A privacy-preserving range aggregation query method for spatial data federation

Abstract

The present invention relates to the field of spatial data federation information services, and in particular to a privacy-protected range aggregation query method for spatial data federation, comprising: dividing a local database into regions and establishing a local storage structure; initializing an index structure in the local database according to the region division result; encrypting position data of index nodes and establishing a global index structure in conjunction with an LBS server; a querying user sending a query request to the LBS server and constructing a query request vector according to the content; the local database constructing a return result vector according to statistical results and returning the result vector to the LBS server after compression and disturbance; the LBS server aggregating and reconstructing the return results of each local database, obtaining a primary encryption result of the original signal, and returning the result to the querying user; the present invention provides an efficient and secure range aggregation query service while ensuring the privacy and security of the querying user.

Description

Technical Field

[0001] The present invention relates to the field of spatial data federation information services, and in particular to a privacy protection range aggregation query method for spatial data federation. Background Art

[0002] In location-based services (LBS) based on spatial data, to improve service quality, several data owners (DOs) tend to join forces to share their data and provide external query services, thus forming a data federation. The difference between spatial data federation and common scenarios is that the final query result is the optimal aggregated result obtained by multiple DOs, rather than a single DO. For example, when answering the question "How many shared bikes are there within a 2-kilometer radius of a certain coordinate location?", a shared bike location service provider (LBSP) can combine data from multiple shared bike service companies to answer this query. Depending on the query content, it can be a range aggregation query, such as the query above, or a nearest neighbor query, such as "Query the shared bikes closest to me."

[0003] Although in spatial data federation, multiple DOs tend to unite and share each other's data information to improve service quality. However, due to legal and regulatory requirements and commercial confidentiality, directly sharing each other's original data is not feasible. At the same time, the search user (SU) continuously shares its own location information with the server to obtain location services. However, location information often reveals the user's relevant privacy information, such as home and company addresses. If the server is untrusted, it will pose a threat to the privacy security of the SU. On the one hand, the server can spy on the user's privacy information through the location information queried by the user. For example, an employer can check the employee's behavior by knowing the places she visits and the time of each visit. On the other hand, the server can track the user's location through the user's real-time location information.

[0004] In current research, many solutions have been proposed to protect the privacy of querying users' locations, such as k-anonymity and cryptographic methods. The basic principle of k-anonymity is to mix the real user's location information with k-1 fake users, thereby constructing an anonymous region to replace the real user's location in location service requests. However, constructing anonymity sets often incurs additional computational overhead, meaning that the LBSP must answer queries outside the query scope, which significantly reduces query efficiency. Other researchers have proposed using traditional cryptographic methods, such as homomorphic encryption and proxy re-encryption, to encrypt location data to achieve privacy protection. However, cryptographic methods often involve complex decryption operations, which require significant computational resources.

[0005] Meanwhile, existing research on spatial data federation focuses primarily on protecting the privacy of local data from multiple parties, while lacking consideration for the location privacy and security of querying users. In this context, the querying user's location information is directly exposed to the server in plain text. Furthermore, while some data privacy and security protections for multiple parties have been proposed in data federation, these are based on relational data rather than spatial datasets and therefore cannot be directly applied to location-based services.

[0006] In summary, in a spatial data federation environment, efficiently and securely answering users' range aggregation query requests still faces the following challenges:

[0007] 1. In spatial data federation, existing query service strategies focus primarily on data privacy and query efficiency across multiple parties, but lack privacy and security protection for user query locations. Users' query location information is directly exposed to third parties in plain text. This poses a significant privacy and security threat when dealing with untrusted third parties.

[0008] 2. With data federation, directly uploading plaintext data to location-based service providers is not feasible for commercial or privacy reasons. Coordinating the actions of multiple parties and aggregating local query results from multiple sources while ensuring the privacy of both users and data owners remains a challenge.

[0009] Generally speaking, there's an inherent conflict between privacy protection and efficiency. The complexity of spatial data federation and the need for efficient, real-time queries make complex decryption operations unsuitable. Striking an effective balance between privacy and query efficiency remains a challenge. Summary of the Invention

[0010] In order to provide efficient and secure range aggregation query services while ensuring the privacy of SUs, the present invention proposes a privacy-preserving range aggregation query method for spatial data federation, which specifically includes the following steps:

[0011] After the local database receives the index building request initiated by the LBS server, it divides the local database into grid areas and establishes a local storage structure;

[0012] The local database initializes the index structure based on the grid area division results;

[0013] The local database encrypts the location data of the index node and establishes a global index structure in conjunction with the LBS server to obtain the index tree QTree;

[0014] When the query user initiates a query request to the LBS server, a query request vector is constructed based on the request content; the query request vector includes the query location information;

[0015] After receiving the query request vector, the local database performs a query based on the query request vector and obtains statistical results;

[0016] The local database returns the result vector based on the statistical results, and after completing the compression disturbance, it feeds the result back to the LBS server;

[0017] The LBS server aggregates and reconstructs the feedback from various local databases, obtains the primary encryption result of the original signal, and then feeds it back to the querying user;

[0018] The querying user decrypts and counts the received encrypted results to obtain the query results.

