Data outsourcing privacy protection method, system and storage medium

Abstract

The present invention claims a data outsourcing privacy protection method, system and storage medium, including the following steps: in the system initialization stage, the location service provider (LBSP) generates system public parameters and keys, after which the new user registers with the LBSP to obtain the keys for query trap construction and data decryption; in the data encryption stage, the LBSP encrypts the location service (LBS) data set to achieve LBS data confidentiality and upload the ciphertext data to the cloud server. In order to protect personal privacy, the user encrypts his query request and sends it to the cloud server for query; after receiving the LBS ciphertext data set and query trap, the cloud server performs matching calculations and returns the ciphertext data that meets the query to the user; finally, the user decrypts the ciphertext data to obtain the actual data. The present invention can well solve the needs of user interval query and privacy protection, and greatly improves the query efficiency and significantly reduces the query communication overhead.

Description

Technical Field

[0001] The invention belongs to the field of information security technology and location service technology, and is a privacy protection method for LBS data outsourcing, which can be used for user privacy query in data outsourcing. Background Art

[0002] With the rapid popularization of location-aware smart terminals and the development of wireless communication networks, location-based services have been widely used. The location positioning system in the smart terminal can be used to easily obtain the current accurate location information and obtain the corresponding location services, such as traffic navigation, point of interest query, location sharing, logistics services, etc. In location-based services, users first need to submit their location and query requests to the LBSP. After receiving the location information sent by the user, the LBSP processes the user's query request and returns the corresponding query results. With the rapid development of cloud computing technology and the continuous increase in the amount of LBS data, more and more LBSPs are beginning to consider outsourcing their location data and query services to cloud servers with powerful computing power. However, in an outsourced environment, cloud servers are usually considered to be honest and curious, that is, they will honestly execute the user's query request, but will also try to analyze the stored LBS data and guess the user's query content based on the user's query request. Since the submitted data directly contains the user's location information when requesting location services, and the query content will also disclose sensitive information such as the user's interests, hobbies, and living habits to a certain extent, if these private information is leaked to an untrustworthy third party (such as a cloud server), it will pose a serious threat to the user's privacy in all aspects. For example, by acquiring the user's continuous historical location information, the cloud server can analyze its patterns and predict the user's future location and infer the individual's whereabouts; by counting the user's location information within a specific time period, the user's home address, work location, etc. Therefore, how to ensure that mobile users can use the various conveniences provided by location services while protecting the privacy of mobile users is an important issue facing LBS.

[0003] In some existing studies, LBSP and users encrypt outsourced data and LBS queries respectively, and the operability of ciphertext data is limited. For example, the cloud server cannot retrieve and return data that meets the user's query conditions in the ciphertext. In addition, some studies only support geographic range or interest keyword queries, and cannot provide support for attribute interval queries, such as querying points of interest that meet the price, rating, and sales volume in a certain interval. To this end, the present invention proposes an LBS privacy protection method that supports interval queries, which not only realizes the confidentiality of cloud-based LBS point of interest POI records, but also supports interval queries based on attributes in POI ciphertext records.

[0004] This application uses asymmetric matrix-vector product value-preserving encryption, public key searchable encryption, bilinear mapping, matrix transformation and other technologies to support interval queries while maintaining low communication overhead and to protect user privacy well. Summary of the invention

[0005] The present invention aims to solve the above problems of the prior art. A data outsourcing privacy protection method, system and storage medium are proposed. The technical solution of the present invention is as follows:

[0006] A data outsourcing privacy protection method comprises the following steps:

[0007] During the system initialization phase, the location based service provider (LBSP) generates system public parameters and keys;

[0008] New users register with LBSP to obtain keys for query trapdoor construction and data decryption;

[0009] In the data encryption phase, LBSP encrypts the location-based service (LBS) data set to achieve LBS data confidentiality and uploads the ciphertext data to the cloud server;

[0010] The user encrypts his query request and sends it to the cloud server for query;

[0011] After receiving the LBS ciphertext data set and the query trapdoor, the cloud server performs matching calculations and returns the ciphertext data that matches the query to the user;

[0012] The user decrypts the ciphertext data to obtain the actual data.

