A query privacy protection method based on local search architecture

Abstract

The application discloses a query privacy protection method based on a local search architecture, wherein a vehicle user first requests point of interest information from an RSU, returns a set of point of interest feature information, selects a point of interest ID to be queried after local sorting, encrypts the point of interest ID to be queried and a vehicle user public key used for key exchange, generates a re-encryption key by using a generated private key and a public key of an LBS server, sends the re-encryption key to an anonymous server, re-generates ciphertext by using the re-encryption key, forwards the ciphertext to the LBS server, decrypts the ciphertext by using a private key of the LBS server after receiving the ciphertext, generates a symmetric key by using the private key of the LBS server and a public key corresponding to the received data after decryption, encrypts detailed data corresponding to the point of interest ID by using the symmetric key, finally sends a public key of the LBS server together with plaintext of the LBS server to the anonymous server, and forwards the data to a client by the anonymous server. The method protects the location, query content and service information of a location service provider of a user.

Description

Technical Field

[0001] This invention relates to the field of privacy protection technology for connected vehicle services, and in particular to a query privacy protection method based on a local search architecture. Background Technology

[0002] The Internet of Vehicles (IoV) is a large-scale system network based on in-vehicle networks, inter-vehicle networks, and in-vehicle mobile internet. It enables wireless communication and information exchange between vehicles, between vehicles and roads, between vehicles and people, and between vehicles and service platforms, in accordance with agreed communication protocols and data interaction standards. It is an integrated network that can realize intelligent traffic management, intelligent dynamic information services, and intelligent vehicle control, thereby achieving a new ecosystem that combines "people-vehicle-road-cloud". It is a typical application of Internet of Things (IoT) technology in the field of transportation systems.

[0003] As a new type of mobile terminal, the Internet of Vehicles (IoV) enables vehicles to access the internet in real time, providing users with location-based services. Location service providers, based on Top-k query requests initiated by vehicle users, return detailed information about nearby Points of Interest (POIs), such as traffic conditions and accident reports, offering more specialized services. While these services provide convenience, they also pose a significant threat to user privacy. If the service provider is semi-honest—honestly adhering to the agreement but curious about other information about the vehicle user—the user's location and query privacy will be completely compromised. Therefore, ensuring user privacy is not leaked when using LBS service systems has become a pressing issue.

[0004] Currently, the mainstream technologies for privacy protection in vehicle-to-everything (V2X) location services can be categorized into: spatial masking-based technologies, encryption-based technologies, differential privacy-based technologies, and spatial distortion-based technologies.

[0005] In research on spatial masking techniques, the advantages of virtual and obfuscated techniques are that they are easy to implement and have a good balance between service quality and privacy. However, because other data is added during the request sending process, the location data in the request is distorted, and it is also susceptible to data feature speculation attacks. The advantages of K-anonymity techniques are that they can reduce the risk of user privacy leakage, the degree of privacy protection can be defined by the user according to their needs, and the algorithm is highly portable. The disadvantage is that it does not take into account the background knowledge of the attacker and is susceptible to replay attacks.

[0006] Encryption-based technologies offer good privacy protection and high service quality. However, since encrypted ciphertext is generally much longer than plaintext and involves encryption and decryption processes, it leads to problems such as high communication and computing overhead and complex deployment.

[0007] Differential privacy technology is supported by mathematical theory and provides a rigorous mathematical definition of privacy protection. Its advantages are that it is not affected by the attacker's background knowledge and is not affected by changes in specific data, resulting in good privacy protection. Its disadvantages are that it is difficult to allocate the privacy budget reasonably and that location data may be distorted.

[0008] The advantage of space warp-based technology is that it does not use third-party servers, reducing the risk of data leakage. Its disadvantages are that it is difficult to select anchor points and the query results are inaccurate.

[0009] The centralized k-anonymity privacy protection mechanism was first proposed by Gruteser. In their scheme, when a vehicle user sends an LBS request, they first send their real location along with the query content to an anonymous server (a trusted third party). Then, the anonymous server selects the real locations of K-1 vehicle users to construct an anonymous region. Finally, this anonymous region, along with the query content of the requesting vehicle user, is sent to the real LBS server, making it difficult for the LBS server to identify the real location of the requesting vehicle user from the anonymous region. However, in the real environment, it is difficult to find a completely trusted third-party server.

