Database aggregation query method and system based on differential privacy protection and storage medium

Abstract

The invention discloses a database aggregation query method and system based on differential privacy protection and a storage medium, and belongs to the technical field of database management systems.The method comprises the steps that if the query type of current database aggregation query is a first preset type, a query aggregation result Q'is calculated through a formula # imgabs0 #; if the query type of the current database aggregation query is a second preset type, respectively calculating corresponding aggregation query results Q'by utilizing an appropriate differential privacy mechanism according to the size relationship between the total row number q of the query intermediate result and a preset parameter lambda; according to the method, the most appropriate differential privacy mechanism is selected according to different conditions of database aggregation query, the balance among data availability, database practicability and efficiency is realized, and the technical problem of providing differential privacy for actual database aggregation query is finally solved.

Description

Technical Field

[0001] The present invention belongs to the technical field of database management systems, and more specifically, relates to a database aggregation query method, system and storage medium based on differential privacy protection. Background Art

[0002] Database aggregation query can provide data analysts with convenient data aggregation and analysis functions. However, while this method improves analysis efficiency, it also carries the risk of privacy leakage. Specifically, differential attack methods can use small differences in the aggregation results to infer individual information with a high probability, including sensitive content such as identity, health status, and financial status. This attack method poses a serious threat to the leakage of individual privacy information, which in turn poses a major challenge to personal privacy protection.

[0003] Differential privacy technology introduces noise into aggregate query results to resist differential attacks based on changes in a single record, while striving to keep the noise as small as possible to ensure data utility. The magnitude of the noise is related to the global sensitivity of the aggregate function. Global sensitivity is used to measure the maximum impact of changes in a single piece of data on query results. Its value depends only on the aggregate function and has nothing to do with the specific data set. However, when determining the value of global sensitivity, the presence of a join key may cause a piece of data to be connected to a large number of other data rows. When the data is removed or added, the aggregate result may change significantly, making it impossible to accurately measure the global sensitivity. At the same time, the uncertainty of the range of aggregate attribute values ​​also increases the difficulty of accurately measuring global sensitivity.

[0004] Currently, the most common methods for determining the global sensitivity of aggregate queries include PrivateSQL and R2T. PrivateSQL does not support sum queries and self-joins. Although R2T supports sum queries and self-joins, it relies on large commercial linear programming solvers, which significantly reduce the computational efficiency in the case of large amounts of data, and does not support aggregate operations such as mean and maximum. Summary of the invention

[0005] In response to the above defects or improvement needs of the prior art, the present invention provides a database aggregation query method, system and storage medium based on differential privacy protection, the purpose of which is to solve the technical problems of low computational efficiency and lack of support for aggregation operations such as mean and maximum when the R2T method is applied to the database.

[0006] To achieve the above objective, according to one aspect of the present invention, a database aggregate query method based on differential privacy protection is provided, comprising:

[0007] S1: If the query type of the current database aggregate query is the first preset type, use the formula Calculate the aggregated query result Q′, where Q is the true query value of the original query, ∈ is the overall privacy budget, and lap() represents the Laplace mechanism; the first preset type includes single-table count queries with a primary privacy relationship;

[0008] S2: If the query type of the current database aggregated query is the second preset type, and the second preset type includes sum queries and multi-table count queries involving a primary privacy relationship, then perform the following steps:

[0009] S21: Determine the size relationship between the total number of rows |q| of the corresponding query intermediate result and the preset parameter λ;

[0010] S22: When the total number of rows |q| of the query intermediate result is less than the preset parameter λ; calculate the adjusted query value Q corresponding to the set truncation threshold i according to the non-self-join and self-join cases respectively i , and then use the formula to calculate the aggregated query result Q′; ∈2 is the difference between the overall privacy budget ∈ and the privacy budget ∈1 consumed by the sparse vector mechanism;

[0011] S23: When the total number of rows |q| of the query intermediate result is greater than the preset parameter λ, calculate the adjusted query value Q corresponding to the set truncation threshold i according to the non-self-join and self-join cases respectively i , and then for all truncation thresholds i = 2 n , n = 1, 2,..., log(GS Q ) calculate the corresponding preliminary aggregation results, and use the preliminary aggregation results to set the final aggregated query result; GS Q is the first preset parameter.

[0012] In one embodiment, using the sparse vector mechanism to determine the specific value of the set truncation threshold i in S22 includes: First, construct the formula (i = 1, 2, 3,... GS Q ), and then report the first i value that makes the formula greater than 0 as the specific value of the truncation threshold i; Q is the true query value, and GS Q is the first preset parameter.

[0013] In one embodiment, for calculating the corresponding preliminary aggregation results for all truncation thresholds in S23 and using the preliminary aggregation results to set the final aggregated query result, it includes:

[0014] Using the formula to calculate all truncation thresholds i = 2 n , n = 1, 2,..., log(GS Q) The preliminary aggregation result corresponding thereto; β is the second preset parameter; if the maximum value of the aggregated queries in all the preliminary aggregation results is greater than 0, then the maximum value of the preliminary aggregation result corresponding to the maximum value is used as the final result, otherwise 0 is used as the final aggregated query result.

