A personalized trajectory privacy protection method based on differential perturbation

Abstract

The present invention discloses a personalized trajectory privacy protection method based on differential perturbation, which belongs to the field of location services and information security. Considering the time correlation between positions at different times on the trajectory, the user determines the possible position set at the moment through the prior probability of the current moment position, and determines the possible position set at each moment according to the time correlation between positions at different times on the trajectory. In the position set, the geographical indistinguishability and the expected inference error are combined, and the minimum distance search algorithm based on the Hilbert curve is used to select a personalized position protection set for each possible position in the set. The Permute‑and‑Flip mechanism is applied to the position protection set to generate a probability distribution matrix to release the pseudo position. The method has simple steps and high protection flexibility. By setting different privacy budgets and expected inference boundary errors, it can meet the personalized privacy protection needs of users in different scenarios and balance location privacy and service quality.

Description

Technical Field

[0001] The invention relates to a personalized trajectory privacy protection method based on differential disturbance, and belongs to the field of location service and information security. Background Art

[0002] Most existing studies only focus on the privacy protection of a single location in a trajectory, and fail to consider key aspects such as the temporal correlation between locations in the trajectory, meeting the personalized needs of users, and ensuring the protection of the user's actual location without relying on a trusted third party.

[0003] When using LBS services, users need to provide their real-time locations to the LBS server, which leads to the problem of location privacy leakage. Combining geographic indistinguishability and distortion privacy, a personalized trajectory privacy protection method based on differential perturbation prevents attackers from obtaining the user's real location. However, existing technologies only focus on the privacy protection of a single location in the trajectory, and fail to consider the time correlation between locations in the trajectory, which will lead to the threat of user privacy leakage. In addition, failure to meet the personalized needs of users and ensure the protection of the user's actual location without relying on a trusted third party will also result in users being unable to obtain corresponding location services. Summary of the invention

[0004] In view of the shortcomings of the existing technology, a personalized trajectory privacy protection method based on differential perturbation is provided, which has simple steps, is flexible and efficient, and can effectively enhance the user's location privacy and realize personalized user privacy protection.

[0005] To achieve the above technical objectives, the present invention discloses a personalized trajectory privacy protection method based on differential perturbation. For users who need trajectory privacy protection, the time correlation between the positions at different times on the user's mobile trajectory is collected to determine the possible position set at each time. Then, in the possible position set, the geographic indistinguishability and expected inference error technology are combined, and a personalized position protection set is selected for each possible position in the position set based on the minimum distance search algorithm of the Hilbert curve. The Permute-and-Flip mechanism is applied to the position protection set to generate a probability distribution matrix, and the pseudo position is released considering the time correlation of different positions on the trajectory. The released pseudo position conforms to the user's usual living habits to confuse attackers, thereby realizing personalized privacy protection of the user's trajectory.

[0006] The specific steps are as follows:

[0007] Step 1: Collect the user's movement trajectory, decompose the movement trajectory into location points according to time, generate user location sets from all coordinate points, and collect the user's prior probability at time t in the user data set. The position points with extremely small or zero value are eliminated to obtain the possible position point set Δχ of the user at time t. t ;

[0008] Step 2: Combine the two location perturbation mechanisms of geographic indistinguishability and expected inference error to limit the inference error range of network attackers, and set different lower bounds of inference error to meet the personalized privacy protection needs of users; find Δχ by using the minimum distance search algorithm based on Hilbert curve t The position protection set Φ for each possible position in t ;

[0009] Step 3: Use the location perturbation mechanism Permute-and-Flip to protect the location set Φ of the user at time t t Generate a probability distribution matrix to publish the pseudo location to the LBS server, and set different privacy parameters E m , infer the lower bound of the attacker's inference error on the user's current location to limit the attacker's inference range, and combine the privacy budget to achieve personalized adjustment of different privacy requirements, thereby achieving personalized privacy protection for the user's location at time t;

[0010] Step 4: Obtain the possible location set Δχ of the user at time t+1 based on the temporal correlation between different locations on the user's movement trajectory t+1 ;

[0011] Step 5: According to step 4, we can get the possible position set Δχ at time t+1 t+1 Repeat step 2 to find the position protection set Φ at time t+1 t+1 , repeat step 3 and use the perturbation mechanism Permute-and-Flip to publish the perturbed location, thereby generating pseudo-locations that conform to the user's life and movement habits at different times, and realizing personalized protection of the user's movement trajectory privacy.