[0010] The workflow of the local search architecture is as follows: Vehicle users initiate location queries, but instead of sending their detailed location information to the location server, they send a broad area containing their location and query keywords. The location server returns a list of Points of Interest (POIs) for that area. This list contains feature information, such as location and rating, but not detailed information. The vehicle user then sorts these features locally and sends detailed POI requests based on their IDs. The location service then returns the results. The problem with this method is that while the server doesn't know the vehicle user's detailed location, it does know the specific POI information the user is querying, allowing for inference attacks to analyze the user's behavioral preferences.

[0011] Given that these technologies all have certain drawbacks, such as data distortion, high communication and computing overhead, the difficulty in finding trustworthy anonymous servers in the real world, and issues related to user query privacy, a new method for protecting query privacy needs to be designed. Summary of the Invention

[0012] This invention addresses the shortcomings of existing technologies by proposing a query privacy protection method based on a local search architecture. It combines K-anonymity technology with a local search architecture, enabling the server to return query results to the user without knowing the user's query content. Furthermore, entities other than the requesting vehicle cannot obtain detailed information about the POI, such as intersection information and traffic accidents. This invention primarily aims to solve the following two technical problems:

[0013] (1) The centralized K-anonymity technology used in spatial masking technology has problems such as high communication overhead and difficulty in finding a trustworthy anonymous server in the real world.

[0014] (2) The existing local search architecture protects the location privacy of vehicles, but does not protect the privacy of vehicle users' query content.

[0015] To achieve the above objectives, the present invention provides the following technical solution:

[0016] A query privacy protection method based on a local search architecture includes two phases: a phase for requesting feature information of points of interest and a phase for requesting detailed information about points of interest.

[0017] The stage of requesting point of interest feature information includes the following steps:

[0018] S1. The vehicle user initiates a regional point of interest information query request to the anonymous server.

[0019] S2. The Anonymous Server (RSU) returns a set of feature information for all points of interest within the area to the vehicle user;

[0020] S3. Vehicle users sort the points of interest according to their preferences based on the feature information and obtain the ID set of the top K points of interest.

[0021] The process of requesting detailed information about a point of interest includes the following steps:

[0022] S4. The vehicle user will send the ID set and their public key. First, use the proxy re-encryption algorithm to encrypt and generate ciphertext. Then, the key is generated using the proxy re-encryption conversion key generation algorithm. Then the ciphertext and key Send to anonymous server, key Use the public key of the anonymous server Ciphertext is generated using the E asymmetric encryption algorithm to encrypt the re-key. ;

[0023] S5, Anonymous server receives ciphertext Afterwards, the ciphertext Perform conversion to generate ciphertext Collect the ciphertext converted from k vehicle users And shuffle the order and forward it to the location server;

[0024] S6, Location server receives ciphertext Then, use your own private key Decryption The query results are Then use the random number 'b' generated by the location server and the vehicle user's public key. The generated symmetric key is used to encrypt the result to obtain Finally, the Diffie-Hellman algorithm was used to calculate... It is then concatenated with the plaintext and sent to the anonymous server;

[0025] S7. After receiving the data, the anonymous server forwards it to the vehicle user.

[0026] S8, after receiving the message, the vehicle user will, according to The symmetric key generated by the random number 'a' itself right Using symmetric key algorithms Decrypt to obtain the query results. .

[0027] Furthermore, the specific process of the sorting method in step S3 is as follows: vehicle users Received a collection of points of interest Next, a sorting algorithm is called to obtain the set of IDs of the top K points of interest. Indicates weight, The feature information is represented by n types. First, a score is calculated for each interest point based on the feature information. Then sort the scores, and obtain the set of IDs of the top k points of interest with the highest scores. .

[0028] Furthermore, the specific process of step S5 is as follows: the anonymous server collects the query information of k vehicle users, iterates through the information k times, and decrypts it to obtain the re-encryption key. Then use a re-encryption algorithm Convert the ciphertext to Finally, the random shuffling function is called. Shuffle the data to obtain the ciphertext. Send to the location server.

