A privacy protection method for location-based services

Abstract

This invention discloses a privacy protection method for location services, applied to a distributed network architecture consisting of several terminal entities, several cloud storage agents, and several cloud computing agents. The method includes the following steps: a security committee generates public and private keys and a system-wide public key for each member and terminal entity; a terminal entity uses the system public key to encrypt acquired location data to obtain location ciphertext and uploads a storage request; a cloud storage agent executes the location storage request and updates the quadtree index; a terminal entity selects a location query range and uses the system public key to encrypt the range query ciphertext; a cloud computing agent performs a range retrieval based on the range query ciphertext and the quadtree index to obtain a set of ciphertext locations; and the cloud computing agent and the security committee collaborate to convert the set of ciphertext locations into ciphertext that the terminal entities can decrypt. This invention enhances the security of data in location services and reduces the storage and query costs of ciphertext location data.

Description

Technical Field

[0001] This invention relates to the field of blockchain technology, and more specifically to a privacy protection method for location services. Background Technology

[0002] Location-based services have permeated all aspects of production and life, covering multiple fields such as social networking, travel, hotels, and integrated lifestyle services, bringing tremendous benefits and convenience to individuals and society. However, the ever-expanding volume of data and increasingly complex business scenarios have greatly increased enterprises' storage, operation and maintenance, and computing costs. With the rise of cloud computing and cloud storage technologies, enterprises and organizations are entrusting applications, data, and services to third-party cloud service providers to reduce business operation costs and data storage costs, and improve the scalability of computing and storage.

[0003] Existing location data privacy protection schemes typically employ techniques such as obfuscation, anonymization, and virtualization to reduce the accuracy of attackers in inferring real location and identity information by perturbing and disguising real location data and user identities. However, current schemes usually focus on protecting the confidentiality of raw data, which greatly limits the applicability and application scenarios of location services, severely restricts the service quality of location-based services, and often neglects the security and trustworthiness of the collaboration process between cloud service agents and users, and between cloud service agents themselves, making them unable to resist malicious collusion and privacy mining by cloud service agents. Summary of the Invention

[0004] The purpose of this invention is to provide a privacy protection method for location services, which combines a multi-key homomorphic encryption algorithm to achieve secure on-chain location query services, resist security risks such as privacy leaks and data abuse of location data, and improve the efficiency and quality of location-based services.

[0005] Technical Solution: The privacy protection method for location services described in this invention is applied to a distributed network architecture consisting of several terminal entities, several cloud storage proxies, and several cloud computing proxies, and includes the following steps:

[0006] (1) Use homomorphic encryption and distributed storage methods to perform public key encryption and consistent storage on real location data;

[0007] (2) Utilize the properties of homomorphic ciphertext operations and key switching methods to execute the user's location query request and return the ciphertext location point result set to the user;

[0008] (3) Construct and maintain the on-chain ciphertext quadtree position index to optimize the efficiency of range retrieval in the ciphertext space;

[0009] In this system, several terminal entities are located in the same map area, and several cloud storage agents and several service computing agents constitute the blockchain maintenance nodes. The blockchain maintenance nodes elect a security committee P. The terminal entities are denoted as DO, the cloud storage agents as SN, and the cloud computing agents as CN.

[0010] Furthermore, step (1) includes the following steps:

[0011] (11) Security Committee P uses homomorphic encryption algorithms to generate unique public and private keys for each security member and terminal entity; each member of Security Committee P jointly generates the system-wide homomorphic encryption public key and publishes it on the blockchain; the homomorphic encryption algorithm is a multi-key fully homomorphic encryption algorithm, including MBFV, MCKKS, MBGV, and MGSW, which supports any number of addition and multiplication operations in the ciphertext space; the security members of the Security Committee are composed of several blockchain maintenance nodes;

[0012] (12) The system-wide homomorphic encryption public key, denoted as PK, is generated from the public and private keys of each member according to the adopted multi-key homomorphic encryption algorithm. mul The system-wide decryption private key does not need to be generated.

