A location node privacy protection method and system based on differential privacy

Abstract

This invention discloses a location node privacy protection method and system based on differential privacy. The method includes: S1: a user personalized privacy setting step, where users set privacy protection requirements according to their own needs; S2: a location information submission step, where users submit their geographic location information according to a preset period, wherein the geographic location information l is a triple consisting of longitude x, latitude y, and time t, represented as l = (x, y, t); S3: a location information collection step, where after receiving the geographic location information submitted by each user, the data center summarizes the geographic location information submitted by each user in chronological order to obtain the user's trajectory dataset L; S4: a query response step, where the data center, based on the query request, the user's trajectory dataset, and the privacy protection requirements set in step S1, provides feedback on the user's query range. This solves the technical problem of simultaneously protecting the queried location point and its associated location points.

Description

Technical Field

[0001] This invention belongs to the field of location node privacy protection, and particularly relates to a method for personalized privacy protection of location nodes based on differential privacy. Background Technology

[0002] With the explosive development of IoT technology, wearable IoT devices such as smart health bracelets and portable blood pressure monitors have enabled real-time health monitoring for wearers, providing auxiliary information for doctors' diagnoses and significantly reducing the time and cost of treating chronic and occupational diseases. However, at the same time, these devices also have problems in the data collection, storage, and query stages, such as real-time monitoring of wearers' geographical location changes, leakage of wearers' personal information, collection and use of personal information beyond the scope of consent, and transfer of user information to third parties without consent.

[0003] Differential privacy, as an emerging privacy protection technology, features quantifiable privacy protection levels. By assuming that attackers possess maximum background knowledge, it adds probabilistic perturbations to the query results, making it impossible for attackers to infer the composition of the dataset from the query results. Differential privacy boasts advantages such as high computational efficiency and quantifiable privacy protection levels, thus attracting significant attention in the field of privacy protection in recent years.

[0004] In location privacy protection research based on differential privacy, the most classic method is the geographic indistinguishability method proposed by Andres et al., which uses the r-value as the protection radius for the real location, associates the privacy protection level r-value, and adds random noise to the real location. Bordenabe et al. pointed out that a balance between privacy and loss can be achieved through linear programming. Huo Zheng et al. constructed a noisy quadtree and a noisy R-tree on the road network space and added Laplace noise to protect the location data. Wu Yuncheng et al. adopted a differential privacy location protection model, using the ratio of the posterior probability of the real location to the probability of the real location when the generated location is known as a condition for satisfying differential privacy, and proposed the DPLRM mechanism. Xiao et al. converted the map into a weighted undirected graph, assigned privacy levels to location regions, used Markov chains to represent the relationship between two consecutive locations, and proposed a location protection scheme based on differential privacy.

[0005] In trajectory privacy protection research based on differential privacy, Chen et al. first proposed combining trajectory data publishing with differential privacy, proposing the STM-Full method for publishing trajectory datasets based on prefix-trees. However, the STM-Full method removes the time dimension information from the trajectory, retaining only the location dimension information, which severely impairs the usability of the data, making the published trajectory data only suitable for data analysis and mining in certain specific scenarios. Chen et al. further designed the N-grams method based on a variable-length n-gram model, which obtains longer sequences as much as possible through iteration to improve data usability; however, this premise is not realistic, and many trajectory sets cannot meet it. Hua et al. first merged the location points in adjacent regions, then added Laplace noise to perturb the data based on the location point count in the generalized region; finally, they connected the points in the generalized region to form trajectory data, generating a set of the same size as the original dataset.

[0006] A review of existing research reveals several shortcomings in current differential privacy solutions: First, most solutions focus on protecting the privacy of single locations or trajectories, with little consideration for protecting the relationships between geographic locations. Attackers can still infer a user's geographic location information based on the correlations and temporal relationships between these locations. Second, existing differential privacy mechanisms face a trade-off between privacy protection and data availability. Summary of the Invention

[0007] The purpose of this invention is to overcome the problems of the prior art by disclosing a location node privacy protection method and system based on differential privacy. The method and / or system of this invention provides a personalized privacy protection solution according to the diverse privacy needs of users, and solves the technical problem of simultaneously protecting the queried location point and its associated location points.

[0008] On the one hand, the objective of this invention is achieved through the following technical solution:

[0009] A location node privacy protection method based on differential privacy, the location node privacy protection method comprising the following steps:

[0010] S1: User personalized privacy settings steps. Users set their privacy protection requirements according to their own needs, including the completion time granularity t. * Geographical granularity r * And the setting of the privacy protection budget ε parameter;

[0011] S2: Location information submission step, complete the submission of user's geographic location information according to the preset cycle. The geographic location information l is a triple consisting of longitude x, latitude y, and time t, represented as L=(x,y,t).

