data held by the user terminal is located, and the query results of the query items in the original query set other than the policy query set can be linearly combined by the query results of at least two query items in the policy query set;

[0011] Based on the private data held by itself and the differential privacy algorithm, answer each query item in the policy query set, generate an answer message for the policy query set, and send it to the shuffler in the data query system.

[0012] According to a third aspect of the embodiments of the present specification, a data query method based on shuffle differential privacy is provided, which is applied to an analyzer in a data query system; the method includes:

[0013] Receive a message queue for a policy query set sent by the shuffler in the data query system; where the policy query set is a proper subset of the original query set, the original query set is used to describe all interval queries that need to be answered in the data domain where the private data is located, and the query results of the query items in the original query set other than the policy query set can be linearly combined by the query results of at least two query items in the policy query set;

[0014] Based on the message queue and the differential privacy algorithm, determine the query results of all query items in the policy query set;

[0015] Based on the mapping relationship between the original query set and the policy query set, convert the query results of all query items in the policy query set into the query results of all query items in the original query set.

[0016] According to a fourth aspect of the embodiments of the present specification, an electronic device is provided, including:

[0017] A processor;

[0018] A memory for storing instructions executable by the processor;

[0019] Wherein, when the processor executes the executable instructions, it is used to implement the method described in the second aspect or the third aspect.

[0020] According to a fifth aspect of the embodiments of the present specification, there is provided a computer-readable storage medium, on which a computer program is stored, and when the program is executed by a processor, the steps of the method described in the second aspect or the third aspect are implemented.

[0021] According to a sixth aspect of the embodiments of the present specification, there is provided a computer program product, including a computer program, and when the computer program is executed by a processor, the steps of the method described in the second aspect or the third aspect are implemented.

[0022] The technical solutions provided by the embodiments of the present specification may include the following beneficial effects:

[0023] In the embodiments of the present specification, through a policy query set, which is a proper subset of the original query set, and partial query results in the original query set can be restored by a linear combination of multiple query results in the policy query set, so that the client only needs to answer each query item in the policy query set, rather than answering each query item in the original query set, reducing the communication overhead; by introducing the shuffling technology and the differential privacy algorithm, the anonymization processing and noise control of the user's answer message are realized, so as to ensure that the overall data query process meets the privacy protection requirements; after the analyzer obtains the query results of all query items in the policy query set, through the mapping relationship between the original query set and the policy query set, the complete original query answer can be restored from the query results of all query items in the policy query set.

[0024] It should be understood that the above general description and the following detailed description are only exemplary and explanatory, and cannot limit the present specification. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 FIG. is a schematic diagram of an application scenario of data query based on shuffling differential privacy provided by an exemplary embodiment.

[0026] Figure 2 FIG. is a structural diagram of a data query system based on shuffling differential privacy provided by an exemplary embodiment.

[0027] Figure 3 FIG. is a schematic diagram of the relationship and data flow between the original query set, the policy query set and the message queue provided by an exemplary embodiment.

[0028] Figure 4 FIG. is a schematic diagram of a binary tree provided by an exemplary embodiment.

[0029] Figure 5 FIG. is a flowchart of a data query method based on shuffling differential privacy provided by an exemplary embodiment.

[0030] Figure 6It is a flowchart of another data query method based on shuffle differential privacy provided by an exemplary embodiment.

[0031] Figure 7 It is a schematic structural diagram of an electronic device provided by an exemplary embodiment. Detailed implementation manners

[0032] Here, the exemplary embodiments will be described in detail, and the examples are shown in the drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The implementation manners described in the following exemplary embodiments do not represent all the implementation manners consistent with one or more embodiments of this specification. On the contrary, they are merely examples of devices and methods that are consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0033] It should be noted that: In other embodiments, the steps of the corresponding method are not necessarily executed in the order shown and described in this specification. In some other embodiments, the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; and multiple steps described in this specification may also be combined into a single step for description in other embodiments.

[0034] The user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for analysis, stored data, displayed data, etc.) involved in this specification are all information and data authorized by the user or fully authorized by all parties. And the collection, use, and processing of relevant data need to comply with the relevant laws, regulations, and standards of relevant countries and regions, and corresponding operation entrances are provided for users to choose to authorize or reject.

[0035] Here, the relevant terms mentioned in the embodiments of this specification are explained:

[0036] 1. Differential Privacy: Differential Privacy (DP for short), as a Privacy Enhancing Technology (PETs), aims to reconcile the contradiction between data utilization efficiency and personal privacy protection. It artificially adds controllable noise in the data processing link to ensure that when publishing the statistical data of the database, any specific user information cannot be accurately traced. The core idea of differential privacy is that for any two similar databases (i.e., only the records of one individual are different), the query results after being processed by the differential privacy algorithm should be highly similar, so that the observer cannot determine whether the information of a specific individual is included. This feature is achieved by injecting random noise into the query results, ensuring the privacy protection of data analysis while still maintaining the usefulness of the data.

[0037] 2. Shuffle Differential Privacy: It is mainly used for large-scale distributed data collection, analysis, and processing. Shuffle Differential Privacy assumes that there is a shuffler between the user side and the analyzer. By shuffling the messages, the analyzer cannot distinguish which user side sent which message to achieve anonymous communication. The implementation of the shuffler can rely on specific routing protocols, trusted security hardware, etc. Shuffle Differential Privacy can significantly improve the accuracy of the results while ensuring privacy security.

