Blockchain-based group collaboration privacy game theory

Abstract

A blockchain-based group collaborative privacy game mechanism is proposed, applied to blockchain-assisted collaborative LBS query scenarios. In this scenario, all parties adhere to the same smart contract. Users, as entities on the blockchain, perform data storage and verification. Neighboring users spontaneously form collaborative groups to mutually assist in LBS queries; users are members of these groups. For any collaborative group, user profile information is stored on the blockchain. A mobile edge computing (MEC) server customizes a multi-user collaborative privacy game mechanism (CPGM) for each collaborative group based on member profile information. Group members, guided by the CPGM, perform collaborative forwarding and message obfuscation to defend against speculative attacks based on prior knowledge. The CPGM is updated in real-time when a user leaves or joins a collaborative group. This method satisfies users' privacy needs at an acceptable cost.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically a blockchain-based group collaborative privacy game method. Background Technology

[0002] Location-based services (LBS) refer to location-related value-added services provided to location-based devices via the mobile internet. While the widespread use of LBS brings convenience to people's lives, it also seriously threatens user privacy.

[0003] Privacy game mechanisms [1][2] can customize protection strategies according to attack methods, thereby effectively resisting speculative attacks based on user profiles. Even if the protection strategy is leaked, this mechanism / method is still effective. However, traditional privacy games [3][4][5] adopt a user-centric paradigm, that is, tailor protection strategies according to user profiles. However, one-to-one privacy game strategies have many limitations in terms of flexibility and protection effectiveness. To this end, user collaborative privacy game mechanisms have emerged in the prior art. This mechanism is group-centric and interferes with the attacker's observation by hiding the behavior of individual users in the group. However, in the mobile Internet scenario with many threats, this collaborative mode still faces challenges in terms of usability.

[0004] The essence of blockchain is a replica state machine protocol in a Byzantine environment [6]. Blockchain networks allow participants to freely choose to join or leave, and use digital accounts instead of real-world identities to provide user anonymity. With its decentralized, auditable, and tamper-proof features, blockchain technology has the potential to solve the usability problem of collaborative privacy game mechanisms. First, the tamper-proof nature of on-chain data is a necessary condition for the customized generation of protection strategies. The openness of data access facilitates information exchange and data transmission within collaborative groups.

[0005] These considerations have driven research into blockchain-assisted solutions, but several challenges remain: First, privacy-preserving games rely on prior data from members, necessitating the use of blockchain for flexible data maintenance and verification. Second, generating CPGM (Collaborative Privacy Game Mechanism) demands significant computing resources, but mobile devices have limited computing power. MEC (Mobile Edge Computing) is an effective paradigm for mitigating this problem. Nevertheless, MEC-assisted game mechanism generation must consider security and adapt to user mobility.

[0006] By designing a game mechanism, an optimal solution that balances privacy level and service quality loss can be found while considering the needs of both parties. Most existing privacy game models consider two-player game scenarios. In the zero-sum Bayesian game model proposed by Shokri et al. [7][8], the attacker uses prior knowledge to establish a one-to-one game with the user, and the user's goal is to maximize the privacy level while ensuring that the service quality loss is not lower than a given threshold. Shen et al. [9] analyzed the trajectory privacy protection effect under quality loss and energy constraints by constructing a one-to-one privacy game model centered on the user. The optimal data obfuscation problem is transformed into a user-attacker privacy game

[10] , in which the joint difference-distortion privacy metric ensures that the privacy level and utility cost remain above the optimal value when using a single metric.

[0007] Few researchers have focused on multi-party privacy games. Ding et al.

[11] considered the multi-party privacy conflict problem in online social networks, modeling the interaction behavior among common owners as a multi-participant non-cooperative game, whose network structure characterizes their social relationships. Hong et al.

[12] analyzed the policy interaction between users and adversaries in dynamic Bayesian games, proving that the user's equilibrium strategy depends on the adversary's ability to access geographic data. In

[13] , they further studied how multiple users can coordinate queries through obfuscation to resist inference attacks. Summary of the Invention

[0008] This invention proposes a blockchain-based group collaboration privacy game theory method (framework). Under this method (framework), profiles of collaboration group members are stored on the blockchain to achieve secure storage and flexible maintenance of these profiles. A mobile edge computing (MEC) server integrates an optimal privacy game theory model, aiming to minimize collaboration costs under dual privacy constraints. The multi-user collaborative privacy game theory mechanism CPGM guides collaborative forwarding and message ambiguity within the collaboration group to resist speculative attacks from attackers. A blockchain-based model verification and traceability mechanism ensures the standardization of model generation.

[0009] Specifically, this invention is a blockchain-based group collaborative privacy game method, which is applied to a blockchain-assisted collaborative LBS query scenario. In the collaborative LBS query scenario, all parts comply with the same smart contract.

[0010] In collaborative LBS query scenarios, users act as entities on the blockchain, storing and verifying data on the blockchain. Neighboring users spontaneously form collaborative groups to assist each other in LBS queries, and users are members of these collaborative groups. For any collaborative group, user profile information is stored on the blockchain. The mobile edge computing (MEC) server customizes a multi-user collaborative privacy game mechanism (CPGM) for the collaborative group based on the members' profile information. Under the guidance of the CPGM, group members perform collaborative forwarding and message obfuscation to resist speculative attacks from attackers based on prior knowledge. When a user leaves or joins a collaborative group, the CPGM is updated in real time.

