Method and system for k-anonymity based location privacy protection in continuous query

Abstract

The application discloses a k-anonymity-based location privacy protection method in continuous query, and steps are as follows: the maximum moving speed of a user is estimated according to the real position of the user in the last two times of initiating a query in continuous query and road speed limit information, so that the maximum moving range of the user is obtained; a part of false positions is preselected in the maximum moving range according to spatial relationship to resist spatial attack by selecting a corresponding spatial defense scheme; a position similar to the real position query probability is selected from the maximum moving range as a candidate set of the remaining false positions; a suitable false position is selected from the candidate set, so that the trajectory entropy reaches a maximum value to resist time attack; and the real position is mixed into the false position to form an anonymous set. On the basis of the k-anonymity scheme, not only the spatial attack using the position relationship between the anonymous sets of the same user at different time points can be resisted, but also the time attack using time sequence information to mine the real moving trajectory of the user can be resisted.

Description

Technical Field

[0001] This invention belongs to the field of privacy protection, and in particular, it is a method and system for protecting location privacy against spatiotemporal attacks based on k-anonymity in continuous queries. Background Technology

[0002] With the rapid development of internet applications and the widespread adoption of smart mobile devices, location-based services (LBS) have flourished in people's daily lives. Typical examples include finding nearby parking lots, checking the fastest route to a destination, or viewing local weather. However, there are potential privacy risks when users send their personal information to LBS providers. Adversaries may seize the opportunity to infer sensitive information from the collected data, such as users' personal preferences and communication habits. Therefore, preventing privacy breaches in LBS has always been a key research focus.

[0003] In LBS privacy protection, location privacy is particularly important. In 1998, Samarati et al. proposed a raw data protection method called k-anonymity. This method aims to hide sensitive records among other k-1 similar records to protect the original data. In 2002, Sweeney et al. achieved k-anonymity for location privacy by sending an anonymized set consisting of the user's real location and several fake locations to the LBS service provider, reducing the risk of location privacy leakage in a single query to 1 / k. Later, in 2014, Niu et al. further proposed the dummy-location selection (DLS) algorithm. This algorithm selects locations with query probabilities close to the user's real location as fake locations to obtain the maximum information entropy of the normalized query probabilities of all locations in the anonymized set.

[0004] In a single query, the DLS algorithm provides strong privacy protection for users. However, when a user initiates consecutive queries—that is, the same user initiates multiple queries within a period of time—this type of k-anonymity method faces significant challenges. A location-dependent attack (LDA) can leverage the spatial relationships between locations in the anonymity set under adjacent query timestamps to eliminate some unreasonable spoof locations, thereby increasing the probability of revealing the true location. Furthermore, in recent years, Shaham et al. have also applied the Viterbi attack from Hidden Markov Models (HMMs) to location privacy. HMMs can effectively capture the characteristics of users across consecutive timestamp factors in consecutive queries. Since there are certain connections between the true locations in a user's movement trajectory, while spoof locations at different timestamps lack this correlation, the Viterbi attack can utilize temporal relationships to transform the problem of multiple location disclosures into a path selection problem and perform related analysis.

[0005] As can be seen from the above, in continuous query application scenarios, the traditional k-anonymity method can no longer cope with spatial and temporal attacks that take into account time factors, and new defense solutions are urgently needed to ensure user privacy and security. Summary of the Invention

[0006] The purpose of this invention is to address the problems existing in the prior art by providing a location privacy protection method based on k-anonymity in continuous queries. By selecting some fake locations to resist spatial attacks and other fake locations to resist temporal attacks, the method aims to protect the location privacy and trajectory privacy of users in continuous queries.