[0015] In one embodiment, in S22 and S23, the adjusted query value Q corresponding to the set truncation threshold i is calculated according to the non-self-join and self-join situations respectively i , including: when there is no self-join, using the formula k ∈ |q| to calculate the adjusted query value Q corresponding to the set truncation threshold i i ; wherein, the set truncation threshold i is the first q when using Report i = 1, 2, 3,... GS Q The serial number of the first q greater than 0 when i is greater than 0, F j is the set of data rows in the intermediate result associated with the j-th row in the main privacy relationship, T is the set of rows in the main privacy relationship where the sensitivity of all tuples exceeds the truncation threshold, and ψ(q k ) is the contribution of the data q k to the final aggregation result.

[0016] In one embodiment, in S22 and S23, the adjusted query value Q corresponding to the set truncation threshold i is calculated according to the non-self-join and self-join situations respectively i , including: when there is a self-join, using the formula to calculate the adjusted query value Q corresponding to the set truncation threshold i i ; u k is an introduced variable used to replace ψ(q k ).

[0017] In one embodiment, it further includes: if the query type of the current database aggregated query is the third preset type, and the third preset type includes mean query; splitting the third preset type into the database count query and sum query included in the first preset type and the second preset type;

[0018] For the database count queries included in the first preset type and the second preset type, execute the corresponding steps in S1 and S2, and the obtained aggregation result is denoted as COUNT(*); for the database sum query included in the second preset type, execute S2, and the obtained aggregation result is denoted as SUM(A);

[0019] Use the formula to calculate the final aggregated query result.

[0020] In one embodiment, it further includes: if the query type of the current database aggregation query is the fourth preset type, and the fourth preset type includes a maximum value query, perform steps S21 - S23; wherein, the adjusted query value Q in S22 and S23 i is calculated by the formula k ∈ |q|, V A (q k ) represents the value of the k-th row of the intermediate result under the MAX attribute A; F j is the set of data rows in the intermediate result associated with the j-th row in the main privacy relationship, and T is the set of rows in the main privacy relationship whose tuple sensitivities exceed the truncation threshold.

[0021] In one embodiment, it further includes: if the query type of the current database aggregation query is the fifth preset type, and the fifth preset type includes a minimum value query, perform steps S21 - S23; wherein, the adjusted query value Q in S22 and S23 i is calculated using the formula k ∈ |q|, V A (q k ) represents the value of the k-th row of the intermediate result under the MAX attribute A; F j is the set of data rows in the intermediate result associated with the j-th row in the main privacy relationship, and T is the set of rows in the main privacy relationship whose tuple sensitivities exceed the truncation threshold; for all truncation thresholds in S23, calculate the corresponding preliminary aggregation results, and use the preliminary aggregation results to set the final aggregation query result, including: using the formula calculate the preliminary aggregation results corresponding to all truncation thresholds i = 2 n , n = 1, 2,..., log(GS Q ); β is the second preset parameter; then determine the final aggregation query result according to .

[0022] In one embodiment, it further includes: if the query type of the current database aggregation query is the sixth preset type, and the sixth preset type includes a grouping query, group the current database aggregation query according to the unique values on the grouping attribute, perform a query for each group to obtain the corresponding aggregation value, and then combine all the aggregation values according to the values on the corresponding grouping attribute to obtain the final grouped aggregation query result.

[0023] On the other hand, according to the present invention, there is provided a database aggregation query system based on differential privacy protection, including a file system and a privacy function execution system. The file system is used to store the source data managed by the privacy system, and the privacy function execution system includes the computer program for executing the method described in any one of the above.

[0024] According to another aspect of the present invention, there is provided a computer-readable storage medium storing a computer program, which when executed by a processor, implements the steps of the above method.

[0025] Generally speaking, compared with the prior art by the above technical solution conceived by the present invention, the following beneficial effects can be achieved:

[0026] (1) The present invention provides a database aggregation query method based on differential privacy protection. Among them, if the query type of the current database aggregation query is the first preset type, the formula is used to calculate the aggregation query result Q'; if the query type of the current database aggregation query is the second preset type, the corresponding aggregation query result Q' is calculated according to the size relationship between the total number of rows |q| of the query intermediate result and the preset parameter λ; the present invention takes into account different situations of database aggregation queries and selects the most suitable differential privacy mechanism, achieving a balance among data availability, database usability, and efficiency, and finally solving the technical problem of providing differential privacy for actual database aggregation queries.

[0027] (2) When the total number of rows |q| of the query intermediate result is less than the preset parameter λ, this solution first constructs the formula using the sparse vector mechanism, and then uses the formula to report the first q i greater than 0 as the specific value of i, and finally uses the formula to calculate the corresponding aggregation result; this solution takes into account the characteristics of small data volumes in the database and implements a differential privacy mechanism with higher data availability for small data volumes.

[0028] (3) When there is no self-join, this solution uses the formula k ∈ |q| to calculate the adjusted query value Q corresponding to the set truncation threshold i i ; this solution takes into account the limitations and efficiency issues of applying a linear programming solver to a database and implements an efficient differential privacy mechanism in the case of no self-join.

[0029] (4) When there is a self-join, this solution uses the formula to calculate the adjusted query value Q corresponding to the set truncation threshold i i ; this solution takes into account the problem that the direct truncation mechanism fails in the presence of a self-join and implements a differential privacy method for database aggregation queries in the presence of a self-join.