[0012] Furthermore, the possible location point set Δχ of the user at time t t The calculation method is as follows;

[0013]

[0014] where Δχ t represents the minimum number of positions whose sum of prior probabilities is less than 1-δ, a i is the possible location area of ​​the user, δ is a constant (0<δ<1); if the user's real location x t If it is removed with a very small probability, the closest position is used. Instead of x t ,in for and xt The Euclidean distance between .

[0015] Furthermore, the perturbation probability distribution in the location perturbation mechanism of geographic indistinguishability satisfies ∈ g -Geographically indistinguishable, that is, satisfying the following formula:

[0016]

[0017] Where d(x t ,y t ) represents the position x t With y t The Euclidean distance between g Determined by the privacy budget ∈ and the user-centric scope.

[0018] The expected inference error position perturbation mechanism can make the attacker's inferred position The user's real location x t The error is used to measure the user's location privacy. The attacker's inference error is expressed as:

[0019]

[0020] Further, the specific method of step 2:

[0021] Step 2.1: Determine the lower bound of the inference error: Assume that the worst case is the attacker's inferred position In the location protection set Φ t Therefore, the lower bound of the expected inference error satisfies:

[0022]

[0023] The expected inference error in the above formula is simplified and expressed as ExpEr(x′ t )≥e -∈ E(Φ t );

[0024] Step 2.2: To ensure the privacy protection effect, set the privacy parameter E as the threshold m , ensuring that the lower bound of the inference error is greater than the threshold, that is, satisfying the expected inference error ExpEr(x′ t )≥E m , it is necessary to make E(Φ t )≥e ∈ E m , users can meet E(Φ t )≥e ∈ E mUnder the condition of , the influence of time correlation between different locations on user trajectory privacy is taken into account, and the complementary characteristics of geographic indistinguishability and expected reasoning error are used to adjust E m and ∈ to adjust the lower bound of the expected inference error;

[0025] Step 2.3: Since the accuracy of the location service provided by LBS is proportional to the service quality, and the personalized location protection set Φ t It is a flat circular range. Therefore, it is necessary to improve the user's location service quality as much as possible while satisfying privacy. The personalized location protection set Φ corresponding to the protection area t Diameter D(Φ t ) is as small as possible, so the personalized location protection set Φ t The distance between any two positions in the t ),Right now So the following expression is satisfied:

[0026]

[0027] Step 2.4: Use the Hilbert curve Hilbert search algorithm to search for the personalized position protection set Φ t Then, the personalized location protection set Φ after search matching is t The content is input into the position perturbation mechanism Permute-and-Flip, and the position perturbation mechanism Permute-and-Flip performs the work of publishing the perturbation position.

[0028] Furthermore, the temporal correlation between different positions on the user trajectory is used to obtain the possible position set Δχ of the user at time t+1 t+1

[0029] Step 4.1: Use the user's historical trajectory data and behavior habits to construct the location transfer probability matrix M. Let m ij is the element in the i-th row and j-th column of the matrix M, then m ij represents the probability of a user moving from area i to area j;

[0030] Step 4.2: Based on the possible location set Δχ of the user at time t t The position information contained in the position transfer probability matrix M is used to find the corresponding row vector m i , m i represents the probability of the user moving from area i to other areas. These row vectors constitute the location transfer probability matrix M at time t. t ; Use the user's posterior probability at time t to deduce the user's prior probability at the next time t+1 Thus, multiple possible locations of the user at the next moment can be inferred;

[0031] The posterior probability distribution of the user at time t satisfies the following formula:

[0032]

[0033] where x t , x′ t are the user’s true position and disturbance position at time t, respectively, f(x′ t |x t ) is the probability distribution of position disturbance. Then the prior probability distribution at time t+1 is

[0034] Step 4.3: The prior probability at time t+1 Substitute the position point set Δχ t Calculate the formula to get the possible position set Δχ at time t+1 t+1 .

[0035] Furthermore, the probability distribution matrix of the perturbation position at each moment is generated by using the Permute-and-Flip mechanism. This mechanism can generate a pseudo position with a smaller perturbation distance, thereby better achieving a balance between trajectory privacy and service quality. Its probability distribution matrix is:

[0036]

[0037] in Used for normalization,∈:privacy budget, The set of all possible locations of the user.

[0038] Beneficial Effects

[0039] In order to enhance privacy, this method uses the complementary properties of geographic indistinguishability and distortion privacy, and adopts a minimum distance search algorithm based on the Hilbert curve to identify the protected location set (PLS) containing all potential locations along the trajectory. This combined method effectively enhances the resistance to location inference attacks. The mechanism adjusts the privacy settings through two privacy parameters to achieve personalized user privacy protection.