[0038] Therefore, Shuffle Differential Privacy has the following advantages: (1) Enhanced privacy protection, no need to fully trust a single entity: Users do not need to directly trust the data collector because the shuffling process can be executed by a neutral third party, or decentralized shuffling can be achieved through protocols such as secure multi-party computing and anonymous network communication, further dispersing the trust risk. (2) Reduced noise and increased data accuracy: Since noise is added to the overall data after shuffling, the total amount of noise required to be added is reduced, thus improving the accuracy of data analysis. (3) Wide applicability: It is applicable to a variety of scenarios, especially those environments that require effective data analysis while protecting user privacy.

[0039] 3. Counting queries are a simple type of query commonly used in database queries. Its purpose is to count the number of data records that meet specific conditions. A basic SQL counting query form is like "SELECT COUNT(*) FROM table WHERE condition;" where table is the name of the query table and condition is the condition for filtering data. The COUNT(*) function will calculate the number of rows in the table that meet the specified conditions.

[0040] Range query is one type of counting query, and its purpose is to count the number of data records that meet a certain continuous range.

[0041] In the range query scenario under shuffle differential privacy, each client holds private data. According to a given query item (such as querying the number of data records in a certain range), all clients jointly answer the question based on their own private data (whether it meets the query range) and add appropriate differentially private noise protection.

[0042] For example, please refer to Figure 1 , when the private data held by each client meets the range indicated by the query item, it sends the real message "1", otherwise it does not send; and sends the noise message "1" with a certain probability. The shuffler collects all the messages sent by the clients, randomly shuffles the message order, and passes the shuffled messages to the analyzer to ensure the anonymity of user identities. After receiving all the messages sent by the shuffler, the analyzer obtains a query result that meets the requirements of differential privacy.

[0043] Based on the problems in the related technologies, please refer to Figure 2 and Figure 3 , the embodiments of this specification provide a data query system based on shuffle differential privacy, including a shuffler, an analyzer, and clients that hold private data. Among them, "holding" represents the ownership of the data. As Figure 2 shown, the number of clients can be multiple, and different clients all include private data that is not publicly disclosed. It can be understood that this embodiment does not impose any restrictions on the storage method of the private data belonging to the clients, and can be specifically set according to the actual application scenario.

[0044] A client is a party that holds data, and its main responsibility is to answer a set of queries based on the private data it holds. The client is used to obtain a policy query set, and the policy query set is a proper subset of the original query set. The original query set is used to describe all the range queries that need to be answered in the data domain where the private data is located, and the query results of the query items in the original query set other than the policy query set can be linearly combined by the query results of at least two query items in the policy query set; answer each query item in the policy query set based on its own private data and the differential privacy algorithm, generate the answer messages of the policy query set, and send them to the shuffler.

[0045] Among them, please refer to Figure 3, A policy query set refers to a subset obtained by optimizing the original query set, and the number of query items it contains is less than that in the original query set. The original query set is used to describe all possible interval queries that need to be answered in the data domain where the above-mentioned private data is located. For example, in the data domain [1, 4], the original query set includes 10 consecutive interval queries, namely [1, 1], [1, 2], [1, 3], [1, 4], [2, 2], [2, 3], [2, 4], [3, 3], [3, 4], [4, 4]. The policy query set is exactly a proper subset optimized from the original query set. The query items in the policy query set are carefully designed so that the query results of the query items in the original query set other than this subset can be obtained by linearly combining the results of at least two query items in the policy query set. By adopting the policy query set, the client only needs to answer fewer query items than the original query set, which can significantly reduce communication costs and noise accumulation, and improve the overall query accuracy and efficiency.

[0046] The shuffler is used to perform anonymizing shuffling on the response messages sent by the client to form a message queue as shown in Figure 3 and send the message queue to the analyzer. Among them, the main function of the shuffler is to disrupt the order of the messages sent by each client to prevent the analyzer from inferring the source of a certain message through the message order or other information, thereby further enhancing privacy protection. Through shuffling, the direct association between a single client and its response message can be effectively isolated, ensuring that the anonymity requirements of the differential privacy mechanism are met.

[0047] As shown in Figure 3 , the analyzer is used to determine the query results of all query items in the policy query set based on the message queue and the differential privacy algorithm; based on the mapping relationship between the original query set and the policy query set, convert the query results of all query items in the policy query set into the query results of all query items in the original query set. Among them, the mapping relationship ensures that even in the case of protecting privacy, the results of the original query set can still be deduced, and the error of the results of the original query set is within a controllable range, realizing the efficient answering of all interval queries described by the original query set.

[0048] In this system, through a policy query set, which is a proper subset of the original query set, and partial query results in the original query set can be recovered by linear combination of multiple query results in the policy query set, so that the user side only needs to answer based on the policy query set, reducing communication overhead; by introducing the shuffling technique and differential privacy algorithm, anonymization processing and noise control of the user's answer message are realized, so as to ensure that the overall data query process meets strict privacy protection requirements; through the mapping relationship between the original query set and the policy query set, the complete original query answer can be recovered from the query results of all query items in the policy query set.