[0011] (a) The steps to establish a CPGM include:

[0012] 1.1) Members send the storage address of their portrait and the decryption key of the portrait to the smart contract;

[0013] 1.2) The smart contract verifies and processes the obtained profile and sends it to the MEC server;

[0014] 1.3) The MEC server performs off-chain computation through a privacy game mechanism, customizes a multi-user collaboration privacy game mechanism CPGM for the collaboration group, and distributes the CPGM to the members of the collaboration group;

[0015] CPGM includes forwarding functions and obfuscation functions (protection mechanisms);

[0016] Forwarding functions are used by members acting as queryers; collaborators are specified through forwarding functions for the queryer's original query information.

[0017] The fuzzy function is used by members acting as the queryer; for the queryer's original query information and collaborators, the fuzzy function yields the fuzzified secret of the queryer, called the fuzzy secret; the fuzzy secret is then sent by the queryer to the collaborators.

[0018] (II) The steps of collaborative LBS query include:

[0019] 2.1) When an LBS query is required, if the queryer wants to hide their identity and location, the queryer determines a collaborator based on the forwarding function and then generates a fuzzy secret based on the fuzzy function; the queryer forwards the obfuscated query containing the collaborator's identity and fuzzy secret information to the collaborator.

[0020] 2.2) After receiving a spoofed query, the collaborator interacts with the LBS in its own identity to cover up the queryer;

[0021] 2.3) LBS provides query results to collaborators based on obfuscated queries;

[0022] 2.4) The collaborator sends the results from the LBS feedback back to the querier.

[0023] This invention enables previously untrusted group users to efficiently assist each other, protect user privacy, and achieve full-process monitoring and traceability of the model generation process.

[0024] In the experimental design verification, this invention used real maps and user movement trajectories. The results show that the proposed solution can adapt to different geographical areas and group sizes, effectively protecting user privacy with acceptable collaboration costs and time constraints. Attached Figure Description

[0025] Figure 1 This is a schematic diagram of the framework of a blockchain-based group collaboration privacy game method;

[0026] Figure 2 This is a schematic diagram of the CPGM generation workflow;

[0027] Figure 3 This is a schematic diagram of the Merkle tree (N=4) of member u;

[0028] Figure 4 This is a schematic diagram illustrating the principle of CPGM;

[0029] Figure 5 This is a schematic diagram of a Bayesian network;

[0030] Figure 6 This is a diagram illustrating how a collaborator modifies the query scope before forwarding the query.

[0031] Figures 7(a) to 7(c) The figures represent the impact of population size on the privacy level of the four game mechanisms in three different POI density regions during the experiment.

[0032] Figures 7(d) to 7(f) The figures represent the impact of population size on the cooperation cost of the four game mechanisms in three different POI density regions during the experiment.

[0033] Figures 7(g) to 7(i) The figures represent the impact of population size on the ratio of collaboration cost to privacy level for the four game mechanisms in three different POI density regions during the experiment.

[0034] Figures 8(a) to 8(c) The figures represent the relationship between the level of privacy protection and the corresponding collaboration cost of CPGM-1 in areas with three different POI densities under three different average user distances in the experiment.

[0035] Figures 9(a) to 9(c) The figures represent the changes in game cost with varying levels of privacy protection when 50 devices operate different game mechanisms in three regions with different POI densities during the experiment. Detailed Implementation

[0036] 1 Overview

[0037] This invention presents a blockchain-based group collaboration privacy game theory method (framework). This method ensures user privacy security through two privacy metrics (mobility privacy and distortion privacy) and minimizes collaboration costs while maximizing service quality. Using this method, previously untrusted users within a group can efficiently assist each other and jointly resist external attacks.

[0038] Major contributions include:

[0039] 1) This invention utilizes blockchain to achieve secure storage and flexible maintenance of user profiles.

[0040] Based on user profiles, a multi-user collaborative privacy game mechanism, abbreviated as CPGM (Collaborative Privacy Game Mechanism), was constructed. This mechanism uses mobility privacy to reduce the probability of real data being inferred in consecutive queries, and combines distortion degree privacy as a metric for attack defense effectiveness.

[0041] Under the guidance of the CPGM, team members disguise query messages and select collaborators to complete LBS queries efficiently and securely. Meanwhile, a blockchain-based verification and traceability mechanism ensures the standardization of CPGM generation.

[0042] 2) Realistic maps were introduced to simulate the behavior of mobile groups (users) and attackers.

[0043] During the experimental verification process, real user location trajectory data was collected and input into the experimental system to objectively evaluate the effectiveness of the proposed solution. Simulation results show that the proposed solution can significantly improve the overall privacy level while maintaining low cost and providing satisfactory privacy protection.

[0044] Later in the text:

[0045] Chapter 2 describes the system architecture of this invention and discusses the threat model and design objectives.

[0046] Chapter 3 constructs CPGM and explores the secure generation of CPGM.

[0047] Chapter 4 analyzes the design goals that the proposed solution can achieve.

[0048] Chapter 5 uses simulation methods to verify the performance of the proposed scheme.

[0049] Chapter Six provides the conclusion.

[0050] 2 System Architecture

[0051] Consider a blockchain-assisted collaborative LBS query scenario. Users, as entities on the blockchain, can flexibly store and verify data on-chain. Neighboring mobile users can spontaneously form a collaborative group to mutually assist in LBS queries while protecting location privacy. All components in the LBS query scenario adhere to the same smart contract.