[0040] This method constructs a location transition probability matrix and realizes the derivation of the potential location set of the user at each time point on the trajectory. In order to enhance privacy, the complementary properties of geographic indistinguishability and distortion privacy are utilized, and a minimum distance search algorithm based on the Hilbert curve is used to identify the protected location set (PLS) containing all potential locations along the trajectory. This combined method effectively enhances the resistance to location reasoning attacks. The mechanism adjusts the privacy settings through two privacy parameters to achieve personalized user privacy protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A schematic diagram of a usage scenario of the personalized trajectory privacy protection method based on differential perturbation of the present invention;

[0042] Figure 2 It is a flowchart of the personalized trajectory privacy protection method based on differential perturbation of the present invention; DETAILED DESCRIPTION

[0043] The embodiments of the present invention are further described below in conjunction with the accompanying drawings:

[0044] like Figure 1 and Figure 2 As shown, the personalized trajectory privacy protection method based on differential perturbation of the present invention combines geographic indistinguishability with the concept of expected inference error to realize personalized protection of user trajectory privacy. The steps are as follows:

[0045] For users who need trajectory privacy protection, the time correlation between the positions at different times on the user's mobile trajectory is collected to determine the possible location set at each time. Then, in the possible location set, the geographical indistinguishability and expected inference error technology are combined, and the minimum distance search algorithm based on the Hilbert curve is used to select a personalized location protection set for each possible location in the location set. The Permute-and-Flip mechanism is applied to the location protection set to generate a probability distribution matrix. The pseudo-location is released considering the spatiotemporal correlation of different locations on the trajectory. The released pseudo-location is consistent with the user's daily living habits to confuse attackers and achieve personalized privacy protection of the user's trajectory.

[0046] The specific steps are as follows:

[0047] Step 1: Collect the user's movement trajectory, decompose the movement trajectory into location points according to time, generate user location sets from all coordinate points, and collect the user's prior probability at time t in the user data set. The position points with extremely small or zero value are eliminated to obtain the possible position point set Δχ of the user at time t. t ;

[0048] The possible location point set Δχ of the user at time t t The calculation method is as follows;

[0049]

[0050] where Δχ t represents the minimum number of positions whose sum of prior probabilities is less than 1-δ, a i is the possible location area of ​​the user, δ is a constant (0<δ<1); if the user's real location x t If it is removed with a very small probability, the closest position is used. Instead of x t ,in for and x t The Euclidean distance between

[0051] Step 2: Combine the two location perturbation mechanisms of geographic indistinguishability and expected inference error to limit the inference error range of network attackers, and set different lower bounds of inference error to meet the personalized privacy protection needs of users; find Δχ by using the minimum distance search algorithm based on Hilbert curve t The position protection set Φ for each possible position in t ;

[0052] The perturbation probability distribution in the location perturbation mechanism of geographic indistinguishability satisfies ∈ g -Geographically indistinguishable, that is, satisfying the following formula:

[0053]

[0054] Where d(x t ,y t ) represents the position x t With y t The Euclidean distance between g Determined by the privacy budget ∈ and the user-centric scope.

[0055] The expected inference error position perturbation mechanism can make the attacker's inferred position The user's real location x t The error is used to measure the user's location privacy. The attacker's inference error is expressed as:

[0056]

[0057] Step 2.1: Determine the lower bound of the inference error: Assume that the worst case is the attacker's inferred position In the location protection set Φ t Therefore, the lower bound of the expected inference error satisfies:

[0058]

[0059] The expected inference error in the above formula is simplified and expressed as ExpEr(x′ t )≥e -∈ E(Φ t );

[0060] Step 2.2: To ensure the privacy protection effect, set the privacy parameter E as the threshold m, ensuring that the lower bound of the inference error is greater than the threshold, that is, satisfying the expected inference error ExpEr(x′ t )≥E m , it is necessary to make E(Φ t )≥e ∈ E m , users can meet E(Φ t )≥e ∈ E m Under the condition of , the influence of time correlation between different locations on user trajectory privacy is taken into account, and the complementary characteristics of geographic indistinguishability and expected reasoning error are used to adjust E m and ∈ to adjust the lower bound of the expected inference error;

[0061] Step 2.3: Since the accuracy of the location service provided by LBS is proportional to the service quality, and the personalized location protection set Φ t It is a flat circular range. Therefore, it is necessary to improve the user's location service quality as much as possible while satisfying privacy. The personalized location protection set Φ corresponding to the protection area t Diameter D(Φ t ) is as small as possible, so the personalized location protection set Φ t The distance between any two positions in the t ),Right now So the following expression is satisfied:

[0062]

[0063] Step 2.4: Use the Hilbert curve search algorithm to search for the personalized location protection set Φ t Then, the personalized location protection set Φ after search matching is t The content is input into the position perturbation mechanism Permute-and-Flip, and the position perturbation mechanism Permute-and-Flip performs the work of publishing the perturbation position.