[0013] Furthermore, in the system initialization phase, the LBSP generates system public parameters and keys, specifically including the steps of:

[0014] 101. LBSP first selects two additive cyclic groups of order q, which are large prime numbers. and a bit string b of length l, let P1, P2 be the group The two generators of is a non-degenerate, efficiently computable bilinear map, and then LBSP randomly selects a vector O of length l-2 o As basis vectors and define two one-way hash functions represents a multiplication group modulo q. Finally, LBSP selects a set of random numbers num={a1,a2…,a d ,β,locI ,loc -1} and generate two l×l order reversible matrices M1 and M2, where a d ≠0,d=l-4,β>0, loc I ,loc -1 They represent the position of the attribute value I and the number -1 in the l-dimensional vector of the point of interest (POI), both of which are less than l. The LBSP public system parameters The remaining parameters {M1, {M2, o ,num,b} is kept securely by it as a key group;

[0015] 102. LBSP selects a random number As its private key SK L , and calculate the corresponding public key PK L =x L P2, similarly, the cloud server also selects a random number As its private key SK S , and calculate the corresponding public key PK S =x S P1; Each user U will also choose a random number As its private key SK u , and calculate the corresponding public key PK u =x u P2.

[0016] Furthermore, the new user registers with the LBSP to obtain a key for query trapdoor construction and data decryption, specifically including:

[0017] 103. User U first selects a random number and your own ID u Together with the registration request, it is sent to LBSP. After receiving the registration request from the new user, LBSP calculates κ = (x L / r u )P1 is returned to the user, and after receiving κ, the user uses the LBSP public key PK L Verify its identity and use the judgment formula e(P2,κ)=e(PK L ,(1 / r u )P1) is true, if not, the LBSP identity is not credible, cancel the registration request; if true, select a random number Calculate your own authentication auxiliary parameters λ=κ+δP1 and authentication parameters ω=x u h1(ID u ), and returns ω to LBSP;

[0018] 104. After receiving ω, LBSP uses the user's public key PK u Verify its identity and use the judgment formula e(P2,ω)=e(PK u ,h1(ID u )) is true, if true, then generate an authorization certificate C for the user u =e(x L h(ID u ),P1) and the key group {M1,M2,O o ,num,b} is sent to user U through a secure communication channel for query trapdoor construction and data decryption. If it is not true, the request is rejected;

[0019] 105. Finally, LBSP will authorize certificate C u Sent to the cloud server for user identity authentication during the query phase.

[0020] Furthermore, in the data encryption stage, the LBSP encrypts the LBS data set to achieve LBS data confidentiality and uploads the ciphertext data to the cloud server, specifically including the following steps:

[0021] 106. Encrypted POI coordinates (x i ,y i )

[0022] LBSP first calculates Then use random numbers a1, a2, ..., a d Expand it to an l-dimensional vector p i , Finally, according to the bit string b, the l-dimensional vector p i Split into 2 l-dimensional vectors p ai and p bi :

[0023] If b[i] = 1, set p ai [i] and p bi [i] are two random numbers such that p ai [i]+p bi [i] = p i [i]

[0024] Otherwise, set p ai [i] = p bi [i] = p i [i]

[0025] Calculation: Formula Chapter (next chapter) Section 1

[0026] Equation Section (Next)

[0027] The coordinate ciphertext is: C ai , C bi Respectively represent the i-th coordinate ciphertext Parameters

[0028] 107. Encrypt POI keyword W i

[0029] LBSP selects a random number Generate POI keyword W i The ciphertext in

[0030] Official Chapter (Next Chapter) Section 1

[0031] Official Chapter (Next Chapter) Section 1

[0032]

[0033] in, Respectively represent the ciphertext of the i-th keyword Parameters;

[0034] 108. Encrypt POI attribute value I i

[0035] In order to protect the attribute values ​​of POI such as price, rating, sales volume, etc. from being leaked, obfuscation is performed; LBSP first i Perform vectorization operations to convert it into vector form I i , and then perform matrix multiplication;

[0036] 109. LBSP will encrypt data sets Further, the step 108 encrypts the POI attribute value I i , the specific steps are as follows:

[0037] ①First select l-2 random numbers v1, v2, ..., v l-2 So that the vector O composed of l-2 random numbers v =(v1,v2,…,v l-2 ) T With the basis vector O o Orthogonal;

[0038] ②Then set the attribute value I in POI i and the number -1 is embedded into the vector O v It becomes an l-dimensional vector I i , I i =(v1,I i,v2,-1,…,v l-2 ) T , where I i and -1 according to loc I and loc -1 OK, assuming loc I and loc -1 2 and 4 respectively;

[0039] ③ In order to further confuse the data, let the vector I i ′=βI i ,calculate:

[0040]

[0041] Furthermore, the user encrypts his query request and sends it to the cloud server for query, which specifically includes:

[0042] 110. User access credential Cert generation

[0043] When a user needs to query, he needs to send the access credential Cert to the cloud server for identity authentication. The access credential construction process is as follows:

[0044] τ=r u h1(ID u ) Official Chapter (Next Chapter) Section 1

[0045] η=δr u h1(ID u ) Official Chapter (Next Chapter) Section 1

[0046] Cert={λ,τ,η}

[0047] Where τ and η represent the parameters related to the user access credential Cert; δ and λ represent the random number selected by the user and the calculated authentication auxiliary parameters respectively.

