Personalized privacy data protection method and system for leasing equipment

Abstract

The invention discloses a personalized privacy data protection method and system for leasing equipment. The method comprises the steps of dividing levels of equipment leasing enterprises and distributing privacy budget; nodes are deployed, and a block chain platform is initialized; dividing privacy budget according to the data sensitivity, and carrying out personalized differential privacy disturbance on the equipment operation data; the disturbed data and the privacy budget are split through a Shamir secret sharing algorithm and then uploaded to a gateway; the gateway completes data validity verification and addition homomorphic aggregation, and uploads the data to a block chain platform; and the block chain platform responds to a manufacturer query request through the smart contract. According to the method, the privacy protection intensity and the sharing efficiency of the multi-dimensional equipment operation data can be effectively improved, a hierarchical disturbance mechanism and verifiable aggregation are supported, and the availability and the fault-tolerant capability of the data are enhanced; the data sharing contradiction and the privacy leakage risk existing in the current MaaS rental service can be effectively solved, and the method has high practical value and popularization prospect.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a personalized privacy data protection method and system for rental equipment. Background Art

[0002] In recent years, with breakthroughs and integration in intelligent control technologies, the manufacturing industry is entering a new stage of fully integrated, highly intelligent development. Under this intelligent manufacturing model, sensors and communication software are embedded in machines to collect real-time data from shop floor machines, optimizing both production and industrial chains. To further promote high-quality industry development and adapt to shifts in supply and demand, intelligent manufacturing has spawned a number of emerging operational paradigms. Machine-as-a-Service (MaaS), a quintessential model of intelligent manufacturing innovation, represents a new approach to modern manufacturing production. MaaS is essentially an equipment leasing operation model, where companies simply pay rent to the original equipment manufacturer (OEM) for the right to use the equipment. Manufacturers, following a capital expenditure business model, lease their equipment products at an upfront price and provide maintenance services. This model not only enables asset-light operations for businesses, but also extends the manufacturer's technical service chain, thereby promoting the transformation and upgrading of the manufacturing industry.

[0003] The MaaS model also presents privacy issues arising from pricing strategies. In real-world leasing scenarios, a manufacturer's equipment maintenance costs are closely tied to the company's actual production conditions. Therefore, manufacturers need to consider the lease duration and equipment usage intensity when developing tiered leasing contracts. Simply put, manufacturers regularly collect operational data on leased equipment and categorize leasing agreements among companies. Higher-tier leasing levels increase equipment maintenance costs, and companies must pay differentiated rental compensation. However, the differential privacy (DP) mechanisms introduced by companies to protect privacy can interfere with equipment pricing strategies. Data perturbations can lead to biases in the company's leasing tier, leading to misjudgments of the company's leasing tier. To avoid these misjudgments, companies provide budget allocation strategies to assist manufacturers in pricing decisions. However, these strategies themselves implicitly incorporate production characteristics, potentially leaking the company's production privacy through reverse engineering. Furthermore, differentiated production conditions lead to unique wear and tear characteristics in equipment. Traditional DP solutions employ a uniform privacy budget to perturb multidimensional data, ignoring the differentiated protection requirements of companies for sensitive indicators. Finally, most solutions employ data aggregation to prevent the leakage of individual user data. However, a common problem with these approaches is their lack of fault tolerance. If an aggregation node (such as a gateway) goes down due to hardware failure or a network attack, data aggregation fails, and data transmission interruptions lead to high operational costs. Therefore, building a data sharing framework for device rental pricing that synergizes fault tolerance with privacy protection has important practical value. Summary of the Invention

[0004] To solve the above technical problems, the present invention provides a personalized privacy data protection method and system for rental equipment. The specific technical solutions are as follows: A personalized privacy data protection method for rental equipment, comprising: Equipment manufacturers sign equipment leasing contracts with enterprises, classify enterprises and allocate privacy budgets; Trusted institutions deploy nodes for device manufacturers, enterprises, and gateways, and initialize the blockchain network platform; Each enterprise shall regularly share equipment operation data with the equipment manufacturer in accordance with the provisions of the equipment leasing contract; The steps of sharing the equipment operation data include: S1. Enterprises divide privacy budgets for collected multi-dimensional device operation data based on data sensitivity; S2. Perform personalized differential privacy perturbations on multi-dimensional device operation data based on partitioned privacy budgets; S3, split the perturbed data and its privacy budget separately according to the Shamir secret sharing algorithm; S4, upload the multi-dimensional device operation data and its privacy budget after secret splitting to the gateway respectively; S5. The gateway verifies the validity and aggregates the received data, and uploads the aggregated data to the blockchain network platform; S6. The blockchain network platform performs integrity verification on the received data and packages the verified data into blocks and links them to the local blockchain ledger. S7. When the equipment manufacturer needs to obtain equipment operation data, it sends a data query request to the blockchain network platform; S8. The blockchain network platform responds to data query requests, restores device operation data through smart contracts, and provides feedback.