[0052] User profile information is stored on the blockchain as hash values, and downloading and verification are determined by smart contracts. Driven by the smart contracts, the MEC server generates a privacy game mechanism (CPGM) customized for the collaboration group based on member profiles, resisting speculative attacks based on prior knowledge. The intermediate results of CPGM generation are recorded on the blockchain for later verification and traceability. Group members collaborate under the guidance of the generated CPGM. When a user leaves or joins the collaboration group, the CPGM is updated in real time.

[0053] Suppose there are two types of malicious entities in the network: untrusted LBS and untrusted MEC servers.

[0054] • Unreliable LBS systems speculate on user privacy based on background knowledge;

[0055] • Untrusted MEC servers may spy on user privacy and algorithm logic, and even produce incorrect calculation results.

[0056] 2.1 Overview of the Solution

[0057] like Figure 1 As shown, the blockchain-based group collaborative privacy game method (framework) of this scheme includes two parts: CPGM generation and collaborative LBS query. The symbols and operations are defined as follows:

[0058] U represents the set of members of a collaboration group.

[0059] • o = {u, s} represents the original query information of member u. Here, u represents the query (initiator), and s is the queryer's secret (such as u's location or preferences, or other private information).

[0060] p1(u′|o) is the forwarding function used by the queryer u. Given the original query information o, p1(u′|o) samples according to a certain probability distribution to accurately assign a collaborator u′ to u.

[0061] p2(s′|u′,o) is a fuzzy function used by the queryer. Given a collaborator u′ and the original query information o, this function outputs a fuzzy secret s′ with a specific probability distribution. The queryer u forwards the fuzzy secret s′ to the collaborator u′.

[0062] ·o′={u′,s′} is the LBS query (information) submitted by collaborator u′, which is a confusing query and is observable for all users on the network.

[0063] · It is a speculation function controlled by the eavesdropper, in which and These represent estimates of the inquirer's identity and the secret, respectively. After the eavesdropper observes o′, it executes... The speculative function is encapsulated in The original queryer and its secrets.

[0064] refer to Figure 2 The left box shows the steps involved in generating CPGM:

[0065] ① Collaboration group members send their user profile storage address and profile decryption key to the smart contract so that the smart contract can obtain the member's profile.

[0066] ② The smart contract verifies and processes the obtained user profile and sends it to the MEC server.

[0067] ③ The MEC server performs off-chain computation through a privacy game mechanism, customizes CPGMs (including forwarding function p1(u′|o) and fuzzy function p2(s′|u′,o)) for the collaboration group, and finally distributes them to the collaboration group members.

[0068] refer to Figure 2 The right-hand box shows the steps involved in a collaborative LBS query:

[0069] ① The queryer u wants to hide its identity and location. When an LBS query is needed, u determines a collaborator u′ based on p1(u′|o), generates a disguised secret s′ based on the fuzzy function p2(s′|u′,o), and then forwards the fuzzy query o′={u′,s′} to u′.

[0070] ② After receiving the fuzzy query o′ sent by u, the collaborator u′ interacts with LBS in its own identity to cover up u.

[0071] ③LBS based on o This provides query results for u. Malicious LBS administrators could exploit this. Speculate on u's identity and secrets.

[0072] ④u′ sends the LBS feedback results back to u to interfere with the eavesdropping of malicious members within the group.

[0073] 2.2 Threat Model

[0074] • Speculative attacks: Attackers use statistical or machine learning methods to infer the identity of the person making the query based on prior information about the user. and secrets

[0075] • Poisoning attack: A user profile may be poisoned (including user-initiated poisoning), resulting in a decrease in the defense capability of the generated CPGM;

[0076] • Deception attack: Untrusted MEC servers provide fake CPGMs, disrupting collaboration between users.

[0077] 2.3 Design Objectives

[0078] This solution achieves the following three design goals:

[0079] Privacy protection

[0080] 1) Users need not worry about privacy leaks caused by the protection functions p1(u′|o) and p2(s′|u′,o) falling into the hands of malicious third parties. Even if the method is stolen or the algorithm design logic is mastered by attackers, CPGM can still guide the collaboration group to effectively defend against external attacks.

[0081] 2) Attackers have difficulty associating the identity of the queryer by observing LBS requests.

[0082] • Security

[0083] 1) Smart contracts perform security verification on member profiles to prevent poisoning attacks;

[0084] 2) The correctness of the generated CPGM is verifiable;

[0085] 3) The black-box nature of the fuzzy function p2(s′|u′,o) makes the fuzzy secret s′ difficult to forge.

[0086] Credibility

[0087] Any abnormal or irregular behavior that occurs during the CPGM generation process will be recorded and traced, thereby standardizing the behavior of the MEC server.

[0088] 3. Collaborative CPGM Generation

[0089] This section introduces CPGM generation with MEC assistance, including: user profile preprocessing, CPGM construction, and MEC server behavior verification and tracing.

[0090] 3.1 Image Storage

[0091] User profiles are stored locally in encrypted form and maintained by each user. Note that profile maintenance is not mandatory. The system provides a default profile to users who do not maintain one. A Merkle hash tree is introduced to ensure the correctness and integrity of the profiles. u,n S represents the nth secret information fragment representing member u∈U. u =∪ n∈{1,2,...,N}S u,n The secret information file representing group member u∈U contains N fragments.

