A differential privacy reinforcement method for a smart building discrete event system

Abstract

This invention relates to a differential privacy enhancement method for a discrete event system in a smart building, comprising: obtaining the initial resource configuration of the smart building system; representing the initial resource configuration using a probabilistic automaton; and establishing a differential privacy mechanism for the smart building system; calculating the probability distribution of the smart building system's behavior under similar initial resource configurations using a differential privacy verifier; verifying whether the smart building system satisfies the differential privacy mechanism using the probability distribution; if it does not satisfy the differential privacy mechanism, calculating a replacement function for the smart building system; and using the replacement function to control the probabilistic automaton to replace the observation symbols of system events. This invention ensures that attackers cannot infer the current initial resource configuration information of the system through external observation.

Description

Technical Field

[0001] This invention relates to the fields of discrete event systems and differential privacy technology, and in particular to a differential privacy enhancement method for discrete event systems in smart buildings. Background Technology

[0002] Smart building systems store and share large amounts of user or organizational data, which may be leaked under external attacks, compromising system security and privacy. Within the framework of discrete event systems in smart buildings, researching differential privacy techniques is crucial for protecting sensitive resource configuration information and is key to solving the problem of state information leakage in repeatable observation smart building systems.

[0003] For repeatable observation discrete event systems, existing techniques utilize probabilistic state opacity methods to quantify the opacity of the discrete event system. However, probabilistic state opacity methods cannot protect sensitive state information of a system initialized from one of two adjacent states.

[0004] Existing technical solutions also introduce differential privacy frameworks into symbolic control systems to protect sensitive language information of the system; however, this method cannot define and protect sensitive state information of the system.

[0005] Therefore, to protect the security of initial resource configuration information in a smart building discrete event system, a differential privacy mechanism more suitable for smart building systems needs to be proposed, and state-based differential privacy verification and enhancement methods need to be determined. Currently, for smart building discrete event systems, there is a lack of a method for constructing an automaton verifier and a supervised control strategy for differential privacy in smart building systems, which can verify whether the system satisfies differential privacy within a finite number of steps and enhance differential privacy technology through a supervised control system. Summary of the Invention

[0006] To address the problems of existing technologies, this invention aims to propose a differential privacy enhancement method for discrete event systems in smart buildings, thereby protecting the system's initial resource configuration information. In probabilistic discrete event systems, adjacent initial states represent similar initial resource configuration information. Probabilistic automata are used to simulate the behavior of repeatable smart building systems, interpreting the specific initial resource configuration information of the smart building system. Based on the behavior of smart building systems, a method for verifying differential privacy is proposed, calculating dangerous state transitions, identifying events that expose system state information, and constructing a supervisory control strategy that meets broader privacy protection requirements based on a substitution function. This provides a differential privacy enhancement method for smart building systems with the maximum permissible behavior.

[0007] To achieve the above objectives, the present invention provides the following solution:

[0008] A differential privacy enhancement method for discrete event systems in smart buildings includes:

[0009] Obtain the initial resource configuration of the smart building system, represent the initial resource configuration using a probabilistic automaton, and establish a differential privacy mechanism for the smart building system;

[0010] The probability distribution of the behavior of the smart building system under similar initial resource configurations is calculated using a differential privacy verifier;

[0011] The probability distribution is used to verify whether the smart building system satisfies the differential privacy mechanism. If it does not satisfy the differential privacy mechanism, the replacement function of the smart building system is calculated, and the replacement function is used to control the probabilistic automaton to replace the observation symbols of system events.

[0012] Optionally, the initial resource configuration includes: system device data and user's personal privacy information.

[0013] Optionally, establishing a differential privacy mechanism for the smart building system includes:

[0014] If the probabilistic automaton satisfies the first objective condition, then it is proven that the first state and the second state of the probabilistic automaton are adjacent initial states, and the observation probability produced by the smart building system in the first state is calculated. Based on the observation probability, a differential privacy mechanism of the smart building system is established.