[0005] Furthermore, each enterprise and gateway needs to register as an entity with a trusted organization, including the following steps: The enterprise and gateway calculate the signature based on the identity and current timestamp, and send the identity and current timestamp together with the signature to the trusted organization to make a registration request; After receiving the registration request message, the trusted institution checks whether the timestamp is the latest and verifies the signature. If the verification is successful, the trust institution sends feedback to the corresponding enterprise and gateway to complete the entity registration. The calculation formula of the signature is: , in, h For signature, id For identity identification, is the timestamp, H 1 is the hash function set by the trusted organization; The verification signature refers to the trusted agency judging the equation based on the received identity, timestamp and signature. Is it true? If so, the verification is successful.

[0006] Furthermore, step S1 includes: S101. Enterprises should classify the sensitivity of the collected multi-dimensional equipment operation data based on their own production conditions. The higher the sensitivity, the more protection is needed for the data. S102. Calculate sensitivity weight based on sensitivity: , in, Representation device i No. j Dimensional data sensitivity, is the corresponding sensitivity weight; S103. Allocate privacy budget based on sensitivity weights: , in, Indicates the device is assigned i No. j Dimensional data privacy budget, Indicates the device is assigned i The higher the sensitivity weight, the smaller the privacy budget allocated, and the greater the disturbance when differential privacy is perturbed.

[0007] Furthermore, step S101 includes: Predefined attribute order: Sort data attributes from high to low based on the mutual information between them to determine the dependency between them. The higher the mutual information, the stronger the dependency between the two attributes. Select parent node set: Select a parent node set for each attribute, and select the optimal parent node set by calculating the mutual information and dynamic weight values ​​between attributes; Generate Bayesian network: Construct a Bayesian network based on the set of parent nodes. Each node in the Bayesian network represents an attribute, and the edges connecting nodes represent the conditional dependencies between attributes. The global sensitivity and conditional sensitivity are calculated based on the Bayesian network, and the global sensitivity and conditional sensitivity are weighted and summed, and the weighted sum value is used as the final sensitivity.

[0008] Furthermore, in step S2, a personalized differential privacy perturbation algorithm is used to perform differential privacy perturbation based on the privacy budget of each dimension of the multi-dimensional device operation data; enterprises at different levels use different perturbation mechanisms for personalized differential privacy perturbation: enterprises with a light privacy protection level use the Gaussian perturbation mechanism, enterprises with a medium privacy protection level use the Laplace perturbation mechanism, and enterprises with a heavy privacy protection level use the NM perturbation mechanism.

[0009] Furthermore, in step S5, the validity verification means that the gateway , verify the equation Is it established? If it is established, the verification is passed; among them, Represents the device after differential privacy perturbation i No. j Dimensional data After Shamir's secret split l share, is the corresponding message verification code, rd is the current round number, is the corresponding timestamp, H 2 is the hash function set by the trusted organization; To increase the verification speed, batch verification is used to verify whether the following equation is true. If so, the verification passes:

[0010] in, n Indicates the total number of devices, w Indicates the total number of data dimensions.

[0011] Furthermore, in step S5, the aggregation operation includes: aggregating the multiple received data based on the additive homomorphic property to obtain aggregated data corresponding to the device operation data and an aggregated budget corresponding to the privacy budget; adding a message verification code to the aggregated data and the aggregated budget respectively to form a data aggregation report and a budget aggregation report, and uploading them to the blockchain network platform.

[0012] Furthermore, in step S6, the integrity check refers to the blockchain network platform performing message verification through a smart contract, verifying the received message verification code, and determining whether the calculation of the message verification code is valid. If so, the verification is passed.

[0013] Furthermore, in step S8, First, the blockchain network platform searches for the data aggregation report share and budget aggregation report share of each enterprise and randomly selects Then, through smart contracts, the two types of reports are restored by Lagrange interpolation calculation based on Shamir's secret sharing algorithm; After recovering the privacy budget for each dimension of the enterprise's device operation data, the weighted total privacy budget is calculated and fed back to the device manufacturer: , in, Representation device i The weighted total privacy budget of Indicates the device is assigned i The total privacy budget of Indicates the device is assigned i No. j The privacy budget of the dimensional data, represents the minimum value in the privacy budget allocation.