[0092] by Figure 3 For example (N=4), the Merkle tree leaf nodes of member u include s u,1 ,s u,2 ,s u,3 ,s u,4 Root hash value root(S) u )=H(g 21 ||g 22 It is stored in the block. Only when u actively updates S u At that time, root(S) u Only then will it change. Each user maintains their own Merkle tree. User updates to the Merkle tree are recorded in the on-chain log, so even if a user attempts to interfere with CPGM generation by "poisoning" their own profile, it will be detected.

[0093] Before generating the CPGM, the smart contract downloads and decrypts the profiles of the group members and verifies their correctness using the root hash value stored on the chain. To prevent the MEC server from identifying users through the received data, the smart contract uniformly performs Differential Privacy Processing

[14] on the user profiles to provide semantic security for the user's privacy information. After receiving the profile, the MEC server performs Differential Privacy Processing on the user profiles. u∈U S u The Cartesian product of the elements in U, i.e., O = U × S, forms the prior probability distribution π(o) (o ∈ O) of the identities and secrets of the collaborative group members, which is used to customize the CPGM.

[0094] 3.2 Defense and Attack Mechanisms

[0095] When user u interacts with an untrusted LBS server, they want to protect their privacy through group (user / member) collaboration. For example... Figure 4 As shown in the schematic diagram of the CPGM principle, this invention assumes that a collaborative group member u∈U wants to protect his / her privacy information s∈S. To this end, the actual queryer u∈U first selects a collaborator u′∈U within the group to help him / her release the obfuscated query o′={u′,s′}.

[0096] like Figure 5 As shown, this invention utilizes a probabilistic graphical model based on Bayesian networks to illustrate privacy protection in collaboration, comprising two steps:

[0097] 1) The choice of collaborators is influenced by the original queryer information o, and is determined by the following probability distribution:

[0098] p1(u′|s,u)=p1(u′|o)=Pr{U=u′|O=o} (1)

[0099] 2) After selecting a suitable u′ through p1, u needs to transform its secret information s into observable fuzzy information s′ to prevent s from being directly exposed during subsequent transmission. The output of s′ is affected by o and u′ and is determined by the following probability distribution:

[0100] p2(s′|u′,s,u)=p1(s′|u′,o)=Pr{S=s′|U=u′,O=o} (2)

[0101] Given a prior data probability distribution π(o), and based on a Bayesian network (such as... Figure 5 Steps ① and ②) have

[0102] p(o′,o)=p({u′,s′},o)=π(o)p1(u′|o)p2(s′|u′,o) (3)

[0103] p(o',o) is mainly used to calculate p(o'|o) in auxiliary formula (4). p(o',o) can be understood as the probability that the original query o and the observable fuzzy query o' exist at the same time.

[0104] Based on equation (3), the generation of the observable o′ conforms to the following probability distribution.

[0105]

[0106] An attacker can be viewed as an entity aiming to discover user secrets and minimize user privacy by observing user output. The attacker can infer possible privacy sets from the observable privacy set o′={u′,s′}. Will The probability distribution of the real privacy set o = {u, s} is defined as follows:

[0107]

[0108] The goal is to estimate using the inversion protection mechanisms p1(u′|o) and p1(s′|u′,o). Inference error determines the effectiveness of an inference algorithm, and it is measured by the distortion constraint. It is worth noting that here... It is not a simple Bayesian probability inference, but a movement pattern attack targeting continuous query scenarios. That is, attackers can use the spatiotemporal correlation of continuous queries to mine more movement information.

[0109] For any observation o′, the present invention represents the actual queryer's o={u,s} as possible. The probability distribution is expressed as

[0110]

[0111] 3.3 Privacy Constraints

[0112] Once the observable o′={u′,s′} is released, the attacker can obtain an estimate by analyzing the observable query content. This invention is based on The deviation between o and σ is used to quantify the degree of information distortion, reflecting the difference between o and σ. The difference between them. If the attacker estimates... If there is a significant discrepancy between 'o' and 'o', then users do not need to worry about their personal information being exposed.

[0113] The privacy gain for a user with secret o is defined as the distance between two data points: in It is a secret, hindsight estimate. Based on (4), (5), and (6), the distortion of privacy expected by the user is calculated as follows:

[0114]

[0115] Because attackers cannot possess all user information, their inferred user location distribution differs from the distribution inferred under ideal circumstances (when all information is available). The smaller the value, the more accurate the attacker's prediction.

[0116] Given that users typically post queries consecutively, attackers with background knowledge can gain more inferences by analyzing queries posted by users at adjacent times. The privacy inferred from consecutive queries is defined as mobilityprivacy. Assume the protection function p posts data o at time t. t ′, data o was released n time ago t-n ′, then mobilityprivacy can be calculated as

[0117]

[0118] 3.4 Optimal CPGM Generation

[0119] While adopting collaborative queries enhances privacy, groups also face the challenge of collaboration costs.

[0120] The cost function c quantifies the cost of selecting collaborator u′ and transforming o into o′. Since u′ forwarding u's LBS query causes a shift in the original query location, u′ needs to modify the query content (e.g., query radius r) before forwarding the query. Figure 6 As shown, assume the original user u's query range is a circular area centered at the current location with radius r; the collaborator u′ needs to modify the query range to the smallest circular area containing the original query range, with a query radius of r′. This invention describes the cost function c as the ratio of the radius increase before and after the query range modification, i.e.