[0030] (5) In this solution, if the query type of the current database aggregation query is the third preset type, split the third preset type into database aggregation queries corresponding to the first preset type and the second preset type respectively, calculate them, and finally fuse the query results of the two types; this solution takes into account that existing solutions do not clearly give the differential privacy mechanism for the third preset type query, and realizes the differential privacy method for database mean query.

[0031] (6) In this solution, if the query type of the current database aggregation query is the fourth preset type, the adjusted query value Q in S22 and S23 i is calculated by the formula k∈|q|; this solution takes into account introducing the idea of the truncation method into the maximum value query, and realizes the differential privacy method for database maximum value query.

[0032] (7) In this solution, if the query type of the current database aggregation query is the fifth preset type, the adjusted query value Q in S22 and S23 i is calculated using the formula k∈|q|; in S23, use the formula to calculate all the truncation thresholds i = 2 n , n = 1, 2,..., log(GS Q ) corresponding preliminary aggregation results, and then according to determine the final aggregation query result; this solution takes into account introducing the truncation method and the instance-optimal mechanism into the minimum value query, and realizes the differential privacy method for database minimum value query.

[0033] (8) In this solution, if the query type of the current database aggregation query is the sixth preset type, group the current database aggregation query according to the unique values on the grouping attribute, perform a query for each group to obtain the corresponding aggregation value, and then combine all the aggregation values according to the values on the corresponding grouping attribute to obtain the final grouped aggregation query result; this solution takes into account that existing solutions do not give a suitable differential privacy solution for grouped queries, and realizes the differential privacy method for database grouped queries. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 is the model diagram in the database of the database aggregation query method based on differential privacy protection provided in Embodiment 1 of the present invention;

[0035] Figure 2 is the system framework diagram corresponding to the database aggregation query method based on differential privacy protection provided in Embodiment 1 of the present invention;

[0036] Figure 3It is the flowchart of the database aggregation query method based on differential privacy protection provided in Embodiment 1 of the present invention;

[0037] Figure 4 It is the structure, data volume and relationship among the tables of the TPC-H data set provided in Embodiment 1 of the present invention. Detailed implementation manners

[0038] In order to make the objectives, technical solutions and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention. In addition, the technical features involved in the various embodiments of the present invention described below can be combined with each other as long as they do not conflict with each other.

[0039] As Figure 1 shown, the model diagram of the method and system of the present invention in the database. As Figure 2 shown, the system framework diagram of the present invention, and the method of the present invention is integrated into the differential privacy algorithm external function in the figure. The present invention adopts the multi-relation privacy model P-differential privacy defined in PrivateSQL, where P = (R, ∈), and this model defines a table R in a schema in the database as the main privacy relationship. The output value of the mechanism M that satisfies P-differential privacy will not change significantly with the addition or deletion of a row of data in the main privacy relationship R. This model supports foreign key constraints, that is, when a row of data is deleted in the main privacy relationship R, due to the existence of foreign key constraints, the data in other tables in this schema that are foreign key-related to this row will be cascaded and deleted.

[0040] In addition, since the present invention is an improvement and extension based on the R2T method, the database query is first expressed as follows according to the definition of the differential privacy problem of the aggregation query in R2T: For the aggregation query Q, q represents the intermediate result of the query, that is, when the database executes the query Q internally, the table data before calculating the final aggregation result. q k represents the k-th row of data of q, and ψ(q k ) represents the contribution of each row of data q k to the final aggregation result. For example, in the COUNT query, the contribution of each row of data to the final result is 1, that is, ψ(q k ) = 1. In the SUM(COL) query, the contribution of each row of data q k to the final result is the value of the COL column in this row, that is, ψ(q k ) is equal to the value of the COL column in q k . Therefore, the aggregation query Q can be expressed as the sum of the contributions of all intermediate result rows, that is, Q = ∑ψ(q k)。In addition, the R2T method uses tuple sensitivity to measure the impact of a row r in the main privacy relationship R on the query result, that is: j on the query result, that is: indicates that the j-th row in the main privacy relationship is associated with the k-th row in the intermediate result through a join or foreign key constraint. F j represents the set of data rows in the intermediate result associated with the j-th row in the main privacy relationship.

[0041] Embodiment 1

[0042] As Figure 3 shown, this embodiment provides a database aggregation query method based on differential privacy protection, including: S1 and S2.

[0043] S1: If the query type of the current database aggregation query is the first preset type, use the formula to calculate the aggregation query result Q′, where Q is the true query value of the original query, ∈ is the overall privacy budget, and lap() represents the Laplace mechanism; the first preset type includes single-table count queries with a main privacy relationship.

[0044] S2: If the query type of the current database aggregation query is the second preset type, the second preset type includes sum queries and multi-table count queries involving the main privacy relationship. The multi-table count queries involving the main privacy relationship include: multi-table count queries in which the main privacy relationship itself participates and multi-table count queries in which the main privacy relationship itself does not participate but the tables associated with the main privacy relationship by foreign key constraint relationships participate. If it is the second preset type, the following steps are executed: S21: Judge the size relationship between the total number of rows |q| of the corresponding query intermediate result and the preset parameter λ; S22: When the total number of rows |q| of the query intermediate result is less than the preset parameter λ; calculate the adjusted query value Q corresponding to the set truncation threshold i according to the self-join situation i , and then use the formula to calculate the aggregation query result Q′; ∈2 is the difference between the overall privacy budget ∈ and the privacy budget ∈1 consumed by the sparse vector mechanism; S23: When the total number of rows |q| of the query intermediate result is greater than the preset parameter λ, for all truncation thresholds i = 2 n , n = 1, 2,..., log(GS Q ) calculate the corresponding preliminary aggregation results, and use the preliminary aggregation results to set the final aggregation query result; GS Q is the first preset parameter.