[0049] In some embodiments, the policy query set can be generated in the following way: taking the data domain involved in the original query set as the root node of a binary tree, splitting each parent node of the binary tree into two child nodes until the interval length of the child nodes is 1 and then stopping the splitting; where the interval of any parent node is the combined result of the intervals of its two child nodes; finally, based on all the nodes in the binary tree, the query items in the policy query set are determined. In this embodiment, constructing a binary tree can capture the hierarchical structure of interval queries within the data domain, and the query result of a parent node can be recovered by linear combination of its child nodes. This can not only maintain the integrity of information but also utilize the hierarchical relationship for optimization, achieving the purpose of recovering all target queries at a lower communication cost.

[0050] Exemplarily, taking the complete data domain [1, B as the root node, splitting each parent node a , b into two child nodes: the left child node is , and the right child node is: , stopping the splitting when the interval length is 1 to generate leaf nodes. All non-leaf nodes and leaf nodes form the policy query set A.

[0051] For example, please refer to Figure 4 , in the data domain [1, 4], the original query set includes 10 consecutive interval queries, namely [1, 1], [1, 2], [1, 3], [1, 4], [2, 2], [2, 3], [2, 4], [3, 3], [3, 4], [4, 4]. These query items cover all interval combinations and can comprehensively reflect the statistical information of each sub-interval in the data domain. By constructing a Figure 4For the binary tree shown, the entire data domain [1, 4] is used as the root node of the binary tree, corresponding to the interval [1, 4]. The interval [1, 4] is split into two child nodes: [1, 2] and [3, 4]. The child node [1, 2] is further split to obtain [1, 1] and [2, 2]. The child node [3, 4] is further split to obtain [3, 3] and [4, 4]. Finally, based on all the nodes in the constructed binary tree, a policy query set is determined. In this way, the obtained policy query set contains 7 query items instead of the original 10 query items.

[0052] In some other embodiments, in addition to using a binary tree structure to construct a policy query set, other various optimization methods can also be used to construct a policy query set. This embodiment does not impose any restrictions on this and can be specifically set according to the actual application scenario.

[0053] Exemplarily, a multi-level tree structure can be used to divide the data domain. Each node represents a data interval. A policy query set can be constructed based on some of the nodes in the tree. Then the user side only answers some of the nodes in the tree. Through the linear relationship between the parent node and the child nodes, the query results for any interval can be reconstructed.

[0054] Exemplarily, a wavelet transform method can be used to construct a policy query set. The data domain is decomposed into coefficients of different frequencies through wavelet basis functions (such as Haar wavelets). Each coefficient corresponds to a basic query (i.e., a query with an interval length of 1). Other non-basic queries (i.e., queries with an interval length greater than 1) can be expressed as linear combinations of these wavelets.

[0055] Exemplarily, the sparsity of the data can be utilized to select key query items that have a greater impact on the results from the original query set as the query items in the policy query set.

[0056] In some embodiments, the generation of the policy query set does not depend on the private data of the user side and only requires the structural information of the target query set, such as the data domain size, query type (such as interval query), etc. Then, in one possible implementation, the policy query set can be optimized by relevant devices of the data service provider or relevant devices of a trusted third party, and then the policy query set is distributed as a common parameter to the analyzer and all user sides during system initialization. In another possible implementation, the policy query set can be optimized by the analyzer, and then the policy query set is distributed as a common parameter to all user sides during system initialization.

[0057] In some embodiments, the execution processes of the shuffler, analyzer, and user side in the data query system based on shuffle differential privacy are further described below:

[0058] After each client obtains a policy query set (where different query items in the policy query set correspond to different query identifiers), for each query item in the policy query set, if it determines that it meets the query item based on the private data it holds, it generates a real message carrying the query identifier related to the query item, and, generates a noise message carrying the query identifier related to the query item according to the noise sending probability corresponding to the query item, where the noise sending probability is determined based on the differential privacy algorithm; then it sends all the real messages and all the noise messages for the policy query set to the shuffler.

[0059] In this embodiment, since the client only needs to answer the query items in the policy query set (instead of all the queries in the original query set), the number of messages generated and sent by the user is greatly reduced, which has obvious advantages in both communication cost and storage. Especially in a big data environment, it can significantly reduce the communication burden of each user. And noise needs to be added to each query item to meet the differential privacy requirements. Answering fewer query items in the policy query set means that the total amount of added noise is reduced, thereby reducing the impact of noise accumulation on the accuracy of the query result. Even when using linear combination to recover the original query result, the noise accumulation effect is relatively small, thus improving the accuracy of the final query.

[0060] Among them, for the noise message corresponding to any query item, the client follows a Bernoulli distribution with the noise sending probability corresponding to the query item as a parameter: if and only if the result of the Bernoulli trial is 1, it generates the noise message corresponding to the query item. The Bernoulli distribution is a discrete probability distribution, and its random variable only takes two values: usually 1 represents success and 0 represents failure, and its probability distribution is determined by the parameter p (that is, the noise sending probability), that is, the probability of taking 1 is p, and the probability of taking 0 is 1 - p. In this embodiment, using the Bernoulli distribution to randomly determine whether to generate a noise message ensures that the noise added by each client during answering is random and independent, which helps to achieve differential privacy protection and prevent attackers from inversely deducing the user's real data through a deterministic pattern. Because the generation of the noise message corresponding to each query item only depends on one Bernoulli trial (generate the noise message when the result is 1, otherwise not), the probability of generating the noise message is precisely controlled, which can reduce unnecessary message sending and thus reduce the overall communication overhead.