[0048] 111. Coordinates and query radius ((x u ,y u ),R) Trapdoor Generation

[0049] The user first calculates Then select d-1 random numbers (r1, r2, ..., r d-1 ) expands it to a l-dimensional vector q, let Among them, γ represents the relevant parameters in the vector q, and R represents the user query radius. Finally, according to the bit string b in the LBSP granted key group, the l-dimensional vector q is divided into two l-dimensional vectors q a and q b :

[0050] If b[i] = 0, set qa [i] and q b [i] are two random numbers such that q a [i]+q b [i] = q[i]

[0051] Otherwise, set q a [i] = q b [i] = q[i]

[0052] calculate: T a ,T b Denotes the query coordinate trapdoor T cord The parameters (x u ,y u ) represents the user coordinates

[0053] User input query coordinate trapdoor: T cord ={T a ,T b}

[0054] 112. Search keyword W q Trapdoor Generation

[0055] Before sending a query request, the user needs to encrypt the query keyword. The specific steps are as follows:

[0056] The user selects a random number calculate

[0057] T1=SK u h2(W q )PK L +r′P2

[0058] T2=r′PK S Equation Chapter(Next)Section 1

[0059] The query keyword trap is: T1 and T2 represent keyword trapdoors respectively. Parameters; SK u ,PK L Represent the private key and public key of the user and LBSP respectively;

[0060] 113. POI attribute interval query trap generation

[0061] The user uses the key group granted by LBSP to encrypt the interval he wants to query The specific method is as follows:

[0062] ①First, the user selects a random number Calculate vector O u=αO o

[0063] ②Then according to loc I and loc -1 The value will be 1 and the query left boundary value Embedded into vector O u The corresponding position in the vector

[0064] ③In order to further confuse the data, finally the vector Perform matrix multiplication to obtain Similarly, for querying the right boundary value Do the same operation and get

[0065] The attribute interval query trap for POI is: Equation Chapter(Next)Section 1

[0066] 114. The user will query the trapdoor Send to the cloud server.

[0067] Furthermore, the cloud server performs matching calculation after receiving the LBS ciphertext data set and the query trapdoor, and returns the ciphertext data that meets the query to the user, specifically including:

[0068] 115. After receiving the encrypted data set EDB sent by the LBSP and the query trap Q' sent by the user, the cloud server first checks the timestamp T q The correctness of the user identity is then verified to be legitimate, and the following equation is calculated to be true:

[0069]

[0070] 116. If the equation is true, perform LBS data retrieval to find matching POI data; if the equation is not true, reject the user's query request;

[0071] 117. Assume that the cloud server saves N encrypted POI data records, expressed as: Each encrypted POI data item can be expressed as: The cloud server matches the location, keywords, and attributes of the first POI record in sequence, and adds the POI records that meet all three matching conditions to the temporary resource list (TRL). The specific operations are as follows:

[0072] 118. Position Matching

[0073] Calculate ψ i = <Cai ,T a >+ <C bi ,T b >, then judge ψ i ≤0. If yes, go to step (2); otherwise, reselect the next POI record for matching;

[0074] 119. Keyword Matching

[0075] verify Is it true? If so, go to step (3); otherwise, reselect the next POI record for location service matching;

[0076] 120. Attribute Matching

[0077] determination and Is it true? If so, it means that the POI record meets the query requirements and is added to the temporary resource list (TRL); otherwise, it means that the POI record does not meet the query conditions and the next POI record is selected for location service matching;

[0078] 121. Traverse all LBS data records. Assume that there are K POI data records that meet the conditions, namely: The cloud server returns the TRL to the user.

[0079] Furthermore, the user decrypts the ciphertext data set to obtain the actual data, specifically including:

[0080] After receiving the TRL returned by the cloud server, the user encrypts the received POI coordinates and POI attribute value ciphertext To decrypt, the specific steps are as follows:

[0081] 122. Decrypt coordinate ciphertext:

[0082] First calculate and Then, according to the bit string b, the two l-dimensional vectors p a and p b Merge into an l-dimensional vector p:

[0083] If b[i] = 1, set p[i] = p a [i]+p b [i]

[0084] Otherwise, set p[i] = p a [i] = p b [i]

[0085] Finally, the decrypted coordinate plaintext is:

[0086]

[0087] 123. Decrypt attribute value ciphertext:

[0088] First calculate Then use I i ′ divided by β can obtain the original vector I i , and finally according to loc I The value of the interval attribute value I of POI can be obtained i .

[0089] A privacy protection system using the method comprises:

[0090] LBSP: Responsible for providing location services to authorized users, owning a large number of LBS resources and managing the system's keys. After the system is initialized, it uses the key to encrypt its own LBS dataset and then uploads it to the cloud server to reduce local storage and computing costs.

