A digital campus-oriented data privacy protection method and system
By assessing and screening the initial and advanced sensitivity of data items and performing multi-stage k-anonymization, the problem of re-identification risk after data item combination in digital campuses is solved, thereby improving the reliability and security of data privacy protection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- SHAANXI LONGXIANG FOUR DIMENSIONAL SPACE INFORMATION TECH CO LTD
- Filing Date
- 2026-05-15
- Publication Date
- 2026-07-14
AI Technical Summary
Existing anonymization methods fail to fully consider the impact of data item combinations on the ability to distinguish user records, resulting in poor anonymization performance in digital campus scenarios and the risk of re-identification.
By evaluating the initial sensitivity of data items and performing k-anonymization, the first number of records and the deepening sensitivity are determined. Data items that contribute significantly to distinguishing user records after combination are selected and further k-anonymized to generate the final anonymized dataset.
It improves the reliability of privacy protection for multi-source data in digital campuses under combined attack scenarios, reduces the risk of re-identification, and ensures the security of data sharing and analysis.
Smart Images
Figure CN122197083B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of data privacy protection technology, specifically to a data privacy protection method and system for digital campuses. Background Technology
[0002] A digital campus, centered on a computer network, integrates various information resources within the campus to build a unified digital management and service platform. The campus card system, a crucial component of the digital campus, handles multiple functions including payment, access control, and library borrowing, accumulating a large amount of data records in its daily operation, including student identity information, spending behavior, and spatiotemporal trajectories. To support educational management and service decisions, this data often needs to be analyzed, shared, or publicly released, requiring effective privacy protection measures before its use.
[0003] To protect privacy data in digital campus scenarios, anonymization techniques are widely used. These techniques reduce the uniqueness of data items by performing generalization or perturbation on each data item in the dataset, and configure the anonymization strength according to the sensitivity of the data item, thereby achieving differentiated privacy protection. However, existing anonymization methods typically only analyze the independent value distribution characteristics of the data item when assessing its sensitivity, failing to fully consider the impact of different combinations of data items on the ability to distinguish user records. This results in anonymized data still being at risk of being re-identified under multiple data combinations, leading to poor overall privacy protection. Summary of the Invention
[0004] To address the technical problem of ineffective privacy protection in digital campus anonymization due to insufficient consideration of the correlation between data item combinations, the present invention aims to provide a data privacy protection method and system for digital campuses. The specific technical solution adopted is as follows:
[0005] Firstly, a data privacy protection method for digital campuses is provided. This method includes: acquiring a digital campus dataset to be processed, the dataset containing multiple user records, each user record having multiple data items; for each data item, determining the initial sensitivity of the data item based on the frequency of occurrence of each value within the data item, and performing k-anonymity processing on the data item based on the initial sensitivity to obtain an initial anonymized dataset; determining a first number of records based on a set of records where values are consistent across all data items; for each data item, determining a second number of records based on a set of records where values are consistent across all other data items, and determining a deeper sensitivity of the data item based on the initial sensitivity, the first number of records, and the second number of records, where the deeper sensitivity characterizes the contribution of the data item to distinguishing user records after combining with other data items; determining data items to be deepened based on the deeper sensitivity of each data item, and performing further k-anonymity processing on the data items to be deepened to generate a final anonymized dataset.
[0006] In one possible design, the initial sensitivity of a data item is determined based on the frequency of occurrence of each value within the data item. This includes: obtaining the frequency of occurrence of each value of the data item in all user records; determining the privacy exposure risk value corresponding to each value based on the frequency of occurrence of each value and a preset scaling constant; and determining the initial sensitivity of the data item based on each privacy exposure risk value, the number of records corresponding to each privacy exposure risk value, and the total number of user records.
[0007] In one possible design, k-anonymization is performed on data items based on initial sensitivity to obtain an initial anonymized dataset. This includes: if the initial sensitivity is greater than a first preset threshold, incrementing the k value corresponding to the data item, performing k-anonymization on the data item based on the incremented k value, and updating the initial sensitivity of the data item according to the frequency of occurrence of each value within the processed data item, until the initial sensitivity is less than or equal to the first preset threshold; if the initial sensitivity is less than or equal to the first preset threshold, determining the k value corresponding to the data item and the initial anonymized data, wherein the initial anonymized dataset includes the initial anonymized data corresponding to all data items.