[0061] The shuffler can perform anonymized shuffling on all the real messages and noise messages sent by the received clients, obtain a message queue and send it to the analyzer.

[0062] After receiving the message queue, the analyzer classifies and counts the messages in the message queue based on the query identifiers carried by each message in the received message queue. The analyzer can, according to these query identifiers, classify each message in the message queue into the query items in the corresponding policy query set, so as to obtain the number of messages for each query item in the policy query set. Since the client adds noise messages according to the set noise sending probability in addition to the real answer when answering the query item, the number of messages for the query item obtained by the analyzer actually includes the mixed result of real data and noise data. In order to obtain as accurate a query result as possible, the analyzer needs to denoise the number of messages for each query item based on the noise sending probability corresponding to each query item to obtain the query result for each query item.

[0063] Specifically, for each query item, the analyzer can estimate the estimated number of noise messages corresponding to the query item based on the noise sending probability corresponding to the query item and the total number of clients. For example, the estimated number of noise messages is the product of the noise sending probability corresponding to the query item and the total number of clients. Then the analyzer uses the estimated number of noise messages corresponding to the query item to denoise the number of messages for the query item to obtain the query result for the query item, that is, the query result for the query item is the difference between the number of messages for the query item and the estimated number of noise messages corresponding to the query item.

[0064] In this embodiment, by determining the estimated number of noise messages and performing denoising processing, the analyzer can effectively reduce the impact of noise on the final query result, improve the accuracy of query statistics, and obtain a relatively reliable data statistics result while ensuring privacy. Since the noise addition by the client is random and the analyzer does not know which specific data is real, the privacy of the user is guaranteed not to be directly leaked, and the denoising processing is carried out on the basis of overall statistics without affecting individual privacy protection.

[0065] In some embodiments, to ensure proper noise control for each query item under shuffled differential privacy, the following steps can be used to determine the noise transmission probability corresponding to each query item: Obtain the total privacy budget indicated by the differential privacy algorithm, which represents the upper limit of privacy loss allowed during the entire query process; and determine the maximum number of private data held by the client that conforms to the query item. Exemplarily, the policy query set is represented by a policy matrix, and one row in the policy matrix is used to describe a query item. The maximum number of private data held by the client that conforms to the query item can be determined based on the L1 norm of the policy matrix. Specifically, the maximum value of the sum of the absolute values of the elements in each column of the policy matrix reflects the maximum number of times the user data can be counted in all queries, that is, the maximum sensitivity. Then, based on the maximum number of conformances obtained in the previous step, evenly distribute the total privacy budget to each query item to obtain the privacy budget corresponding to each query item. This distribution method ensures that each query item meets the corresponding privacy requirements when answered individually. Next, calculate based on the privacy budget corresponding to each query item and the total number of clients to obtain the noise transmission probability corresponding to the query item. Among them, the noise transmission probability corresponding to the query item is negatively correlated with the privacy budget corresponding to the query item and the total number of clients respectively.

[0066] For example, assume that the total privacy budget indicated by the differential privacy algorithm is the parameter values of ε and δ. ε is the main privacy parameter in differential privacy, used to measure the strength of privacy protection; δ is another privacy parameter in differential privacy, used to allow a certain probability of privacy leakage, and is a non - negative real number, indicating that in extremely rare cases, the privacy protection mechanism may not fully meet the requirements of differential privacy. The policy query set is represented by the policy matrix A, and the values of the matrix elements in the policy matrix A are 0 / 1. Then the privacy budget corresponding to each query item , , represents the L1 norm of the policy matrix A. Let the total number of clients be n, and the noise transmission probability corresponding to each query item be p′. Similar formulas such as can be used, or other equivalent formulas. This embodiment does not impose any restrictions on this. At this time, since ε′ and δ′ are evenly distributed, when the privacy budget allocated to each query item is large, the required amount of noise will decrease, so p′ is smaller; and when the total number of clients N is large, the proportion of noise contributed by a single user can also be reduced. Therefore, the noise transmission probability p′ is negatively correlated with the privacy budget corresponding to the query item and the total number of users respectively, that is, the higher the privacy budget and the number of users, the lower the noise transmission probability.

[0067] Among them, the noise sending probability is calculated based on information such as publicly disclosed privacy parameters, the number of users, and the policy query set, without involving any user private data. In one possible implementation, the noise sending probability corresponding to each query item can be calculated by relevant devices of the data service provider or relevant devices of a trusted third party, and then the noise sending probability corresponding to the query item is distributed to the analyzer and all user terminals as a common parameter during system initialization. In another possible implementation, the noise sending probability corresponding to the query item can be calculated by the analyzer, and then the noise sending probability corresponding to the query item is distributed to all user terminals as a common parameter during system initialization.

[0068] In some embodiments, the policy query set is represented by a policy matrix (denoted as A), and the original query set is represented by an original matrix (denoted as W). One row in the policy matrix and the original matrix is used to describe a query item; the query results of all query items in the policy query set are represented by a first result matrix (denoted as ), and the rows in the first result matrix correspond one-to-one with the rows in the policy matrix. Since there is a predetermined mapping relationship between the original query set W and the policy query set A, it can be considered that the original query results can be recovered from the policy query results through linear combination. Specifically, this can be achieved by constructing the inverse matrix of the policy matrix A (or if A is not invertible, a pseudo-inverse is usually used to achieve a similar effect).