[0013] (13) Security members and terminal entities publish their public keys on the blockchain; wherein, publishing on the blockchain means that the blockchain executes the consensus protocol, distributes the on-chain information to each node in the blockchain network, and maintains the consistency of the state of each node.

[0014] (14) The terminal entity DO obtains its own real location data through the terminal positioning function and obtains the homomorphic encryption public key of the system from any node of the blockchain; the terminal positioning function is for the terminal device to obtain the geographical location using GPS, and the real location data is the two-dimensional coordinate point w = (x, y) within the map area;

[0015] (15) The terminal entity DO uses the encryption public key and encryption algorithm to encrypt the real location data to obtain the real location ciphertext, and publishes it on the blockchain; the real location ciphertext is the system's global homomorphic encryption public key PK. mul The two-dimensional position data w is calculated using an encryption algorithm, as shown in the following formula: wc=(E(x),E(y));

[0016] (16) The terminal’s real location ciphertext is published on the blockchain and, after consensus is reached by the blockchain, is stored in the cloud storage agent SN; wherein, the cloud storage agent SN only stores the terminal location ciphertext wc.

[0017] Furthermore, step (2) includes the following steps:

[0018] (21) Before making a location service request, the service requesting terminal entity QU selects a location query range and obtains the system's homomorphic encrypted public key from any node in the blockchain; wherein, the location query range is any rectangular area within the map area, and the coordinates of the lower left and upper right corners of the rectangular area are marked h = (w l,b ,w r,t );

[0019] (22) The service request terminal entity QU uses the encryption public key and encryption algorithm to encrypt the location query range to obtain the range query ciphertext, and publishes it on the blockchain; wherein, the range query ciphertext is the system's global homomorphic encryption public key PK. mul The location query range h is calculated using an encryption algorithm, as follows: h=(E(w l,b ),E(w r,t ));

[0020] (23) The blockchain executes the consensus protocol to reach a consensus. The cloud computing node CN executes the range retrieval algorithm based on the range query ciphertext and the quadtree index. The retrieval result is the location ciphertext set. The range retrieval algorithm recursively determines whether the query range intersects with the rectangular subspaces represented by the nodes at each level of the quadtree in the ciphertext space, and obtains all the real location ciphertexts in the intersecting child nodes. The location ciphertext set is a set of all the real location ciphertexts in each quadtree subspace that intersects with the query range. The location ciphertext set is traversed, and each location point is determined to be within the query range. Location points outside the query range are filtered out to form the final returned location ciphertext set.

[0021] (24) The cloud computing node CN and the security committee P perform collaborative computation to transform the obtained location ciphertext set into a ciphertext result that is decrypted by the service request terminal entity QU, and return the ciphertext result to the service request terminal entity QU; wherein, the collaborative computation is that the security committee P receives the location ciphertext set sent by the cloud computing node CN, obtains the public key of the terminal entity QU from the blockchain, and then re-encrypts the original ciphertext location set into a ciphertext set encrypted with the public key of the terminal entity QU;

[0022] (25) The service request terminal entity QU uses its own private key to decrypt the ciphertext result and obtain the plaintext set of location points within the location query range.

[0023] Further, step (3) is as follows: The cloud storage agent SN constructs a quadtree index based on the map area and the real location ciphertext, calculates the hash value of the quadtree index using a hash function, and publishes it on the blockchain; wherein, the quadtree index is constructed by building each node of the quadtree according to the tree height set by the system, dividing the map area into four rectangular subspaces, and recursively dividing the subspaces at different levels into smaller subspaces until the maximum height; wherein, the nodes at different levels of the quadtree represent different levels of subspaces; the real location ciphertext has any number of addition and multiplication operations under the ciphertext space. The algorithm performs quadtree insertion and query algorithms in the ciphertext space. The child nodes of the quadtree store the ciphertext of their actual locations (wc). The quadtree insertion algorithm starts from the root node, recursively determining the specific node coordinates in the quadtree where a two-dimensional location point should be inserted, and storing the location point in that node. The quadtree query algorithm starts from the root node, recursively determining whether the query range intersects with the rectangular subspaces represented by nodes at each level of the quadtree in the ciphertext space, and obtaining the ciphertext of all actual locations in the intersecting child nodes. Hash functions include SHA-2 and SHA-3.