[0014] A personalized privacy data protection system based on the above method includes several local clients, device sensor modules, a privacy budget allocation module, a differential privacy module and a blockchain network platform; the device sensor module is used to collect device operation data, and the privacy operation allocation module is used to divide the privacy budget of the collected device operation data; the differential privacy module is used to perform differential privacy perturbations on the device operation data according to the divided privacy budget, and split it according to the Shamir secret sharing algorithm; the local client is used to upload the split data shares to the corresponding gateway, and the gateway aggregates the secret shares of the data and sends them together with the budget to the blockchain network platform; the blockchain network platform retrieves the data according to the access request, and restores the device operation data and the corresponding privacy budget through the smart contract in response to the request.

[0015] Compared with the existing technology, the present invention has many outstanding advantages and technical effects. Its core lies in that, under the premise of protecting the privacy of enterprise data, it can still enable equipment manufacturers to effectively collect equipment operation data and accurately obtain pricing basis, thereby taking into account the interests of multiple parties and promoting the healthy development of the "Machine as a Service (MaaS)" model.

[0016] First, the present invention addresses the common conflict between privacy protection and equipment pricing in traditional equipment leasing processes, constructs a personalized privacy protection framework with differential privacy as the core, and introduces a sensitivity weight allocation mechanism to achieve fine-grained privacy budget division for multi-dimensional equipment operation data. Through the company's independent determination of the sensitivity of data in different dimensions, combined with Bayesian network modeling, the dependency relationship between data attributes is systematically evaluated to form an objective and quantitative sensitivity assessment basis. On this basis, weight calculation and privacy budget allocation are performed, so that each dimension of data can obtain a disturbance intensity that is appropriate to its sensitivity. This method avoids the problem of "one-size-fits-all" differential privacy disturbance in the existing technology that does not provide sufficient protection for sensitive information or excessive disturbance for non-sensitive data, and enhances the accuracy of privacy protection and policy flexibility while improving data availability.

[0017] Secondly, to further enhance the adaptability and operability of differential privacy protection, this paper proposes using different levels of differential privacy perturbation mechanisms based on the level of the lease contract signed by the enterprise: the Gaussian mechanism for light-level enterprises, the Laplace mechanism for medium-level enterprises, and the NM mechanism for heavy-level enterprises. This differentiated mechanism design overcomes the limitations of the existing single perturbation method, enabling enterprises with different privacy protection requirements to obtain the optimal perturbation strategy match, significantly enhancing the solution's versatility and scalability across multiple scenarios and enterprise levels.

[0018] Third, in terms of data sharing and data security, the present invention proposes to split the disturbed data together with the privacy budget through Shamir secret sharing, upload it to the gateway node, and then perform validity verification and additive homomorphic aggregation processing by the gateway node before finally uploading it to the blockchain platform. This process realizes decentralized storage, node fault tolerance, and structural tamper-proofing of data, effectively avoiding the risks of data loss and transmission interruption caused by hardware failure or network attacks in traditional single-node aggregation solutions. At the same time, the blockchain platform controlled by smart contracts further strengthens data integrity verification and access control, ensuring the credibility and traceability of shared data in the cross-subject collaboration process. This technical approach has significantly improved security and fault tolerance compared to existing technologies.

[0019] Furthermore, during the data query phase, the present invention introduces the Shamir secret recovery algorithm based on smart contracts, performs Lagrangian interpolation restoration on aggregated data and privacy budgets, and combines this with the concept of weighted privacy budgets to output enterprise equipment operation data and its corresponding weighted privacy usage quota. This weighted budget not only reflects the privacy contribution of enterprises in different protection strategies for multidimensional data, but also enables manufacturers to more precisely assess the quality and sharing level of enterprise data, thereby formulating more reasonable equipment leasing tier pricing and reward strategies. This mechanism effectively addresses the problem of inaccurate leasing pricing caused by data perturbations in the existing DP mechanism, while also enhancing enterprises' ability to proactively negotiate between privacy protection and data sharing.

[0020] Finally, from the perspective of system construction, the present invention builds the underlying blockchain architecture based on Hyperledger Fabric, and establishes a complete data "collection-perturbation-distribution-storage-query-feedback" closed-loop system including sensor modules, local clients, differential privacy modules, privacy budget allocation modules and blockchain networks. The high concurrency capability and low latency characteristics of the system architecture are verified by throughput and latency performance charts, showing strong potential for industrial deployment.

[0021] In summary, this paper constructs a data sharing and protection solution for rental equipment by integrating multiple key technologies, such as differential privacy protection, personalized privacy budget allocation, blockchain trusted storage, fault-tolerant aggregation, and smart contract recovery mechanism, in a multi-dimensional manner. The solution features a strict technical logic loop, superior system performance, and a balance between privacy protection and business objectives. This solution can effectively resolve the data sharing conflicts and privacy leakage risks existing in current MaaS rental services. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. They are used to explain the present invention together with the embodiments of the present invention and do not constitute a limitation of the present invention.