[0019] Furthermore, the process of dividing the local database into grid areas and establishing a local storage structure includes:

[0020] If the i-th local database is represented by DO i ,DO i Owned spatial data object set O i Indicated as O i ={o1,...,o m}, its mth spatial data object o m Indicated as o m =(x m ,y m ,cont m ), x m 、y m Represents spatial data objects o m Longitude and latitude information, cont m Represents spatial data object o m Attribute identifier, m is the spatial data object set Oi The number of spatial data objects in the

[0021] Use Hilbert to divide the space area and get a set of k grid areas of equal size {AR i}, 1≤i≤k, the i-th grid area AR i Represented as AR i =(Attr,Num,Count,D), Attr represents AR i Position attribute, Num is the grid area number, Count is the grid area AR i The total number of spatial data objects owned, and D is the set of spatial objects in the area;

[0022] The grid area set is combined with a given curve construction rule rule = (d, p, N, θ) to determine a Hilbert curve, where d represents the opening direction, p represents the starting point, N represents the curve order, and θ represents the rotation angle.

[0023] Furthermore, the process of initializing the index structure includes:

[0024] A quadtree index structure is established in a bottom-up manner, that is, four grid areas are merged into one area node, and four area nodes are merged into a new area node until the entire query area is covered, resulting in a quadtree-based index structure QTree;

[0025] In the index structure QTree, its leaf node is a grid area, and the storage structure of the leaf node stores the location attribute of the leaf node and the grid area number;

[0026] In the index structure QTree, a non-leaf node is a domain node, and the storage structure of the domain node stores the location attribute and domain node number of the domain node;

[0027] The location attributes of the domain node include the extreme values ​​of the coordinates of the four domain nodes or vertices in the grid area constituting the domain node and the centers of the four domain nodes;

[0028] The network domain node number can be a unique number assigned by the user.

[0029] Furthermore, the process of encrypting the location data of the index node in the local database includes:

[0030] If the original signal of the position data is represented by x=[x1,...,x N ] T ∈R N , is sparse under the N×N dimensional transformation basis matrix ψ, then the original signal x can be expressed as: x = ψs;

[0031] The original signal x is projected onto a measurement matrix φ that is unrelated to the sparse matrix ψ. The scale of the measurement matrix is ​​M×N and M<<N. The M-dimensional observation vector y is obtained, and the compression operation can be defined for:

[0032]

[0033] The measurement matrix φ satisfies the restricted isometry property, and the signal can be reconstructed by solving the l1 norm minimization problem using the observation vector y. , thus approximately reconstructing the original signal

[0034] Where Θ represents the sparse perception matrix, Θ = φψ, and Θ is passed to the LBS server as a secret key when the query is returned to complete the reconstruction operation.

[0035] Furthermore, when the query user initiates a query request to the LBS server, constructing a query request vector according to the request content includes:

[0036] The query user initializes the query request as Q = (T, P), where P represents the query location information, which is expressed as P =<c,r> , c is the query location center, r represents the query radius; T is the time when the query is initiated;

[0037] The query user requests the encryption key information, i.e., the measurement matrix, from the local service library. The query position center c is transformed by CS according to the measurement information. The query request is updated to

[0038] Furthermore, the process of querying based on the query request vector and obtaining statistical results includes:

[0039] The LBS server retrieves the index tree QTree based on the query location information in the query request vector and determines the grid area that intersects with the query range. During the confirmation process, if the distance between the query center vector and the vertex of a grid area is less than the query radius, then the grid area intersects with the query range; otherwise, if the distance between the query center vector and the center of a grid area satisfies Then the grid area intersects with the query range, otherwise it does not intersect with the query range;

[0040] After determining the set of intersecting grid areas, the set of intersecting grid areas is forwarded to each local database, and each local database is required to answer the spatial object statistics of the corresponding grid.

[0041] Furthermore, the local database returns the result vector based on the statistical results, performs compression perturbation, that is, performs a CS transformation, and then performs differential privacy protection on the local compressed result vector of the local database, which is expressed as:

[0042]

[0043] Where Δc is The corresponding sensitivity; ε is the privacy budget; laplace (Δc / ε) is the Laplace noise addition mechanism. It has been proven that adding noise that conforms to the Laplace distribution can meet differential privacy.

[0044] Furthermore, the process of obtaining the primary encryption result of the original signal and feeding it back to the querying user includes:

[0045] Aggregate the differentially private data from each local database, that is:

[0046]

[0047] The aggregated quantity is reconstructed, and the perception matrix is ​​encrypted once during the reconstruction process. The reconstruction operation is expressed as:

[0048]

[0049] Where λ is the Lagrange multiplier, represents the reconstruction operation of the signal y; Θ′=ψφM=ΘM, Θ represents a sparse perception matrix, ψ represents a sparse matrix, φ represents a perception matrix unrelated to ψ, M represents a reversible linear transformation matrix, ||·||2 represents the l2 norm, and ||·||1 represents the l1 norm.