[0024] The privacy protection system for location services described in this invention includes:

[0025] Encryption and storage module: Used to perform public-key encryption and consistent storage of real location data using homomorphic encryption and distributed storage methods;

[0026] Query module: Used to execute the user's location query request by utilizing the properties of homomorphic ciphertext operation and key switching method, and return the set of ciphertext location points to the user;

[0027] Index module: Used to build and maintain the on-chain ciphertext quadtree position index, optimizing the efficiency of range retrieval in the ciphertext space;

[0028] The privacy protection system is a distributed network architecture consisting of several terminal entities, several cloud storage agents, and several cloud computing agents. Several terminal entities are located in the same map area, and several cloud storage agents and several service computing agents constitute the blockchain maintenance nodes. The blockchain maintenance nodes elect a security committee P. The terminal entities are denoted as DO, the cloud storage agents as SN, and the cloud computing agents as CN.

[0029] Furthermore, the encryption and storage module includes the following steps:

[0030] (11) Security Committee P uses homomorphic encryption algorithms to generate unique public and private keys for each security member and terminal entity; each member of Security Committee P jointly generates the system-wide homomorphic encryption public key and publishes it on the blockchain; the homomorphic encryption algorithm is a multi-key fully homomorphic encryption algorithm, including MBFV, MCKKS, MBGV, and MGSW, which supports any number of addition and multiplication operations in the ciphertext space; the security members of the Security Committee are composed of several blockchain maintenance nodes;

[0031] (12) The system-wide homomorphic encryption public key, denoted as PK, is generated from the public and private keys of each member according to the adopted multi-key homomorphic encryption algorithm. mul The system-wide decryption private key does not need to be generated.

[0032] (13) Security members and terminal entities publish their public keys on the blockchain; wherein, publishing on the blockchain means that the blockchain executes the consensus protocol, distributes the on-chain information to each node in the blockchain network, and maintains the consistency of the state of each node.

[0033] (14) The terminal entity DO obtains its own real location data through the terminal positioning function and obtains the homomorphic encryption public key of the system from any node of the blockchain; the terminal positioning function is for the terminal device to obtain the geographical location using GPS, and the real location data is the two-dimensional coordinate point w = (x, y) within the map area;

[0034] (15) The terminal entity DO uses the encryption public key and encryption algorithm to encrypt the real location data to obtain the real location ciphertext, and publishes it on the blockchain; the real location ciphertext is the system's global homomorphic encryption public key PK. mul The two-dimensional position data w is calculated using an encryption algorithm, as shown in the following formula: wc=(E(x),E(y));

[0035] (16) The terminal’s real location ciphertext is published on the blockchain and, after consensus is reached by the blockchain, is stored in the cloud storage agent SN; wherein, the cloud storage agent SN only stores the terminal location ciphertext wc.

[0036] Furthermore, the query module includes the following steps:

[0037] (21) Before making a location service request, the service requesting terminal entity QU selects a location query range and obtains the system's homomorphic encrypted public key from any node in the blockchain; wherein, the location query range is any rectangular area within the map area, and the coordinates of the lower left and upper right corners of the rectangular area are marked h = (w l,b ,w r,t );

[0038] (22) The service request terminal entity QU uses the encryption public key and encryption algorithm to encrypt the location query range to obtain the range query ciphertext, and publishes it on the blockchain; wherein, the range query ciphertext is the system's global homomorphic encryption public key PK. mul The location query range h is calculated using an encryption algorithm, and the formula is as follows: hc=(E(w l,b ),E(w r,t ));

[0039] (23) The blockchain executes the consensus protocol to reach a consensus. The cloud computing node CN executes the range retrieval algorithm based on the range query ciphertext and the quadtree index. The retrieval result is the location ciphertext set. The range retrieval algorithm recursively determines whether the query range intersects with the rectangular subspaces represented by the nodes at each level of the quadtree in the ciphertext space, and obtains all the real location ciphertexts in the intersecting child nodes. The location ciphertext set is a set of all the real location ciphertexts in each quadtree subspace that intersects with the query range. The location ciphertext set is traversed, and each location point is determined to be within the query range. Location points outside the query range are filtered out to form the final returned location ciphertext set.