[0023] Figure 1 This is a schematic diagram of the method architecture provided by one embodiment of the present invention; Figure 2 This is a timing diagram of a method provided by an embodiment of the present invention; Figure 3 This is a flow chart of local data processing provided by one embodiment of the present invention; Figure 4 1 is a schematic diagram of weighted calculation of a privacy budget provided by an embodiment of the present invention; Figure 5 This is a blockchain upload performance diagram provided by an embodiment of the present invention; Figure 6 This is a blockchain query performance graph provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0024] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, other embodiments obtained by ordinary technicians in this field without making creative efforts are all within the scope of protection of the present invention.

[0025] Example 1 This embodiment provides a personalized privacy data protection method for rental equipment, such as Figure 1 As shown in Figure 1, the method involves a trusted authority (TA), an enterprise, a gateway (GW), a blockchain, and an OEM. The specific functions of the five entities are as follows: Trusted Authority (TA): TA is an honest and trusted third party responsible for generating system parameters. It registers each enterprise and gateway to ensure the legitimacy of the user's identity, and is responsible for initializing the blockchain network and deploying smart contracts (chain codes).

[0026] Gateway (GW): GW is responsible for collecting data reports from different enterprises, performing message verification and aggregation on them, then adding message verification codes to the aggregated data, and uploading the aggregated reports with the added codes to the blockchain for storage.

[0027] Manufacturers (OEMs): Manufacturers sign equipment rental contracts with companies in advance, categorizing them into different tiers based on the contracts and providing corresponding equipment repair and maintenance services. Furthermore, manufacturers utilize the blockchain platform to access equipment data uploaded by companies and their privacy budgets. Using this privacy budget, manufacturers assess the companies' data sharing contributions and offer rental discounts to achieve reasonable pricing. Company groups are industrial local area networks comprised of different companies. By categorizing companies into different tiers, the network connects their leased equipment and systematically monitors and collects their equipment data. This model facilitates future equipment optimization and pricing for manufacturers.

[0028] Enterprise (MU): During the equipment rental period, as the equipment user, the enterprise is responsible for regularly collecting multi-dimensional fault data generated by the daily operation of the leased equipment, classifying the data sensitivity based on its own privacy protection needs to reasonably allocate the privacy budget, and then perturbing and splitting the data according to the budget. The split data is then message-verified and generated into a data report that is sent to the corresponding GW.

[0029] Blockchain: In this embodiment, Hyperledger Fabric (HF) is used as the blockchain network, which is mainly responsible for verifying and storing the aggregated reports from the GW, as well as calculating the privacy budget of each dimension of the enterprise and feeding back the total privacy budget to the manufacturer.

[0030] Based on the above entities, this embodiment provides a personalized privacy data protection method for rental equipment, such as Figure 2 As shown, it mainly includes the following steps: Step 1: Initialization phase First, the manufacturer signs an equipment lease agreement with each enterprise, outlining the specifications for shared data and transactions during the lease period, including data format, transaction format, sharing frequency, and noise reduction standards. Enterprises are pre-classified based on the lease agreement, with different budget allocations allocated to different levels. For example, if Enterprise A signs a light-intensity equipment lease agreement, the manufacturer will classify Enterprise A into the light-level enterprise group, with a total privacy budget of 10.

[0031] The Trusted Authority (TA) then performs the following steps to generate the required parameters: Step 1.1: TA provides security parameters and embeds them into the enterprise's rental equipment program; Step 1.2: TA selects two secure hash functions H1 and H2 ; Step 1.3: TA completes the initialization of the blockchain and deploys the pre-defined smart contract (chain code) to the blockchain; Step 1.4: TA sets the number of secret shares m , threshold k and large prime numbers p , and randomly generate a k -1st order polynomial: ,in ; Step 1.5: TA announces public parameters .

[0032] In order to become a legal entity, the enterprise (MU) needs to register with the TA. The steps are as follows: Step 1.6: Enterprise i ( ) is identified by , Get the current timestamp , and calculate the signature: , and then ( ) is sent to TA through a secure channel; Step 1.7: TA receives the registration request message After that, if the timestamp is detected to be the latest, the signature is verified: ; If established, TA randomly selects Send to , to prove that it is a legal entity.

[0033] Similarly, the gateway (GW) also needs to register with the TA. The steps are as follows: Step 1.8, Gateway l ( ) is identified by , Get the current timestamp , and calculate the signature: , and then Send it to TA through a secure channel; Step 1.9: TA receives the registration request message After that, if the timestamp is detected to be the latest, the signature is verified: ; If established, TA randomly selects Send to , to prove that it is a legal entity.

[0034] Step 2: Data submission phase In accordance with the leasing contract, the company regularly shares equipment failure data with the manufacturer.