[0045] Among them, for other types of COUNT and SUM queries, their sensitivity is infinite, denoted as GS Q , and at this time, when adding noise in combination with the Laplace mechanism Due to the noise scale being infinite, the output result is basically equivalent to a random value, making the data unavailable. The truncation method can effectively limit the global sensitivity of the query within a preset finite range. Specifically, this method first sets a global sensitivity threshold τ. In the main privacy relationship, for those parts where the tuple sensitivity exceeds τ, truncation processing is performed, that is, when calculating the final aggregated query value, the intermediate results associated with these tuples whose sensitivity exceeds τ are excluded and not included in the calculation of the query result, or other means are used to limit their impact on the final aggregated query value to not exceed τ. In this way, the global sensitivity of the aggregated query is successfully truncated and limited within the preset truncation threshold τ, that is where Q τ represents the calculation result obtained after adjusting the original query value after truncating the global sensitivity to τ. This adjustment process involves excluding certain rows in the intermediate results or imposing restrictions on certain row data in the intermediate results to ensure that the final calculated value meets the preset sensitivity constraints.

[0046] In one embodiment, in S22 for setting the truncation threshold i, the sparse vector mechanism is used to determine its specific value, including: first constructing the formula Then using the formula Report the first q i greater than 0 as the specific value of i; Q is the true query value, GS Q is the first preset parameter.

[0047] In one embodiment, in S23 for calculating the corresponding preliminary aggregation results for all truncation thresholds and setting the final aggregation query result using the preliminary aggregation results, including: using the formula All truncation thresholds i = 2 n , n = 1, 2,..., log(GS Q ) to calculate the corresponding preliminary aggregation results; β is the second preset parameter; if the maximum value among all the preliminary aggregation results is greater than 0, then take the maximum value of the preliminary aggregation result corresponding to the maximum value as the final aggregation query result, otherwise take 0 as the final aggregation query result.

[0048] In one embodiment, in S22 and S23, the adjusted query value Q i corresponding to the set truncation threshold i is calculated according to the non-self-join and self-join situations respectively, including: when there is no self-join, using the formula k ∈ |q| to calculate the adjusted query value Q i corresponding to the set truncation threshold i.

[0049] In one embodiment, in S22 and S23, the adjusted query value Q corresponding to the set truncation threshold i is calculated according to the non-self-join and self-join cases respectively i , including: when there is a self-join, use the formula to calculate the adjusted query value Q corresponding to the set truncation threshold i i ; u k is an introduced variable used to replace ψ(q k ).

[0050] Among them, when calculating the truncation threshold as τ, the calculation result Q obtained by adjusting the original query value τ . When the query is a non-self-join query, the present invention uses a direct truncation method to truncate the query. The direct truncation method is that when the tuple sensitivity of a row in the main privacy relationship exceeds the truncation threshold τ, all the data rows associated with that row in the query intermediate result are directly deleted, that is, when S Q (r j ) > τ, delete all {q k |k ∈ F j}. Denote the set of rows in the main privacy relationship whose tuple sensitivities exceed the truncation threshold as T = {j|S Q (r j ) > τ}, and at this time the adjusted query value Q τ is: k ∈ |q|.

[0051] When the query is a self-join query, the linear programming mechanism in R2T is used to calculate the adjusted query value. This mechanism first introduces a variable u k for each row of data in the intermediate result to replace ψ(q k ), and then transforms the calculation of Q τ into a problem of maximizing the sum of variables u k , that is: max Q τ = ∑u k , k ∈ |q|, and its constraint conditions include: s.t. j ∈ |R| and 0 ≤ u k ≤ ψ(q k ), k ∈ |q|.

[0052] Regarding the selection of the truncation threshold. The present invention found in actual tests that the instance optimization mechanism in R2T has very poor data utility when the data volume is small. Therefore, a new truncation threshold selection method is provided when the data volume is small. This method first introduces a parameter λ, representing the critical value of the number of rows in the intermediate result. When |q k | ≤ λ, the SVT mechanism is used to find a truncation threshold that makes the adjusted query value close to the true query value. First, construct the following query: (i = 1, 2, 3,... GS Q ). Where Q i is the adjusted query value when the truncation threshold takes the value of i, Q is the true query value, and GS Q is a settable global sensitivity parameter. In this query, the sensitivity of Q i is i, and the sensitivity of Q is GS Q , so the sensitivity of Qi - Q will be covered by the sensitivity of Q, that is, the sensitivity of Qi - Q is GS Q , then the sensitivity of qi is the constant 1. Then the SVT mechanism uses to report the first q i where the i value greater than 0 is used as the truncation threshold. Then use as the final aggregated query result. The SVT mechanism consumes a part of the privacy budget ∈1, and calculating the final noisy result after obtaining the truncation threshold consumes another part of the privacy budget ∈2. The two stages together consume the privacy budget of a single query, that is, the privacy budget of a single query ∈ = ∈1 + ∈2.