[0050] Furthermore, the querying user decrypts and counts the received encrypted result. The process of obtaining the query result includes:

[0051]

[0052]

[0053] Among them, x ij Represents the specific item in the i-th row and j-th column of the matrix x, where x is an n×m real number matrix; m represents the number of grid areas participating in the statistics in a local database, n represents the number of local databases participating in the joint query, and res is the aggregate query result.

[0054] The privacy-preserving range aggregation query method for spatial data federation of the present invention has the following beneficial effects:

[0055] 1. We introduce location privacy protection for querying users in spatial data federation and propose a lightweight privacy protection strategy based on compressed sensing transform. This strategy shifts range aggregation queries from the plaintext domain to the compressed sensing encrypted domain, effectively avoiding complex decryption operations while ensuring privacy.

[0056] 2. To ensure both privacy and query efficiency, a privacy-preserving quadtree-based global index structure is established. Here, the location service provider does not directly forward the user's query request. Instead, it searches the index structure to identify and forward the grid areas that intersect the query range, greatly improving service efficiency.

[0057] This paper proposes an efficient range aggregation query service based on spatial data federation with privacy and security considerations. The location service provider converts the query request in the encrypted domain and coordinates the aggregation of local query results from various federated parties. At the same time, in order to prevent speculation attacks from malicious third parties, differential privacy technology is used to add noise perturbations to the statistical results. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] Figure 1 Query the overall interaction graph for range aggregation;

[0059] Figure 2 Schematic diagram of using Hilbert to divide the space area;

[0060] Figure 3 Schematic diagram of a global index tree with a quadtree structure constructed for the divided grid area;

[0061] Figure 4 Schematic diagram of the storage structure of leaf nodes and non-leaf nodes in the index tree;

[0062] Figure 5 Schematic diagram of the relative position of the query range and grid area. DETAILED DESCRIPTION

[0063] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0064] The present invention proposes a privacy-preserving range aggregation query method for spatial data federation, which specifically includes the following steps:

[0065] After the local database receives the network construction request initiated by the LBS server, it divides the network area and establishes a local storage structure;

[0066] The local database initializes the index structure based on the network area division results;

[0067] The local database encrypts the location data of the index node and establishes a global index structure in conjunction with the LBS server to obtain the index tree QTree;

[0068] When the query user initiates a query request to the LBS server, a query request vector is constructed based on the request content; the query request vector includes the query location information;

[0069] After receiving the query request vector, the local database performs a query based on the query request vector and obtains statistical results;

[0070] The local database returns the result vector based on the statistical results, and after completing the compression disturbance, it feeds the result back to the LBS server;

[0071] The LBS server aggregates and reconstructs the feedback from various local databases, obtains the primary encryption result of the original signal, and then feeds it back to the querying user;

[0072] The querying user decrypts and counts the received encrypted results to obtain the query results.

[0073] like Figure 1 The figure shows the overall interactive process of range query based on spatial data federation, which mainly includes four steps:

[0074] In the first phase, LBSP and DO jointly build a global index structure to answer range aggregation queries.

[0075] In the second stage, the SU initiates a query request and constructs a request vector based on the request content; after being encrypted using the Compressed Sensing (CS) transform, it is sent to the LBSP.

[0076] In the third stage, the LBSP obtains the set of intersecting grid areas by retrieving the global index based on the query request; then the LBSP forwards the task, sends the traversed set of intersecting grid areas to each DO, and requires it to answer the corresponding statistical information; after receiving the query request, the DO performs a local query, constructs a return result vector based on the local statistical results, performs CS transformation, adds differential privacy noise perturbation (DP), and returns it to the LBSP.

[0077] In the fourth stage, after receiving the return result from DO, LBSP first performs aggregation and completes the reconstruction operation, and then returns the final query result to SU.

[0078] The above four stages specifically include the following steps:

[0079] S1 and DO divide the area and establish a local storage structure.

[0080] In order to assist the query, each joint query participant DO traverses the same area and builds local storage information based on the spatial data objects it holds. Generally, a spatial data object can be represented as o = (x, y, cont), where x and y can represent the latitude and longitude information of o, and cont is the attribute identifier of o (such as whether it is a restaurant, gas station or supermarket, etc.). Then for a local database DO in one of the n local databases, i (1≤i≤n), there are O i ={o1,...,o m}, O i For DO i The set of spatial data objects owned, and m is the number of objects.

[0081] The Hilbert curve is a widely used space-filling curve that can linearly connect discrete units in a high-dimensional space and assign unique identifiers. This allows for mapping discrete units into a one-dimensional space to aid index construction. In this paper, the Hilbert curve is used to partition a designated area, providing preliminary preparation for index construction.