[0035] like Figure 3 As shown in the figure, first, due to the different privacy protection requirements of enterprises for different dimensions of sensitive data, personalized LDP is used to protect the privacy of multi-dimensional data in a fine-grained manner, and a privacy budget adaptive allocation algorithm is used to achieve a reasonable allocation of the limited privacy budget; finally, the disturbed device fault data and its privacy budget are secretly split by Shamir and uploaded to the corresponding aggregation GW respectively.

[0036] Taking the heavy enterprise group as an example, during the rental period, all enterprises in the group periodically (e.g., weekly or monthly) collect multi-dimensional fault data generated by the rented equipment. , Indicates the The first Type of failure occurrence. Then multidimensional data Allocate privacy budget, personalized perturbation and Shamir secret split. As shown in Algorithm 1, first, the enterprise determines the sensitive dimensions based on its own production situation and performs The sensitivity of the data is scored and the privacy budget is adaptively allocated through the sensitivity weight to achieve high utilization of the privacy budget. The specific steps are as follows: Step 2.1: Enterprises divide the sensitivity of multidimensional data according to their own production conditions. Comprehensively weight the global sensitivity and conditional sensitivity of each attribute of the data. First, predefine the attribute order. Then, for each attribute Select the parent node set , thus generating a Bayesian network Finally, the global sensitivity and conditional sensitivity of the attribute are calculated to obtain the comprehensive sensitivity.

[0037] (1) Predefined attribute order: Companies typically sort attributes based on their mutual information (MI) to identify dependencies. Mutual information measures the degree of interdependence between two variables, with higher values ​​indicating a stronger relationship. This allows companies to prioritize attributes that have a greater impact on overall data sensitivity.

[0038] (2) Select the parent node set: When building a Bayesian network, a set of parent nodes must be selected for each attribute to ensure conditional independence. This selection can be accomplished using a variety of algorithms, such as the IAGreedyBayes algorithm, which calculates the mutual information between attributes and dynamic weights to select the optimal set of parent nodes. Alternatively, heuristic methods can be used to select the attribute with the highest information entropy as the initial node, reducing computational effort.

[0039] (3) Generate Bayesian network: Once the set of parent nodes is determined, a Bayesian network can be constructed. A Bayesian network is a directed acyclic graph (DAG) in which each node represents an attribute and edges represent conditional dependencies between attributes. By constructing a Bayesian network, companies can effectively model complex relationships between multidimensional data.

[0040] (4) Sensitivity calculation: In Bayesian networks, global sensitivity and conditional sensitivity are key metrics for measuring data sensitivity. Global sensitivity measures the sensitivity of the entire network to data changes, while conditional sensitivity measures the sensitivity of a particular attribute to data changes given other attributes.

[0041] Global Sensitivity Analysis: Using auxiliary variable methods, we can distinguish the natural uncertainty in random variables from the uncertainty in distribution parameters. This approach can be extended to any conditional distribution in a Bayesian network, allowing global sensitivity to be calculated. Conditional Sensitivity Analysis: By calculating the impact of changes in conditional probabilities on output probabilities, we can identify key factors in a Bayesian network model. For example, in GeNie software, we can perform sensitivity analysis to quantify the impact of changes in parent node parameters on child node parameters.

[0042] (5) Comprehensive sensitivity weighting: Enterprises can perform comprehensive weighting on each attribute based on the predefined attribute order and the calculated global sensitivity and conditional sensitivity. The weight calculation method can be based on the diversity of attribute values, that is, the distribution of different valid values ​​of the attribute value. When the original data set has few tuples, an approximate value can be obtained by calculating the limited tuple data. In this embodiment, the conditional sensitivity , global sensitivity and its weighted comprehensive sensitivity It can be expressed as follows:

[0043] in, It is a trade-off parameter. The larger the value, the stronger the dominance of global sensitivity.

[0044] Step 2.2: Each enterprise collects the sensitivity of each dimension of device data into a set. The higher the sensitivity, the more data needs to be protected. The sensitivity set can be expressed as .

[0045] Step 2.3, calculate the sensitivity weight. The higher the sensitivity level, the higher the corresponding sensitivity weight. i A certain device j Dimensional data The sensitivity of , and the corresponding sensitivity value weight It can be expressed as:

[0046] In step 2.4, a higher sensitivity weight is assigned a smaller privacy budget, meaning greater privacy protection is achieved. In differential privacy, the privacy budget is a key parameter that determines the balance between the strength of privacy protection and data availability. A smaller privacy budget indicates a more stringent privacy protection algorithm, meaning it perturbs the data more, making it more difficult to infer individual information from the results. Conversely, a larger privacy budget indicates weaker privacy protection and greater data availability.