[0008] In one possible design, the first record number is determined based on a set of records where the values across all data items are consistent. This includes: generating a corresponding full-item combination identifier for each user record based on the values across all data items for each user record in the initial anonymized dataset; counting the number of user records corresponding to each full-item combination identifier; determining the set of user records corresponding to the full-item combination identifier with the smallest number of user records and a greater than zero number of user records as a candidate record group; if multiple candidate record groups exist, determining the first candidate record group as the minimum record group according to a preset filtering rule; if only one candidate record group exists, determining the candidate record group as the minimum record group; and using the number of user records in the minimum record group as the first record number.
[0009] In one possible design, for each data item, a second record number is determined based on the set of records that have the same value across all other data items. The deeper sensitivity of the data item is then determined based on the initial sensitivity, the first record number, and the second record number. This includes: for each data item, determining the number of user records in the dataset that have the same value across all other data items as the smallest record group as the second record number; obtaining the maximum record number among the second record numbers corresponding to all data items; and for each data item, determining the deeper sensitivity based on the initial sensitivity, the first record number, the total number of user records, the second record number corresponding to the data item, and the maximum record number.
[0010] In one possible design, the data items to be deepened are determined based on the deepening sensitivity of each data item, and further k-anonymization processing is performed on the data items to be deepened to generate the final anonymized dataset. This includes: if the deepening sensitivity of at least one data item is greater than a second preset threshold, the data item corresponding to the highest deepening sensitivity among all deepening sensitivities is determined as the data item to be deepened; the k value corresponding to the data item to be deepened is incremented, and k-anonymization processing is performed on the data item to be deepened based on the incremented k value to obtain an iterative anonymized dataset; based on the iterative anonymized dataset, the deepening sensitivity corresponding to all data items is updated until the deepening sensitivity of all data items is less than or equal to the second preset threshold; the dataset with all deepening sensitivities less than or equal to the second preset threshold is determined as the final anonymized dataset.
[0011] In one possible design, the above method further includes: determining the preliminary anonymized dataset as the final anonymized dataset when the deepening sensitivity of all data items is less than or equal to a second preset threshold.
[0012] In one possible design, obtaining the digital campus dataset to be processed includes: collecting data records within a preset time period from the digital campus smart card data recording system. The data records include one or more of the following: user identification data, consumption data, and spatiotemporal data. The data records are then classified and stored according to the data type of each data item to obtain a digital campus dataset containing multiple user records. The data types include string type and numeric type.
[0013] In one possible design, the generalization processing methods used in k-anonymization include: replacing the specific value of a numeric data item with a preset numeric range; replacing the specific value of a string data item belonging to a category attribute with its parent category; and replacing some consecutive characters in a string data item belonging to an identity attribute with preset masking characters.
[0014] Secondly, a data privacy protection system for digital campuses is provided, comprising: a data acquisition unit for acquiring a digital campus dataset to be processed, the dataset containing multiple user records, each user record having multiple data items; a preliminary anonymization unit for determining the preliminary sensitivity of each data item based on the frequency of occurrence of each value within the data item, and performing k-anonymization processing on the data item based on the preliminary sensitivity to obtain a preliminary anonymized dataset; a combination analysis unit for determining a first number of records based on a set of records where values are consistent across all data items, and for each data item, determining a second number of records based on a set of records where values are consistent across all other data items, and determining a deeper sensitivity of the data item based on the preliminary sensitivity, the first number of records, and the second number of records, the deeper sensitivity characterizing the contribution of the data item to distinguishing user records after being combined with other data items; and a deeper anonymization unit for determining data items to be deepened based on the deeper sensitivity of each data item, and performing further k-anonymization processing on the data items to be deepened to generate a final anonymized dataset.