[0007] The technical solution to achieve the purpose of this invention is: a location privacy protection method based on k-anonymity in continuous queries, the method comprising the following steps:

[0008] Step 1: The anonymity mechanism receives the user's data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed

[0009] Step 2, based on the anonymous set Select τ false locations based on spatial relationships to defend against spatial attacks;

[0010] Step 3, based on the anonymous set Select k-τ-1 false locations based on trajectory probability to defend against time attacks;

[0011] Step 4: Combine the k-1 false locations selected in Step 2 and Step 3 with the real locations to form an anonymity set, creating k-anonymity of spatial location at the same time and k-τ anonymity of trajectory at different times, thus realizing k-anonymity of the user's real location at the time of query.

[0012] Furthermore, step 2, based on the anonymous set Selecting τ dummy locations to defend against spatial attacks includes:

[0013] Assume the user is in time interval Δt i-1 =t i -t i-1 The maximum distance that can be moved within is from After Δt i-1 The maximum range of movement that can be reached is denoted as And from After Δt i-1 The maximum range of movement that can be reached is denoted as That is, the user at timestamp t i-1 Real location The area in which it is located;

[0014] To make different timestamps t i For anonymous sets to have reasonable spatial relationships, CR should satisfy the following conditions:

[0015]

[0016]

[0017] in, It stipulates The upper bound that should be satisfied, and It stipulates The lower bound that must be satisfied is defined as follows: The lower bound that should be satisfied;

[0018] To make Establishment only requires... Select a fake location;

[0019] To make If true, the selection of the τ spurious positions is as follows:

[0020] Step 2-1, from the previous moment Divided into several sub-regions;

[0021] Step 2-2, determine the timestamp t i The real location For the given sub-region, select τ false locations from other sub-regions. During the selection process, the information entropy H1 obtained from the normalized query probabilities of the τ false locations and the true locations should reach its maximum value. The formula for calculating H1 is:

[0022]

[0023] In the formula, For t i User's real location under timestamp The probability of querying. For t i The query probability of the j-th false location under the timestamp.

[0024] Furthermore, step 2-1 describes the previous time... Divided into several sub-regions, specifically including:

[0025] The previous moment Divide into 3×3 regions: Using the straight line containing the left boundary as a reference, To create an interval, draw two parallel lines x0 and x1 on the left and right sides of the reference. As defined, x0 must be related to... The left boundary coincides with the straight line; similarly, with Using the lines containing the remaining boundaries as a reference, draw parallel lines x2~x3 and y0~y3. Divide the area into 3×3 regions based on location, where x2 to x3 correspond to The right boundary, y0~y1, y2~y3 respectively correspond to The lower and upper boundaries; to satisfy Based on the lower bound requirement, the following conclusions are obtained: (1) The left boundary must be less than x1, (2) The right boundary must be greater than x2, (3) The lower boundary is less than y1, (4) The upper boundary is greater than y2;

[0026] Based on this, the determination of timestamp t in step 2-2 i The real location In the sub-region where it is located, select τ spurious locations in other sub-regions and update them as follows:

[0027] Determine the timestamp t i The real location If a subregion meets any of the above conclusions, then select τ spurious locations from the remaining subregions that meet the conclusions.

[0028] Furthermore, step 2-1 also includes: dividing the 3×3 area into four sub-areas: A, B, C, and D. The sub-area at the center of the 3×3 area is of type A, the four corners are of type D, the two sub-areas that are symmetrical vertically are of type B, and the two sub-areas that are symmetrical horizontally are of type C.

[0029] Based on this, step 2-2 is further updated to: determine the timestamp t. i The real location If a subregion falls under any of the above conclusions and categories, then select τ spurious locations from the other subregions that fall under the remaining conclusions and categories.

[0030] Furthermore, the selection of the k-τ-1 spurious positions in step 3 is specifically as follows:

[0031] In all the above sub-regions, select k-τ-1 spurious locations that maximize the trajectory information entropy H2, where the formula for calculating the trajectory information entropy H2 is:

[0032]

[0033] In the formula, T β 'Indicates timestamp t c The trajectory in the anonymous set whose endpoint is the βth position excluding the spurious positions in step 2, Pr(*) represents the probability of the trajectory “*”.