[0069] After the analyzer obtains the first result matrix based on the above steps, it can perform a transformation process on the first result matrix based on the original matrix and the inverse matrix of the policy matrix to obtain a second result matrix (denoted as ), and different rows in the second result matrix represent the query results of different query items in the original query set. Specifically, the second result matrix is the product of the original matrix, the inverse matrix of the policy matrix, and the first result matrix, that is . By using the inverse matrix of A, the query results in the policy query set are recovered through linear combination to the query results in the original query set , ensuring that all original query items can be accurately answered under differential privacy protection. In this way, the system can not only use the policy query set to reduce the communication burden of each user terminal, but also recover the complete original query results through post-processing, thereby improving query efficiency and accuracy while ensuring differential privacy protection.

[0070] The following is an example of the data query based on shuffle differential privacy mentioned in the embodiments of this specification:

[0071] (1) Regarding the original query set and the policy query set.

[0072] Suppose the original query set describes all possible continuous interval queries in the data domain [1, 4], with a total of 10 query items. Represented by 0 / 1, each query item is represented by a 4-dimensional row vector indicating which data values belong to the query. Specifically, the meaning of 0 / 1 for each dimension of the 4-dimensional row vector is as follows: The first dimension indicates whether the data value 1 is included in the query, 1 means included, 0 means not included; the second dimension indicates whether the data value 2 is included in the query, 1 means included, 0 means not included; the third dimension indicates whether the data value 3 is included in the query, 1 means included, 0 means not included; the fourth dimension indicates whether the data value 4 is included in the query, 1 means included, 0 means not included. For example, the original query set can be represented as a 10*4 matrix as follows: ; Each row corresponds to a query item. The first row corresponds to the query [1, 1]; the second row corresponds to the query [1, 2]; the third row corresponds to the query [1, 3]; the fourth row corresponds to the query [1, 4]; the fifth row corresponds to the query [2, 2]; the sixth row corresponds to the query [2, 3]; the seventh row corresponds to the query [2, 4]; the eighth row corresponds to the query [3, 3]; the ninth row corresponds to the query [3, 4]; the tenth row corresponds to the query [4, 4].

[0073] To reduce the user communication burden and noise accumulation, this embodiment uses a binary tree method to optimize the original query set and generate a smaller policy query set. The policy query set can be represented as a 10*4 matrix as follows:

[0074] ; The first row corresponds to the query [1, 4]; the second row corresponds to the query [1, 2]; the third row corresponds to the query [3, 4]; the fourth row corresponds to the query [1, 1]; the fifth row corresponds to the query [2, 2]; the sixth row corresponds to the query [3, 3]; the seventh row corresponds to the query [4, 4].

[0075] (2) The local calculation process at the user side.

[0076] Suppose the private data held by the user side is a specific value. Here, taking the data value 2 as an example, the user side first converts its own data into a one-hot vector. The dimension of the one-hot vector is determined based on the size of the data domain, that is, the dimension of the one-hot vector is 4. For the data value 2 held by the user, the one-hot vector (denoted as x) is: , then, the user side calculates the local response, that is, multiplies the one-hot vector by the policy matrix A to obtain the answer vector (denoted as y), y = x * A, which means it can be obtained ; The answer vector corresponds one-to-one with the policy matrix A. For example, the first row in the answer vector is "1", indicating that it conforms to the first query item in the policy matrix A, that is, in the interval [1, 4].

[0077] After the client computes y locally, for each position corresponding to a query item: if a certain position in y is 1, the user generates a real message with the corresponding query identifier; meanwhile, for each query item, according to a preset noise sending probability (a parameter determined by the differential privacy algorithm), it is decided whether to generate a noise message through a Bernoulli trial (i.e., following the Bernoulli(p′) distribution). Finally, the client sends all real and noise messages to the shuffler.

[0078] (3) After receiving messages from all clients, the shuffler randomly shuffles (anonymizes) these messages to form a message queue and sends the queue to the analyzer.

[0079] (4) Based on the query identifiers carried by each message in the message queue, the analyzer classifies and counts the messages to obtain the number of messages for each query item in the policy query set. Subsequently, combining the noise sending probability and the total number of users, the analyzer can calculate the estimated number of noise messages corresponding to each query item. To obtain an unbiased estimate, the analyzer denoises the number of messages for each query item to obtain the denoised number of messages for each query item in the policy query set, which is the query result for each query item in the policy query set. Finally, according to the pre-established mapping relationship between the original query set and the policy query set, the query results in the policy query set are converted into the query results in the original query set. The analyzer finally outputs the query results for each query item in the original query set, and these query results are close to the true values under privacy guarantee.

[0080] The various technical features in the above embodiments can be combined arbitrarily as long as there is no conflict or contradiction between the features. However, due to space limitations, they are not described one by one. Therefore, any combination of the various technical features in the above embodiments also belongs to the scope disclosed in this specification.

[0081] In some embodiments, please refer to Figure 5 , this specification also provides a data query method based on shuffle differential privacy, which is applied to the client in the above data query system; the method includes:

[0082] In S501, obtain a policy query set, where the policy query set is a proper subset of the original query set. The original query set is used to describe all interval queries that need to be answered in the data domain where the private data held by the client is located, and the query results of the query items in the original query set other than the policy query set can be obtained by linearly combining the query results of at least two query items in the policy query set.