[0053] When |q k | > λ, the instance - optimal mechanism in R2T is used to select the truncation threshold. This mechanism first calculates: For all τ = 2 n , n = 1, 2,..., log(GS Q ), the mechanism outputs the maximum value of Q′ as the output value of the final aggregated query result. If this value is negative, then 0 is output. Where log(x) represents the logarithmic function with base 2, and both β and GS Q are settable parameters.

[0054] In one embodiment, it further includes: If the query type of the current database aggregated query is the third preset type, and the third preset type includes mean query; splitting the third preset type into the database count and sum queries included in the first preset type and the second preset type; for the database count queries included in the first preset type and the second preset type, performing the corresponding steps in S1 and S2, and the obtained aggregated result is denoted as COUNT(*); for the database sum query included in the second preset type, performing S2, and the obtained aggregated result is denoted as SUM(A); using the formula to calculate the final aggregated query result.

[0055] Specifically, split the AVG query. Assume that the database AVG query is expressed as SELECT AVG(A) FROM T(S|J) WHERE φ, where T(S|J) indicates that the query is a single-table query or a join query. Split the AVG into a SUM query and a COUNT query, namely SELECT SUM(A) FROM T(S|J) WHERE φ and SELECT COUNT(*) FROM T(S|J) WHERE φ. Calculate the perturbation results of the decomposed SUM and COUNT queries respectively. According to different query types, use the methods in S1 or S2 to calculate the noise perturbation values of the decomposed SUM and COUNT queries, denoted as SUM(A) and COUNT(*). Each calculation consumes one privacy budget. The privacy budget consumption of one AVG query is evenly distributed to the SUM and COUNT queries. Calculate the final result. For the results SUM(A) and COUNT(*), according to Calculate the final result of AVG. This calculation process utilizes the post-processing invariance of differential privacy, that is, any calculation on the data with noise perturbation that conforms to differential privacy added will still satisfy differential privacy.

[0056] In one embodiment, it further includes: if the query type of the current database aggregation query is the fourth preset type, and the fourth preset type includes a maximum value query, execute steps S21 - S23; where the adjusted query value Q in S22 and S23 i is calculated by the formula k ∈ |q|, and V A (q k ) represents the value of the k-th row of the intermediate result under the MAX attribute A; F j is the set of data rows in the intermediate result associated with the j-th row in the main privacy relationship, and T is the set of rows in the main privacy relationship where the tuple sensitivity of all tuples exceeds the truncation threshold.

[0057] Among them, for the MAX query, the difference from the COUNT and SUM queries is that its result is not obtained by summing the weight functions of each row of the intermediate result, but by selecting the maximum value under the MAX attribute of each row of the intermediate result, that is where V A (q k ) represents the value of the k-th row of the intermediate result under the MAX attribute A. At this time, the tuple sensitivity of a row r j in the main privacy relationship is: Adopt the direct truncation method for truncation, specifically as follows:

[0058] Regarding the calculation of the adjusted query value Q τWhen the tuple sensitivity of a row in the main privacy relationship exceeds the truncation threshold τ, all the data rows associated with that row in the query intermediate result are directly deleted. At this time, the adjusted query value Q τ is expressed as: k ∈ |q|. Regarding the selection of the truncation threshold. The method for selecting the truncation threshold for the MAX query is the same as that for the COUNT and SUM queries.

[0059] In one embodiment, it further includes: if the query type of the current database aggregation query is the fifth preset type, and the fifth preset type includes the minimum value query, execute steps S21 - S23; where the adjusted query value Q in S22 and S23 i is calculated using the formula k ∈ |q|, and V A (q k ) represents the value of the k-th row in the intermediate result under the MIN attribute A; F j is the set of data rows in the intermediate result associated with the j-th row in the main privacy relationship, T is the set of all rows in the main privacy relationship whose tuple sensitivity exceeds the truncation threshold; in S23, the corresponding preliminary aggregation results are calculated for all truncation thresholds, and the final aggregation query result is set using the preliminary aggregation results, including: using the formula to calculate the preliminary aggregation results corresponding to all truncation thresholds i = 2 n , n = 1, 2,..., log(GS Q ); β is the second preset parameter; then determine the final aggregation query result.

[0060] For the MIN query, its query can be expressed as where V A (q k ) represents the value of the k-th row in the intermediate result under the MIN attribute A. At this time, the tuple sensitivity of a row r j in the main privacy relationship is: The direct truncation method is used for truncation, specifically as follows:

[0061] Regarding the calculation of the adjusted query value Q τ When the tuple sensitivity of a row in the main privacy relationship exceeds the truncation threshold τ, all the data rows associated with that row in the query intermediate result are directly deleted. At this time, the adjusted query value Q τ is expressed as: k ∈ |q|.

[0062] Regarding the selection of the truncation threshold. When |q k | ≤ λ, the method in S22 is used. When |q kWhen λ >, the truncation method of the MIN function no longer satisfies the conditions applicable to the method in S22, so a new truncation threshold selection method is adopted. First, calculate: For all τ = 2 n , n = 1, 2,..., log(GS Q ), the method outputs: As the output value of the aggregated query result. Where log(x) represents the logarithmic function with base 2, and both β and GS Q are settable parameters.