[0015] Optionally, the first objective condition expression is:

[0016]

[0017] in, and Let q0 and q′0 represent the sets of all observations produced by systems G1 and G2 under initial states q0 and q′0, respectively. θ is the ratio of the number of identical observations produced by the system under initial states q0 and q′0 to the total number of observations, and represents the degree of adjacency between initial states q0 and q′0.

[0018] Calculating the observation probability produced by the smart building system in the first state includes:

[0019]

[0020] in, This represents the probability value of system G generating observation ωσ in state q. Let η(q,ω) represent the probability value of system G generating observation ω in state q, η(q,ω) represent the state reached in state q to generate observation ω, and ρ(η(q,ω),σ) represent the probability value of generating observable event σ in state η(q,ω).

[0021] Optionally, verifying whether the smart building system satisfies the differential privacy mechanism using the probability distribution includes:

[0022] If the probability distribution verification satisfies the second objective condition for all observation data generated in several steps, it proves that the system satisfies differential privacy within several steps; if the probability distribution verification does not satisfy the second objective condition for all observation data generated in several steps, it proves that the system does not satisfy differential privacy within several steps.

[0023] The second objective condition expression is:

[0024]

[0025] in, This represents all observations generated by systems G1 and G2, where ∈ is a positive real number, ω is the observed data, and states q0 and q′0 are θ-adjacent initial states. Let be the probability value of system G2 generating observation data ω in the initial state q′0. For, e ∈ To the degree of privacy protection.

[0026] Optionally, calculating the substitution function of the smart building system includes:

[0027] Obtain all state transitions of the differential privacy verifier, select the dangerous state transitions from all state transitions, and calculate the replacement function of the smart building system based on the dangerous state transitions;

[0028] All state transition expressions of the differential privacy validator are obtained as follows:

[0029]

[0030] Among them, S e (G1,q,σ) and S e (G2,q′,σ) is the set of states reached by systems G1 and G2 in states q and q′ to generate the observable event σ. For system G1 in set The set of all states reached by the observable event σ in any given state. For system G2 in set The set of all states reached by the observable event σ in any given state. and Let G1 and G2 be the set of all states that systems G1 and G2 reach after the same observable event, starting from initial states θ-q0 and q′0. The state of the differential privacy validator. For differential privacy validators in state The new state reached by the observable event σ is generated below.

[0031] Optionally, dangerous state transitions among all state transitions can be selected as follows:

[0032] like and The third objective condition is met, and and If the fourth objective condition is met, then Dangerous state transitions that expose initial state information to the system;

[0033] Where P(σ) represents the observations of the string σ mapping. To generate the probability value of observation P(σ) for system G1 in the initial state q0, Let σ be the probability value of the observation P(σ) generated by system G2 in the initial state q′0. o P(σσ) is the string generated after the system generates the string σ. o ) is the string σσ o Observations of the mapping Generate observations P(σσ) for system G1 in initial state q0. o The probability value of ). Generate observations P(σσ) for system G2 in the initial state q′0. o The probability value of ). and Generate a set of all states reached by the observation P(σ) for systems G1 and G2. Let P(σ) be the state reached by the differential privacy validator after generating observation P(σ) in the initial state. o ) represents the observations of the string σ mapping. For differential privacy validators in state The following observations are generated: P(σ) o (State transition)

[0034] Optionally, the third objective condition expression is:

[0035]

[0036] Among them, e ∈ To maintain privacy, P(σ) represents the observation of the string σ mapping. To generate the probability value of observation P(σ) for system G1 in the initial state q0, The probability value for generating observation P(σ) for system G2 in the initial state q′0.

[0037] Optionally, the fourth objective condition expression is:

[0038]

[0039] or

[0040] Among them, e ∈ For the degree of privacy protection, σ o P(σσ) is the string generated after the system generates the string σ. o ) is the string σσ o Observations of the mapping Generate observations P(σσ) for system G1 in initial state q0. o The probability value of ). Generate observations P(σσ) for system G2 in the initial state q′0. o The probability value of ).