[0047] Based on sensitivity weight division Total privacy budget , After the privacy budget of each dimension is allocated, the data of each dimension is personalized differential privacy perturbation (PLDP), that is, according to the privacy budget of each dimension of the device data, the multidimensional data is The disturbance is PLDP is an LDP mechanism that allows different users to adopt different privacy budgets and privacy regions according to their privacy needs and data sensitivity.

[0048] Enterprises with different lease levels will use different disturbance mechanisms to Perform personalized local differential privacy perturbations, such as the Laplace and Gaussian mechanism perturbation rules. Since Laplace provides stricter privacy performance than Gaussian, Gaussian is used for data privacy protection in light-critical enterprises, while Laplace is used in moderate-critical enterprises.

[0049]

[0050] The disturbance mechanism will 、 、 as well as Encapsulated into transactions The NM mechanism is implemented through and control The size of the two disturbance probabilities is generated and By controlling the perturbation intensity through these two probabilities, it has high perturbation flexibility and data privacy, and is therefore used in heavy enterprise data privacy protection. The specific perturbation rules are as follows:

[0051] The principle is to convert the true value With a greater probability Disturb to nearby intervals, improve data availability, and have a lower probability Perturb to a farther interval to enhance data privacy, parameters along with By adjusting The size of the perturbation balances data availability and privacy. Repeat the above steps until all data is perturbed, and then perturb the fault data. Recreate the array , and add as well as Parameters are repackaged into data reports.

[0052] The PLDP mechanism can allocate different privacy budgets and privacy regions to different users, while the NM mechanism can select the optimal neighborhood length for each user. b , to balance data availability and privacy protection strength.,This embodiment combines the PLDP perturbation with the NM perturbation mechanism to achieve more fine-grained privacy protection while improving data availability.

[0053] at last, According to Algorithm 1, and Implementing the Shamir Secret Split: The first step is to generate a message verification code:

[0054] in An index representing the fault type, is the current round number, is the current timestamp, For the share, .

[0055] Then Send to .

[0056] It is worth noting that the maximum power of the polynomial of the Shamir secret sharing scheme used by each enterprise is the same, that is, However, their coefficients are different and kept secret from other companies. Other companies will send their reports to the corresponding .

[0057]

[0058] Step 3: Data aggregation phase In this phase, when all enterprises report the split data and budget reports After being sent to the corresponding gateway, the gateway performs data report verification and aggregation operations.

[0059] Step 3.1: The gateway first checks the data report and budget report Is it valid? If the verification is invalid, then output Taking the data report as an example, calculate whether the following formula is true: To increase the verification speed, the gateway uses message verification codes to batch verify the reports to verify whether the messages are valid:

[0060] Step 3.2: If the above formula is true, according to the homomorphic property of addition, the device data share in the data report of the gateway Perform aggregation: .

[0061] Step 3.3: The gateway adds a message verification code to the report. Take data report aggregation as an example:

[0062] in, The current timestamp.

[0063] Step 3.4: Finally, each gateway aggregates the data and reports and budget reports Upload to the HF blockchain platform for decentralized storage.

[0064] Step 4: Data query phase After the HF blockchain receives the data aggregation report and budget aggregation report sent by the gateway, it performs message verification through the smart contract (chain code) to ensure data integrity. Take the data aggregation report as an example: Step 4.1. First, check Is it valid? Calculate whether the following formula is true:

[0065] If invalid, the output .

[0066] Step 4.2: To speed up verification, a message verification code will be used on the smart contract (chain code) to batch verify the report to verify whether the message is valid, namely:

[0067] Step 4.3: If the above equation is true, the verified report is packaged into a block and broadcast to HF. Finally, each blockchain node links the newly generated block to the local blockchain ledger to ensure the consistency of the ledger. Once the newly generated block is linked to the blockchain, the blockchain's tamper-proof and non-deletable properties ensure the data integrity and authentication of all transactions in the block.

[0068] Step 4.4: When a manufacturer queries the device failure data of a certain enterprise group, it sends a data query transaction to HF. HF restores the device failure data share of the group through the smart contract (chain code) and returns the device data. The specific implementation process is shown in Algorithm 2.

[0069]

[0070] First, HF will search for the aggregated data reporting share of the group and the privacy budget reporting share of each enterprise, and randomly select indivual The smart contract (chain code) then performs Lagrange interpolation calculations on the two types of reports based on the Shamir secret recovery algorithm to restore the results.

[0071] Manufacturers can obtain information about the use of privacy budgets of various enterprises, which helps them understand the accuracy of the data shared by enterprises and provides a strong basis for manufacturers to reward enterprises for sharing data and provide reasonable leasing prices. However, the allocation of privacy budgets of enterprises to multi-dimensional device data is also a form of privacy, from which sensitive information can be inferred. Moreover, in terms of data dimensions and total privacy budget, Under the same circumstances, different companies have different budget allocation strategies, and their actual impact on data is also different. Figure 4 As shown in Figure 2, since enterprises implement different allocation strategies according to their own production privacy needs, the weighted privacy budgets vary and are much smaller than the prescribed budget. Therefore, the concept of weighted privacy budget calculation is introduced in Algorithm 2. After calculating their privacy budgets, calculate their respective weighted total privacy budgets , and packaged together with the aggregated data into a report and returned to the manufacturer.