[0034] The calculation of Pr(*) is as follows:

[0035]

[0036] Based on the homogeneous Markov and observation independence assumptions of HMM, the above equation can be simplified to:

[0037]

[0038] Wherein, the normalized query probability of the position of the α-th trajectory at timestamp t1 in the anonymous set at this time is:

[0039]

[0040] User from The probability of starting to move along this trajectory, for each adjacent timestamp, can be expressed by the normalized posterior probability as:

[0041]

[0042] In the formula, Pr(T) α ) represents the α-th trajectory T α The probability, Represents a series of identity transformations, This indicates a spurious location in the anonymous set with timestamp t1. Indicates from timestamp t i of up to timestamp t i+1 of The transition probability, Represents timestamp t i A location in the anonymous set, which can be a real location or a fake location; the range of values ​​for α is... in For users at timestamp t i Privacy requirements, in addition, the real trajectory in this Within the trajectory.

[0043] A location privacy protection system based on k-anonymity in continuous queries, the system comprising:

[0044] The query module is used to implement an anonymous mechanism to receive user data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed

[0045] The first spurious location selection module is used based on the anonymous set. Select τ false locations based on spatial relationships to defend against spatial attacks;

[0046] The second spoof location selection module is used based on the anonymous set. Select k-τ-1 false locations based on trajectory probability to defend against time attacks;

[0047] The anonymous set construction module is used to combine the k-1 spurious locations selected by the above module with the real locations to form an anonymous set, thus creating k-anonymous locations at the same time and k-τ-anonymous trajectories at different times.

[0048] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it performs the following steps:

[0049] Step 1: The anonymity mechanism receives the user's data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed

[0050] Step 2, based on the anonymous set Select τ false locations based on spatial relationships to defend against spatial attacks;

[0051] Step 3, based on the anonymous set Select k-τ-1 false locations based on trajectory probability to defend against time attacks;

[0052] Step 4: Combine the k-1 false locations selected in Step 2 and Step 3 with the real locations to form an anonymity set, creating k-anonymity of spatial location at the same time and k-τ anonymity of trajectory at different times, thus realizing k-anonymity of the user's real location at the time of query.

[0053] A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, performs the following steps:

[0054] Step 1: The anonymity mechanism receives the user's data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed

[0055] Step 2, based on the anonymous set Select τ false locations based on spatial relationships to defend against spatial attacks;

[0056] Step 3, based on the anonymous set Select k-τ-1 false locations based on trajectory probability to defend against time attacks;

[0057] Step 4: Combine the k-1 false locations selected in Step 2 and Step 3 with the real locations to form an anonymity set, creating k-anonymity of spatial location at the same time and k-τ anonymity of trajectory at different times, thus realizing k-anonymity of the user's real location at the time of query.

[0058] Compared with existing technologies, the significant advantages of this invention are as follows: While traditional DLS defense methods make it statistically indistinguishable between false and true locations, they neglect the correlation between the time series of true locations in continuous queries. This method, based on statistical significance, can not only resist spatial attacks that increase the probability of revealing a user's true location by exploiting spatial relationship disclosure probabilities, but also resist temporal attacks that mine users' true movement trajectories by exploiting time series relationships.

[0059] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0060] Figure 1 This is a flowchart of a location privacy protection method based on k-anonymity in continuous queries.

[0061] Figure 2 This is a system model diagram to which the method of the present invention applies.

[0062] Figure 3This is a schematic diagram illustrating the positional relationship division of the present invention when resisting space attacks.

[0063] Figure 4 This is a schematic diagram of the false location candidate region scheme of the present invention in resisting space attacks. Figure 4 (a) to (d) are respectively in In the case where the actual location of the current timestamp is in one of the four sub-regions A, B, C, or D, this is a schematic diagram of the corresponding candidate region scheme for false locations. Figure 4 (e) to (f) are respectively in In the case where the actual location of the current timestamp is in one of the four sub-regions A, B, C, or D, this is a schematic diagram of the corresponding candidate region scheme for false locations. Figure 4 (i) to (l) are respectively in This diagram illustrates the candidate region scheme for the false location when the actual location of the current timestamp is in one of the four sub-regions A, B, C, or D.