[0029] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0030] (1) This invention provides a privacy protection mechanism for K-anonymous queries based on proxy re-encryption. In this scheme, the vehicle user first uses the proxy re-encryption algorithm to encrypt the point of interest ID they are querying and the vehicle user's public key used for key exchange. They then use the private key generated by proxy re-encryption and the LBS server's public key to generate a re-encryption key, which is sent to the anonymous server. The anonymous server uses the re-encryption key to regenerate ciphertext and forwards it to the LBS server. After receiving the data, the LBS server decrypts it using its own private key. After decryption, it generates a symmetric key using its own private key and the public key corresponding to the received data. It then encrypts the detailed data corresponding to the point of interest ID using the symmetric key and finally sends its own public key along with its plaintext to the anonymous server. The anonymous server forwards the data to the client. The purpose of this is that the server does not know who initiated the query because the query was initiated by the anonymous server. Furthermore, the generation of the symmetric key cannot be used for authentication, and the anonymous server does not know the query content because it cannot decrypt the content. Other attackers cannot perform man-in-the-middle attacks because the public key used for key exchange is encrypted using the proxy re-encryption method.

[0031] (2) Query Privacy Protection Scheme Based on Local Search Architecture. In this scheme, when a vehicle user wants to perform a Top-k query for points of interest, they first initiate a query for points of interest in a large area, such as querying "all restaurants in Haidian District". The server then returns feature information (such as location information and ratings) for all restaurants in Haidian District, not detailed information (vehicle user reviews and detailed locations). The vehicle user sorts the queries locally, selects the top n points of interest, and uses the aforementioned proxy re-encryption-based K-anonymous query privacy protection mechanism to obtain detailed information for the n points of interest. During this process, the vehicle user's query content is not known to the LBS server, and the final query result is not known to the anonymous server. Proxy re-encryption is used when transmitting the ID of the point of interest to be queried. Since the point of interest ID is a small data value, the data transmission efficiency will not be low due to the efficiency problem of proxy re-encryption. Symmetric encryption is used when transmitting the detailed information of the points of interest, which is highly efficient.

[0032] In summary, the query privacy protection method based on a local search architecture proposed in this invention, based on proxy re-encryption, Diffie-Hellman key exchange protocol, and K-anonymity technology, is suitable for protecting the privacy of location service query content in the Internet of Vehicles scenario, protecting the user's location, query content, and service information of the location service provider. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0034] Figure 1 This is a schematic diagram of trilateration positioning. In the diagram, ① represents the first stage, and ② represents the second stage.

[0035] Figure 2 A flowchart illustrating a query privacy protection method based on a local search architecture provided in an embodiment of the present invention. Detailed Implementation

[0036] To better understand this technical solution, the method of the present invention will be described in detail below with reference to the accompanying drawings.

[0037] like Figure 1 and Figure 2 As shown, the query privacy protection method based on a local search architecture proposed in this invention includes two stages: ① requesting feature information of points of interest and ② requesting detailed information of points of interest, wherein...

[0038] The first stage of requesting point-of-interest feature information includes the following steps:

[0039] S1. The vehicle user initiates a regional point of interest information query request to the anonymous server.

[0040] Specifically, vehicle users Send a region query request Q to the anonymous server, such as "query all hot pot restaurants in Haidian District". Because POI information is public, while the location server provides information such as vehicle density and traffic accidents near the POI, which are not public, the RSU can respond to vehicle requests for POI feature information.

[0041] S2. The anonymous server returns feature information of all points of interest within the area to the vehicle user.

[0042] Specifically, the anonymous server queries the database to retrieve the set of interest feature information that the vehicle user wants to query. Return to vehicle user This list only contains feature information about points of interest, such as latitude and longitude, rating, average price, etc.

[0043] S3. Vehicle users sort the points of interest according to their preferences based on the feature information and obtain the ID set of the top K points of interest.