[0012] S3: Location information collection step. After receiving the geographic location information submitted by each user, the data center summarizes the geographic location information submitted by each user in chronological order to obtain the user's trajectory dataset L.

[0013] S4: Response to query steps. The data center provides feedback on the user's query scope based on the query request, the user's trajectory dataset, and the privacy protection requirements set in step S1.

[0014] According to a preferred embodiment, the response query step of S4 includes: S41: determining the reference location dataset L′ based on the query request. u S42: Calculate the reference location dataset L′ u S43: Calculate the maximum distance of each location point on the x-axis and y-axis, and calculate the sensitivity in that direction; S44: Based on the sensitivity obtained in step S42, calculate the perturbation location points using the Laplace mechanism; S45: Based on the geographic location granularity submitted by the user and the perturbation location points obtained in step S43, generate the query range; S46: Feed back the generated query range to the querying party.

[0015] According to a preferred embodiment, step S41 specifically includes: when a query request Q(u,t) is received... Q In other words, the querying party wants to know the time point t for user u. Q The geographical scope of the location; the data center first determines the trajectory L corresponding to user u in the trajectory dataset L based on the querying user. u And based on the query time t Q The time granularity t of the submission by user u * Determine the reference location points and form the reference location dataset L′. u .

[0016] According to a preferred embodiment, step S42 specifically includes: letting L′ u,x For the reference location dataset L′ u The set of x-axis coordinates, L′ u,y For the reference location dataset L′ u The set of y-axis coordinates, where x i ,x j For L′ u,x For any two points in the middle, y m ,y n For L′ u,y Any two points in the middle, i.e., x i ,x j ∈L′ u,x ,y m ,y n ∈L′ u,y At this time, L′ uThe maximum distance in each direction is denoted as dist; the maximum distance in each direction is taken as max(dist). x ,r * As a sensitivity, L′ u The sensitivity in the x-axis direction is denoted as Δf. x =Max(|x i -x j |1);L′ u The sensitivity in the y-axis direction is denoted as

[0017] According to a preferred embodiment, step S43 specifically includes: based on the sensitivity calculated in step S42, injecting a mean of 0 and a scale of [value missing] into the actual query results along the x-axis and y-axis directions, respectively. And the noise follows a Laplace distribution; let n x Noise injected along the x-axis, n y If the noise is injected in the y-axis direction, then The perturbation result is x′ Q =x Q +n x y′ Q =y Q +n y Step S43 returns the disturbance location point (x′) Q ,y′ Q ).

[0018] According to a preferred embodiment, step S44 specifically includes: combining the geographic location granularity Δr submitted by user u. u With the disturbance location point (x′) Q ,y′ Q Generate query range C u =(x′) Q ,y′ Q ,r * ), where C u Represented by (x′) Q ,y′ Q With r as the center, * The query range is defined by the radius.

[0019] According to a preferred embodiment, in step S1, the time granularity t * When user data is queried, it is desirable to calculate based on the query time point t. Q The provided time range; if the time series submitted by user u is {t1,…,t…} i ,t m The query time point is t. Q The user-defined time granularity is t. * Then query Q(u) i ,tQ The response results will take into account the time range (t). Q -t * ,t Q +t * The geographical locations submitted by users within the query results are used as reference points.

[0020] According to a preferred embodiment, in step S1, the geographic location granularity r * Represents the minimum perturbation range acceptable to the user; the privacy budget ε is used to measure the user's privacy protection needs.

[0021] According to a preferred embodiment, step S3, the location information collection step, includes: after receiving the geographic location information submitted by user u, the data center summarizes the geographic location information submitted by user u in chronological order to obtain the trajectory dataset L of user u. u The data center compiles the trajectories of all users, which is the trajectory dataset L composed of all user trajectory sequences.

[0022] On the other hand, the present invention also discloses:

[0023] A location node privacy protection system based on differential privacy is disclosed. The system includes a data providing unit, a data center, and a data querying unit. The user completes personalized privacy settings through the data providing unit and submits corresponding location information to the data center. The data querying unit sends a query request to the data center and receives the query scope from the data center. The location node privacy protection system operates according to the aforementioned location node privacy protection method.

[0024] The aforementioned main solution of the present invention and its various further alternative solutions can be freely combined to form multiple solutions, all of which are solutions that can be adopted and are claimed by the present invention. Those skilled in the art, after understanding the solution of the present invention, will realize, based on existing technology and common knowledge, that there are many combinations, all of which are technical solutions to be protected by the present invention; therefore, no exhaustive list is provided here.