[0121]

[0122] Based on the cost function c, the collaboration cost can be specifically described as follows:

[0123]

[0124] The attacker's goal is to minimize user privacy, i.e., to minimize the estimated value. The error between the original value o and the original value. This error is primarily determined by distorted privacy. When the error f dist When the minimum value is reached, the attacker's speculation is most effective. Therefore, the optimal attack algorithm is expressed as:

[0125]

[0126] From equations (4) and (5), it can be seen that the attack function is determined by p1 and p2. Mobility privacy is guaranteed when p1 and p2 satisfy the following inequality.

[0127]

[0128] exp(α) represents the desired minimum mobility privacy; α represents the range of distances the user can travel.

[0129] Let β be the desired minimum distortion privacy level. The average distortion privacy of the user is guaranteed if the obfuscation mechanisms p1 and p2 satisfy the following inequality.

[0130]

[0131] In contrast to attackers, the goal of group collaboration is to minimize the collaboration cost (10) under privacy constraints (12) and (13), i.e., to find the probability distribution function. and They are defined as minimizing the collaboration cost under multiple privacy constraints. Accordingly, the problem solved by Collaborative Privacy Game Theory (CPGM) is formulated as follows:

[0132]

[0133] st(12),(13)

[0134] Given α and β, the MEC server calculates the optimal protection mechanisms p1 and p2, and solves them using a linear programming solver. The corresponding optimal attack q is obtained.

[0135] 3.5 Verification and Traceability

[0136] This invention employs the following measures to ensure the standardization, transparency, and traceability of CPGM generation:

[0137] 1) The CPGM generation logic is written into a smart contract. The MEC server is only responsible for executing the computational tasks dispatched by the smart contract. Key results during the generation process are stored on the blockchain for later review.

[0138] 2) The generated CPGM is sent to the collaboration group's virtual account. During the generation process, the CPGM is embedded with a special, tamper-proof identifier

[15]

[16] , and users can verify the completion of the MEC server's work afterward. The smart contract can be verified afterward.

[0139] 4. Security and Privacy Analysis

[0140] 1) Stable defensive capabilities

[0141] Game theory allows both attackers and defenders to reach an equilibrium point, achieving optimal defense and attack simultaneously. Even if the protection methods or algorithm logic are leaked, users don't need to worry about their protection strategies failing.

[0142] 2) Identity unassociativity

[0143] Since the observable o′=(u′,s′) is fuzzy and anonymized, it is difficult for an attacker to infer the true identity and secret information of the inquirer u based on o′.

[0144] 3) Unforgeability

[0145] The queryer u has no reason to fabricate its ambiguous position; on the other hand, the output s′ of p2(s′|u′,o) cannot be accurately predicted. Even if a malicious entity attempts to forge or tamper with s′, this scheme identifies it by embedding a special identifier in s′.

[0146] 5CPGM Performance Analysis

[0147] This section investigates the privacy protection effectiveness of the proposed CPGM in different geographic environments using simulation methods. A user group is simulated by generating a random user dataset on a Beijing map containing various POI (Point of Interest) types. Attackers infer users' precise locations based on their maximum movement speed limits and anonymous locations during continuous queries. To evaluate the feasibility of CPGM in real-world environments, trajectory tracking software running on smartphones is used to collect user trajectories used in the experiments. The experiments focus on performance metrics such as privacy level, collaboration cost, and initialization time. All algorithms are implemented in Matlab on a computer with an Intel Core i3 2.53GHz processor and 8GB of RAM.

[0148] 5.1 Single-user vs. Multi-user Game

[0149] The proposed CPGM can be divided into CPGM-1 and CPGM-2. The former, CPGM-1, considers both mobile privacy constraints (as shown in Equation 12) and distortion privacy constraints (as shown in Equation 13), while the latter, CPGM-2, only considers distortion privacy constraints and not mobile privacy constraints. Two types of single-user privacy game schemes, SUPG-1 and SUPG-2, improved by references [5]

[10] , are selected as benchmark methods. These two methods are similar to CPGM-1 and CPGM-2, except that CPGM-2 ignores mobile privacy.

[0150] Figures 7(a) to 7(i) Comparative results are presented for α = 0.5 km and β = 0.4 (β is the expected minimum distortion privacy level). Although group game theory consumes more time, the expected privacy level is significantly improved. For a collaborative group of 20 people, the privacy level obtained through group game theory shows a surge trend, while the cost increases slowly, demonstrating good performance; however, as the group size increases, the privacy level tends to increase slowly, while the time consumption increases rapidly. Although theoretically a larger group size is beneficial for better camouflage, this result shows that simply increasing the group size is not a good choice. When the group size reaches 20 people, the optimal performance trade-off between privacy protection and execution efficiency is achieved. If new computing techniques are used, or if a more efficient solution is found in the future, the completion time can be further reduced.

[0151] from Figures 7(a) to 7(i)It can be seen that the density of Points of Interest (POIs) in a region affects both the privacy level and the cost of group games. In Haidian District, where the POI density is highest, the privacy protection effect of group games is stronger, and the collaboration cost is lower. As the POI density decreases, the privacy level of group games in Shunyi District and Yanqing District decreases, while the corresponding collaboration cost increases. Therefore, in terms of protection effect and collaboration cost, the effectiveness of CPGM-1 is more pronounced in environments with higher POI density.