[0082] like Figure 2 The figure shows a schematic diagram of using Hilbert partitioning for spatial regions. Performing two-dimensional partitioning within a specified region yields a set of grid regions of equal size, where k is the total number of grid regions. Here, the storage structure of an AR can be defined as:

[0083] AR i =(Attr,Num,Count,D),(1≤i≤k)

[0084] Among them, Attr represents AR i Position attribute, Num is the grid area number, Count is the grid area AR i The total number of spatial data objects o owned by the DO, and D is the set of spatial objects in the region. In order to facilitate the construction of the global grid index, all DOs are required to use the same partitioning method for the same region, which means that the grid regions obtained by each DO are of the same size and quantity.

[0085] Given a set of grid areas {AR i}(1≤i≤k), combined with the given curve construction rule rule=(d,p,N,θ), a Hilbert curve can be determined, where d represents the opening direction, p represents the starting point, N represents the curve order, and θ represents the rotation angle. Figure 2 Shown h.

[0086] S2. DO initializes the index structure based on the region division results.

[0087] In order to provide fast query services, LBSP and DO build a global index structure. Spatial data federation can be defined as SDF = {DO1,...,DO i For a specific DO (1≤i≤n), as described in S1, the AR contains the following information: AR = (Attr, Num, Count, D). In the SDF, D represents the local data held by the DO and not directly shared externally. Therefore, the information uploaded by the DO to the LBSP should only include Attr and Num.

[0088] As mentioned in S1, all DOs in the same query area adopt a unified grid division method and encoding. Therefore, DOs are randomly selected from SDF. i (1≤i≤n) assists LBSP in establishing a global index structure. Figure 3 As shown in the figure, after the Hilbert curve is used to divide the region into regions and encode them, a certain number of grid regions {AR i}(1≤i≤k). Here, a bottom-up approach is adopted to build a quadtree index structure.

[0089] Among them, the leaf node is the grid area AR, and the grid areas {AR0, AR1, AR2, AR3} are further merged to form the regional node A. The same regional nodes {A, B, C, D} are merged to form the regional node E with a larger coverage. Through continuous iteration, until the entire query area is covered, and finally a network is established as follows Figure 3 The quadtree-based index structure QTree is shown.

[0090] In the index QTree, its leaf node is the grid area AR, so its storage structure can be determined as follows:

[0091] AR=(Attr,Num)

[0092] Where Num is the unique number of the grid area, Attr is the position attribute of AR, which is the position set of four vertices, that is, Attr = {α i}(1≤i≤4). For non-leaf nodes, such as Figure 4 As shown in Figure 1, the position attribute Attr is composed of the maximum values ​​of the horizontal and vertical coordinates of the vertex positions in the grid areas AR0, AR1, AR2, and AR3. At the same time, in order to facilitate the determination of the relative position of the area and the query range, the geometric position center β is added to A, so that Attr = {α i,β}(1≤i≤4); for non-leaf nodes, Num is not necessary information. Non-leaf nodes can be numbered according to actual needs, and the numbers must be unique in the index structure QTree.

[0093] S3 and DO encrypt the location data of the index node and jointly establish a global index structure with LBSP.

[0094] In order to protect location privacy, DO first encrypts the location information in the index QTree before uploading it to LBSP. LBSP is usually assumed to be an untrusted third party, which requires that the proposed encryption strategy not only guarantees the location privacy of SU, but also cannot affect the query service. This requires LBSP to complete the relative distance comparison between locations in a fully encrypted environment. As a data sampling algorithm, the compressed sensing algorithm not only samples and encrypts the original data to protect privacy, but also maintains the finite distance constraint property. Therefore, the CS transform is used in the present invention to provide a lightweight encryption strategy. Assume that the original signal is x = [x1,...,x N ] T ∈R N , is sparse under the N×N dimensional transformation basis matrix ψ, then the original signal x can be expressed as:

[0095] x=ψs

[0096] Where s=[s1,...,s N ] T It is a sparse representation of the original signal x on the sparse matrix ψ. If s contains K non-zero components and K<<N, the signal s is said to be K-order sparse; in this embodiment, the original signal represents the signal before the CS transformation. For example, if the position vector needs to be CS transformed, the original signal here refers to the position signal. The sparse matrix ψ is generally a fixed orthogonal basis matrix, such as a Fourier transform matrix, a discrete cosine transform matrix, etc. The signal is then projected onto a perception matrix φ(M×N,M<<N) that is unrelated to the sparse matrix ψ to obtain an M-dimensional observation vector y, and the compression operation can be defined. for:

[0097]