[0091] Cloud server: It has powerful storage and computing capabilities. It is responsible for storing a large amount of encrypted LBS data from LBSP and providing LBS query services to authorized users. After receiving the ciphertext data set uploaded by LBSP and the query trap sent by the user, it performs matching calculations and returns the data that meets the user's query to the user.

[0092] User side: A legitimate user who has registered with LBSP and uses the query service submits an LBS query request to the cloud server to obtain LBS services. In order to protect their privacy, the query requests of LBS users are encrypted and sent to the cloud server. After receiving the ciphertext data returned by the cloud server, it is decrypted to obtain the actual data.

[0093] A storage medium stores a computer program therein, wherein when the computer program is read by a processor, any of the above methods is executed.

[0094] The advantages and beneficial effects of the present invention are as follows:

[0095] In claim 4, the present invention uses asymmetric matrix-vector product value-preserving encryption and public key searchable encryption algorithm to encrypt LBS data, thereby achieving the confidentiality of cloud-based LBS point of interest records; in claim 5, lightweight matrix operations are used to convert the interval attributes of LBS point of interest records, so that users can accurately obtain the required LBS data without leaking the query interval and reduce computing overhead. The user constructs a query trap in claim 6 to achieve the privacy of the user's query mode and prevent the leakage of the user's query privacy. In addition, in claim 3, a user identity access control mechanism based on bilinear mapping technology is used to construct a user identity access control mechanism, so that registered users can perform LBS queries, and unregistered users cannot access LBS.

[0096] Finally, the outstanding advantage of the present invention is that claim 6 supports users to query intervals based on attributes in POI ciphertext records, such as querying points of interest that meet the price, rating, and sales volume in a certain interval. In summary, the present invention can well solve the needs of user interval query and privacy protection, and greatly improve the query efficiency and significantly reduce the query communication overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] Figure 1 The present invention provides a framework diagram of a preferred embodiment system of a preferred embodiment;

[0098] Figure 2 Flow chart of the method of the present invention. DETAILED DESCRIPTION

[0099] The following will describe the technical solutions in the embodiments of the present invention in detail in conjunction with the accompanying drawings in the embodiments of the present invention. The described embodiments are only part of the embodiments of the present invention.

[0100] The technical solution of the present invention to solve the above technical problems is:

[0101] The following is combined with Figure 1 Describe the framework of the system.

[0102] (1) LBSP: Responsible for providing location services to authorized users, owning a large number of LBS resources and managing the system keys. After the system is initialized, it uses the key to encrypt its own LBS dataset and then uploads it to the cloud server to reduce local storage and computing costs.

[0103] (2) Cloud server: It has powerful storage and computing capabilities. It is responsible for storing a large amount of encrypted LBS data from LBSP and providing LBS query services to authorized users. After receiving the ciphertext data set uploaded by LBSP and the query trap sent by the user, it performs matching calculations and returns the data that meets the user's query to the user.

[0104] (3) User side: Legitimate users who have registered with LBSP and use query services submit LBS query requests to the cloud server to obtain LBS services. In order to protect their privacy, LBS users' query requests are encrypted and sent to the cloud server. After receiving the ciphertext data set returned by the cloud service, it is decrypted to obtain the actual data.

[0105] The following is combined with Figure 2 The present invention is described in further detail. The present invention mainly comprises the following steps:

[0106] (1) System initialization

[0107] LBSP first selects two additive cyclic groups of order q, which are large prime numbers. and a bit string b of length l, let P1, P2 be the group The two generators of is a non-degenerate, efficiently computable bilinear map. Then LBSP randomly selects a vector O of length l-2 o As basis vectors and define two one-way hash functions represents a multiplication group modulo q. Finally, LBSP selects a set of random numbers num={a1,a2…,a d ,β,loc I ,loc -1} and generate two l×l order reversible matrices M1 and M2, where a d ≠0,d=l-4,β>0, loc I ,loc -1 They represent the position of the attribute value I and the number -1 in the POI in the l-dimensional vector, respectively, and are both less than l. LBSP public system parameters The remaining parameters {M1,M2,O o ,num,b} is kept securely by it as a key group.

[0108] In addition, LBSP selects a random number As its private key SK L , and calculate the corresponding public key PK L =x L P2. Similarly, the cloud server also selects a random number As its private key SK S , and calculate the corresponding public key PK S =x S P1. Each user U will also choose a random number As its private key SK u , and calculate the corresponding public key PKu =x u P2.

[0109] (2) User Registration

[0110] When a new LBS user U wants to join the system, he registers with the LBSP.