[0152] For groups of different sizes, each user is individually subjected to a Stackelberg game against the attacker, and the average privacy level and cost are calculated separately, then compared with the CPGM proposed in this invention. Figures 7(a) to 7(i) Comparative results are presented when α = 0.5 km and β = 0.4. Although the time consumption of swarm game is relatively high, the expected privacy level is significantly improved. When |U| ≤ 20, the privacy level obtained by swarm game increases rapidly, accompanied by a slow increase in cost, showing good performance; however, as the group size increases, the increase in privacy level tends to slow down, while the time consumption increases rapidly. Although theoretically a larger group size is beneficial for better camouflage, the results show that simply increasing the group size is not a good choice. When |U| = 20, the optimal performance trade-off between privacy protection level and execution efficiency can be achieved. If new computing techniques or more efficient solutions are found in the future, the completion time can be further shortened.

[0153] from Figures 7(a) to 7(i) It can also be seen that the density of Points of Interest (POIs) in a region affects the privacy level and collaboration cost of group games. In Haidian District, where the POI density is highest, the privacy protection effect of group games is at a high level, and the collaboration cost is low. As the POI density decreases, the privacy level of group games in Shunyi and Yanqing Districts decreases, and the corresponding collaboration cost increases. Therefore, in terms of protection effect and collaboration cost, CPGM is more effective in real-world environments with high POI density.

[0154] 5.2 POI density

[0155] The impact of POI density on privacy protection was verified through simulation experiments. Twenty users experienced LBS in three different areas of Beijing, with the highest POI density in Haidian District in the city center and the lowest in Yanqing District, a suburb of Beijing.

[0156] Figures 8(a) to 8(c)The privacy protection levels and corresponding collaboration costs of CPGM-1 in three regions are presented. Users in Haidian District can achieve a high level of privacy at a lower cost. However, achieving the same level of privacy in Yanqing District requires a higher collaboration cost. CPGM-1 achieves satisfactory privacy protection in areas with high POI density, protecting at least 74% of privacy even in suburban areas. Figures 8(a) to 8(c) The differences show that as the average distance between users increases, the collaboration cost required for CPGM-1 to achieve the same level of privacy protection increases, but the overall fluctuation is not significant. Overall, CPGM can help users better hide in areas with high POI density and strong member relationships, achieving higher privacy protection at a lower collaboration cost.

[0157] The above results were generated using actual maps from the simulated scenario. A realistic dataset was obtained by collecting trajectory data from 50 mobile devices (phones), which was then used to replace the user data generated in the previous simulation. In this set of experiments, α and β were set to 0.5 km and 0.4, respectively. Figures 9(a) to 9(c) The study recorded how the game cost varies with the level of privacy protection when 50 devices run different game mechanisms in areas with different POI densities. Figures 9(a) to 9(c) Intuitively, incorporating mobile privacy helps defend against mobile pattern attacks, primarily when users execute consecutive queries. CPGM-1 plays a very positive role in meeting at least 80% of user privacy needs. CPGM-1 introduces mobile privacy metrics, improving privacy levels by an average of approximately 7%. One device in the Haidian district achieved a privacy level of 98%. This feature demonstrates that CPGM can provide better privacy protection.

[0158] 6 Conclusions

[0159] This invention proposes a group-based collaborative privacy game framework that enables members of a collaborative group lacking trust to cooperate efficiently. Simulation results of the multi-user collaborative privacy game mechanism CPGM, designed to address untrusted LBS and network attackers, demonstrate that the proposed scheme can meet users' privacy needs at an acceptable cost, achieving better privacy protection in areas with relatively high POI density.

[0160] References

[0161] [1]H.Jiang,J.Li,P.Zhao,F.Zeng,Z.Xiao,and A.Iyengar,“Location privacy-preserving mechanisms in location-based services:A comprehensive survey,”ACMComput.Surv.,vol.54,

[0162] no.1,2022.

[0163] [2]J.Pawlick,E.Colbert,and Q.Zhu,“A game-theoretic taxonomy andsurvey of defensive deception for cybersecurity and privacy,”ACMComput.Surv.,vol.52,no.4,2020.

[0164] [3]S.Hong,L.Duan,and J.Huang,“Protecting location privacy bymultiquery:A dynamic bayesian game theoretic approach,”IEEETrans.Inf.Forensics Security,vol.17,pp.2569–2584,2022.

[0165] [4]M.Pirani,E.Nekouei,H.Sandberg,and K.H.Johansson,“A graph-theoreticequilibrium analysis of attacker-defender game on consensus dynamics under H2performance metric,”IEEE Trans.Netw.Sci.Eng.,vol.8,no.3,pp.1991–2000,2020.

[0166] [5]R.Shokri,G.Theodorakopoulos,and C.Troncoso,“Privacy games alonglocation traces:A game-theoretic framework for optimizing location privacy,”ACM Trans.Priv.Secur.,vol.19,no.

[0167] 4,pp.1–31,2016.

[0168] [6]I.Eyal,A.E.Gencer,E.G.Sirer,and R.Van Renesse,“Bitcoin-ng:Ascalable blockchain protocol,”in Proc.of USENIX NSDI,2016,pp.45–59.

[0169] [7]R.Shokri,G.Theodorakopoulos,and C.Troncoso,“Privacy games alonglocation traces:A game-theoretic framework for optimizing location privacy,”ACM Trans.Priv.Secur.,vol.19,no.