[0040] (24) The cloud computing node CN and the security committee P perform collaborative computation to transform the obtained location ciphertext set into a ciphertext result that is decrypted by the service request terminal entity QU, and return the ciphertext result to the service request terminal entity QU; wherein, the collaborative computation is that the security committee P receives the location ciphertext set sent by the cloud computing node CN, obtains the public key of the terminal entity QU from the blockchain, and then re-encrypts the original ciphertext location set into a ciphertext set encrypted with the public key of the terminal entity QU;

[0041] (25) The service request terminal entity QU uses its own private key to decrypt the ciphertext result and obtain the plaintext set of location points within the location query range.

[0042] Furthermore, in the index module, the specific steps are as follows: The cloud storage agent SN constructs a quadtree index based on the map region and the encrypted real location, calculates the hash value of the quadtree index using a hash function, and publishes it on the blockchain. The quadtree index is constructed by building the nodes of the quadtree according to the system-defined tree height, dividing the map region into four rectangular subspaces, and recursively dividing the subspaces at different levels into smaller subspaces until the maximum height is reached. Nodes at different levels of the quadtree represent different levels of subspaces. The encrypted real location allows for any number of addition and multiplication operations within the encrypted space. The algorithm performs quadtree insertion and query algorithms in the ciphertext space. The child nodes of the quadtree store the ciphertext of their actual locations (wc). The quadtree insertion algorithm starts from the root node, recursively determining the specific node coordinates in the quadtree where a two-dimensional location point should be inserted, and storing the location point in that node. The quadtree query algorithm starts from the root node, recursively determining whether the query range intersects with the rectangular subspaces represented by nodes at each level of the quadtree in the ciphertext space, and obtaining the ciphertext of all actual locations in the intersecting child nodes. Hash functions include SHA-2 and SHA-3.

[0043] An electronic device according to the present invention includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements any of the location-based service privacy protection methods described above.

[0044] The present invention provides a storage medium storing a computer program, which, when executed by a processor, implements any of the location-based service privacy protection methods described herein.

[0045] Beneficial Effects: Compared with existing technologies, this invention has the following significant advantages: It utilizes blockchain technology for distributed storage of location data, reducing the storage pressure on individual cloud service agents and protecting the privacy of location data. Simultaneously, it employs homomorphic encryption to implement encrypted location query services. The cloud service agent calculates the retrieval results using encrypted location data and encrypted query requests, avoiding privacy leaks in location queries and effectively ensuring the security of the query process. Furthermore, this method uses an encrypted quadtree index to accelerate the query process, significantly reducing the computational cost of range retrieval and facilitating the handling of query services for large-scale location sets. Attached Figure Description

[0046] Figure 1 This is a schematic diagram of the method of the present invention;

[0047] Figure 2 This is a schematic diagram of the entity model of the location service architecture of the present invention;

[0048] Figure 3This is a schematic diagram of the structure of the location data index in the two-dimensional region according to the present invention;

[0049] Figure 4 This is a schematic diagram illustrating the range retrieval process of the present invention. Detailed Implementation

[0050] The technical solution of the present invention will be further described below with reference to the accompanying drawings.