[0041] Optionally, replacing the observation symbol for the system event includes:

[0042] The probabilistic automaton is controlled using the replacement function to replace the observation symbols of observable events during dangerous state transitions;

[0043] The expression for the replacement function is:

[0044]

[0045] Wherein, P(σ) o ) is the string σ o The observation of the mapping, ε is the null character, P(σ′) o ) for and P(σ o Other observation signs that are different from σ′, and P(σ′) o ) for differential privacy validators in state The following observations were generated separately.

[0046] The beneficial effects of this invention are as follows:

[0047] This invention can perform differential privacy verification on repeatable smart building systems to ensure that the system cannot leak initial resource configuration information under repeated observation by an attacker. When the smart building system does not meet differential privacy, differential privacy is satisfied by establishing an automaton controller to supervise and control the system. That is, the probability distribution of the system’s behavior under similar initial resource configurations is similar, ensuring that attackers cannot infer the system’s current initial resource configuration information through external observation. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a schematic diagram of an intelligent building system according to an embodiment of the present invention;

[0050] Figure 2 This is an example diagram of a smart building system demonstrator according to an embodiment of the present invention;

[0051] Figure 3 This is an example diagram illustrating the probability distribution of observations generated by the intelligent building system after control in adjacent initial states according to an embodiment of the present invention.

[0052] Figure 4 This is a schematic diagram of a differential privacy enhancement method for a discrete event system in a smart building, according to an embodiment of the present invention. Detailed Implementation

[0053] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0054] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0055] like Figure 4 As shown in the figure, this embodiment discloses a differential privacy enhancement method for a discrete event system in a smart building, including: obtaining the initial resource configuration of the smart building system, representing the initial resource configuration using a probabilistic automaton, and establishing a differential privacy mechanism for the smart building system; calculating the probability distribution of the behavior of the smart building system under similar initial resource configurations using a differential privacy verifier; verifying whether the smart building system satisfies the differential privacy mechanism using the probability distribution; if it does not satisfy the differential privacy mechanism, calculating the replacement function of the smart building system, and using the replacement function to control the probabilistic automaton to replace the observation symbols of system events.

[0056] Specifically, this embodiment provides a differential privacy enhancement method for a discrete event system in smart buildings, comprising the following steps:

[0057] Based on the existing discrete event system of smart buildings, a probabilistic automata model is used to describe the behavior of repeatable observation system.

[0058] Based on the framework of probabilistic automata, a state-based differential privacy mechanism more suitable for smart building systems is proposed.

[0059] Based on the framework of probabilistic automata, a differential privacy verifier for a smart building system is established, and the probability distribution of the system’s behavior under similar initial resource configurations is calculated. By comparing the probability distributions, it is verified whether the smart building system satisfies differential privacy.

[0060] Based on the framework of probabilistic automata, this paper calculates dangerous state transitions, identifies events that can expose the system's state information, and constructs a supervisory control strategy that meets broader privacy protection requirements based on replacement functions. This provides a differential privacy enhancement method for smart building systems with maximum permissible behavior.

[0061] Among them, the method for determining probabilistic automata to model and describe the behavior of repeatable observation systems includes: based on the discrete event system of smart buildings, determining the system's similar resource configuration information and event transitions, and using probabilistic automata to simulate the behavior of repeatable observation systems.

[0062] Differential privacy techniques are applied to smart building systems, using probabilistic automata to simulate the behavior of repeatable smart building systems. Specific similar initial resource configurations of the smart building system are explained, represented by adjacent initial states of the probabilistic automata.