[0015] The present invention has the following beneficial effects:
[0016] The data privacy protection method and system for digital campuses provided by this invention first assesses the initial sensitivity of each data item and performs k-anonymization. Then, based on the combination constraints of all data items, a first number of records is determined, and the constraints on individual data items are removed one by one to determine the second number of records for each data item. Finally, the increased sensitivity of each data item is determined by combining the initial sensitivity, the first number of records, and the second number of records. Based on this, data items that contribute significantly to distinguishing user records after combining other data items are selected for further k-anonymization. This two-stage processing method ensures that the anonymization process considers not only the value distribution characteristics of individual data items but also the combined effect of multiple data items on the user identification range. It can apply a stronger anonymization intensity to data items that contribute more to user differentiation under combined constraints, thereby reducing the risk of re-identification of the dataset in combined attack scenarios and improving the reliability of privacy protection for multi-source data in digital campuses. Attached Figure Description
[0017] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0018] Figure 1 This is a flowchart illustrating a data privacy protection method for digital campuses, provided as an embodiment of the present invention.
[0019] Figure 2 This is a schematic diagram of a data privacy protection system for digital campuses provided in one embodiment of the present invention. Detailed Implementation
[0020] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a data privacy protection method and system for digital campuses proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.
[0021] In embodiments of the present invention, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" or "for example" in embodiments of the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.
[0022] In the description of this invention, unless otherwise stated, " / " means "or". For example, A / B can mean A or B. The term "and / or" in this document is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A alone, A and B simultaneously, and B alone. Furthermore, "at least one" and "more than one" refer to two or more. The terms "first," "second," etc., do not limit the quantity or order of execution, and "first," "second," etc., do not necessarily imply differences.
[0023] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.
[0024] The following description, in conjunction with the accompanying drawings, details a specific solution for a data privacy protection method and system for digital campuses provided by this invention.
[0025] Please see Figure 1 The diagram illustrates a flowchart of a data privacy protection method for digital campuses according to an embodiment of the present invention, including the following steps S101-S105.
[0026] S101. Obtain the digital campus dataset to be processed.
[0027] The dataset contains multiple user records, and each user record has multiple data items.
[0028] As one possible approach, when data analysis, sharing, or public disclosure is required, data records within a preset time period (which can be set according to needs, such as the most recent week or the most recent month) can be collected from the digital campus card data recording system. These data records include one or more of the following: user identification data, consumption data, and spatiotemporal data.
[0029] Optionally, identity data includes, but is not limited to, card number, student ID, name, national ID number, college and grade; consumption data includes, but is not limited to, card balance and consumption amount; spatiotemporal data includes, but is not limited to, card swipe time and card swipe location.
[0030] The collected data records are further categorized and stored according to the data type of each data item, resulting in a digital campus dataset containing multiple user records. The data types include string and numeric types. String types are used to store data items corresponding to identity identification data (such as card number, student ID, name, and national ID number), while numeric types are used to store data items corresponding to numeric attributes in consumption data and spatiotemporal data (such as card balance, consumption amount, and age).
[0031] Each user record corresponds to a user's campus card usage data within a preset time period, and each user record contains multiple data items. For example, the digital campus dataset contains... Each user record contains [number] user records. One data item.
[0032] S102. For each data item, determine the initial sensitivity of the data item based on the frequency of occurrence of each value within the data item, and perform k-anonymization processing on the data item based on the initial sensitivity to obtain the initial anonymized dataset.
[0033] First, for each data item, obtain the frequency of each value of that data item across all user records.
[0034] In some embodiments, with the first Let's take one data item as an example to illustrate, where... From 1 to Positive integers between [a certain range].
[0035] Statistics All of the data items The different values and frequencies of each user record. Let the first user record be... There are data items There are 10 different possible values, and the frequency of each value is denoted as . ,in From 1 to Positive integers between [a certain value]. All possible values are categorized as follows: Arrange the values in ascending order to obtain the value sequence. , … That is, satisfying … .
[0036] Furthermore, based on the frequency of occurrence of each value and the preset scaling constant, the privacy exposure risk value corresponding to each value is determined.
[0037] Optionally, the frequency of occurrence of each value and the privacy exposure risk value corresponding to each value satisfy the following mapping relationship including a preset scaling constant.
[0038]
[0039] In the formula, For the first Frequency of occurrence of the given value This is a preset scaling constant, which can be empirically set to 0.01, used to map the obtained results to a reasonable calculation range. For the first The less frequently a value appears, the smaller the scope of users it can be limited to, and the higher the corresponding privacy exposure risk.