[0064] Figure 5 This figure shows a comparison between the present invention and the traditional DLS method in dealing with LDA space attacks.

[0065] Figure 6 Figures (a) to (c) show the comparison results of the present invention and the traditional DLS method in dealing with Viterbi time attacks. The figures (a) to (c) show the comparison results of Viterbi attacks when the total number of timestamps is 2, 6, and 10, respectively. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0067] It should be noted that if the embodiments of the present invention involve descriptions such as "first" and "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0068] This invention aims to protect users' location and trajectory privacy during continuous queries by selecting some fake locations to resist spatial attacks and others fake locations to resist temporal attacks.

[0069] Here, a fake location is a position disguised as the real location, generated by an anonymization mechanism to hide the real location. To defend against different types of attack models, various methods can be used to select fake locations. Furthermore, replacing the original single real location with an anonymity set consisting of k-1 fake locations and the real location constitutes k-anonymity.

[0070] Here, spatial attacks allow attackers to exploit the spatial relationships between anonymous locations at different timestamps in a single, consecutive query to exclude false locations that do not conform to actual distance relationships, thereby increasing the probability that the true location will be disclosed.

[0071] Here, a time-based attack allows attackers to exploit the time-series information of a user's continuous queries to uncover their movement patterns. Because spurious locations at different timestamps often cannot form a temporal connection like the actual movement patterns, attackers can directly identify the user's true movement patterns formed by their real locations at different timestamps.

[0072] Here, location privacy and security are paramount. Attackers should be unable to find the user's real location. A common method is to mix the real location with k-1 fake locations to form an anonymous set.

[0073] Here, trajectory privacy and security are ensured, and attackers should be unable to find the user's movement trajectory formed by connecting the real locations of the sequential timestamps.

[0074] Here, the strategy to defend against spatial attacks analyzes the anonymous set built by the user at the previous timestamp, determines its maximum movement range, and finds τ false locations within this range to ensure that the minimum movement range of the anonymous set to be built includes all locations in the anonymous set at the previous timestamp.

[0075] Here, the anti-time attack scheme finds k-τ false positions within the maximum movement range of the spatial defense scheme, making it impossible to distinguish the time sequence information carried by the trajectory ending at these k-τ false positions and the real position, that is, the trajectory entropy reaches the maximum value, thereby hiding the real trajectory.

[0076] In continuous queries, users send anonymous query requests to the LBS provider via an anonymization mechanism, and the LBS provider then returns the request results to the user. The anonymous set generated by the anonymization mechanism contains the user's real location and k-1 fake locations, which together constitute an anonymous region (CR), with timestamp t. i The CR is recorded as

[0077] In one embodiment, combined Figure 1 and Figure 2This paper presents a location privacy protection method based on k-anonymity to resist spatiotemporal attacks in continuous queries. The specific steps are as follows:

[0078] Step 1: The anonymity mechanism receives the user's data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed

[0079] Step 2, based on the anonymous set Select τ false locations based on spatial relationships to defend against spatial attacks;

[0080] Assume the user is in time interval Δt i-1 =t i -t i-1 The maximum distance that can be moved within is from After Δt i-1 The maximum range of movement that can be reached is denoted as And from After Δt i-1 The maximum range of movement that can be reached is denoted as That is, the user at timestamp t i-1 Real location The area in which it is located;

[0081] To make different timestamps t i For anonymous sets to have reasonable spatial relationships, CR should satisfy the following conditions:

[0082]

[0083]

[0084] in, It stipulates The upper bound that should be satisfied, and It stipulates The lower bound that must be satisfied is defined as follows: The lower bound that should be satisfied;