[0063] like: Figure 1 A simple smart building system was visualized, including probabilistic automata G1 and G2 describing the behavior of users aged 30-45 and 45-60 within the system. This system describes user behavior within a community monitored by cameras, sensors, or other devices. The timing of users entering the underground parking garage and entering the community are key events of interest. For a smart building system, initial resource configuration can include system device data settings or users' personal privacy information, such as age, occupation, and address. Assume an attacker is interested in the age information of users within the community. Figure 1 The smart building system shown has a similar initial resource configuration, with users in different age groups, such as users aged 30-45 and users aged 45-60. An attacker could repeatedly observe the community's public database to obtain user behavior. Events and user behaviors are shown in Table 1. Figure 1As shown, the probabilistic automata G1 and G2, which describe the behavior of users aged 30-45 and 45-60 in the system, have the same system structure, but different probability distributions for events occurring in a certain state. The most common times for users aged 30-45 to enter the underground parking lot are 6:00-12:00 and 18:00-24:00, and the most common times to enter the community are 12:00-18:00 and 18:00-24:00. The most common times for users aged 45-60 to enter the underground parking lot are 0:00-6:00 and 6:00-12:00, and the most common times to enter the community are 6:00-12:00 and 18:00-24:00.

[0064] Table 1. Correspondence between events and user behaviors

[0065]

[0066]

[0067] Establish a differential privacy mechanism for smart building systems: Based on the framework of probabilistic automata, a state-based differential privacy mechanism more suitable for smart building systems is proposed.

[0068] For example: Given two probabilistic automata G1=(Q1,Σ1,δ1,q0,ρ1) and G2=(Q2,Σ2,δ1,q′0,ρ1), if the following formula is satisfied:

[0069]

[0070] Then states q0 and q′0 are called θ-adjacent. and Let represent the sets of all observations generated by systems G1 and G2 in their initial states q0 and q′0, respectively. And θ≤1, where θ is the ratio of the number of identical observations produced by the system in the initial states q0 and q′0 to the total number of observations, representing the degree of adjacency between the initial states q0 and q′0.

[0071] The formula for calculating the probability that system G generates observation ωσ in state q is:

[0072]

[0073] in, This represents the probability value of system G generating observation ωσ in state q. Let η(q,ω) represent the probability value of system G generating observation ω in state q, η(q,ω) represent the state reached in state q to generate observation ω, and ρ(η(q,ω),σ) represent the probability value of generating observable event σ in state η(q,ω).

[0074] Based on this probability calculation formula, and A differential privacy mechanism for smart building systems is proposed.

[0075] Given two probabilistic automata G1 = (Q1, Σ, δ1, q0, ρ1) and G2 = (Q2, Σ, δ2, q′0, ρ2) based on adjacent initial states q0 and q′0, if for all observations ω generated in all k steps, the following formula is satisfied:

[0076]

[0077] Then the systems G(q0) and G(q′0) are said to satisfy ∈-differential privacy within k steps. Here, the parameter ∈ is a positive real number between 0 and 1, and ∈ specifies the privacy protection level of adjacent initial states.

[0078] Based on the framework of probabilistic automata, a differential privacy verifier for a smart building system is established, and the probability distribution of the system’s behavior under similar initial resource configurations is calculated. By comparing the probability distributions, it is verified whether the smart building system satisfies differential privacy.

[0079] For example: quadruple It is a differential privacy validator between probabilistic automata G1=(Q1,Σ,δ1,q0,ρ1) and G2=(Q2,Σ,δ2,q′0,ρ2), where, It is a finite set of all states, where v0 = {y0} × {y′0} is the initial state, and Σ o It is the set of observable events, η v :V×∑ o →V is the state transition function. For all states and all observable events σ∈∑ o If observable events σ∈∑ in state v o If it can be generated, then the state transition of the differential privacy verifier in state v to generate the observable event σ is:

[0080]

[0081] Among them, S e (G1,q,σ) and S e (G2,q′,σ) is the set of states reached by systems G1 and G2 in states q and q′ to generate the observable event σ. For system G1 in set The set of all states reached by the observable event σ in any given state. For system G2 in set The set of all states reached by the observable event σ in any given state. and Let G1 and G2 be the set of all states that systems G1 and G2 reach after the same observable event, starting from initial states θ-q0 and q′0. The state of the differential privacy validator. For differential privacy validators in state The new state reached by the observable event σ is generated below.