[0040] Furthermore, the initial sensitivity of data items is determined based on each privacy exposure risk value, the number of records corresponding to each privacy exposure risk value, and the total number of user records.
[0041] Optionally, the privacy exposure risk values are statistically analyzed, and a total of [number] values are determined. The privacy exposure risk value will be the first The privacy exposure risk value is denoted as ( The value is the first Privacy exposure risk value). From 1 to Positive integers between 1 and 2 will be the first The sum of the number of records for each data item corresponding to a privacy exposure risk value is determined as the first value. The number of records corresponding to each privacy exposure risk value is denoted as: Then, the initial sensitivity of the data item is determined according to the following calculation formula.
[0042]
[0043] In the formula, For the first The number of privacy exposure risk values included in each data item For the first The number of records corresponding to each privacy exposure risk value. Record the total number for each user. For the first Privacy exposure risk value, Indicates the first The ratio of the number of records corresponding to a certain privacy exposure risk value to the total number of user records is used to assess privacy exposure risk. Weighting, This indicates normalization processing. In this embodiment, the maximum-minimum value normalization method can be used to normalize the values. The calculated values are mapped to [0,1], where the maximum and minimum values are obtained by calibration using sample data from the system's historical normal operation. For the first The initial sensitivity of a data item; the higher the value, the more sensitive the data item.
[0044] Furthermore, an initial k value is set for all data items. The initial sensitivity of all data items is compared with a first preset threshold.
[0045] Among them, the first Taking one data item as an example, if If the value is greater than a first preset threshold (the first preset threshold is used to characterize the minimum sensitivity requirement for privacy protection, for example, an empirical value of 0.5), then the [missing information] will be [missing information]. The k value corresponding to each data item is incremented (in this embodiment, the preset step size is 1), and k-anonymization is performed on the data item based on the incremented k value. Then, based on the processed k value... The frequency of occurrence of each value within each data item is recalculated and updated. The initial sensitivity of each data item is used to further determine the updated... Is it greater than the first preset threshold, until... The iteration continues until it is less than or equal to the first preset threshold or the number of iterations reaches the first preset maximum number of iterations (e.g., 7 times).
[0046] like If it is less than or equal to the first preset threshold, then determine the first... The k-value corresponding to the data item and the preliminary anonymized data, wherein, if the k-value of the data item is... When each data item is judged for the first time If the threshold is less than or equal to the first preset threshold, then the first threshold will be directly set to the next threshold. The initial data of the k-th data item is used as the corresponding preliminary anonymization data. If it is not the first time, the data after the current k-anonymization process is used as the k-th anonymization data. Preliminary anonymization of data items.
[0047] It should be noted that, in relation to the first When k-anonymization is performed on a data item, a corresponding generalization method is selected from the preset anonymization strategy library according to the data type of the data item, so that the number of records with different values in the data item that are merged into the same value after generalization meets the minimum number of records corresponding to the current k value of the data item.
[0048] For example, if the first For data items that are numerical, such as card balance, spending amount, or age, the specific value in that data item will be replaced with a preset numerical range to which that value belongs. The range of the preset numerical range is determined by the current k value of the data item. The larger the k value, the wider the range of the preset numerical range, and the more records are merged within the same range. For example, when the age data item has a k value of 2, the specific age value will be replaced with age ranges such as 18 to 20 years old, 21 to 23 years old, etc. As the k value increases, the age range will expand accordingly, such as 18 to 22 years old, 23 to 26 years old, etc., to meet higher anonymization requirements.
[0049] If the first If a data item is a string representing a category attribute, such as its college or grade, then the specific value in that data item will be replaced with its parent category. The level of the parent category is determined by the current k value of the data item. The larger the k value, the higher the level of the selected parent category, and the coarser the granularity of the merged category. For example, when the k value of the college data item is small, colleges under the same discipline can be merged into a parent category, such as merging "Computer Science College" and "Software Engineering College" into "Information Technology". As the k value increases, more colleges can be merged into higher-level parent categories.