[0085] To make Establishment only requires... Select a fake location;

[0086] To make If true, the selection of the τ spurious positions is as follows:

[0087] Step 2-1, combined Figure 3 The previous moment Divide into 3×3 regions: Using the straight line containing the left boundary of the (dashed rectangle) as a reference, To create an interval, draw two parallel lines x0 and x1 on the left and right sides of the reference. As defined, x0 must be related to... The left boundary coincides with the straight line; similarly, with Using the lines containing the remaining boundaries as a reference, draw parallel lines x2~x3 and y0~y3. Divide the area into 3×3 regions based on location, where x2 to x3 correspond to The right boundary, y0~y1, y2~y3 respectively correspond to The lower and upper boundaries; to satisfy Based on the lower bound requirement, the following conclusions are obtained: (1) The left boundary must be less than x1, (2) The right boundary must be greater than x2, (3) The lower boundary is less than y1, (4) The upper boundary is greater than y2;

[0088] Divide the 3×3 area into four sub-areas: A, B, C, and D. The sub-area at the center of the 3×3 area is of type A, the four corners are of type D, the two sub-areas that are symmetrical vertically are of type B, and the two sub-areas that are symmetrical horizontally are of type C.

[0089] Here, it is particularly important to note that when dividing the four sub-regions into A, B, C, and D, there may be cases where x1 > x2 or y1 > y2, such as... Figure 4 As shown in (a) to (l) The situation and Figure 4 (Similar to (e) to (h), which will not be repeated here, but the above conclusions remain unchanged;

[0090] Step 2-2, and as long as spurious positions are selected in the candidate sub-regions of the above conclusion, i.e., τ = 4, it can be achieved that... It must satisfy the lower bound requirement. However, the timestamp t i The real location The sub-region in question often satisfies the conditions in the conclusion. Some of the constraints, such as Figure 4 As shown in (b), at this time In the B-class sub-region, then The conclusion must satisfy the condition " The upper boundary must be greater than y2. Therefore, the number of such spurious positions can be further reduced so that τ∈{0,1,2} satisfies the conclusion requirement.

[0091] In summary, determining the timestamp t i The real location The sub-region is determined to conform to which of the above conclusions and categories. Then, τ fake locations are selected from the remaining sub-regions that conform to the other categories. During the selection process, to make the fake locations statistically closer to real users, the information entropy H1 obtained from the normalized query probabilities of the τ fake locations and real locations should reach its maximum value. The formula for calculating H1 is:

[0092]

[0093] In the formula, For t i User's real location under timestamp The probability of querying. For t i The query probability of the j-th false location under the timestamp.

[0094] Step 3, based on the anonymous set K-τ-1 spurious locations are selected based on trajectory probability to defend against time-series attacks. Here, trajectory probability is used to measure the temporal relationship between locations at different timestamps, with the aim of identifying the spurious locations at timestamp t. i Generate k-τ-1 false positions such that their maximum trajectory probability is as close as possible to the maximum trajectory probability of the true position, thus forming k-τ anonymity on the trajectory;

[0095] In continuous queries, a user's actual trajectory can be represented by the following formula:

[0096]

[0097] In the formula, This indicates that the user is at timestamp t i The actual location, c represents the total number of queries in this continuous query, that is, the total number of current timestamps.

[0098] The trajectory of the αth line can be represented by the following formula:

[0099]

[0100] In the formula, Represents timestamp t i A location in the anonymous set, which can be a real location or a fake location, where α takes values ​​ranging from 0 to 1. in For users at timestamp t i Privacy requirements. Furthermore, the actual trajectory is... Within the trajectory.

[0101] In all the above sub-regions, select k-τ-1 spurious locations that maximize the trajectory information entropy H2, where the formula for calculating the trajectory information entropy H2 is:

[0102]

[0103] In the formula, T β 'Indicates timestamp t c The trajectory in the anonymous set whose endpoint is the βth position excluding the spurious positions in step 2, Pr(*) represents the probability of the trajectory “*”.