[0025] Compared to existing differential privacy perturbation methods, the advantages of this invention are:

[0026] (1) A series of parameters were used to describe the diverse privacy protection needs of users. During the query process, the query time point and time granularity were combined to filter out a series of related location points, which were used to further reduce the disturbance to the query results, improve the usability of the feedback results, and achieve a balance between the effectiveness of the query results and the needs of privacy protection;

[0027] (2) A dataset of reference locations related to the query point was selected in the time dimension, thus realizing the location privacy protection of the query point and its related points. Attached Figure Description

[0028] Figure 1 This is a flowchart illustrating the location node privacy protection method based on differential privacy of the present invention;

[0029] Figure 2 This is a schematic diagram of the architecture of the location node privacy protection system based on differential privacy of the present invention. Detailed Implementation

[0030] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0031] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0032] Example 1:

[0033] refer to Figure 1 As shown in the figure, a location node privacy protection method based on differential privacy is illustrated. The location node privacy protection method includes the following steps:

[0034] S1: User personalized privacy settings steps. Users set their privacy protection requirements according to their own needs, including the completion time granularity t. * Geographical granularity r * And the setting of the privacy protection budget ε parameter.

[0035] Furthermore, in step S1, the time granularity t * When user data is queried, it is desirable to calculate based on the query time point t. Q The time range provided.

[0036] If user u submits a time series {t1,…,t} i ,t m The query time point is t. Q The user-defined time granularity is t. * Then query Q(u) i ,t Q The response results will take into account the time range (t). Q -t * ,t Q +t *The geographical locations submitted by users within the query results are used as reference points.

[0037] Furthermore, the geographic location granularity r * Represents the minimum perturbation range acceptable to the user; the privacy budget ε is used to measure the user's privacy protection needs.

[0038] S2: Location information submission step, complete the submission of user's geographical location information according to the preset period. The geographical location information l is a triple consisting of longitude x, latitude y, and time t, and is represented as l = (x, y, t).

[0039] S3: Location information collection step. After receiving the geographic location information submitted by each user, the data center summarizes the geographic location information submitted by each user in chronological order to obtain the user's trajectory dataset L.

[0040] Furthermore, step S3, the location information collection step, includes: after receiving the geographic location information submitted by user u, the data center summarizes the geographic location information submitted by user u in chronological order to obtain the trajectory dataset L of user u. u The data center compiles the trajectories of all users, which is the trajectory dataset L composed of all user trajectory sequences.

[0041] S4: Query Response Step. Based on the query request, the user's trajectory dataset, and the privacy protection requirements set in step S1, the data center provides feedback on the user's query scope. Specifically, the query response step in S4 includes:

[0042] Step S41: Determine the reference location dataset L′ based on the query request. u .

[0043] Further, step S41 specifically includes: when a query request Q(u,t) is received... Q In other words, the querying party wants to know the time point t for user u. Q The geographical scope of the location; the data center first determines the trajectory L corresponding to user u in the trajectory dataset L based on the querying user. u And based on the query time t Q The time granularity t of the submission by user u * Determine the reference location points and form the reference location dataset L′. u .

[0044] Step S42: Calculate the reference location dataset L′ u Find the maximum distance between each location point on the x-axis and y-axis, and calculate the sensitivity in that direction.

[0045] Further, step S42 specifically includes: letting L′ u,x For the reference location dataset L′u The set of x-axis coordinates, L′ u,y For the reference location dataset L′ u The set of y-axis coordinates, where x i ,x j For L′ u,x For any two points in the middle, y m ,y n For L′ u,y Any two points in the middle, i.e., x i ,x j ∈L′ u,x ,y m ,y n ∈L′ u,y At this time, L′ u The maximum distance in each direction is denoted as dist; the maximum distance in each direction is taken as max(dist). x ,r * As a sensitivity, L′ u The sensitivity in the x-axis direction is denoted as Δf. x =Max(|x i -x j |1);L′ u The sensitivity in the y-axis direction is denoted as

[0046] Step S43: Based on the sensitivity obtained in step S42, calculate the perturbation location point through the Laplace mechanism.

[0047] Further, step S43 specifically includes: based on the sensitivity calculated in step S42, injecting a mean of 0 and a scale of [value missing] into the actual query results in the x-axis and y-axis directions respectively. And the noise follows a Laplace distribution; let n x Noise injected along the x-axis, n y If the noise is injected in the y-axis direction, then The perturbation result is x′ Q =x Q +n x y′ Q =y Q +n y Step S43 returns the disturbance location point (x′) Q ,y′ Q ).

[0048] Step S44: Generate a query range based on the geographic location granularity submitted by the user and the perturbation location points obtained in step S43.

[0049] Furthermore, step S44 specifically includes: combining the geographic location granularity Δr submitted by user u. uWith the disturbance location point (x′) Q ,y′ Q Generate query range C u =(x′) Q ,y′ Q ,r * ), where C u Represented by (x′) Q ,y′ Q With r as the center, * The query range is defined by the radius.

[0050] Step S45: Feed back the generated query range to the querying party.