[0050] If the first If a data item is a string type belonging to the identity attribute, such as student ID, card number, or national ID number, then a portion of consecutive characters in that data item will be replaced with a preset masking character. The degree of masking is determined by the current k value of the data item; the larger the k value, the more consecutive characters are replaced, and the higher the degree of masking. For example, for the student ID data item with a k value of 2, the last two digits will be replaced with the masking character "". As the value of k increases, the number of digits being replaced increases accordingly, such as replacing the last four digits with a mask character. ".
[0051] Based on the above steps, for all After performing the above process on each data item, the k value and preliminary anonymized data corresponding to each data item are obtained. The preliminary anonymized data corresponding to all data items are summarized to form the preliminary anonymized dataset.
[0052] S103. Determine the first record number based on the set of records where all data items have the same value.
[0053] As one possible implementation, a corresponding full-item combination identifier is generated for each user record based on the values of each user record across all data items in the initial anonymized dataset. This full-item combination identifier is used to characterize a user record across all data items. The combination of values for each data item is formed by concatenating the values recorded by the user for each data item in the order of the data items.
[0054] For example, the first anonymized dataset... The complete combination identifier of a user record is ,in From 1 to Positive integers between Recorded by the user from the first data item to the second. The values of each data item , … Arranged sequentially, that is 、 、…、 For user records whose values are generalized and merged after initial k-anonymization, the value for the corresponding data item is the value after generalization.
[0055] Furthermore, the number of user records corresponding to each type of full-item combination identifier is counted.
[0056] For example, iterate through all data in the initial anonymized dataset. For each user record, generate its complete identifier. Group user records with identical complete identifiers into the same record group. Assume there are multiple... There are 2 different full-item combination identifiers, and the number of user records corresponding to each full-item combination identifier is as follows: , … Among them, the larger the number of corresponding user records, the more likely the total number of records is to be included. The more user records with completely identical values across all data items, the lower the risk of this group of user records being distinguished and located. Correspondingly, a smaller number of corresponding user records in the full-item combination identifier indicates that, across all... The fewer the number of user records with completely identical values on each data item, the higher the risk of that group of user records being distinguished and located.
[0057] Furthermore, the set of user records corresponding to the smallest combination of user record counts with a greater than zero count is identified as a candidate record group. If multiple candidate record groups exist, one candidate record group is selected as the minimum record group according to a preset filtering rule. If only one candidate record group exists, that candidate record group is identified as the minimum record group, and the number of user records in the minimum record group is taken as the first record count, denoted as . This indicates the range of users that can be limited under all combinations of data items.
[0058] For example, the preset filtering rule is to select the candidate record group with the coarsest generalization of the identity identifier type data items included in the data item value combination, or to select the first candidate record group that has been traversed.
[0059] S104. For each data item, determine the second record number based on the set of records where the values are consistent across all other data items except the data item, and determine the advanced sensitivity of the data item based on the initial sensitivity of the data item, the first record number, and the second record number.
[0060] Among them, the contribution of the sensitivity representation data item to distinguishing user records after being combined with other data items is analyzed.
[0061] First, for each data item, in the dataset, the number of user records whose values are consistent with the minimum record group on all other data items is determined as the second record number.
[0062] In some embodiments, with the first Taking the first data item as an example, in the full item combination identifier corresponding to the smallest record group, the cancellation of the first data item... Value restrictions for each data item, retaining only the remaining values. The value constraints on each data item form a partial combination identifier. This is applied to the entire initially anonymized dataset. In the user records, the matching and partial combination identifiers are in addition to the first one. The number of user records that have the same value on all data items except for the first data item is determined as the th. The number of the second record corresponding to each data item is denoted as . Because the first [item] was revoked The matching range for each data item is usually expanded compared to the smallest group of records. ,because Greater than zero, correspondingly, The minimum value is also greater than zero. The larger the value, the more likely it is to be revoked. The more user records matched after limiting a data item, the greater the contribution of that data item to narrowing the user scope in the combined limitation.
[0063] Furthermore, obtain the maximum number of records among the second record counts corresponding to all data items.
[0064] For example, iterate through all Each data item is assigned a second record number. , … Take the maximum value among them, and denote it as . It is used to characterize the maximum matching range that can be achieved after removing the constraint of a single item among all data items, and serves as a reference benchmark for measuring the contribution of each data item constraint.