[0083] In S502, each query item in the policy query set is answered based on the private data held by itself and the differential privacy algorithm, a response message for the policy query set is generated, and sent to the shuffler in the data query system.

[0084] In some embodiments, different query items in the policy query set correspond to different query identifiers.

[0085] Answering each query item in the policy query set based on the private data held by itself and the differential privacy algorithm to generate a response message for the policy query set, including: for each query item in the policy query set, if it is determined based on the private data held by itself that it conforms to the query item, a true message carrying the query identifier related to the query item is generated; and a noise message carrying the query identifier related to the query item is generated according to the noise sending probability corresponding to the query item, and the noise sending probability is determined based on the differential privacy algorithm; all the true messages and all the noise messages for the policy query set are sent to the shuffler.

[0086] In some embodiments, for the noise message corresponding to any query item, the client follows a Bernoulli distribution with the noise sending probability corresponding to the query item as a parameter: and only when the result of the Bernoulli trial is 1, the noise message corresponding to the query item is generated.

[0087] The specific implementation process of the above method can be found in the description process of the corresponding client in the above system, which will not be elaborated here.

[0088] In some embodiments, please refer to Figure 6 , this specification also provides a data query method based on shuffle differential privacy, which is applied to the analyzer in the above data query system; the method includes:

[0089] In S601, a message queue for the policy query set sent by the shuffler in the data query system is received; wherein, the policy query set is a proper subset of the original query set, the original query set is used to describe all interval queries that need to be answered in the data domain where the private data is located, and the query results of the query items other than the policy query set in the original query set can be linearly combined by the query results of at least two query items in the policy query set.

[0090] In S602, the query results of all query items in the policy query set are determined based on the message queue and the differential privacy algorithm.

[0091] In S603, based on the mapping relationship between the original query set and the policy query set, the query results of all query items in the policy query set are converted into the query results of all query items in the original query set.

[0092] In some embodiments, different query items in the policy query set correspond to different query identifiers.

[0093] Determine the query results of all query items in the policy query set based on the message queue and the differential privacy algorithm, including: classify and count the messages in the message queue based on the query identifiers carried by each message in the message queue to obtain the number of messages of each query item in the policy query set; denoise the number of messages of each query item based on the noise sending probability corresponding to each query item to obtain the query result of each query item.

[0094] In some embodiments, denoising the number of messages of each query item based on the noise sending probability corresponding to each query item to obtain the query result of each query item includes: for each query item, estimate the estimated number of noise messages corresponding to the query item based on the noise sending probability corresponding to the query item and the total number of user terminals, and use the estimated number of noise messages corresponding to the query item to denoise the number of messages of the query item to obtain the query result of the query item.

[0095] In some embodiments, the policy query set is represented by a policy matrix, the original query set is represented by an original matrix, and one row in the policy matrix and the original matrix is used to describe one query item; the query results of all query items in the policy query set are represented by a first result matrix, and the rows in the first result matrix correspond one-to-one with the rows in the policy matrix.

[0096] Based on the mapping relationship between the original query set and the policy query set, convert the query results of all query items in the policy query set into the query results of all query items in the original query set, including: perform a conversion process on the first result matrix based on the original matrix and the inverse matrix of the policy matrix to obtain a second result matrix, and different rows in the second result matrix represent the query results of different query items in the original query set.

[0097] In some embodiments, the second result matrix is the product of the original matrix, the inverse matrix of the policy matrix, and the first result matrix.

[0098] For the specific implementation process of the above method, please refer to the description process of the corresponding analyzer in the above system, which will not be elaborated here.

[0099] In some embodiments, the embodiments of this specification also provide an electronic device, including: a processor; a memory for storing executable instructions of the processor; wherein, the processor realizes the method described in any one of the above by running the executable instructions.

[0100] Figure 7 It is a schematic structural diagram of a device provided by an exemplary embodiment. Please refer to Figure 7, at the hardware level, the device includes a processor 702, an internal bus 704, a network interface 706, a memory 708, and a non-volatile memory 710. Of course, it may also include other hardware required for other functions. One or more embodiments of this specification can be implemented in a software manner. For example, the processor 702 reads the corresponding computer program from the non-volatile memory 710 into the memory 708 and then runs it. Of course, in addition to the software implementation method, one or more embodiments of this specification do not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc. That is to say, the execution subject of the following processing flow is not limited to each logic unit, and can also be hardware or a logic device.

[0101] In some embodiments, the data query device based on shuffle differential privacy can be applied to a device as Figure 7 shown to implement the technical solutions of this specification. Among them, the device may include:

[0102] A policy query set acquisition module, configured to acquire a policy query set, where the policy query set is a proper subset of the original query set, and the original query set is used to describe all interval queries that need to be answered in the data domain where the private data is located, and the query results of the query items in the original query set except the policy query set can be obtained by linearly combining the query results of at least two query items in the policy query set.

[0103] A query answering module, configured to answer each query item in the policy query set based on the private data it holds and the differential privacy algorithm, generate an answer message for the policy query set, and send it to the shuffler in the data query system.