[0072] Step 5: Data response phase First, HF uses the privacy budget weighting algorithm embedded in the smart contract to perform weighted calculations on the privacy budget of each dimension of each enterprise's equipment failure data, and obtains the weighted total privacy budget spent by each enterprise. Then, HF aggregates the equipment failure data of enterprises at the same level. and their respective The data is packaged into an independent response message and returned to the manufacturer. The manufacturer analyzes the light, medium and severe equipment failure data according to the lease contract level and optimizes the performance of the equipment in a targeted manner. It helps manufacturers to further understand the disturbance of equipment failure data of each enterprise, and also provides an important basis for manufacturers to give corporate rewards or make reasonable pricing for leasing equipment.

[0073] Example 2 Based on the above method, this embodiment provides a personalized privacy data protection system for rental equipment, including several local client interfaces, device sensor modules, privacy budget calculation mechanism modules, blockchain network and local differential privacy modules. The raw data collected by the device sensor is statistically analyzed, personalized LDP noise is added and split according to the Shamir secret sharing mechanism; then the secret share is uploaded to the corresponding gateway (MU) through the local client interface. After receiving the data, the gateway aggregates the secret share of the data and sends it together with the budget to the blockchain. The blockchain uses the storage module to reach consensus, sort and store the data. The manufacturer (OEM) requests access to the data through the client web interface. The blockchain smart contract receives and retrieves the data according to the parameters name and date of the access request. The data is processed by the calculation module integrated in the chain code and returned to the web page and displayed in the form of a bar chart. The system has efficient data transmission performance. The throughput (TPS) and latency (Latency) of the system are as follows. Figure 5 and Figure 6 The above system can execute the personalized privacy data protection method for rental equipment described in Example 1, and has the corresponding functional modules and beneficial effects of the method. For technical details not fully described in this embodiment, please refer to the personalized privacy data protection method provided in Example 1 of the present invention.

[0074] Through the description of the above embodiments, those skilled in the art will clearly understand that each embodiment can be implemented using software plus a general hardware platform, or of course, hardware. Based on this understanding, the essence of the above technical solution, or the portion that contributes to the relevant technology, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, or an optical disk, and includes a number of instructions for causing a computer device (such as a personal computer, server, or network device) to execute the methods described in each embodiment or certain portions of the embodiments.

[0075] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Under the idea of ​​the present invention, the technical features in the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of the present invention as described above. For the sake of simplicity, they are not provided in detail. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in this field should understand that they can still modify the technical solutions described in the above embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of this application.

Claims

1. A personalized privacy data protection method for rental equipment, characterized in that: include: Equipment manufacturers sign equipment leasing contracts with enterprises, classify enterprises and allocate privacy budgets; Trusted institutions deploy nodes for device manufacturers, enterprises, and gateways, and initialize the blockchain network platform; Each enterprise shall regularly share equipment operation data with the equipment manufacturer in accordance with the provisions of the equipment leasing contract; The steps of sharing the equipment operation data include: S1. Enterprises divide privacy budgets for collected multi-dimensional device operation data based on data sensitivity; S2. Perform personalized differential privacy perturbations on multi-dimensional device operation data based on partitioned privacy budgets; S3, split the perturbed data and its privacy budget separately according to the Shamir secret sharing algorithm; S4, upload the multi-dimensional device operation data and its privacy budget after secret splitting to the gateway respectively; S5. The gateway verifies the validity and aggregates the received data, and uploads the aggregated data to the blockchain network platform; S6. The blockchain network platform performs integrity verification on the received data and packages the verified data into blocks and links them to the local blockchain ledger. S7. When the equipment manufacturer needs to obtain equipment operation data, it sends a data query request to the blockchain network platform; S8. The blockchain network platform responds to data query requests, restores device operation data through smart contracts, and provides feedback.

2. The personalized privacy data protection method according to claim 1, characterized in that: Each enterprise and gateway needs to register as an entity with a trusted organization, including the following steps: The enterprise and gateway calculate the signature based on the identity and current timestamp, and send the identity and current timestamp together with the signature to the trusted organization to make a registration request; After receiving the registration request message, the trusted institution checks whether the timestamp is the latest and verifies the signature. If the verification is successful, the trust institution sends feedback to the corresponding enterprise and gateway to complete the entity registration. The calculation formula of the signature is: , in, h For signature, id For identity identification, is the timestamp, H 1 is the hash function set by the trusted organization; The verification signature refers to the trusted agency judging the equation based on the received identity, timestamp and signature. Is it true? If so, the verification is successful.