[0170] 4,pp.1–31,2016.

[0171] [8]R.Shokri,G.Theodorakopoulos,C.Troncoso,J.-P.Hubaux,and J.-Y.LeBoudec,“Protecting location privacy:Optimal strategy against localizationattacks,”in Proc.of ACM SIGSAC CCS,

[0172] 2012,pp.617–627.

[0173] [9]H.Shen,G.Bai,M.Yang,and Z.Wang,“Protecting trajectory privacy:Auser-centric analysis,”J.

[0174] Netw.Comput.Appl.,vol.82,pp.128–139,2017.

[0175]

[10] R.Shokri,“Privacy games:Optimal user-centric data obfuscation,”Proc.Priv.Enh.Technol.,vol.

[0176] 2015,no.2,pp.299–315,2015.

[0177]

[11] K.Ding and J.Zhang,“Multi-party privacy conflict management inonline social networks:A network game perspective,”IEEE / ACM Trans.Netw.,vol.28,no.6,pp.2685–2698,2020.

[0178]

[12] S.Hong,L.Duan,and J.Huang,“Protecting location privacy bymultiquery:Adynamic bayesian game theoretic approach,”IEEETrans.Inf.Forensics Security,vol.17,pp.2569–2584,2022.

[0179]

[13] S.Hong and L.Duan,“Multi-user privacy cooperation game byleveraging users’service flexibility,”in IEEE ISIT,2022,pp.637–642.

[0180]

[14] Y.Zhao and J.Chen,“Asurvey on differential privacy forunstructured data content,”ACM Comput.Surv.,vol.54,no.10s,pp.1–28,2022.

[0181]

[15] G.Gao,T.Han,Z.Feng,M.Wang,and Z.Xia,“AData IntegrityAuthentication Scheme in WSNs Based on Double Watermark,”IEEE Internet ThingsJ.,pp.1–1,2022.

[0182]

[16] F.Yan,H.Huang,and X.Yu,“AMultiwatermarking Scheme for VerifyingMedical Image Integrity and Authenticity in the Internet of Medical Things,”IEEE Trans.Industr.Inform.,vol.

[0183] 18,no.12,pp.8885–8894,2022.

Claims

1. A blockchain-based group collaborative privacy game method, characterized in that the collaborative privacy game method is applied to a blockchain-assisted collaborative LBS query scenario; in the collaborative LBS query scenario, all parts comply with the same smart contract; In collaborative LBS query scenarios, users act as entities on the blockchain, storing and verifying data on the blockchain. Neighboring users spontaneously form collaborative groups to assist each other in LBS queries, and users are members of these collaborative groups. For any collaborative group, user profile information is stored on the blockchain. The mobile edge computing (MEC) server customizes a multi-user collaborative privacy game mechanism (CPGM) for the collaborative group based on the members' profile information. Under the guidance of the CPGM, group members perform collaborative forwarding and message obfuscation to resist speculative attacks from attackers based on prior knowledge. When a user leaves or joins a collaborative group, the CPGM is updated in real time. (a) The steps for establishing a CPGM include: 1.1) Members send the storage address of their portrait and the decryption key of the portrait to the smart contract; 1.2) The smart contract verifies and processes the obtained profile and sends it to the MEC server; 1.3) The MEC server performs off-chain computation through a privacy game mechanism, customizes a multi-user collaboration privacy game mechanism CPGM for the collaboration group, and distributes the CPGM to the members of the collaboration group; CPGM includes protection mechanisms such as forwarding functions and obfuscation functions; Forwarding functions are used by members acting as queryers; collaborators are specified through forwarding functions for the queryer's original query information. The fuzzy function is used by members acting as the queryer; for the queryer's original query information and collaborators, the fuzzy function yields the fuzzified secret of the queryer, called the fuzzy secret; the fuzzy secret is then sent by the queryer to the collaborators. (ii) The steps of collaborative LBS query include: 2.1) When an LBS query is required, if the queryer wants to hide their identity and location, the queryer determines a collaborator based on the forwarding function and generates a fuzzy secret based on the fuzzy function; the queryer forwards the obfuscated query containing the collaborator's identity and fuzzy secret information to the collaborator. 2.2) After receiving a spoofed query, the collaborator interacts with the LBS in its own identity to cover up the queryer; 2.3) LBS provides query results to collaborators based on obfuscated queries; 2.4) The collaborator will send the LBS feedback results back to the queryer; In step 1.3), the method for generating the optimal CPGM is as follows: 1.3.1) Defense and Attack Mechanisms If the attacker is an untrusted LBS server, then when a member of the collaboration group interacts with the untrusted LBS server, they protect their secrets through collaboration among group members. Assuming the members of the collaboration group Want to protect his secret To this end, u first selects a collaborator within the group. Help him release the obfuscated query U represents the set of members of a collaborative group. It is a vague secret. According to CPGM: u, as the queryer, uses the forwarding function p1 to select... , The choice is influenced by the original query information o. It is determined by the following probability distribution: (1) In passing Choose a suitable one Subsequently, u further transforms its own secret s into an observable fuzzy secret through the fuzzy function p2. ; The output is affected by o and The impact, It is determined by the following probability distribution: (2) Given the prior data probability distribution π(o), based on a Bayesian network, we have: (3) p(o',o) represents the probability that the original query o and the observable fuzzy query o' exist simultaneously; Based on equation (3), it can be observed The generation conforms to the following probability distribution (4) Attackers through observable Using speculation functions Estimate the query information by inference ,in: and These represent estimates of the inquirer's identity and the secret, respectively. Will It is the actual original query information. The probability distribution is defined as follows: (5) The goal is to achieve protection through inversion mechanism and To estimate ; This describes a mobile pattern attack targeting continuous query scenarios, where attackers can exploit the spatiotemporal correlation of continuous queries to uncover more mobile information. For any observation The original query information of the actual queryer Represented as a possible set of privacy The probability distribution is expressed as (6); 1.3.2) Privacy Constraints Observable After being released, the attacker can obtain an estimate by analyzing the observable query content. ;by The deviation between o and σ is used to quantify the degree of information distortion, reflecting the difference between o and σ. The difference between them; if the attacker estimates If the deviation between 'o' and 'o' is greater than the threshold, then the user does not need to worry about the exposure of their personal information. The privacy gain for a user who possesses the original query information is defined as the distance between two data points: Based on (4), (5), and (6), the user's expected distorted privacy is calculated as follows: (7) The discrepancy between the user location distribution inferred by the attacker and the user location distribution inferred under ideal circumstances The smaller the value, the more accurate the attacker's inferences; the ideal situation is when the attacker has all the information. Since users typically post queries consecutively, attackers can gain more inferences by analyzing queries posted by users at adjacent times. Therefore, the information inferred from consecutive queries is defined as mobility privacy. Assume the protection function p posts data at time t. Data was released in the previous n time steps. Then mobility privacy is calculated as (8) 1.3.3) Optimal CPGM Generation Users need to consider the cost of collaboration while gaining enhanced privacy; a cost function c is used to quantify the selection of collaborators. And converting o to The costs incurred; because The forwarding of LBS queries by u causes the original query location to shift, therefore Before forwarding the query, the query radius r needs to be modified; assuming the query range published by u is a circular area centered at u's current location with radius r; collaborators To modify the query range to the smallest circular region that includes the original query range, the query radius of this circular region is... ; The cost function c can be described as the ratio of the radius increase before and after the query range modification, i.e. （9） Based on the cost function c, the collaboration cost is described as （10） The attacker's goal is to minimize user privacy, i.e., to minimize the estimated value. The error between the original value o and the original value o, which depends on distorted privacy; when the error is minimized, the attacker's speculation effect is optimal, and the optimal attack algorithm is expressed as: （11） From equations (4) and (5), the attack function is derived from... and The decision, then and Mobility privacy is guaranteed when the following inequality is satisfied: （12） exp(α) represents the desired minimum mobility privacy, where α represents the range of distances the user can travel. Let β be the desired minimum distortion privacy level; if the protection mechanism and The average distortion privacy of users is guaranteed if the following inequality is satisfied: （13） In contrast to attackers, the goal of group collaboration is to minimize the collaboration cost (10) under privacy constraints (12) and (13), i.e., to find the probability distribution function. and They are defined as minimizing collaboration costs under multiple privacy constraints, and the problem solved by CPGM is expressed as follows: ， Given and MEC server computing optimal protection mechanism and Solve Thus, the corresponding optimal attack q is obtained.