[0104] In some embodiments, the data query device based on shuffle differential privacy can be applied to a device as Figure 7 shown to implement the technical solutions of this specification. Among them, the device may include:

[0105] A message queue receiving module, configured to receive the message queue for the policy query set sent by the shuffler in the data query system; where the policy query set is a proper subset of the original query set, and the original query set is used to describe all interval queries that need to be answered in the data domain where the private data is located, and the query results of the query items in the original query set except the policy query set can be obtained by linearly combining the query results of at least two query items in the policy query set.

[0106] A query result determination module, configured to determine the query results of all query items in the policy query set based on the message queue and the differential privacy algorithm.

[0107] A query result mapping module, configured to convert the query results of all query items in the policy query set into the query results of all query items in the original query set based on the mapping relationship between the original query set and the policy query set.

[0108] The implementation processes of the functions and roles of the various modules in the above device are specifically described in the implementation processes of the corresponding steps in the above method, and will not be elaborated here.

[0109] Based on the same concept as the above method, this specification also provides an electronic device, including: a processor; a memory for storing executable instructions that can be executed by the processor; wherein, the processor realizes the steps of the method as described in any of the above embodiments by running the executable instructions.

[0110] Based on the same concept as the above method, this specification also provides a computer-readable storage medium, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method as described in any of the above embodiments are realized.

[0111] Computer-readable media includes both permanent and non-permanent, removable and non-removable media and can store information by any method or technology. The information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette tapes, magnetic disk storage, quantum memory, graphene-based storage media, or other magnetic storage devices, or any other non-transmission media that can store information accessible by a computing device. As defined herein, computer-readable media does not include transitory media such as modulated data signals and carrier waves.

[0112] Based on the same concept as the above method, this specification also provides a computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the method as described in any of the above embodiments are realized.

[0113] The above are only the preferred embodiments of one or more embodiments of this specification, and are not intended to limit one or more embodiments of this specification. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of one or more embodiments of this specification shall be included within the scope protected by one or more embodiments of this specification.

Claims

1. A data query system based on shuffle differential privacy, comprising a shuffler, an analyzer, and a user terminal holding private data; The client is used to obtain a policy query set, which is a proper subset of the original query set. The original query set is used to describe all interval queries that need to be answered in the data domain where the private data is located. Moreover, the query results of the query items in the original query set except the policy query set can be obtained by linearly combining the query results of at least two query items in the policy query set. Based on the private data it holds and the differential privacy algorithm, each query item in the policy query set is answered to generate an answer message for the policy query set and sent to the shuffler; where The policy query set is generated in the following manner: taking the data domain involved in the original query set as the root node of a binary tree, splitting each parent node of the binary tree into two child nodes until the interval length of the child nodes is 1 and then stopping the splitting; wherein, the interval of any parent node is the combined result of the intervals of its two child nodes; based on all the nodes in the binary tree, determining the query items in the policy query set; The shuffler is configured to perform anonymization shuffling on the response messages sent by the user terminal, form a message queue, and send the message queue to the analyzer; The analyzer is configured to determine the query results of all the query items in the policy query set based on the message queue and the differential privacy algorithm; and convert the query results of all the query items in the policy query set into the query results of all the query items in the original query set based on the mapping relationship between the original query set and the policy query set.

2. The system according to claim 1, wherein different query items in the policy query set correspond to different query identifiers; The user terminal is specifically configured to, for each query item in the policy query set, if it determines that it conforms to the query item based on the private data it holds, generate a real message carrying the query identifier related to the query item, and generate a noise message carrying the query identifier related to the query item according to the noise sending probability corresponding to the query item, where the noise sending probability is determined based on the differential privacy algorithm; and send all the real messages and all the noise messages for the policy query set to the shuffler; The shuffler is specifically configured to perform anonymization shuffling on all the real messages and noise messages sent by the user terminal received, obtain a message queue and send it to the analyzer.

3. The system according to claim 2, for the noise message corresponding to any query item, the user terminal follows a Bernoulli distribution with the noise sending probability corresponding to the query item as a parameter: generating the noise message corresponding to the query item if and only if the result of the Bernoulli trial is 1.

4. The system according to claim 2, the analyzer is specifically configured to classify and count the messages in the message queue based on the query identifiers carried by the messages in the received message queue, obtain the number of messages for each query item in the policy query set; and perform denoising processing on the number of messages for each query item based on the noise sending probability corresponding to each query item to obtain the query result for each query item.

5. The system according to claim 4, the analyzer is specifically configured to, for each query item, determine the estimated number of noise messages corresponding to the query item based on the noise sending probability corresponding to the query item and the total number of user terminals, and use the estimated number of noise messages corresponding to the query item to perform denoising processing on the number of messages for the query item to obtain the query result for the query item.

6. The system according to any one of claims 2 to 5, wherein the noise transmission probability corresponding to the query item is determined by the following method: Obtain the total privacy budget indicated by the differential privacy algorithm, and determine the maximum number of matches of the private data held by the client that conforms to the query item; Based on the maximum number of matches, evenly distribute the total privacy budget to each query item to obtain the privacy budget corresponding to each query item; Calculating based on the privacy budget corresponding to each of the query items and the total number of user terminals to obtain the noise sending probability corresponding to the query item; wherein, The noise transmission probability corresponding to the query item is negatively correlated with the privacy budget corresponding to the query item and the total number of clients.

7. The system according to claim 6, wherein the policy query set is represented by a policy matrix, and one row in the policy matrix is used to describe one query item; Among them, The maximum number of matches of the private data held by the client that conforms to the query item is determined based on the L1 norm of the policy matrix.