[0098] Among them, Θ is a sparse perception matrix, Θ = φψ. Common perception matrices φ include random Gaussian matrices, Bernoulli random measurement matrices, etc. Here, φ satisfies the restricted isometry property (RIP), and then the signal can be approximately reconstructed by solving the l1 norm minimization problem using the observation vector y. . Thus the original signal can be reconstructed approximately Signal The acquisition process is expressed as:

[0099]

[0100] Generally speaking, Euclidean distance is often used to measure the relative distance between two vectors in n-dimensional space. Given two vectors A = (a1,...,a i ),a i ∈R(1≤i≤n), B=(b1,...,b i ),b i ∈R(1≤i≤n), then the Euclidean distance between A and B can be defined as:

[0101]

[0102] Here, CS transform is performed on A and B respectively to obtain Y a =φA,Y b =φB, where φ is the perception matrix, Y a and Y b Then they are the observation vectors of A and B in the CS domain. Since the CS transformation is a linear operation, the transformed vectors still maintain the original linear correlation and Euclidean distance, so we can get:

[0103] dis(A,B)=dis(Y a ,Y b )

[0104] Based on the above transformation, the aggregate query operation in the plaintext domain can be performed in the CS domain. This natural encryption operation allows the LBSP to complete the range distance comparison without knowing the specific location information of the SU and DO. It avoids complex decryption operations while ensuring location privacy, greatly improving query efficiency.

[0105] After receiving the encrypted index QTree uploaded by the DO and a query request from the SU, the LBSP no longer forwards the original query request to the DO. Instead, it searches the QTree to identify the grid area that intersects the query range and forwards the intersecting grid area instead of the original query. This significantly improves the DO's local search speed while maintaining the SU's location privacy.

[0106] S4. SU sends a query request to the LBSP and constructs a query request vector based on the content.

[0107] In a query request submitted by the query user SU, the information contained generally includes query location information (such as the query center and query radius in range query), query time, and query content (that is, the target content of the query is about restaurants, gas stations, etc.). Although the query content can reveal the user's query purpose to a certain extent, the present invention only focuses on the privacy protection of SU's query location information. Generally speaking, in LBS, SU's range aggregation query request Q = (T, P). Among them, T is the query time, which means the time when the query is initiated. P is the query-related geographic location information. Since the service involved in the present invention is a range aggregation query service, P can be expressed as P =<c,r> , where c represents the coordinate position information of the query center, usually c = (x, y), and r represents the query radius.

[0108] Furthermore, in spatial data federation, the range aggregation query request of SU can be defined as:

[0109] Q(SDF,F,T,P)=F({o,o∈SDF&o is within Pr})

[0110] Among them, SDF is spatial data federation, generally SDF={DO1,...,DO i}, (1≤i≤n); F is an aggregation function, such as statistics, summation, etc., and o is the spatial target object.

[0111] Since the query location information P often reveals the geographical location information of the querying user SU (such as home, company, etc.), in the present invention, P is the key to the location privacy protection of the SU. Specifically, before the SU initiates a query service request to the LBSP, it first encrypts the carried location information. The SU requests the encryption key, i.e., the perception matrix φ, from the DO participating in building the global index. After obtaining φ, a CS transformation is performed on the query coordinate center c to obtain the observation vector in the CS domain. Then P can be updated to Therefore, the SU update query request is and submit it to LBSP.

[0112] To summarize, the specific steps for SU to construct a query request vector are:

[0113] 1. SU initializes the query request as Q = (T, P), where P =<c,r> , c is the query location information, r represents the query radius;

[0114] 2. SU requests encryption key information, i.e., measurement matrix φ, from DO;

[0115] 3. After receiving the secret key, SU encrypts the query information, that is, performs a CS transformation and updates the query request to

[0116] 4.SU sends updated query request to LBSP

[0117] S5. LBSP receives the query request from SU and completes the range aggregation query service.

[0118] LBSP receives the query request from SU After that, get the specific query content through parsing Since the query request is encrypted by CS transformation, LBSP does not know the specific content information and completes the search operation in the CS encryption domain. Instead of forwarding to DO, the grid area AR that intersects with the query range is determined by retrieving the index tree QTree. After determining the set of intersecting grid areas {AR}, it is forwarded to each DO and asked to answer the spatial object statistics of the corresponding grid.

[0119] From S2, we can know that the non-leaf node storage information of the index tree QTree is AR = (Attr, Num), and for the leaf node (i.e., the grid area) Attr = {α i}(1≤i≤4), and for non-leaf nodes, Attr={α i ,β}(1≤i≤4), where α and β are the coordinate information of the region vertex and geometric center respectively. In order to quickly retrieve and determine the grid area that intersects with the query range, LBSP starts from the vertex and iteratively determines the coordinates in Attr and the query request. Is the relationship satisfied?