[0063] In one embodiment, it further includes: if the query type of the current database aggregated query is the sixth preset type, group the current database aggregated query according to the unique values on the grouping attribute, perform a query for each group to obtain the corresponding aggregated value, and then combine all the aggregated values according to the values on the corresponding grouping attribute to obtain the final grouped aggregated query result.

[0064] For grouped queries, a strategy of grouping first and then synthesizing can be adopted to make full use of the parallel combination theorem of differential privacy. Specifically, first group the query data according to the GROUP BY attribute, then calculate the processed value for each group separately, and finally merge the results of each group. Since the parallel combination theorem of differential privacy ensures that the results calculated by adding noise and calculating separately on disjoint subsets still satisfy differential privacy, the same privacy budget can be directly used for each group, calculate its result separately, and then combine these results into the total result. The specific steps are as follows:

[0065] First, query all different values on the grouping attribute. Assume that the database query is expressed as SELECT B, AGG(A) FROM T(S|J) WHERE φ GROUP BY B, where AGG(A) is the above-mentioned aggregated query on attribute A, and T(S|J) represents that the query is a single-table query or a join query. Then first execute SELECT DISTINCT B FROM T(S|J) WHERE φ in the database to obtain all different values b1, b2,..., bn.

[0066] Then, calculate the noise perturbation results for each grouping attribute value separately. Use each value obtained in S61 as the condition of the new WHERE clause, and calculate the aggregated perturbation result under this value, that is, SELECT AGG(A) FROM T(S|J) WHERE φ and B = bi. Calculate the perturbation results for different aggregation types according to the methods in S1 - S5 above.

[0067] Finally, merge all the obtained results. Finally, combine all the results according to the values of the B attribute to obtain the final result of the grouped query.

[0068] The following is an illustrative example of instance simulation. In this embodiment, the TPC-H dataset is used. TPC-H is a decision support benchmark, which consists of a set of business-oriented ad hoc queries and concurrent data modifications. The TPCH-H dataset simulates an online parts sales system and defines a total of 8 tables: REGION region table, NATION country table, SUPPLIER supplier table, PART parts table, PARTSUPP parts supply table, CUSTOMER customer table, ORDERS order table, LINEITEM order details table. See the appendix for the structure, data volume, and relationships between each table Figure 4 , where the column name prefix of the table is in parentheses after the table name, the arrow indicates the direction of the one-to-many relationship between the tables, and the number or formula below the table name is the cardinality (number of rows) of the table. The cardinality in the LINEITEM table is an approximation, and the sf in the cardinality is the scale factor, which is used to generate datasets of different data scales. In this embodiment, sf is taken as 0.1.

[0069] In this embodiment, a new role TPCHUSER is created in the database as the policy creator, and the above TPC-H dataset is imported under this role. Additionally, an authorized role TPCHSELECTOR is created. Use TPCHUSER to create a policy, set the main privacy relationship to the LINEITEM table, the authorized query user to TPCHSELECTOR, and the fixed privacy budget consumed by a single query to 0.1.

[0070] After setting the policy, the authorized query user TPCHSELECTOR performs the following aggregation query Q:

[0071] SELECT COUNT(*)

[0072] FROM TPCHUSER.LINEITEM L

[0073] JOIN TPCHUSER.ORDERS O ON L.L_ORDERKEY=O.O_ORDERKEY

[0074] WHERE O.O_ORDERDATE>='1995-01-01'

[0075] AND O.O_ORDERDATE<'1996-01-01'

[0076] AND L.L_SHIPDATE IS NOT NULL;

[0077] The physical meaning of this query is to query the total number of rows of all shipped orders in 1995.

[0078] Step 1: Preprocess the single-table COUNT query, AVG query, and GROUP BY query of the main privacy relationship

[0079] For the single-table COUNT query of the main privacy relationship, directly use the method of S1 of the present invention to give the final result and end this process; if it is an AVG query and does not include a grouped query, then decompose the query into SUM and COUNT queries according to the method of S3 of the present invention, and perform subsequent steps respectively, and finally obtain the noise perturbation result of the AVG query through calculation; if it is a non-AVG query and includes a grouped query, then first extract the GROUP BY attribute according to the method of S6 of the present invention, then query all different values on this attribute, and then replace the GROUP BY with a WHERE clause for each value for subsequent single queries, and finally combine the results; if it is an AVG query and includes a grouped query, then first process it as a single grouped query, then process it as a single AVG operation, and finally combine them; for other types of queries, directly execute the subsequent steps

[0080] Since this embodiment does not belong to the above three types, directly execute the subsequent steps

[0081] Step 2: Generate q k , ψ(q k ), V A (q k ), F j values

[0082] The query value formula after the above calculation adjustment needs to use q k , ψ(q k ), V A (q k ), F j . First, generate query statements for obtaining q k , ψ(q k ), V A (q k ), F j values according to the original query type. The specific method is shown in Table 1. The aggregation query is expressed as SELECT AGG(A)FROM T(S|J)WHEREφ. The main privacy relationship is expressed as R, and the primary key on the main privacy relationship is expressed as R.PK

[0083] Table 1 Method for generating query statements corresponding to query types to obtain q k , ψ(q k ), V A (q k ), F j values

[0084]

[0085]

[0086] This embodiment obtains q k , ψ(q k ), V A (q k ), F j The query statement for obtaining the values is: SELECT L_ORDERKEY,L_LINENUMBER FROM TPCHUSER.LINEITEM L