[0082] Based on the differential privacy verifier, all possible observations that the smart building system can generate within a finite number of steps in adjacent initial states can be calculated. For each observation, the probability of the smart building system generating this observation in adjacent initial states is calculated using equation (2). For all observations generated by the smart building system in adjacent initial states, the probability value of the system generating each observation is calculated, resulting in the probability distribution of all observations generated by the system in adjacent initial states. If there exists an observation such that the probability value of the smart building system generating this observation in adjacent initial states does not conform to equation (3), then the system does not satisfy differential privacy. Therefore, attackers cannot infer the initial state of the system by repeatedly observing the observations generated by the smart building system, thus protecting the initial resource configuration information of the system. An example of the differential privacy verifier is shown below. Figure 2 As shown.

[0083] Based on a differential privacy verifier, dangerous state transitions that may expose initial state information in the computational system are identified. Events that could expose system state information are determined, and a supervisory control strategy that meets broader privacy protection requirements is constructed based on a substitution function, providing a differential privacy enhancement method for smart building systems with maximum permissible behavior.

[0084] For example, if the system does not satisfy state-difference privacy, an enhanced method for state-difference privacy is proposed. Based on the probability distribution of observations generated by the system within a finite number of steps, the dangerous state transitions of the system are calculated.

[0085] Given two probabilistic automata, G1 = (Q1, Σ, δ1, q0, ρ1) and G2 = (Q2, Σ, δ2, q′0, ρ2), a validator... A dangerous state transition that may expose the initial state information of the system is considered to be if both formula (5) and formula (6) are satisfied:

[0086]

[0087] Among them, e ∈ To maintain privacy, P(σ) represents the observation of the string σ mapping. To generate the probability value of observation P(σ) for system G1 in the initial state q0, Let σ be the probability value of the observation P(σ) generated by system G2 in the initial state q′0. o P(σσ) is the string generated after the system generates the string σ. o) is the string σσ o Observations of the mapping Generate observations P(σσ) for system G1 in initial state q0. o The probability value of ). Generate observations P(σσ) for system G2 in the initial state q′0. o The probability value of ). and Generate a set of all states that observation P(σ) can reach for systems G1 and G2. Let P(σ) be the state reached by the differential privacy validator after generating observation P(σ) in the initial state. o ) represents the observations of the string σ mapping. For differential privacy validators in state The following observations are generated: P(σ) o (State transition)

[0088] Based on the obtained danger state transformation Calculate the replacement function F m The probability distribution of observations generated by the de-control system under adjacent initial states is similar.

[0089] The substitution function is defined as F m E→E∪{ε} maps one observable label to another. Given an observable event P(σ... o )∈Σ o The replacement function is defined as:

[0090]

[0091] Wherein, P(σ) o ) is the string σ o The observation of the mapping, ε is the null character, P(σ′) o ) for and P(σ o Other observation signs that are different from σ′, and P(σ′) o ) for differential privacy validators in state The following are other observations that can be generated.

[0092] By controlling the probabilistic automaton using a substitution function to replace the observation symbols of certain events, attackers are prevented from inferring the initial state of the smart building system (sensitive information such as user age, occupation, and address) through repeated observations of the system's behavior. This achieves privacy protection for sensitive information within the smart building system. An example of the probability distribution of observations generated by the smart building system under adjacent initial states after control is provided, such as... Figure 3 As shown.

[0093] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Various modifications and improvements made by those skilled in the art to the technical solutions of the present invention without departing from the spirit of the present invention should fall within the protection scope defined by the claims of the present invention.