8. The system according to claim 1, wherein the policy query set is represented by a policy matrix, the original query set is represented by an original matrix, and one row in the policy matrix and the original matrix is used to describe a query item; The query results of all query items in the policy query set are represented by a first result matrix, and the rows in the first result matrix correspond one-to-one with the rows in the policy matrix; The analyzer is specifically configured to perform a conversion process on the first result matrix based on the original matrix and the inverse matrix of the policy matrix to obtain a second result matrix, and different rows in the second result matrix represent the query results of different query items in the original query set.

9. The system according to claim 8, wherein the second result matrix is the product of the original matrix, the inverse matrix of the policy matrix, and the first result matrix.

10. A data query method based on shuffle differential privacy, which is applied to the client in a data query system; the method includes: Obtain a policy query set, where the policy query set is a proper subset of the original query set, the original query set is used to describe all interval queries that need to be answered in the data domain where the private data held by the client is located, and the query results of the query items in the original query set other than the policy query set can be linearly combined by the query results of at least two query items in the policy query set; wherein, the policy query set is generated by the following method: use the data domain involved in the original query set as the root node of a binary tree, split each parent node of the binary tree into two child nodes until the interval length of the child node is 1 and then stop splitting; wherein, the interval of any parent node is the combined result of the intervals of its two child nodes; based on all nodes in the binary tree, determine the query items in the policy query set; Based on the private data held by itself and the differential privacy algorithm, answer each query item in the policy query set, generate an answer message for the policy query set, and send it to the shuffler in the data query system.

11. The method according to claim 10, wherein different query items in the policy query set correspond to different query identifiers; The answering each query item in the policy query set based on the private data held by itself and the differential privacy algorithm to generate an answer message for the policy query set includes: For each query item in the policy query set, if it is determined to conform to the query item based on the private data held by itself, generate a real message carrying a query identifier related to the query item; and Generate a noise message carrying a query identifier related to the query item according to the noise sending probability corresponding to the query item, where the noise sending probability is determined based on the differential privacy algorithm; Send all the real messages and all the noise messages for the policy query set to the shuffler.

12. According to the method described in claim 11, for the noise message corresponding to any query item, the client follows a Bernoulli distribution with the noise sending probability corresponding to the query item as a parameter: generate the noise message corresponding to the query item if and only if the result of the Bernoulli trial is 1.

13. A data query method based on shuffle differential privacy, applied to an analyzer in a data query system; the method includes: Receive a message queue for a policy query set sent by a shuffler in the data query system; where the policy query set is a proper subset of the original query set, the original query set is used to describe all interval queries that need to be answered in the data domain where the private data is located, and the query results of the query items in the original query set other than the policy query set can be obtained by linearly combining the query results of at least two query items in the policy query set; where the policy query set is generated in the following way: take the data domain involved in the original query set as the root node of a binary tree, split each parent node of the binary tree into two child nodes until the interval length of the child nodes is 1 and then stop splitting; where the interval of any parent node is the combined result of the intervals of its two child nodes; based on all the nodes in the binary tree, determine the query items in the policy query set; Determine the query results of all query items in the policy query set based on the message queue and the differential privacy algorithm; Based on the mapping relationship between the original query set and the policy query set, convert the query results of all query items in the policy query set into the query results of all query items in the original query set.

14. According to the method described in claim 13, different query items in the policy query set correspond to different query identifiers; The determining the query results of all query items in the policy query set based on the message queue and the differential privacy algorithm includes: Classify and count the messages in the message queue based on the query identifiers carried by each message in the message queue to obtain the number of messages for each query item in the policy query set; Denoise the number of messages for each query item based on the noise sending probability corresponding to each query item to obtain the query result for each query item.

15. According to the method described in claim 14, the denoising the number of messages for each query item based on the noise sending probability corresponding to each query item to obtain the query result for each query item includes: For each of the query items, based on the noise sending probability corresponding to the query item and the total number of user terminals, estimate the estimated number of noise messages corresponding to the query item, and use the estimated number of noise messages corresponding to the query item to denoise the number of messages of the query item to obtain the query result of the query item.

16. According to the method described in claim 13, the policy query set is represented by a policy matrix, the original query set is represented by an original matrix, and one row in the policy matrix and the original matrix is used to describe a query item; The query results of all query items in the policy query set are represented by a first result matrix, and the rows in the first result matrix correspond one by one to the rows in the policy matrix; Based on the mapping relationship between the original query set and the policy query set, converting the query results of all query items in the policy query set into the query results of all query items in the original query set includes: Based on the original matrix and the inverse matrix of the policy matrix, perform a conversion process on the first result matrix to obtain a second result matrix, and different rows in the second result matrix represent the query results of different query items in the original query set.

17. The method according to claim 16, wherein the second result matrix is the product of the original matrix, the inverse matrix of the policy matrix, and the first result matrix.

18. An electronic device, comprising: A processor; A memory for storing processor-executable instructions; wherein, the processor realizes the steps of the method according to any one of claims 10 to 17 by running the executable instructions.

19. A computer-readable storage medium, on which computer instructions are stored, and when the instructions are executed by a processor, the steps of the method according to any one of claims 10 to 17 are realized.

20. A computer program product, including a computer program / instructions, and when the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 10 to 17 are realized.

Images