[0087] JOIN TPCHUSER.ORDERS O ON L.L_ORDERKEY = O.O_ORDERKEYWHERE O.O_ORDERDATE >= '1995-01-01'

[0088] AND O.O_ORDERDATE < '1996-01-01'AND L.L_SHIPDATE IS NOT NULL;

[0089] Then, execute the corresponding query statement in the database to obtain the data table T. Then, generate the adjusted query value calculation data tables F and V based on the data table T. Among them, the F table is used to record which rows in the intermediate result come from the same row of the source privacy relationship, that is, F = {F j |j ∈ |R|}, and F is required in the above formula for calculating the adjusted query value j . The V table is used to record the specific values of each row in the intermediate result under the aggregation attribute. When the query is a COUNT or SUM query, V = {ψ(q k )|k ∈ |q|}, and ψ(q k ) is required in the above formula for calculating the adjusted query value of the count and sum queries. When the query is a MAX or MIN query, V = {V A (q k )|k ∈ |q|}, and V A (q k ) is required in the above formula for calculating the adjusted query value of the maximum and minimum queries. The specific generation methods of F and V are shown in Table 2

[0090] Table 2 Methods for Obtaining F and V

[0091]

[0092]

[0093] Execute the q obtaining operation of this embodiment k , ψ(q k)、V A (q k )、F j The query statement for the values can obtain the data table T of this embodiment, which is a table containing the attribute values of two columns, L_ORDERKEY and L_LINENUMBER. The set of row numbers with the same attribute values of L_ORDERKEY and L_LINENUMBER in table T is used as a group of data and inserted into F until all the data in T is processed. Since this embodiment is a COUNT query, the value of ψ(q k ) in each row of the intermediate result is 1, so each row of data in V is set to 1. Through the above method, the F and V tables of this embodiment are finally obtained.

[0094] Step 3: Add noise perturbation to the query result

[0095] According to the adjusted query value, calculate the data table. Add noise perturbation to the query result according to the method proposed by the present invention. The specific implementation process is as shown in the following algorithm.

[0096]

[0097]

[0098] The TrancateDB function is a method for actually performing truncation in the database. The specific implementation process of this function is as shown in the following algorithm.

[0099]

[0100]

[0101] The original result of this embodiment is 91945, and the original execution time is 52 ms, GS Q is set to 1000000, ∈ is set to 0.1, β is set to 0.1, λ is set to 1000, the aggregation type A is COUNT, the self-join flag S is false, and then combined with the F and V obtained in step 2 to execute the above algorithm. Finally, the noise perturbation result Q' is 90773, where the truncation threshold τ selected by the algorithm is 2. The overall execution time is 394 ms.

[0102] Embodiment 2

[0103] This embodiment provides a database aggregation query system based on differential privacy protection, including a file system and a privacy function execution system. The file system is used to store all the necessary information for any of the above methods, and the privacy function execution system includes the computer program for executing any of the above methods.

[0104] The privacy system manages the source data, i.e., the data stored in the file system, including the system privacy management user and the privacy system table. The system privacy management user is a database user maintained by the system in the database, under which the privacy system table is stored. The privacy system table is used to store a privacy protection policy defined by other users in the database. The privacy protection policy allows a database user to specify, through this system, a table that needs to be protected by differential privacy. This table is called the main privacy relationship of the user, and another user is specified as the authorized user with the right to query the privacy data. The authorized user can perform an aggregation query on the data under the authorized user through this system.

[0105] The privacy function executor is used to provide interfaces related to the privacy protection function, including providing the function of defining privacy policies for users and implementing the database aggregation query system based on differential privacy protection described in the first aspect.

[0106] In this embodiment, the advanced composition theorem is used to manage the privacy budget under each policy. Each query is regarded as a differential privacy mechanism, and each query satisfies ∈-differential privacy. All queries are organized through the advanced composition theorem so that a single policy satisfies (∈′, δ′)-differential privacy, where δ′ takes n represents the size of the data volume contained in the main privacy relationship, ∈ represents the privacy budget consumed by a single query, and ∈′ represents the total privacy budget that can be consumed under a main privacy relationship policy. Then the number of queries that can be replied to for the same main privacy relationship is: In addition, each time the privacy budget is consumed, the query problem and result are recorded. The same query gives the same result each time, without consuming the privacy budget.

[0107] This embodiment clarifies how each query consumes the privacy budget and how the overall privacy budget is allocated, so that the differential privacy mechanism can be directly used in the actual queries of the database. And in view of the characteristics of database queries, the present invention uses the advanced composition theorem to manage the privacy budget, so that the differential privacy mechanism for database queries can meet the large number of query requirements in the actual database.

[0108] Embodiment 3

[0109] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above method are implemented.