[0111] User U first chooses a random number and your own ID u Together with the registration request, it is sent to LBSP. After receiving the registration request from the new user, LBSP calculates κ = (x L / r u )P1 is returned to the user. After receiving κ, the user uses the LBSP public key PK L Verify its identity and use the judgment formula e(P2,κ)=e(PK L ,(1 / r u )P1) is true. If not, the LBSP identity is not credible and the registration request is cancelled. If true, a random number is selected Calculate your own authentication auxiliary parameters λ=κ+δP1 and authentication parameters ω=x u h1(ID u ), and returns ω to LBSP.

[0112] Similarly, after receiving ω, LBSP uses the user's public key PK u Verify its identity and use the judgment formula e(P2,ω)=e(PK u ,h1(ID u )) is true. If true, generate an authorization certificate C for the user u =e(x L h(ID u ),P1) and the key group {M1,M2,O o ,num,b} is sent to user U through a secure communication channel for query trapdoor construction and data decryption. If not, the request is rejected.

[0113] Finally, LBSP will authorize certificate C u Sent to the cloud server for user identity authentication during the query phase.

[0114] (3) LBS data encryption

[0115] ■ Encrypted POI coordinates (x i ,y i )

[0116] LBSP first calculates Then use random numbers a1, a2, ..., a d Expand it to an l-dimensional vector pi , Finally, according to the bit string b, the l-dimensional vector p i Split into 2 l-dimensional vectors p ai and p bi :

[0117] If b[i] = 1, set p ai [i] and p bi [i] are two random numbers such that p ai [i]+p bi [i] = p i [i]

[0118] Otherwise, set p ai [i] = p bi [i] = p i [i]

[0119] Calculation: Formula Chapter (next chapter) Section 1

[0120] Equation Section (Next)

[0121] The coordinate ciphertext is: C ai , C bi Represents the i-th coordinate ciphertext Parameters

[0122] ■ Encrypted POI keyword W i

[0123] LBSP selects a random number Generate POI keyword W i The ciphertext in

[0124] Official Chapter (Next Chapter) Section 1

[0125] Official Chapter (Next Chapter) Section 1

[0126]

[0127] in, Indicates the ciphertext of the i-th keyword Parameters

[0128] ■ Encrypt POI attribute value I i

[0129] In order to protect the attribute values ​​of POI such as price, rating, sales volume, etc. from being leaked, this paper performs obfuscation. iPerform vectorization operations to convert it into vector form I i , and then perform matrix multiplication. The specific steps are as follows:

[0130] ④First select l-2 random numbers v1, v2, ..., v l-2 So that the vector O composed of l-2 random numbers v =(v1,v2,…,v l-2 ) T With the basis vector O o Orthogonal

[0131] ⑤Then set the attribute value I in POI i and the number -1 is embedded into the vector O v It becomes an l-dimensional vector I i , I i =(v1,I i ,v2,-1,…,v l-2 ) T , where I i and -1 according to loc I and loc -1 OK, assuming loc I and loc -1 2 and 4 respectively

[0132] ⑥ To further confuse the data, let vector I i ′=βI i ,calculate:

[0133]

[0134] LBSP will encrypt the data set Send to the cloud server.

[0135] (4) User query trap generation

[0136] An LBS user query request can be expressed as Cert is the access credential submitted to the cloud server by the user when querying, which is used to verify the user's identity; ((x u ,y u ), R) is the user's current coordinates and query radius; W q It is the keyword of interest of the user's query; is the POI attribute value interval queried by the user; T q Indicates the timestamp of the query.

[0137] In order to protect personal privacy, users will encrypt their queries and submit them to the cloud server in the form of query trapdoor Q'.

[0138] ■Generate user access credential Cert

[0139] When a user needs to query, he needs to send the access credential Cert to the cloud server for identity authentication. The access credential construction process is as follows:

[0140] τ=r u h1(ID u ) Official Chapter (Next Chapter) Section 1

[0141] η=δr u h1(ID u ) Official Chapter (Next Chapter) Section 1

[0142] Cert={λ,τ,η}

[0143] Where τ and η represent the parameters related to the user access credential Cert; δ and λ represent the random number selected by the user and the calculated authentication auxiliary parameters respectively.