Claims

1. A differential privacy enhancement method for a discrete event system in smart buildings, characterized in that, include: Obtain the initial resource configuration of the smart building system, represent the initial resource configuration using a probabilistic automaton, and establish a differential privacy mechanism for the smart building system; The probability distribution of the behavior of the smart building system under similar initial resource configurations is calculated using a differential privacy verifier; The probability distribution is used to verify whether the smart building system satisfies the differential privacy mechanism. If it does not satisfy the differential privacy mechanism, the replacement function of the smart building system is calculated, and the replacement function is used to control the probabilistic automaton to replace the observation symbols of system events. Calculating the substitution function of the smart building system includes: Obtain all state transitions of the differential privacy verifier, select the dangerous state transitions from all state transitions, and calculate the replacement function of the smart building system based on the dangerous state transitions; Select the dangerous state transitions from all state transitions: like and The third objective condition is met, and and If the fourth objective condition is met, then Dangerous state transitions that expose initial state information to the system; in, For string Observations of the mapping For the system In the initial state Lower generation observation The probability value, For the system In the initial state Lower generation observation The probability value, Generate strings for the system The strings generated afterward, For string Observations of the mapping For the system In the initial state Lower generation observation The probability value, For the system In the initial state Lower generation observation The probability value, and For the system and Generate observations The set of all states that can be reached. Generate observations for the differential privacy validator in its initial state. The state that is reached later For strings Observations of the mapping For differential privacy validators in state Lower generation observation State transition; The third objective condition expression is: in, For the degree of privacy protection, For strings Observations of the mapping For the system In the initial state Lower generation observation The probability value, For the system In the initial state Lower generation observation The probability value; The fourth objective condition expression is: or in, For the degree of privacy protection, Generate strings for the system The strings generated afterward, For strings Observations of the mapping For the system In the initial state Lower generation observation The probability value, For the system In the initial state Lower generation observation The probability value; All state transition expressions of the differential privacy validator are obtained as follows: in, and It is a system and In state and Generate observable events The set of states reached For the system In the set Generate observable events in any state The set of all states that can be reached. For the system In the set Generate observable events in any state The set of all states that can be reached. and For the system and exist -Initial state and The set of all states reached by the same observable event. The state of the differential privacy validator. For differential privacy validators in state Generate observable events The new state reached; The observation symbols that replace the system events include: The probabilistic automaton is controlled using the replacement function to replace the observation symbols of observable events during dangerous state transitions; The expression for the replacement function is: in, For strings Observations of the mapping An empty character. For and Different observation symbols, and For differential privacy validators in state The following observations were generated separately.

2. The differential privacy enhancement method for a discrete event system in a smart building according to claim 1, characterized in that, The initial resource configuration includes: system device data and user personal privacy information.

3. The differential privacy enhancement method for a discrete event system in a smart building according to claim 1, characterized in that, The differential privacy mechanism for the aforementioned smart building system includes: If the probabilistic automaton satisfies the first objective condition, then it is proven that the first state and the second state of the probabilistic automaton are adjacent initial states, and the observation probability produced by the smart building system in the first state is calculated. Based on the observation probability, a differential privacy mechanism of the smart building system is established.

4. The differential privacy enhancement method for a discrete event system in a smart building according to claim 3, characterized in that, The first objective condition expression is: in, and Representing the system and In the initial state and The set of all observations generated below, The system in its initial state and The ratio of the number of identical observations to the total number of observations represents the initial state. and The degree of adjacency; Calculating the observation probability produced by the smart building system in the first state includes: in, Representation system In state Lower generation observation The probability value, system representation In state Lower generation observation The probability value, In the state The following observations were generated. The state reached, In the state The following observable events are generated. The probability value.

5. The differential privacy enhancement method for a discrete event system in a smart building according to claim 1, characterized in that, Verifying whether the smart building system satisfies the differential privacy mechanism using the probability distribution includes: If the probability distribution verification satisfies the second objective condition for all observation data generated in several steps, it proves that the system satisfies differential privacy within several steps; if the probability distribution verification does not satisfy the second objective condition for all observation data generated in several steps, it proves that the system does not satisfy differential privacy within several steps. The second objective condition expression is: in, Indicates for the system and All observations generated, It is a positive real number. For observation data, state and yes -Adjacent initial states For the system In the initial state The following observation data is generated. The probability value, For the system In the initial state The following observation data is generated. The probability value, To the degree of privacy protection.

Images