[0051] Example 2

[0052] refer to Figure 2 As shown, this embodiment also discloses a location node privacy protection system based on differential privacy. The location node privacy protection system includes a data providing unit, a data center, and a data querying unit. The location node privacy protection system operates according to the location node privacy protection method described in Embodiment 1.

[0053] The data providing unit includes, but is not limited to, mobile terminal settings or wearable devices. Users complete personalized privacy settings and submit corresponding location information to the data center via the data providing unit. The data query unit sends a query request to the data center and receives the query scope from the data center.

[0054] Compared to existing differential privacy perturbation methods, the method and system of this invention describe the diverse privacy protection needs of users through a series of parameters. During the query process, the query time point is combined with time granularity to filter out a series of related location points, which further reduce the perturbation of the query results, improve the usability of the feedback results, and achieve a balance between the effectiveness of the query results and the need for privacy protection. The method and system of this invention also filter out a reference location dataset related to the query point in the time dimension, thereby achieving location privacy protection for the query point and its related points.

[0055] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A location node privacy protection method based on differential privacy, characterized in that, The location node privacy protection method includes the following steps: S1: Steps for users to personalize their privacy settings. Users can set their privacy protection requirements according to their own needs, including the time granularity of completion. Geographical granularity And the setting of the privacy protection budget ε parameter; S2: Location information submission step. The user's geographic location information is submitted according to a preset cycle. This geographic location information is represented as a triplicate consisting of longitude x, latitude y, and time t. ; S3: Location information collection step. After receiving the geographic location information submitted by each user, the data center aggregates the geographic location information submitted by each user in chronological order to obtain the user's trajectory dataset. ; S4: Response to query steps, the data center provides feedback on the user's query scope based on the query request, the user's trajectory dataset, and the privacy protection requirements set in step S1; The response query step of S4 includes: S41: Determine the reference location dataset based on the query request. ; S42: Calculate the reference location dataset The internal locations are respectively in x axis, y Find the maximum distance on the axis and calculate it. x axis, y Sensitivity in the axial direction; S43: Based on the sensitivity obtained in step S42, the perturbation location point is calculated using the Laplace mechanism; S44: Generate a query range based on the geographic location granularity submitted by the user and the perturbation location points obtained in step S43; S45: Feedback the generated query scope to the querying party; Step S42 specifically includes: make Reference location dataset middle x The set of axis coordinates, Reference location dataset middle y The set of axis coordinates, where , for Any two points in, , for Any two points in, i.e. ,at this time The maximum distance in each direction is denoted as dist; Take each direction As for sensitivity, exist x The sensitivity in the axial direction is denoted as ; exist y The sensitivity in the axial direction is denoted as ; Step S43 specifically includes: Based on the sensitivity calculated in step S42, respectively from... x axis, y The mean of the injected true query results along the axis is 0, and the scale is [missing value]. And noise that follows a Laplace distribution; make for x Noise injected in the axial direction, for y Noise injected in the axial direction, The perturbation result is Step S43 returns the disturbance location point. .

2. The location node privacy protection method as described in claim 1, characterized in that, Step S41 specifically includes: when a query request is received In other words, the querying party wants to know the time point in time that user u was in. The geographical area where it is located; The data center first determines the trajectory dataset based on the querying user. Chinese users u Corresponding trajectory dataset L u And based on the query time With users u Submission time granularity Determine reference location points to form a reference location dataset. .

3. The location node privacy protection method as described in claim 1, characterized in that, Step S44 specifically includes: Combined with users u Submitted geographic location granularity relative to the location of the disturbance Generate query range ,in Representative with With the center as the center, The query range is defined by the radius.

4. The location node privacy protection method as described in claim 1, characterized in that, In step S1, the time granularity When user data is queried, it is desirable to consider the query time. The time range provided; If user u submits the time series as follows The query time point is The user-defined time granularity is Then the query request The response results will take time range into account The geographical locations submitted by users are used as reference points for the query results.

5. The location node privacy protection method as described in claim 1, characterized in that, In step S1, the geographic location granularity Represents the minimum perturbation range acceptable to the user; the privacy budget ε is used to measure the user's privacy protection needs.

6. The location node privacy protection method as described in claim 1, characterized in that, Step S3, location information collection, includes: After receiving the geographic location information submitted by user u, the data center aggregates the geographic location information submitted by user u in chronological order to obtain user u's trajectory dataset. ; The data center compiles the trajectories of all users, i.e., a trajectory dataset composed of all user trajectory sequences. .

7. A location node privacy protection system based on differential privacy, characterized in that, The location node privacy protection system includes a data providing unit, a data center, and a data query unit; In this process, the user completes the personalized privacy settings steps through the data providing unit and submits the corresponding location information to the data center; the data query unit sends a query request to the data center and receives the query scope from the data center. The location node privacy protection system operates based on the location node privacy protection method according to any one of claims 1 to 6.

Images