3. The personalized privacy data protection method according to claim 1, wherein: Step S1 includes: S101. Enterprises should classify the sensitivity of the collected multi-dimensional equipment operation data based on their own production conditions. The higher the sensitivity, the more protection is needed for the data. S102. Calculate sensitivity weight based on sensitivity: , in, Representation device i No. j Dimensional data sensitivity, is the corresponding sensitivity weight; S103. Allocate privacy budget based on sensitivity weights: , in, Indicates the device is assigned i No. j Dimensional data privacy budget, Indicates the device is assigned i The higher the sensitivity weight, the smaller the privacy budget allocated, and the greater the disturbance when differential privacy is perturbed.

4. The personalized privacy data protection method according to claim 3, wherein: Step S101 includes: Predefined attribute order: Sort data attributes from high to low based on the mutual information between them to determine the dependency between them. The higher the mutual information, the stronger the dependency between the two attributes. Select parent node set: Select a parent node set for each attribute, and select the optimal parent node set by calculating the mutual information and dynamic weight values ​​between attributes; Generate Bayesian network: Construct a Bayesian network based on the set of parent nodes. Each node in the Bayesian network represents an attribute, and the edges connecting nodes represent the conditional dependencies between attributes. The global sensitivity and conditional sensitivity are calculated based on the Bayesian network, and the global sensitivity and conditional sensitivity are weighted and summed, and the weighted sum value is used as the final sensitivity.

5. The personalized privacy data protection method according to claim 1, wherein: In step S2, a personalized differential privacy perturbation algorithm is used to perform differential privacy perturbation based on the privacy budget of each dimension of the multi-dimensional device operation data. Different levels of enterprises use different perturbation mechanisms for personalized differential privacy perturbation: enterprises with a mild privacy protection level use the Gaussian perturbation mechanism, enterprises with a moderate privacy protection level use the Laplace perturbation mechanism, and enterprises with a severe privacy protection level use the NM perturbation mechanism.

6. The personalized privacy data protection method according to claim 1, wherein: In step S5, the validity verification means that the gateway , verify the equation Is it established? If so, the verification is successful. in, Represents the device after differential privacy perturbation i No. j Dimensional data After Shamir's secret split l share, is the corresponding message verification code, rd is the current round number, is the corresponding timestamp, H 2 is the hash function set by the trusted organization; To increase the verification speed, batch verification is used to verify whether the following equation is true. If so, the verification passes: in, n Indicates the total number of devices, w Indicates the total number of data dimensions.

7. The personalized privacy data protection method according to claim 6, characterized in that: In step S5, the aggregation operation includes: aggregating the multiple received data based on the additive homomorphic property to obtain aggregated data corresponding to the device operation data and an aggregated budget corresponding to the privacy budget; adding a message verification code to the aggregated data and the aggregated budget respectively to form a data aggregation report and a budget aggregation report, which are uploaded to the blockchain network platform.

8. The personalized privacy data protection method according to claim 6, characterized in that: In step S6, the integrity check refers to the blockchain network platform performing message verification through the smart contract, verifying the received message verification code, and determining whether the calculation of the message verification code is valid. If so, the verification is passed.

9. The personalized privacy data protection method according to claim 7, wherein: In step S8, First, the blockchain network platform searches for the data aggregation report share and budget aggregation report share of each enterprise and randomly selects Then, through smart contracts, the two types of reports are restored by Lagrange interpolation calculation based on Shamir's secret sharing algorithm; After recovering the privacy budget for each dimension of the enterprise's device operation data, the weighted total privacy budget is calculated and fed back to the device manufacturer: ， in, Representation device i The total weighted privacy budget of Indicates the device is assigned i The total privacy budget, Indicates the device is assigned i No. j The privacy budget of the dimensional data, represents the minimum value in the privacy budget allocation.

10. A personalized privacy data protection system based on the method according to any one of claims 1 to 9, characterized in that: It includes several local clients, device sensor modules, privacy budget allocation modules, differential privacy modules and blockchain network platforms; the device sensor modules are used to collect device operation data, and the privacy operation allocation module is used to divide the collected device operation data into privacy budgets; the differential privacy module is used to perform differential privacy perturbations on the device operation data according to the divided privacy budgets, and split the data according to the Shamir secret sharing algorithm; the local client is used to upload the split data shares to the corresponding gateway, and the gateway aggregates the secret shares of the data and sends them together with the budget to the blockchain network platform; the blockchain network platform retrieves the data according to the access request, and restores the device operation data and the corresponding privacy budget through the smart contract to respond to the request.

Images