[0064] Step 3: Use the location perturbation mechanism Permute-and-Flip to protect the location set Φ of the user at time t t Generate a probability distribution matrix to publish the pseudo location to the LBS server, and set different privacy parameters E m , infer the lower bound of the attacker's inference error on the user's current location to limit the attacker's inference range, and combine the privacy budget to achieve personalized adjustment of different privacy requirements, thereby achieving personalized privacy protection for the user's location at time t;

[0065] Step 4: Obtain the possible location set Δχ of the user at time t+1 based on the temporal correlation between different locations on the user's movement trajectory t+1 ;

[0066] The temporal correlation between different positions on the user trajectory is used to obtain the possible position set Δχ of the user at time t+1 t+1 (Is this sentence repeated in step 4) (The following should be steps 4.1, 4.2...)

[0067] Step 4.1: Use the user's historical trajectory data and behavior habits to construct the location transfer probability matrix M. Let m ij is the element in the i-th row and j-th column of the matrix M, then m ij represents the probability of a user moving from area i to area j;

[0068] Step 4.2: Based on the possible location set Δχ of the user at time t t The position information contained in the position transfer probability matrix M is used to find the corresponding row vector m i , m i represents the probability of the user moving from area i to other areas. These row vectors constitute the location transfer probability matrix M at time t. t ; Use the user's posterior probability at time t to deduce the user's prior probability at the next time t+1 Thus, multiple possible locations of the user at the next moment can be inferred;

[0069] The posterior probability distribution of the user at time t satisfies the following formula:

[0070]

[0071] where x t , x′ t are the user’s true position and disturbance position at time t, respectively, f(x′ t |x t ) is the probability distribution of position disturbance. Then the prior probability distribution at time t+1 is

[0072] Step 4.3: The prior probability at time t+1 Substitute the position point set Δχ t Calculate the formula to get the possible position set Δχ at time t+1 t+1 .

[0073] Step 5: According to step 4, we can get the possible position set Δχ at time t+1 t+1 Repeat step 2 to find the position protection set Φ at time t+1 t+1, repeat step 3 and use the perturbation mechanism Permute-and-Flip to publish the perturbed location, thereby generating pseudo-locations that conform to the user's life and movement habits at different times, and realizing personalized protection of the user's movement trajectory privacy.

[0074] The Permute-and-Flip mechanism is used to generate the probability distribution matrix of the perturbation position at each moment. This mechanism can generate a pseudo position with a smaller perturbation distance, thereby better achieving a balance between trajectory privacy and service quality. Its probability distribution matrix is:

[0075]

[0076] in Used for normalization,∈:privacy budget, The set of all possible locations of the user.