[0104] The calculation of Pr(*) is as follows:

[0105]

[0106] Based on the homogeneous Markov and observation independence assumptions of HMM, the above equation can be simplified to:

[0107]

[0108] Wherein, the normalized query probability of the position of the α-th trajectory at timestamp t1 in the anonymous set at this time is:

[0109]

[0110] User from The probability of starting to move along this trajectory, for each adjacent timestamp, can be expressed by the normalized posterior probability as:

[0111]

[0112] In the formula, Pr(T) α ) represents the α-th trajectory T α The probability, Represents a series of identity transformations, This indicates a spurious location in the anonymous set with timestamp t1. Indicates from timestamp t i of up to timestamp t i+1 of The transition probability.

[0113] Step 4: Combine the k-1 false locations selected in Step 2 and Step 3 with the real locations to form an anonymity set, creating k-anonymity of spatial location at the same time and k-τ anonymity of trajectory at different times, thus realizing k-anonymity of the user's real location at the time of query.

[0114] In one embodiment, a location privacy protection system based on k-anonymity in consecutive queries is provided, the system comprising:

[0115] The query module is used to implement an anonymous mechanism to receive user data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query.i-1 Anonymous set constructed

[0116] The first spurious location selection module is used based on the anonymous set. Select τ false locations based on spatial relationships to defend against spatial attacks;

[0117] The second spoof location selection module is used based on the anonymous set. Select k-τ-1 false locations based on trajectory probability to defend against time attacks;

[0118] The anonymous set construction module is used to combine the k-1 false locations selected by the above module with the real locations to form an anonymous set, thus creating k-anonymity at the same spatial location at the same time and k-τ anonymity of the trajectory at different times, thereby realizing k-anonymity of the user's real location at the time of query.

[0119] For specific limitations regarding the k-anonymity-based location privacy protection system in continuous queries, please refer to the limitations of the k-anonymity-based location privacy protection method in continuous queries above, which will not be repeated here. Each module in the aforementioned k-anonymity-based location privacy protection system in continuous queries can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0120] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0121] Step 1: The anonymity mechanism receives the user's data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed

[0122] Step 2, based on the anonymous set Select τ false locations based on spatial relationships to defend against spatial attacks;

[0123] Step 3, based on the anonymous set Select k-τ-1 false locations based on trajectory probability to defend against time attacks;

[0124] Step 4: Combine the k-1 false locations selected in Step 2 and Step 3 with the real locations to form an anonymity set, creating k-anonymity of spatial location at the same time and k-τ anonymity of trajectory at different times, thus realizing k-anonymity of the user's real location at the time of query.

[0125] For specific limitations on each step, please refer to the limitations on location privacy protection methods based on k-anonymity in continuous queries above, which will not be repeated here.

[0126] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0127] Step 1: The anonymity mechanism receives the user's data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed

[0128] Step 2, based on the anonymous set Select τ false locations based on spatial relationships to defend against spatial attacks;

[0129] Step 3, based on the anonymous set Select k-τ-1 false locations based on trajectory probability to defend against time attacks;

[0130] Step 4: Combine the k-1 false locations selected in Step 2 and Step 3 with the real locations to form an anonymity set, creating k-anonymity of spatial location at the same time and k-τ anonymity of trajectory at different times, thus realizing k-anonymity of the user's real location at the time of query.

[0131] For specific limitations on each step, please refer to the limitations on location privacy protection methods based on k-anonymity in continuous queries above, which will not be repeated here.

[0132] As a specific example, the invention will be further verified and illustrated in one embodiment.

[0133] In continuous queries, when a user initiates a query, they send their location to an anonymization mechanism. This mechanism constructs an anonymous location to replace the real location in the query request and sends it to the LBS service provider. Assuming the LBS service provider is honest but curious, while returning the query results to the user, they may also attempt to extract the user's LBS privacy from the query request, thus playing the role of an attacker disclosing user privacy. The system model in this embodiment is as follows: Figure 2 As shown.