[0044] Specifically, vehicle users Received a collection of points of interest Next, a sorting algorithm is called to obtain the set of IDs of the top K points of interest. Indicates weight, Representing feature information, These represent the latitude and longitude of the POI and the query user, respectively. The distance between a Point of Interest (POI) and a user is represented by n types of feature information. First, a score for each POI is calculated based on the feature information. Then sort the scores, and obtain the set of IDs of the top K points of interest with the highest scores. The pseudocode for the sorting algorithm is as follows:

[0045] enter:

[0046] Output:

[0047]

[0048]

[0049]

[0050]

[0051]

[0052]

[0053] .

[0054] II. The stage of requesting detailed information about points of interest includes the following steps:

[0055] S4. The vehicle user will send the ID set and their public key. First, use the proxy re-encryption algorithm to encrypt and generate ciphertext. Then, the key is generated using the proxy re-encryption conversion key generation algorithm. Then the ciphertext and key Send to anonymous server, key Use the public key of the anonymous server Ciphertext is generated using the E asymmetric encryption algorithm to encrypt the re-key. ;

[0056] Specifically, vehicle users Send a query request to the anonymous server. These are common parameters of the proxy re-encryption algorithm. Vehicle users private key, It is a generator of the finite cyclic group G. It is a random number generated by the vehicle user. yes One of the original roots, It is the public key of the LBS server. It is the public key of the anonymous server, and E is the asymmetric encryption method, specifically: message By ID and vehicle user Public Key The message is first encrypted using the Enc encryption algorithm, which is then re-encrypted by the proxy. Output ciphertext Enter vehicle user private key and location server public key The ReKeyGen key is used to generate a re-encryption key. Ciphertext is generated by using the asymmetric encryption algorithm E to encrypt and re-encrypt the key. The pseudocode for the asymmetric encryption algorithm is as follows:

[0057] enter:

[0058] Output:

[0059]

[0060] S5, Anonymous server receives ciphertext Afterwards, the ciphertext Perform conversion to generate ciphertext Collect the ciphertext converted from k vehicle users Then, the order is shuffled and forwarded to the location server.

[0061] Specifically, D represents the decryption method for asymmetric encryption. It's the private key of the anonymous server in an asymmetric encryption algorithm. The anonymous server collects query information from k vehicle users, iterates through the data k times, and decrypts it to obtain the re-encryption key. Then use a re-encryption algorithm Convert the ciphertext to Finally, the random shuffling function is called. Shuffle the data to obtain the ciphertext. Send it to the location server. The algorithm pseudocode is as follows:

[0062] enter:

[0063] Output:

[0064]

[0065] S6, Location server receives ciphertext Then, use your own private key Decryption The query results are Then use the random number 'b' generated by the location server and the vehicle user's public key. Generated symmetric key The result is encrypted to obtain Finally, the Diffie-Hellman algorithm was used to calculate... and The data is concatenated and sent to the anonymous server.

[0066] Specifically, the location server receives the ciphertext sent by the anonymous server. Query the database and return the results. , This represents the private key of LBS in the proxy re-encryption algorithm. It is a random number selected by the LBS server. This indicates a database query operation. The following is the pseudocode for a symmetric encryption algorithm:

[0067] enter:

[0068] Output:

[0069]

[0070] S7. After receiving the data, the anonymous server forwards it to the vehicle user.

[0071] S8, after receiving the message, the vehicle user will, according to The symmetric key generated by the random number 'a' itself right Using symmetric key algorithms Decrypt to obtain the query results. .

[0072] Specifically, The decryption algorithm for symmetric encryption is shown below, with the following pseudocode:

[0073] enter:

[0074] Output:

[0075]

[0076] The purpose of this invention is to protect the vehicle user's location, query content, and real-time POI information of the location server under the assumption that both the Location Server (LBS) and the Restoration Unit (RSU) are semi-honest. We will explain the advantages of this invention based on threat scenarios:

[0077] ① Threat 1: Large-scale inference attacks on LBS servers. Attempting to analyze vehicle users' identities, locations, query content, and times.