Claims

1. A personalized trajectory privacy protection method based on differential perturbation, characterized in that: For users who need trajectory privacy protection, the time correlation between the positions at different times on the user's mobile trajectory is collected to determine the possible location set at each time. Then, in the possible location set, the geographical indistinguishability and expected inference error technology are combined, and the minimum distance search algorithm based on the Hilbert curve is used to select a personalized location protection set for each possible location in the location set. The Permute-and-Flip mechanism is applied to the location protection set to generate a probability distribution matrix. The pseudo-location is released considering the spatiotemporal correlation of different locations on the trajectory. The released pseudo-location is consistent with the user's daily living habits to confuse attackers and achieve personalized privacy protection of the user's trajectory. By constructing a position transition probability matrix, the potential position set of the user at each time point on the trajectory is derived, and a minimum distance search algorithm based on the Hilbert curve is used to identify the protected position set that contains all potential positions along the trajectory; this combined method effectively enhances resistance to position inference attacks The specific steps are as follows: Step 1: Collect the user's movement trajectory, decompose the movement trajectory into location points according to time, generate user location sets from all coordinate points, and collect the user's prior probability at time t in the user data set. Remove extremely small or zero position points to obtain the possible position point set of the user at time t The possible location points of the user at time t The calculation method is as follows; in represents the minimum number of positions whose sum of prior probabilities is less than 1-δ, a i is the possible location area of ​​the user, δ is a constant (0<δ<1); if the user's real location x t If it is removed with a very small probability, the closest position is used. Instead of x t ,in for and x t The Euclidean distance between Step 2: Combine the two location perturbation mechanisms of geographic indistinguishability and expected inference error to limit the inference error range of network attackers, and set different inference error lower bounds to meet the user's personalized privacy protection needs; find the minimum distance search algorithm based on the Hilbert curve The position protection set Φ for each possible position in t ; The perturbation probability distribution in the location perturbation mechanism of geographic indistinguishability satisfies ∈ g -Geographically indistinguishable, that is, satisfying the following formula: Where d(x t ,y t ) represents the position x t With y t The Euclidean distance between g Determined by the privacy budget ∈ and the user-centric scope; The expected inference error position perturbation mechanism can make the attacker's inferred position The user's real location x t The error is used to measure the user's location privacy. The attacker's inference error is expressed as: Step 2.1: Determine the lower bound of the inference error: Assume that the worst case is the attacker's inferred position In the location protection set Φ t Therefore, the lower bound of the expected inference error satisfies: The expected inference error in the above formula is simplified and expressed as ExpEr(x′ t )≥e -∈ E(Φ t ); Step 2.2: To ensure the privacy protection effect, set the privacy parameter E as the threshold m , ensuring that the lower bound of the inference error is greater than the threshold, that is, satisfying the expected inference error ExpEr(x′ t )≥E m , it is necessary to make E(Φ t )≥e ∈ E m , users can meet E(Φ t )≥e ∈ E m Under the condition of , the influence of time correlation between different locations on user trajectory privacy is taken into account, and the complementary characteristics of geographic indistinguishability and expected reasoning error are used to adjust E m and ∈ to adjust the lower bound of the expected inference error; Step 2.3: Since the accuracy of the location service provided by LBS is proportional to the service quality, and the personalized location protection set Φ t It is a flat circular range. Therefore, it is necessary to improve the user's location service quality as much as possible while satisfying privacy. The personalized location protection set Φ corresponding to the protection area t Diameter D(Φ t ) is as small as possible, so the personalized location protection set Φ t The distance between any two positions in the t ),Right now So the following expression is satisfied: Step 2.4: Use the Hilbert search algorithm to search for the personalized location protection set Φ t Then, the personalized location protection set Φ after search matching is t The content is input into the position perturbation mechanism Permute-and-Flip, and the position perturbation mechanism Permute-and-Flip performs the work of publishing the perturbation position; Step 3: Use the location perturbation mechanism Permute-and-Flip to protect the location set Φ of the user at time t t Generate a probability distribution matrix to publish the pseudo location to the LBS server, and set different privacy parameters E m , infer the lower bound of the attacker's inference error on the user's current location to limit the attacker's inference range, and combine the privacy budget to achieve personalized adjustment of different privacy requirements, thereby achieving personalized privacy protection for the user's location at time t; Step 4: Obtain the possible location set of the user at time t+1 based on the temporal correlation between different locations on the user's movement trajectory The temporal correlation between different positions on the user's trajectory is used to obtain the possible location set of the user at time t+1. Step 4.1: Use the user's historical trajectory data and behavior habits to construct the location transfer probability matrix M. Let m ij is the element in the i-th row and j-th column of the matrix M, then m ij represents the probability of a user moving from area i to area j; Step 4.2: Based on the possible location set of the user at time t The position information contained in the position transfer probability matrix M is used to find the corresponding row vector m i , m i represents the probability of the user moving from area i to other areas. These row vectors constitute the location transfer probability matrix M at time t. t ; Use the user's posterior probability at time t to deduce the user's prior probability at the next time t+1 Thus, multiple possible locations of the user at the next moment can be inferred; The posterior probability distribution of the user at time t satisfies the following formula: where x t , x′ t are the user’s true position and disturbance position at time t, respectively, f(x′ t |x t ) is the probability distribution of position disturbance; then the prior probability distribution at time t+1 is Step 4.3: The prior probability at time t+1 Bring in a location point set Calculate the formula to get the possible position set at time t+1 Step 5: According to step 4, we can get the possible position set Δχ at time t+1 t+1 Repeat step 2 to find the position protection set Φ at time t+1 t+1 , repeat step 3 and use the perturbation mechanism Permute-and-Flip to publish the perturbed location, thereby generating pseudo-locations that conform to the user's life and movement habits at different times, and realizing personalized protection of the user's movement trajectory privacy; The Permute-and-Flip mechanism is used to generate the probability distribution matrix of the perturbation position at each moment. This mechanism can generate a pseudo position with a smaller perturbation distance, thereby better achieving a balance between trajectory privacy and service quality. Its probability distribution matrix is: in Used for normalization,∈: privacy budget, The set of all possible locations of the user.

Images