[0120]

[0121] Among them, the function dis(·) is the Euclidean distance calculation, is the query center vector, α i is the query vertex vector, r is the query radius. i (1≤i≤4) As long as the above formula is satisfied, it can be determined that the area intersects with the query range. Figure 5 (a). If neither of these holds true, two situations may occur: the grid area completely contains the query range (such as when the area represented by the parent node is initially determined to be large enough), or the query range does not intersect with the grid area at all, such as Figure 5 (b)(c). Therefore, continue to judge Relationship with β:

[0122]

[0123] If the above equation is satisfied, it means that the query range is within the grid area or intersects with it, otherwise it does not intersect. Where d is the side length of the grid area.

[0124] S6. DO constructs a return result vector based on the statistical results and returns it to LBSP after completing the compression perturbation.

[0125] Based on the calculation results of S5, for this joint query, each DO stores a set of grid areas that intersect the query range and retains relevant statistical results in the corresponding grid units. Generally speaking, the DO can directly iteratively add the statistical results of all grid units locally to determine the local answer to the query. And for privacy protection purposes, the DO adds noise perturbations (such as DP noise) to prevent speculation attacks from third parties. However, in reality, adding noise affects the accuracy of the query results to a certain extent, and users only receive a rough answer to the query.

[0126] As described in S3, if the perception matrix φ is considered a special encryption key, then the CS transform can be used as a special symmetric encryption technique. Furthermore, by compressing the original signal, the amount of disturbance noise added can be effectively reduced. Based on this, the aggregation server utilizes a compressed sensing reconstruction algorithm to effectively reconstruct the original signal while minimizing the disturbance noise. This means that while achieving encrypted transmission of the original signal, the accuracy of the query results can be effectively guaranteed. Therefore, the present invention proposes a disturbance encryption strategy that combines DP with CS transforms.

[0127] Here, DO does not directly return the final iterative addition result, but uses the Hilbert curve partitioning characteristics to construct the return result vector based on the adjacent grid areas. Figure 5 As shown in (a), the grid areas numbered 2 and 3 intersect with the query range in area A. Then the result vector for area A can be expressed as R A =[0,0,d2,d3] T , where d2 and d3 are the relevant statistical results, that is, d2 and d3 are the number of shared bicycles in the grid areas numbered 2 and 3. Since the grid areas numbered 0 and 1 do not intersect with the query range, they are set to 0. The same operation is performed on the other intersecting areas B, C, and D. The result returned by DO for this query is:

[0128] R DO =[R A ,R B ,R C ,R D ]

[0129] Therefore, R DOAs the original signal x of compressed sensing, perform the corresponding compression operation Then get the compressed result vector

[0130]

[0131] In order to prevent speculation attacks from third parties, differential privacy technology is used to compress the result vector Add noise perturbation to the shared data. Differential privacy is a rigorously proven privacy protection model. By adding perturbation noise that conforms to a certain distribution mechanism to shared data, it can effectively resist membership inference attacks from third parties, making it impossible for them to distinguish the authenticity of user private information even if they obtain it. DP can be defined as follows:

[0132] Assume that there exists a random function A such that the probability of obtaining any identical output set S on any two adjacent data sets D and D′ (||DD′||1≤1) satisfies:

[0133] Pr[A(D)∈S]≤e ε Pr[A(D′)∈S]

[0134] The random function A is said to satisfy ε-Differential Privacy, abbreviated as ε-DP. Here, ε is the privacy budget or privacy loss. The smaller its value, the higher the degree of privacy protection, but at the same time, more noise needs to be added. An important combinatorial property of the differential privacy protection algorithm is:

[0135] The maximum principle of parallel combination: there are n random algorithms A i , 1≤i≤n, where A i Satisfy ε i -DP, and the operation data sets of any two algorithms have no intersection, then {A i}(1≤i≤n) The combined algorithm satisfies

[0136] Based on the parallel composability principle of DP, the local data information of each DO that meets ε-DP will also meet ε-DP after being uploaded to the LBSP for statistical aggregation. This effectively supports the statistical aggregation operations of data federation while protecting data information from leakage.

[0137] The noise mechanisms commonly used to implement differential privacy technology are exponential mechanism and Laplace mechanism. When facing numerical data, noise that conforms to the Laplace mechanism can be added to the statistical results. Perform differential privacy protection, namely:

[0138]

[0139] Here, Δc describes The corresponding sensitivity is the sensitivity of The impact caused by this is the size of the error. ε is the privacy budget. The smaller its value, the more noise needs to be added, and the stronger the privacy protection. It is generally set to 0.01 or 0.1. laplace (Δc / ε) is the Laplace noise addition mechanism. It has been proven that adding noise that conforms to the Laplace distribution can achieve differential privacy.

[0140] S7. LBSP aggregates and reconstructs the return results from each DO, obtains the first encryption result of the original signal and returns it to SU; SU decrypts and calculates the final query result.