[0078] A vehicle user's request to LBS (Location-Based Services) includes all points of interest (POIs) within a given area. Even with a reasoning attack, the final data obtained is only the general area the vehicle user is currently in (e.g., knowing the user is in Haidian District). A request from an anonymous server contains k POI IDs for vehicle users, making it impossible for LBS to determine which server sent the request. This is because the anonymous server reassembles the vehicle user's request content in a different order before sending it to the LBS server. The encrypted information obtained by the LBS server through eavesdropping on the communication between the vehicle user and the anonymous server has not been processed by the anonymous server and cannot be decrypted. Therefore, LBS cannot analyze the incoming and outgoing messages from the anonymous server.

[0079] Threat 2: Large-scale inference attacks on anonymous servers. Attempting to analyze vehicle user identities, locations, query content, and timestamps.

[0080] The anonymous server can obtain data (if a car wants to query n points of interest, the anonymous server will obtain a set of k*n IDs that can only be decrypted using the LBS server's private key). Because the data is encrypted, the anonymous server doesn't know what the intermediate data is transmitted. It mainly performs a mixing operation, knowing which vehicle user sent which ciphertext, but not the specific content. Message responses are also encrypted using a symmetric key, and the anonymous server cannot perform man-in-the-middle attacks because it cannot decrypt the public key sent by the vehicle user.

[0081] ③ Threat 3: Other attackers may eavesdrop on channels, intercept information, and launch inference attacks.

[0082] Intercepting vehicle users' requests to LBS (Location-Based Services) only yields a general area, not the vehicle user's location. Intercepting vehicle users' requests to an anonymous server allows for large-scale inference attacks. However, each request from a vehicle user adds a random number to the ID, ensuring that even IDs for the same point of interest are encrypted differently each time. Therefore, large-scale inference attacks cannot be performed by vehicle users.

[0083] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. However, these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A query privacy protection method based on a local search architecture, characterized in that, It includes two stages: the stage of requesting feature information of points of interest and the stage of requesting detailed information of points of interest. The stage of requesting point of interest feature information includes the following steps: S1. The vehicle user initiates a regional point of interest information query request to the anonymous server. S2. The anonymous server returns a set of feature information of all points of interest in the area to the vehicle user. S3. Vehicle users sort the points of interest according to their preferences based on the feature information and obtain the ID set of the top K points of interest. The process of requesting detailed information about a point of interest includes the following steps: S4. The vehicle user will send the ID set and their public key. First, use the proxy re-encryption algorithm to encrypt and generate ciphertext. Then, the key is generated using the proxy re-encryption conversion key generation algorithm. Then the ciphertext and key Send to anonymous server, key Use the public key of the anonymous server Ciphertext is generated using the E asymmetric encryption algorithm to encrypt the re-key. ; S5, Anonymous server receives ciphertext Afterwards, the ciphertext Perform conversion to generate ciphertext Collect the ciphertext converted from k vehicle users And shuffle the order and forward it to the location server; S6, Location server receives ciphertext Then, use your own private key Decryption The query results are Then use the random number 'b' generated by the location server and the vehicle user's public key. The generated symmetric key is used to encrypt the result to obtain Finally, the Diffie-Hellman algorithm was used to calculate... It is then concatenated with the plaintext and sent to the anonymous server; S7. After receiving the data, the anonymous server forwards it to the vehicle user. S8, after receiving the message, the vehicle user will, according to The symmetric key generated by the random number 'a' itself right Using symmetric key algorithms Decrypt to obtain the query results. .

2. The query privacy protection method based on a local search architecture according to claim 1, characterized in that, The specific process of the sorting method in step S3 is as follows: vehicle users Received a collection of points of interest Next, a sorting algorithm is called to obtain the set of IDs of the top K points of interest. Indicates weight, The feature information is represented by n types. First, a score is calculated for each interest point based on the feature information. Then sort the scores, and obtain the set of IDs of the top K points of interest with the highest scores. .

3. The query privacy protection method based on a local search architecture according to claim 1, characterized in that, The specific process of step S5 is as follows: The anonymous server collects the query information of k vehicle users, iterates through the information k times, and decrypts the information to obtain the re-encryption key. Then use a re-encryption algorithm Convert the ciphertext to Finally, the random shuffling function is called. Shuffle the data to obtain the ciphertext. Send to the location server.

Images