[0134] After receiving the user's location, the anonymity mechanism uses the location privacy protection method based on k-anonymity to resist spatiotemporal attacks, as described in this invention, to select τ fake locations to resist spatial attacks and k-τ fake locations to resist temporal attacks. Figure 3 This is a schematic diagram illustrating the positional relationship division of the present invention when resisting space attacks. Figure 4This is a schematic diagram of the false location selection scheme of this invention when resisting space attacks. The anonymity mechanism is based on the user's real location at the current timestamp. Figure 3 The corresponding sub-region type in Figure 4 The process involves identifying corresponding candidate sub-regions and selecting τ fake locations based on the information entropy H1. Then, using the trajectory information entropy H2 as a benchmark, the remaining k-τ-1 fake locations are selected from all sub-regions. After the selection of fake locations is complete, the anonymization mechanism sends the anonymized query request to the LBS service provider. In addition to fulfilling the user's request, the LBS service provider collects user information from the query request and attempts to uncover more of the user's location privacy information.

[0135] The experimental results of this embodiment are as follows: Figure 5 and Figure 6 As shown. In Figure 5 In the diagram, the dashed line represents the result of the traditional DLS defense method, while the solid line represents the result of the defense method of this invention. Under spatial attacks, compared to traditional defense methods where the protection rate of the actual location decreases significantly with the increase of the total number of timestamps in continuous queries, the defense method of this invention not only provides users with more effective protection but is also largely unaffected by the total number of timestamps. Figure 6 Under time-based attacks with a total timestamp count of 2, 6, and 10, the success rate of the defense method of this invention in protecting the true trajectory is higher than that of traditional DLS defense methods of the same period. The results show that the method of this invention can compensate for the shortcomings of traditional DLS defense methods in dealing with spatial and temporal attacks during continuous queries, improving the privacy and security level of users when using LBS, and has very broad application prospects.

[0136] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A location privacy protection method based on k-anonymity in continuous queries, characterized in that, The method includes the following steps: Step 1: The anonymity mechanism receives the user's data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed Step 2, based on the anonymous set Select τ false locations based on spatial relationships to defend against spatial attacks; Step 3, based on the anonymous set Select k-τ-1 false locations based on trajectory probability to defend against time attacks; Step 4: Combine the k-1 false locations selected in Step 2 and Step 3 with the real locations to form an anonymity set, thus creating k-anonymity of spatial location at the same time and k-τ anonymity of trajectory at different times, thereby achieving k-anonymity of the user's real location at the time of query. Step 2 is based on the anonymous set Selecting τ dummy locations to defend against spatial attacks includes: Assume the user is in time interval Δt i-1 =t i -t i-1 The maximum distance that can be moved within is from After Δt i-1 The maximum range of movement that can be reached is denoted as And from After Δt i-1 The maximum range of movement that can be reached is denoted as That is, the user at timestamp t i-1 Real location The area in which it is located; To make different timestamps t i For anonymous sets to have reasonable spatial relationships, CR should satisfy the following conditions: in, It stipulates The upper bound that should be satisfied, and It stipulates The lower bound that must be satisfied is defined as follows: The lower bound that should be satisfied; To make Establishment only requires... Select a fake location; To make If true, the selection of the τ spurious positions is as follows: Step 2-1, from the previous moment Divided into several sub-regions; Step 2-2, determine the timestamp t i The real location For the given sub-region, select τ false locations from other sub-regions. During the selection process, the information entropy H1 obtained from the normalized query probabilities of the τ false locations and the true locations should reach its maximum value. The formula for calculating H1 is: In the formula, For t i User's real location under timestamp The probability of querying. For t i The query probability of the j-th false location under the timestamp.