[0065] Furthermore, for each data item, the advanced sensitivity of the data item is determined based on the initial sensitivity, the number of first records, the total number of user records, the number of second records corresponding to the data item, and the maximum number of records.
[0066] Optional, the first Deepening sensitivity of individual data items The calculation formula is as follows:
[0067]
[0068] In the formula, and These are the weighting coefficients. Its value can be pre-calibrated based on sample data from historical normal operation, such as... or ; For the first Preliminary sensitivity of each data item This is the first record number, and its value is greater than zero. This represents the total number of user records, and its value is greater than zero. The percentage of the first record out of the total number of user records. For the first The ratio of the initial sensitivity of a data item to the proportion of the minimum user range under all data item combinations to the total number of user records. The larger this ratio, the higher the sensitivity of the data item is within a narrower limit, and the higher the degree of anonymization needs to be. For the first The number of the second record corresponding to each data item The maximum number of records, because If the minimum value is greater than zero, then The minimum value is greater than zero. Characterizing the first The degree of contribution of each data item to the combination constraint. The closer The greater the contribution, the stronger the need for deeper anonymity; This indicates normalization processing. In this embodiment, the maximum-minimum value normalization method can be used to normalize the values. The calculated values are mapped to [0,1], where the maximum and minimum values are obtained by calibration from sample data during the system's historical normal operation; For the first The deeper sensitivity of a data item is determined by its value. The higher the value, the greater the contribution of that data item to distinguishing user records after being combined with other data items, and the more necessary it is to undergo further k-anonymization.
[0069] Based on this, for all The above process is performed on each data item to obtain the depth sensitivity of each data item.
[0070] S105. Determine the data items to be deepened based on the deepening sensitivity of each data item, and perform further k-anonymization processing on the data items to be deepened to generate the final anonymized dataset.
[0071] First, determine whether there is a value in the sensitivity of each data item that is greater than the second preset threshold.
[0072] In some embodiments, all Deepening sensitivity of individual data items , … Each data item is compared with a second preset threshold (an empirical value of 0.6 is acceptable), where the second preset threshold represents the minimum level of privacy protection required under the combined constraints. If the sensitivity of all data items is less than or equal to the second preset threshold, it is considered that the minimum user range that can be located by the combination of data items after the current initial anonymization process meets the privacy protection requirements, and no further anonymization is needed. The initial anonymized dataset is then directly determined as the final anonymized dataset.
[0073] Furthermore, if at least one data item has a depth sensitivity greater than the second preset threshold, the data item corresponding to the highest depth sensitivity among all depth sensitivities is determined as the data item to be deepened.
[0074] Optional, from , … Select the maximum value from the middle ,Will The corresponding data item is determined as the data item to be deepened in this iteration. If multiple data items have the same maximum deepening sensitivity, one of them is selected as the data item to be deepened according to a preset priority rule, such as selecting the data item with the smallest data item number.
[0075] Furthermore, the k value corresponding to the data item to be deepened is incremented, and k-anonymization is performed on the data item to be deepened based on the incremented k value to obtain an iterative anonymized dataset.
[0076] In some embodiments, the k-value corresponding to the data item to be deepened is incremented incrementally based on the existing value, with a preset increment step size. Based on the incremented k-value, k-anonymization is then performed on the data item. During k-anonymization, the generalization processing method described in the preceding steps is used. A corresponding generalization processing method is selected from a preset anonymization strategy library according to the data type of the data item to be deepened. This will not be elaborated further here. After k-anonymization, an iteratively anonymized dataset is obtained.
[0077] Furthermore, based on the iteratively anonymized dataset, the depth sensitivity corresponding to all data items is updated until the depth sensitivity of all data items is less than or equal to the second preset threshold, or the number of iterations reaches the second preset maximum number of iterations.
[0078] For example, using the iteratively anonymized dataset as the base data, the complete process of determining the first number of records, the second number of records, and the depth sensitivity in the aforementioned steps is repeated, and will not be elaborated here. Each updated depth sensitivity is compared again with the second preset threshold. If at least one depth sensitivity is still greater than the second preset threshold, the iterative process of selecting the data item corresponding to the maximum depth sensitivity, incrementing the k-value, performing k-anonymization, and recalculating the depth sensitivity is repeated until the depth sensitivity of all data items is less than or equal to the second preset threshold, or the number of iterations reaches the second preset maximum number of iterations (e.g., 10). When the depth sensitivity of all data items is less than or equal to the second preset threshold, the current dataset is determined as the final anonymized dataset.