[0141] LBSP receives the query result from DO. After that, the aggregation operation is performed first, namely:

[0142]

[0143] Among them, n is the total number of DOs participating in this query, and is the aggregated compression result with noise disturbance. Due to the parallel combination of DP, ε-DP is still satisfied. Here, based on the restricted equidistance characteristics of the perception matrix, the possibility of approximate signal reconstruction is theoretically proved. Usually, the query user SU is a terminal user with limited computing resources, and it is difficult to complete the computationally complex reconstruction task. This means that the reconstruction work should be completed by the LBSP with relatively strong computing power, and in order to ensure the accuracy of the results, noise denoising should also be completed during the reconstruction process. As one of the recovery algorithms for compressed sensing, the convex optimization method has high recovery accuracy and is suitable for the recovery of noisy signals. Therefore, the present invention completes the reconstruction of the original information based on the convex optimization theory. The recovery model of the noise introduced by CS is:

[0144] y=Θs+z

[0145] in, is the added bounded independent noise, i.e., ||z||2≤κ. According to convex optimization theory, the reconstruction optimization problem can be transformed into the basis pursuit denoising problem (BPDN), which is an extension of the original optimization problem basis pursuit problem (BP), namely:

[0146]

[0147] Then, the reconstruction operation It can be defined as:

[0148]

[0149] Among them, λ is the Lagrange multiplier, which represents the importance of the ||s||1 term in the signal recovery process. In particular, when λ→0, λ||s||1 tends to 0, and the problem is the basis pursuit problem BP, which is a noise-free environment. Here, the reconstruction operation This is an example of convex optimization theory. The OWL-QN algorithm can be used to complete the optimization reconstruction process. This algorithm is an extension of the memory-limited BFGS algorithm and can effectively solve the reconstruction problem.

[0150] Since LBSP is usually assumed to be untrustworthy, although it is required to complete the complex reconstruction calculation task, it is not expected to directly obtain the final query results. Therefore, in order to protect the privacy of the query results, in the reconstruction task, DO should provide the LBSP with an encrypted result of the perception matrix. Therefore, a linear matrix transformation is performed on the perception matrix to complete the encryption, that is, φ′=φ·M. Reconstruction operation Can become:

[0151]

[0152] Among them, Θ′=ψφM=ΘM. Therefore, by encrypting the perception matrix, the returned result can be hidden, and the corresponding reconstruction operation is ), (M can be provided to SU together with the sensing key during the initialization phase). At the same time, relevant research shows that in order to ensure is the sparsest solution to the reconstructed optimization problem. The encrypted matrix M should satisfy the following conditions: the product of the objective function and M should be the same as the product of the original problem. In addition, M should be reversible).

[0153] After receiving the return result from LBSP, SU performs a decryption to obtain the final query result, that is, (x∈R n×m ), and perform iterative addition to determine the final result res of this aggregation query.

[0154] To sum up, the specific implementation steps of the range aggregation query algorithm are:

[0155] 1.LBSP receives query request from SU Perform analysis;

[0156] 2. Combined with the global index structure QTree, LBSP traverses to obtain the grid area set {AR} that intersects with the query range;

[0157] 3.LBSP traverses the intersecting grid area set {AR} task and assigns it to each DO i (1≤i≤n), requiring them to answer relevant statistical information;

[0158] 4. After receiving the query request, DO quickly locates the corresponding grid area according to the grid area number and counts the spatial objects in it;

[0159] 5. After DO completes the retrieval task of all grid areas, it constructs the return result vector R DO . And complete the CS transformation, add DP noise, and determine the final return result

[0160] 6.LBSP aggregates the return results of each DO Get the global encryption result vector And use the OWL-QN algorithm to complete the reconstruction operation Will Return SU;

[0161] 7. SU uses the encryption matrix M to decrypt and obtain the final statistical result res.

[0162] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions, and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A privacy-preserving range aggregation query method for spatial data federation, characterized by: The specific steps include: After the local database receives the index building request initiated by the LBS server, it divides the local database into grid areas and establishes a local storage structure; The local database initializes the index structure based on the grid area division results; The local database encrypts the location data of the index node and establishes a global index structure in conjunction with the LBS server to obtain the index tree QTree. The process of encrypting the location data of the index node in the local database includes: If the original signal of the position data is represented by x=[x1,...,x N ] T ∈R N , is sparse under the N×N dimensional transformation basis matrix ψ, then the original signal x is expressed as: x = ψs, s represents the sparse representation of the original signal x on the sparse matrix ψ; The original signal x is projected onto a perception matrix φ that is unrelated to the sparse matrix ψ. The size of the perception matrix is ​​M×N and M<<N. The M-dimensional observation vector y is obtained, and the compression operation can be defined for: The sensing matrix φ satisfies the restricted isometry property, and the signal is approximately reconstructed by solving the l1 norm minimization problem using the observation vector y. Approximately reconstruct the original signal Where Θ represents the sparse perception matrix, and Θ = φψ, Θ is passed to the LBS server as a secret key when the query is returned; When the query user initiates a query request to the LBS server, a query request vector is constructed based on the request content; the query request vector includes the query location information; After receiving the query request vector, the local database performs a query based on the query request vector and obtains the statistical results, that is, the number of spatial objects in each grid area within the query range; The local database returns the result vector based on the statistical results, and after completing the compression perturbation, it feeds the result back to the LBS server, that is, a CS transformation is performed, and then the local compression result vector of the local database is differentially privacy protected, which is expressed as: Where Δc is The corresponding sensitivity; ε is the privacy budget; laplace (Δc / ε) is the Laplace noise addition mechanism. It has been proven that adding noise that conforms to the Laplace distribution can meet differential privacy. The LBS server aggregates and reconstructs the feedback from various local databases, obtains the primary encryption result of the original signal, and then feeds it back to the querying user; The querying user decrypts and counts the received encrypted results to obtain the query results.