[0110] It is easy for those skilled in the art to understand that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent replacements, and improvements made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A database aggregation query method based on differential privacy protection, characterized in that: include: S1: If the query type of the current database aggregate query is the first preset type, the aggregate query result Q' is calculated using the formula Q'=Q+Lap(1 / ∈), where Q is the real query value of the original query, ∈ is the privacy budget consumed by a single query, and lap() represents the Laplace mechanism; the first preset type includes a single-table count query on a primary privacy relation; S2: If the query type of the current database aggregate query is the second preset type, which includes sum query and multi-table count query involving the participation of the primary privacy relationship, then execute the following steps: S21: Determine the relationship between the number of rows |q| of the query intermediate result and the preset parameter λ; S22: When the number of rows |q| of the query intermediate result is less than the preset parameter λ; the adjusted query value Q corresponding to the truncation threshold i determined by the sparse vector mechanism is calculated according to the non-self-join and self-join situations respectively. i , and then use the formula Calculate the aggregate query result Q';∈2 as the difference between the overall privacy budget ∈ and the privacy budget ∈1 consumed by the sparse vector mechanism; S23: When the number of rows |q| of the query intermediate result is greater than the preset parameter λ, the adjusted query values ​​Q corresponding to all truncation thresholds i are calculated according to the non-self-join and self-join situations respectively. i , for all cutoff thresholds i = 2 n ,n=1,2,...,log(GS Q ) calculating the corresponding preliminary aggregation result, and using the preliminary aggregation result to set the final aggregation query result; GS Q is the first preset parameter.

2. The database aggregate query method based on differential privacy protection as claimed in claim 1, characterized in that: In S22, the sparse vector mechanism is used to determine the specific value of the truncation threshold i, including: first constructing the formula Then report the first one such that the formula i values ​​greater than 0 are used as the specific values ​​of the cutoff threshold i; Q is the actual query value, GS Q is the first preset parameter.

3. The database aggregate query method based on differential privacy protection as claimed in claim 1, characterized in that: In S23, the corresponding preliminary aggregation results are calculated for all the truncation thresholds, and the final aggregation query results are set using the preliminary aggregation results, including: Using the formula Calculate all cutoff thresholds i=2 n ,n=1,2,...,log(GS Q ) when β is the corresponding preliminary aggregation result; β is the second preset parameter; if the maximum value among all the preliminary aggregation results is greater than 0, the value of the preliminary aggregation result corresponding to the maximum value is used as the final aggregation query result, otherwise 0 is used as the final aggregation query result.

4. The database aggregate query method based on differential privacy protection as claimed in claim 1, characterized in that: In S22 and S23, the adjusted query value Q corresponding to the truncation threshold i is calculated according to the non-self-join and self-join situations. i , including: When there is no self-join, use the formula Calculate the adjusted query value Q corresponding to the truncation threshold i i ; where F j is the set of data rows in the intermediate result associated with the jth row in the primary privacy relation, T is the set of all rows in the primary privacy relation whose tuple sensitivity exceeds the truncation threshold, ψ(q k ) is the data q k Contribution to the final aggregation result; when there is a self-join, use the formula Calculate the adjusted query value Q corresponding to the set cutoff threshold i i ;u k To introduce variables, used to replace ψ(q k ).

5. The database aggregate query method based on differential privacy protection as claimed in claim 1, characterized in that: Also includes: If the query type of the current database aggregation query is the third preset type, and the third preset type includes a mean query; split the third preset type into database count and sum queries included in the first preset type and the second preset type; For the count query of the database included in the first preset type and the second preset type, execute the corresponding steps in claim 1, and the obtained aggregation result is recorded as COUNT(*); for the sum query of the database included in the second preset type, execute S2, and the obtained aggregation result is recorded as SUM(A); Using the formula Calculate the final aggregate query result.

6. The database aggregate query method based on differential privacy protection as claimed in claim 1, characterized in that: Also includes: If the query type of the current database aggregate query is the fourth preset type, and the fourth preset type includes a maximum value query, steps S21-S23 are executed; wherein, The adjusted query value Q in S22 and S23 i By formula Calculated, V A (q k ) represents the value of the kth row of the intermediate result under the MAX attribute A; F j is the set of data rows in the intermediate result associated with the jth row in the primary privacy relation, and T is the set of all rows in the primary privacy relation whose tuple sensitivity exceeds the truncation threshold.

7. The database aggregate query method based on differential privacy protection as claimed in claim 1, characterized in that: Also includes: If the query type of the current database aggregate query is the fifth preset type, and the fifth preset type includes a minimum value query, steps S21-S23 are executed; wherein, The adjusted query value Q in S22 and S23 i Using the formula Calculated, V A (q k ) represents the value of the kth row of the intermediate result aggregate query under the MIN attribute A; F j is the set of data rows in the intermediate result associated with the jth row in the primary privacy relation, T is the set of all rows in the primary privacy relation whose tuple sensitivity exceeds the truncation threshold; In S23, the corresponding preliminary aggregation results are calculated for all the truncation thresholds, and the final result is set using the preliminary aggregation results, including: using the formula Calculate all cutoff thresholds i=2 n ,n=1,2,...,log(GS Q ) corresponds to the preliminary aggregation result; β is the second preset parameter; and then according to Determine the final aggregate query result.

8. The database aggregate query method based on differential privacy protection according to any one of claims 1 to 7, characterized in that: Also includes: If the query type of the current database aggregate query is the sixth preset type, the sixth preset type includes grouped queries, the current database aggregate query is grouped according to the unique values ​​on the grouping attributes, a query is performed on each group to obtain the corresponding aggregate value, and then all the aggregate values ​​are combined according to the values ​​on the corresponding grouping attributes to obtain the final grouped aggregate query result.

9. A database aggregate query system based on differential privacy protection, comprising a file system and a privacy function execution system, characterized in that: The file system is used to store privacy system management source data, and the privacy function execution system includes the computer program for executing the method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

Images