[0079] Understandably, in the final anonymized dataset, each data item has undergone different degrees of differentiated k-anonymization processing based on its corresponding k value. The individual sensitivity of each data item and the enhanced sensitivity after combining and limiting the data items both meet the preset privacy protection requirements. This achieves the goal of meeting the needs of application scenarios such as data sharing, analysis, and public disclosure in digital campuses while ensuring the personal privacy and security of students.
[0080] Please see Figure 2 The diagram illustrates a structural schematic of a data privacy protection system for digital campuses according to an embodiment of the present invention. Figure 2 As shown, the data privacy protection system 20 for digital campuses includes a data acquisition unit 21, a preliminary anonymization unit 22, a combined analysis unit 23, and a deep anonymization unit 24.
[0081] The data acquisition unit 21 is used to acquire the digital campus dataset to be processed. The dataset contains multiple user records, and each user record has multiple data items.
[0082] The preliminary anonymization unit 22 is used to determine the preliminary sensitivity of each data item based on the frequency of occurrence of each value within the data item, and to perform k-anonymization processing on the data item based on the preliminary sensitivity to obtain the preliminary anonymized dataset.
[0083] The combined analysis unit 23 is used to determine a first number of records based on a set of records in which all data items have the same value, and for each data item, to determine a second number of records based on a set of records in which all other data items have the same value, and to determine a deeper sensitivity of the data item based on the initial sensitivity of the data item, the first number of records, and the second number of records. The deeper sensitivity characterizes the contribution of the data item to distinguishing user records after combining other data items.
[0084] The enhanced anonymization unit 24 is used to determine the data items to be enhanced based on the enhancement sensitivity of each data item, and to perform further k-anonymization processing on the data items to be enhanced to generate the final anonymized dataset.
[0085] It should be noted that the data privacy protection system 20 for digital campuses provided in the above embodiments is only an example of the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above.
[0086] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.
[0087] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.
Claims
1. A data privacy protection method for digital campuses, characterized in that, The method includes: Obtain the digital campus dataset to be processed, which contains multiple user records, each with multiple data items; For each data item, the initial sensitivity of the data item is determined based on the frequency of occurrence of each value within the data item, and k-anonymization is performed on the data item based on the initial sensitivity to obtain an initial anonymized dataset; The first record number is determined based on the set of records where all data items have the same value. For each data item, a second number of records is determined based on the set of records in which the values are consistent across all other data items except the data item. The advanced sensitivity of the data item is determined based on the initial sensitivity of the data item, the first number of records, and the second number of records. The advanced sensitivity characterizes the contribution of the data item to distinguishing user records after being combined with other data items. Based on the depth sensitivity of each data item, the data items to be deepened are determined, and further k-anonymization processing is performed on the data items to be deepened to generate the final anonymized dataset.
2. The data privacy protection method for digital campuses according to claim 1, characterized in that, Based on the frequency of occurrence of each value within the data item, the preliminary sensitivity of the data item is determined, including: Get the frequency of occurrence of each value of the data item in all user records; Based on the frequency of occurrence of each value and the preset scaling constant, determine the privacy exposure risk value corresponding to each value; The initial sensitivity of the data item is determined based on each privacy exposure risk value, the number of records corresponding to each privacy exposure risk value, and the total number of user records.
3. The data privacy protection method for digital campuses according to claim 1, characterized in that, Based on the initial sensitivity, k-anonymization is performed on the data items to obtain a preliminary anonymized dataset, including: If the initial sensitivity is greater than the first preset threshold, the k value corresponding to the data item is incremented, and k-anonymization is performed on the data item based on the incremented k value. The initial sensitivity of the data item is updated according to the frequency of occurrence of each value in the processed data item until the initial sensitivity is less than or equal to the first preset threshold. If the initial sensitivity is less than or equal to the first preset threshold, the k value corresponding to the data item and the initial anonymized data are determined. The initial anonymized dataset includes the initial anonymized data corresponding to all data items.