[0144] ■Coordinates and query radius ((x u ,y u ),R) Trapdoor Generation

[0145] The user first calculates Then select d-1 random numbers (r1, r2, ..., r d-1 ) expands it to a l-dimensional vector q, let Among them, γ represents the relevant parameters in the vector q, and R represents the user query radius. Finally, according to the bit string b in the LBSP granted key group, the l-dimensional vector q is divided into two l-dimensional vectors q a and q b :

[0146] If b[i] = 0, set q a [i] and q b [i] are two random numbers such that q a [i]+q b [i] = q[i]

[0147] Otherwise, set q a [i] = q b [i] = q[i]

[0148] calculate: T a ,T b Denotes the query coordinate trapdoor T cord The parameters (x u ,y u ) represents the user coordinates

[0149] User input query coordinate trapdoor: T cord ={T a ,Tb}

[0150] ■ Search keyword W q Trapdoor Generation

[0151] Since the query keywords sent by users may reveal their interests, hobbies, behavioral habits and other sensitive information, users need to encrypt their query keywords before sending a query request. The specific steps are as follows:

[0152] The user selects a random number calculate

[0153] T1=SK u h2(W q )PK L +r′P2

[0154] T2=r′PK S Equation Chapter(Next)Section 1

[0155] The query keyword trap is: T1 and T2 represent keyword trapdoors respectively. Parameters; SK u ,PK L Represents the private key and public key of the user and LBSP respectively

[0156] ■POI attribute interval query trap generation

[0157] The user uses the key group granted by LBSP to encrypt the interval he wants to query The specific method is as follows:

[0158] ④First, the user selects a random number Calculate vector O u =αO o

[0159] ⑤Then according to loc I and loc -1 The value will be 1 and the query left boundary value Embedded into vector O u The corresponding position in the vector

[0160] ⑥ In order to further confuse the data, the vector Perform matrix multiplication to obtain Similarly, for querying the right boundary value Do the same operation and get

[0161] The attribute interval query trap for POI is: Equation Chapter(Next)Section 1

[0162] The user will query the trapdoor Send to the cloud server.

[0163] (5) LBS data retrieval

[0164] After receiving the encrypted data set EDB sent by the LBSP and the query trap Q' sent by the user, the cloud server first checks the timestamp T q The correctness of the user identity is then verified to be legitimate, and the following equation is calculated to be true:

[0165]

[0166] If the equation is true, LBS data retrieval is performed to find matching POI data; if the equation is not true, the user's query request is rejected.

[0167] Assume that the cloud server saves N encrypted POI data records, expressed as: Each encrypted POI data item can be expressed as: The cloud server matches the location, keywords, and attributes of the first POI record in sequence, and adds the POI records that meet all three matching conditions to the temporary resource list (TRL). The specific operations are as follows:

[0168] ■Position Matching

[0169] Calculate ψ i = <C ai ,T a >+ <C bi ,T b >, then judge ψ i ≤0. If yes, go to step (2); otherwise, reselect the next POI record for matching;

[0170] ■Keyword matching

[0171] verify Is it true? If so, go to step (3); otherwise, reselect the next POI record for location service matching;

[0172] ■Attribute matching

[0173] determination and Is it true? If it is true, it means that the POI record meets the query requirements and it is added to the temporary resource list (TRL); otherwise, it means that the POI record does not meet the query conditions and the next POI record is selected for location service matching.

[0174] Traverse all LBS data records, assuming that there are K POI data records that meet the conditions, namely: The cloud server returns the TRL to the user (6) and the user decrypts it

[0175] After receiving the TRL returned by the cloud server, the user encrypts the received POI coordinates and POI attribute value ciphertext To decrypt, the specific steps are as follows:

[0176] ■Decryption of coordinate ciphertext:

[0177] First calculate and Then, according to the bit string b, the two l-dimensional vectors p a and p b Merge into an l-dimensional vector p:

[0178] If b[i] = 1, set p[i] = p a [i]+p b [i]

[0179] Otherwise, set p[i] = p a [i] = p b [i]

[0180] Finally, the decrypted coordinate plaintext is:

[0181]

[0182] ■Decrypt the attribute value ciphertext:

[0183] First calculate Then use I i ′ divided by β can obtain the original vector I i , and finally according to loc I The value of the interval attribute value I of POI can be obtained i

[0184] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0185] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0186] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0187] The above embodiments should be understood to be only used to illustrate the present invention and not to limit the protection scope of the present invention. After reading the contents of the present invention, technicians can make various changes or modifications to the present invention, and these equivalent changes and modifications also fall within the scope defined by the claims of the present invention.

Claims

1. A data outsourcing privacy protection method, characterized in that: The following steps are involved: During the system initialization phase, the location service provider LBSP generates system public parameters and keys; New users register with LBSP to obtain keys for query trapdoor construction and data decryption; In the data encryption phase, LBSP encrypts the location service LBS data set to achieve LBS data confidentiality and uploads the ciphertext data to the cloud server; The user encrypts his query request and sends it to the cloud server for query; After receiving the LBS ciphertext data set and the query trapdoor, the cloud server performs matching calculations and returns the ciphertext data that matches the query to the user; The user decrypts the ciphertext data to obtain the actual data; In the system initialization phase, the LBSP generates system public parameters and keys, specifically including the following steps:

101. LBSP first selects two additive cyclic groups of order q, which are large prime numbers. and a bit string b of length l, let P1, P2 be the group The two generators of is a non-degenerate, efficiently computable bilinear map, and then LBSP randomly selects a vector O of length l-2 o As basis vectors and define two one-way hash functions represents a multiplication group modulo q; finally, LBSP selects a set of random numbers num={a1,a2…,a d ,β,loc I ,loc -1 } and generate two l×l order reversible matrices M1 and M2, where a d ≠0,d=l-4,β>0, loc I ,loc -1 The positions of the attribute value I and the number -1 in the l-dimensional vector in the POI representation are both less than l. The LBSP public system parameters The remaining parameters {M1, {M2, o ,num,b} is kept securely by it as a key group; 102. LBSP selects a random number As its private key SK L , and calculate the corresponding public key PK L =x L P2, similarly, the cloud server also selects a random number As its private key SK S , and calculate the corresponding public key PK S =x S P1; Each user U will also choose a random number As its private key SK u , and calculate the corresponding public key PK u =x u P2; The new user registers with the LBSP to obtain a key for query trapdoor construction and data decryption, specifically including:

103. User U first selects a random number and your own ID u Together with the registration request, it is sent to LBSP. After receiving the registration request from the new user, LBSP calculates κ = (x L / r u )P1 is returned to the user, and after receiving κ, the user uses the LBSP public key PK L Verify its identity and use the judgment formula e(P2,κ)=e(PK L ,(1 / r u )P1) is true, if not, the LBSP identity is not credible, cancel the registration request; if true, select a random number Calculate your own authentication auxiliary parameters λ=κ+δP1 and authentication parameters ω=x u h1(ID u ), and returns ω to LBSP; 104. After receiving ω, LBSP uses the user's public key PK u Verify its identity and use the judgment formula e(P2,ω)=e(PK u ,h1(ID u )) is true, if true, then generate an authorization certificate C for the user u =e(x L h(ID u ),P1) and the key group {M1,M2,O o ,num,b} is sent to user U through a secure communication channel for query trapdoor construction and data decryption. If it is not true, the request is rejected; 105. Finally, LBSP will authorize certificate C u Sent to the cloud server for user identity authentication during the query phase; In the data encryption stage, the LBSP encrypts the LBS data set to achieve LBS data confidentiality and uploads the ciphertext data to the cloud server, specifically including the following steps:

106. Encrypted POI coordinates (x i ,y i ) LBSP first calculates Then use random numbers a1, a2, ..., a d Expand it to an l-dimensional vector p i , Finally, according to the bit string b, the l-dimensional vector p i Split into 2 l-dimensional vectors p ai and p bi : If b[i] = 1, set p ai [i] and p bi [i] are two random numbers such that p ai [i]+p bi [i] = p i [i] Otherwise, set p ai [i] = p bi [i] = p i [i] calculate: The coordinate ciphertext is: C ai , C bi Respectively represent the i-th coordinate ciphertext C cordi Parameters; 107. Encrypt POI keyword W i LBSP selects a random number Generate POI keyword W i The ciphertext in in, Respectively represent the ciphertext of the i-th keyword C Wi Parameters; 108. Encrypt POI attribute value I i In order to protect the attribute values ​​of POI such as price, rating, sales volume, etc. from being leaked, obfuscation is performed; LBSP first i Perform vectorization operations to convert it into vector form I i , and then perform matrix multiplication; 109. LBSP will encrypt data sets Send to cloud server; The step 108 encrypts the POI attribute value I i , the specific steps are as follows: ①First select l-2 random numbers v1, v2, ..., v l-2 So that the vector O composed of l-2 random numbers v =(v1,v2,...,v l-2 ) T With the basis vector O o Orthogonal; ②Then set the attribute value I in POI i and the number -1 is embedded into the vector O v It becomes an l-dimensional vector I i , I i =(v1,I i ,v2,-1,...,v l-2 ) T , where I i and -1 according to loc I and loc -1 OK, assuming loc I and loc -1 2 and 4 respectively; ③ In order to further confuse the data, let the vector I i ′=βI i ,calculate: C Ii =M2 -1 I i '; The user encrypts his query request and sends it to the cloud server for query, specifically including:

110. User access credential Cert generation When a user needs to query, he needs to send the access credential Cert to the cloud server for identity authentication. The access credential construction process is as follows: τ=r u h1(ID u ) η=δr u h1(ID u ) Cert={λ,τ,η} Where τ and η represent the parameters related to the user access credential Cert; δ and λ represent the random number selected by the user and the calculated authentication auxiliary parameters respectively; 111. Coordinates and query radius ((x u ,y u ),R) Trapdoor Generation The user first calculates Then select d-1 random numbers (r1, r2, ..., r d-1 ) expands it to a l-dimensional vector q, let Where γ represents the relevant parameters in the vector q, R represents the user query radius, and finally the l-dimensional vector q is divided into two l-dimensional vectors q according to the bit string b in the LBSP grant key group a and q b : If b[i] = 0, set q a [i] and q b [i] are two random numbers such that q a [i]+q b [i] = q[i] Otherwise, set q a [i] = q b [i] = q[i] calculate: T a ,T b Denotes the query coordinate trapdoor T cord The parameters (x u ,y u ) represents user coordinates; User input query coordinate trapdoor: T cord ={T a ,T b } 112. Search keyword W q Trapdoor Generation Before sending a query request, the user needs to encrypt the query keyword. The specific steps are as follows: The user selects a random number calculate T1=SK u h2(W q )PK L +r′P2 T2=r′PK S The query keyword trap is: T1 and T2 represent keyword trapdoors respectively. Parameters; SK u ,PK L Represent the private key and public key of the user and LBSP respectively; 113. POI attribute interval query trap generation The user uses the key group granted by LBSP to encrypt the interval he wants to query The specific method is as follows: ①First, the user selects a random number Calculate vector O u =αO o ②Then according to loc I and loc -1 The value will be 1 and the query left boundary value Embedded into vector O u The corresponding position in the vector ③In order to further confuse the data, finally the vector Perform matrix multiplication to obtain Similarly, for querying the right boundary value Do the same operation and get The attribute interval query trap for POI is:

114. The user will query the trapdoor Send to the cloud server.

2. A data outsourcing privacy protection method according to claim 1, characterized in that: The cloud server performs matching calculation after receiving the LBS ciphertext data set and the query trap, and returns the ciphertext data that meets the query to the user, specifically including:

115. After receiving the encrypted data set EDB sent by the LBSP and the query trap Q' sent by the user, the cloud server first checks the timestamp T q The correctness of the user identity is then verified to be legitimate, and the following equation is calculated to be true:

116. If the equation is true, perform LBS data retrieval to find matching POI data; if the equation is not true, reject the user's query request; 117. Assume that the cloud server saves N encrypted POI data records, expressed as: Each encrypted POI data item can be expressed as: The cloud server matches the location, keywords, and attributes of the first POI record in sequence, and adds the POI records that meet all three matching conditions to the temporary resource list (TRL). The specific operations are as follows:

118. Position Matching Calculate ψ i = <C ai ,T a >+ <C bi ,T b >, then judge ψ i ≤0 is true; if true, go to step (2); otherwise, reselect the next POI record for matching; 119. Keyword Matching verify Is it true? If so, go to step (3); otherwise, reselect the next POI record for location service matching; 120. Attribute Matching determination and Is it true? If so, it means that the POI record meets the query requirements and is added to the temporary resource list TRL; otherwise, it means that the POI record does not meet the query conditions and the next POI record is selected for location service matching; 121. Traverse all LBS data records. Assume that there are K POI data records that meet the conditions, namely: The cloud server returns the TRL to the user.

3. A data outsourcing privacy protection method according to claim 2, characterized in that: The user decrypts the ciphertext data set to obtain the actual data, specifically including: After receiving the TRL returned by the cloud server, the user encrypts the received POI coordinates and POI attribute value ciphertext To decrypt, the specific steps are as follows:

122. Decrypt coordinate ciphertext: First calculate and Then, according to the bit string b, the two l-dimensional vectors p a and p b Merge into an l-dimensional vector p: If b[i] = 1, set p[i] = p a [i]+p b [i] Otherwise, set p[i] = p a [i] = p b [i] Finally, the decrypted coordinate plaintext is:

123. Decrypt attribute value ciphertext: First calculate Then use I i ′ divided by β can obtain the original vector I i , and finally according to loc I The value of the interval attribute value I of POI can be obtained i .

4. A privacy protection system using the method according to any one of claims 1 to 3, characterized in that: include: LBSP: responsible for providing location services to authorized users, owning a large number of LBS resources and managing the system's keys; After the system is initialized, the LBS dataset is encrypted with a key and then uploaded to the cloud server to reduce local storage and computing costs; Cloud server: It has powerful storage and computing capabilities. It is responsible for storing a large amount of encrypted LBS data from LBSP and providing LBS query services to authorized users. After receiving the ciphertext data set uploaded by LBSP and the query trap sent by the user, it performs matching calculations and returns the data that meets the user's query to the user. User side: Legitimate users who have registered with LBSP and use query services submit LBS query requests to the cloud server to obtain LBS services; in order to protect their privacy, LBS users' query requests are encrypted and sent to the cloud server; after receiving the ciphertext data returned by the cloud server, they are decrypted to obtain the actual data.

5. A storage medium storing a computer program, characterized in that: When the computer program is read by a processor, the method according to any one of claims 1 to 3 is executed.

Images