2. The privacy protection range aggregation query method for spatial data federation according to claim 1 is characterized in that: The process of dividing the local database into grid areas and establishing the local storage structure includes: If the i-th local database is represented by DO i ,DO i Owned spatial data object set O i Indicated as O i ={o1,...,o m }, its mth spatial data object o m Indicated as o m =(x m ,y m ,cont m ), x m 、y m Represents spatial data objects o m Longitude and latitude information, cont m Represents spatial data object o m Attribute identifier, m is the spatial data object set O i The number of spatial data objects in the; Use Hilbert to divide the space area and get a set of k grid areas of equal size {AR i }, 1≤i≤k, the i-th grid area AR i Represented as AR i =(Attr,Num,Count,D), Attr represents AR i Position attribute, Num is the grid area number, Count is the grid area AR i The total number of spatial data objects owned, and D is the set of spatial objects in the area; The grid area set is combined with a given curve construction rule rule = (d, p, N, θ) to determine a Hilbert curve, where d represents the opening direction, p represents the starting point, N represents the curve order, and θ represents the rotation angle.

3. The privacy protection range aggregation query method for spatial data federation according to claim 2 is characterized in that: The process of initializing the index structure includes: A quadtree index structure is established in a bottom-up manner, that is, four grid areas are merged into one area node, and four area nodes are merged into a new area node until the entire query area is covered, resulting in a quadtree-based index structure QTree; In the index structure QTree, its leaf node is a grid area, and the storage structure of the leaf node stores the location attribute of the leaf node and the grid area number; In the index structure QTree, a non-leaf node is a domain node, and the storage structure of the domain node stores the location attribute and grid area number of the domain node; The location attributes of the domain node include the extreme values ​​of the coordinates of the four domain nodes or vertices in the grid area constituting the domain node and the centers of the four domain nodes.

4. The privacy protection range aggregation query method for spatial data federation according to claim 1 is characterized in that: When a query user initiates a query request to the LBS server, the query request vector is constructed based on the request content, including: The query user initializes the query request as Q = (T, P), where P represents the query location information, which is expressed as P =<c,r> , c is the query location center, r represents the query radius; T is the time when the query is initiated; The query user requests the encryption key information from the local database, that is, the perception matrix. According to the perception matrix, the query position center c is transformed into CS, and the query request is updated to 5. The privacy protection range aggregation query method for spatial data federation according to claim 1 is characterized in that: The process of querying based on the query request vector and obtaining statistical results includes: The LBS server retrieves the index tree QTree based on the query location information in the query request vector and determines the grid area that intersects with the query range. During the confirmation process, if the distance between the query center vector and the vertex of a grid area is less than the query radius, then the grid area intersects with the query range; otherwise, if the distance between the query center vector and the center of a grid area satisfies Then the grid area intersects with the query range, otherwise it does not intersect with the query range, where, Represents the distance between the query center vector and the center of a grid area, r is the query radius, and d1 is the side length of the grid area; After determining the set of intersecting grid areas, the set of intersecting grid areas is forwarded to each local database, and each local database is required to answer the spatial object statistics of the corresponding grid.

6. The privacy protection range aggregation query method for spatial data federation according to claim 1 is characterized in that: The process of obtaining the primary encryption result of the original signal and feeding it back to the querying user includes: Aggregate the differentially private data from each local database, that is: The aggregated quantity is reconstructed, and the perception matrix is ​​encrypted once during the reconstruction process. The reconstruction operation is expressed as: Where λ is the Lagrange multiplier, represents the reconstruction operation of the signal y; Θ′=ψφM=ΘM, M represents the reversible linear transformation matrix, ||·||2 represents the l2 norm, and ||·||1 represents the l1 norm.

7. The privacy protection range aggregation query method for spatial data federation according to claim 6 is characterized in that: The querying user decrypts and counts the received encrypted results. The process of obtaining the query results includes: Among them, x ij Represents the specific items contained in x, x is an n×m real number matrix, m represents the number of grid areas participating in the statistics in a local database, n represents the number of local databases participating in the joint query, and res is the aggregate query result; The output obtained by aggregating and reconstructing the query results is expressed as

Images