4. The data privacy protection method for digital campuses according to claim 1, characterized in that, The first record number is determined based on the set of records where all data items have the same value, including: Based on the values of each user record in all data items in the preliminary anonymized dataset, a corresponding full-item combination identifier is generated for each user record; Count the number of user records corresponding to each type of full-item combination identifier; The set of user records corresponding to the full combination identifier with the smallest number of user records and a greater than zero number of user records is identified as the candidate record group; If there are multiple candidate record groups, the first candidate record group is determined as the smallest record group according to the preset screening rules; if there is only one candidate record group, the candidate record group is determined as the smallest record group. The number of user records in the minimum record group is taken as the first record number.
5. The data privacy protection method for digital campuses according to claim 4, characterized in that, For each data item, a second record number is determined based on the set of records where the values are consistent across all other data items. The deeper sensitivity of the data item is then determined based on the initial sensitivity of the data item, the first record number, and the second record number, including: For each data item, in the dataset, the number of user records whose values are consistent with the minimum record group on all other data items except the data item is determined as the second record number; Get the maximum number of records in the second record count for all data items; For each data item, the in-depth sensitivity of the data item is determined based on the initial sensitivity, the first number of records, the total number of user records, the second number of records corresponding to the data item, and the maximum number of records.
6. The data privacy protection method for digital campuses according to claim 3, characterized in that, Based on the depth sensitivity of each data item, data items to be deepened are determined, and further k-anonymization processing is performed on the data items to be deepened to generate the final anonymized dataset, including: If at least one data item has a depth sensitivity greater than the second preset threshold, the data item corresponding to the maximum depth sensitivity among all depth sensitivities is determined as the data item to be deepened. The k value corresponding to the data item to be deepened is incremented, and k-anonymization is performed on the data item to be deepened based on the incremented k value to obtain an iterative anonymized dataset; Based on the iterative anonymized dataset, update the depth sensitivity of all data items until the depth sensitivity of all data items is less than or equal to the second preset threshold. The dataset whose deepening sensitivity is less than or equal to the second preset threshold is determined as the final anonymized dataset.
7. The data privacy protection method for digital campuses according to claim 5, characterized in that, The method further includes: If the deepening sensitivity of all data items is less than or equal to the second preset threshold, the preliminary anonymized dataset is determined as the final anonymized dataset.
8. The data privacy protection method for digital campuses according to claim 1, characterized in that, Obtain the digital campus dataset to be processed, including: Data records within a preset time period are collected from the digital campus card data recording system. The data records include one or more of the following: user identification data, consumption data, and spatiotemporal data. The data records are classified and stored according to the data type of each data item to obtain a digital campus dataset containing multiple user records. The data types include string type and numeric type.
9. The data privacy protection method for digital campuses according to claim 1, characterized in that, The generalization methods used in k-anonymization include: Replace the specific value of the numeric data item with the preset numeric range to which the value belongs; Replace the specific value of the data item belonging to the category attribute in the string type with the parent category to which the value belongs; Replace a portion of consecutive characters in the data items belonging to the identity attribute in the string type with preset mask characters.
10. A data privacy protection system for digital campuses, characterized in that, include: The data acquisition unit is used to acquire a digital campus dataset to be processed, which contains multiple user records, each user record having multiple data items; The preliminary anonymization unit is used to determine the preliminary sensitivity of each data item based on the frequency of occurrence of each value within the data item, and to perform k-anonymization processing on the data item based on the preliminary sensitivity to obtain a preliminary anonymized dataset. The combined analysis unit is used to determine a first number of records based on a set of records in which the values are consistent across all data items, and for each data item, to determine a second number of records based on a set of records in which the values are consistent across all other data items, and to determine a deeper sensitivity of the data item based on the initial sensitivity of the data item, the first number of records, and the second number of records, wherein the deeper sensitivity characterizes the contribution of the data item to distinguishing user records after being combined with other data items; The enhanced anonymization unit is used to determine the data items to be enhanced based on the enhancement sensitivity of each data item, and to perform further k-anonymization processing on the data items to be enhanced to generate the final anonymized dataset.