2. The location privacy protection method based on k-anonymity in continuous queries according to claim 1, characterized in that, Step 2-1 describes the previous time period Divided into several sub-regions, specifically including: The previous moment Divide into 3×3 regions: Using the straight line containing the left boundary as a reference, To create an interval, draw two parallel lines x0 and x1 on the left and right sides of the reference. As defined, x0 must be related to... The left boundary coincides with the straight line; similarly, with Using the lines containing the remaining boundaries as a reference, draw parallel lines x2~x3 and y0~y3. Divide the area into 3×3 regions based on location, where x2 to x3 correspond to The right boundary, y0~y1, y2~y3 respectively correspond to The lower and upper boundaries; to satisfy Based on the lower bound requirement, the following conclusions are obtained: (1) The left boundary must be less than x1, (2) The right boundary must be greater than x2, (3) The lower boundary is less than y1, (4) The upper boundary is greater than y2; Based on this, the determination of timestamp t in step 2-2 i The real location In the sub-region where it is located, select τ spurious locations in other sub-regions and update them as follows: Determine the timestamp t i The real location If a subregion meets any of the above conclusions, then select τ spurious locations from the remaining subregions that meet the conclusions.

3. The location privacy protection method based on k-anonymity in continuous queries according to claim 2, characterized in that, Step 2-1 also includes: dividing the 3×3 area into four sub-areas: A, B, C, and D. The sub-area at the center of the 3×3 area is of type A, the four corners are of type D, the two sub-areas that are symmetrical vertically are of type B, and the two sub-areas that are symmetrical horizontally are of type C. Based on this, step 2-2 is further updated to: determine the timestamp t. i The real location If a subregion falls under any of the above conclusions and categories, then select τ spurious locations from the other subregions that fall under the remaining conclusions and categories.

4. The location privacy protection method based on k-anonymity in continuous queries according to claim 1, characterized in that, The selection of k-τ-1 spurious positions in step 3 is as follows: In all the above sub-regions, select k-τ-1 spurious locations that maximize the trajectory information entropy H2, where the formula for calculating the trajectory information entropy H2 is: In the formula, T β 'Indicates timestamp t c The trajectory in the anonymous set whose endpoint is the βth position excluding the spurious positions in step 2, Pr(*) represents the probability of the trajectory "*". The calculation of Pr(*) is as follows: Based on the homogeneous Markov and observation independence assumptions of HMM, the above equation can be simplified to: Wherein, the normalized query probability of the position of the α-th trajectory at timestamp t1 in the anonymous set at this time is: User from The probability of starting to move along this trajectory, for each adjacent timestamp, can be expressed by the normalized posterior probability as: In the above formula, Pr(T) α ) represents the α-th trajectory T α The probability, Represents a series of identity transformations, This indicates a spurious location in the anonymous set with timestamp t1. Indicates from timestamp t i of up to timestamp t i+1 of The transition probability, Represents timestamp t i A location in the anonymous set, which can be a real location or a fake location; the range of values ​​for α is... in For users at timestamp t i Privacy requirements, in addition, the real trajectory in this Within the trajectory.

5. A location privacy protection system based on k-anonymity in continuous queries, based on the method of any one of claims 1 to 4, characterized in that, The system includes: The query module is used to implement an anonymous mechanism to receive user data at timestamp t. i After a query request is sent, the query history will show the user's previous timestamp t in this consecutive query. i-1 Anonymous set constructed The first spurious location selection module is used based on the anonymous set. Select τ false locations based on spatial relationships to defend against spatial attacks; The second spoof location selection module is used based on the anonymous set. Select k-τ-1 false locations based on trajectory probability to defend against time attacks; The anonymous set construction module is used to combine the k-1 false locations selected by the above module with the real locations to form an anonymous set, thus creating k-anonymity at the same spatial location at the same time and k-τ anonymity of the trajectory at different times, thereby realizing k-anonymity of the user's real location at the time of query.

6. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 4.

7. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images