2. The blockchain-based group collaborative privacy game method according to claim 1, characterized in that: Intermediate results of the CPGM generation process are recorded on the blockchain for later verification and traceability.

3. The blockchain-based group collaborative privacy game method according to claim 2, characterized in that: The CPGM generation process also includes step 1.4) verification and traceability, which are used to ensure the standardization, transparency, and traceability of CPGM generation. 1) The generation logic of CPGM is written into the smart contract. The MEC server is only responsible for executing the computational tasks dispatched by the smart contract; intermediate results during the CPGM generation process are stored on the chain for later tracing. 2) The generated CPGM is sent to the collaboration group's virtual account. The CPGM is embedded with an immutable identifier during its generation process, allowing users to verify the completion of the MEC server's work afterward; smart contracts can also be verified afterward.

4. The blockchain-based group collaborative privacy game method according to claim 1, characterized in that: User profiles are stored locally in encrypted form and maintained by each user; users who do not maintain their own profiles will receive a default profile.

5. The blockchain-based group collaborative privacy game method according to claim 1 or 4, characterized in that: In step 1.1), the profile of member u is as follows: Merkle hash trees were introduced to ensure the correctness and integrity of the image: S u,n This represents the nth secret information fragment representing member u; A secret information file representing group member u, this secret information file has N fragments; U represents the set of members of a collaboration group; The Merkle tree leaf nodes of member u include S u,1， S u,2，…， S u,n ; Root hash value It is stored in a block; only member u actively updates the secret information file. hour, Only then will things change; Each user maintains their own Merkle tree; user updates to the Merkle tree are recorded in the on-chain log, thus preventing users from trying to interfere with CPGM generation by "poisoning" their own profile. Before establishing CPGM, the smart contract downloads and decrypts the user profile and verifies the correctness of the user profile through the root hash value stored on the chain. The smart contract uniformly performs differential privacy processing on the user profile to provide semantic security for the user's privacy information, thereby preventing the MEC server from identifying the user's identity through the received data as an attacker. After the MEC server receives the image, it... Cartesian product of the elements in U Obtain the prior probability distribution of the identities and secrets of the members of the collaborative group. ( ), used to formulate CPGM; o represents the original query information of member u; S represents the set of secret information of all members in the collaboration group U.

Images