[0051] like Figure 1 As shown, this embodiment of the invention provides a blockchain privacy protection method for location services. It employs the traditional MBFV multi-key homomorphic encryption algorithm, selecting system security parameters log2N = 14 and log2QP = 438 to achieve 128-bit security. The method includes the following steps:

[0052] Step 100: Select p blockchain maintenance nodes to form a security committee P. Based on the system security parameters, use the MBFV key generation algorithm to generate unique public and private keys for each member and terminal entity. All members jointly generate a system-wide homomorphic encrypted public key and publish it on the blockchain. The private key of each member of the security committee is denoted as SK = {SK...} i The public key is denoted as PK = {PK}, i ∈ [1, p]}. i ,i∈[1,p]};The terminal entity consists of several users, and the public and private keys of any terminal entity are denoted as SK. u and PK u The system's global encryption public key is denoted as PK. mul ;

[0053] like Figure 2 As shown, the system model includes a blockchain system, a security committee, and user terminal entities. Within the blockchain system, the maintenance nodes can consist of two types of nodes: cloud storage nodes and cloud computing nodes. These cloud storage nodes and cloud service nodes can respectively form different types of service clusters. The cloud storage and cloud computing service clusters can each include at least one cloud storage node or cloud computing node. For example, Figure 1 The cloud storage cluster shown includes cloud storage node 1, cloud storage node 2 and cloud storage node 3, and the cloud computing cluster includes cloud computing node 1, cloud computing node 2 and cloud computing node 3.

[0054] A security committee can be composed of maintenance nodes of the blockchain system and equipment from other authoritative bodies; for example, Figure 1 The security committee shown includes devices 1 and 4 from authoritative institutions, and devices 2 and 3 from blockchain system maintenance nodes; each device in the security committee is responsible for collaborating with the blockchain system and user terminals to perform calculations and jointly realize privacy queries for location services.

[0055] User terminal entities can include various types of smart devices; for example, they can include mobile terminal devices, Internet of Things (IoT) devices, portable host devices, and other forms of smart devices with positioning and computing capabilities; for example, Figure 1 The user terminal entities shown include portable host devices 1 and 4, and smartphone devices 2 and 3. Each device in the user terminal entity can upload encrypted information of its real location to the blockchain system through the positioning function, and can also send location service query requests to the blockchain system, as well as collaboratively obtain information such as location query results.

[0056] Step 110: First, the terminal entity DO obtains its own real location data w = (x, y) through the GPS positioning function of the mobile device; second, the terminal entity DO obtains the system's encrypted public key PK from the blockchain. mul The real location data w is encrypted using the MBFV encryption algorithm, and the location ciphertext E(w) = (E(x), E(y)) is calculated. Finally, the terminal entity DO generates a storage request for the location ciphertext E(w) and sends it to the blockchain.

[0057] Step 120: First, the blockchain maintenance node collects transaction requests, verifies their legality, packages them into new blocks, and executes the consensus protocol; second, the cloud storage agent SN persistently stores the location ciphertext E(w) locally and updates the ciphertext quadtree position index T; finally, the hash value of the updated quadtree is calculated using the SHA-256 hash function, denoted as H(T), and uploaded to the blockchain for consensus.

[0058] like Figure 3 The diagram shows the structure of a location data index in a two-dimensional region. First, the map region is determined; if the map region is not rectangular, it is padded to a rectangle. Second, based on the actual map region size, a suitable quadtree height d = 3 is selected. Then, the rectangular map region is equally divided into 2... d Each subspace is used to construct a quadtree T based on its height d, and its subspaces are denoted as T1, ..., T4, T5 according to their levels. 11 ,T 12 ,…,T 44 etc. Among them, 2 d The leaf nodes of the quadtree are composed of the smallest subspaces, and the subspaces represented by the child nodes at each level increase exponentially from low to high. Next, the cloud storage agent SN receives the ciphertexts E(w1), E(w2), and E(w3) for locations w1, w2, and w3. Then, for location E(w1), the cloud storage agent SN starts judging from the highest-level child node of the quadtree T. Since the rectangular subspace represented by the current child node T1 covers E(w1), it continues to traverse all the next-level child nodes T1 contained in the child node T1. 11 ,T12 ,T 13 ,T 14 Repeat this process until the leaf node of the quadtree is reached, and finally insert E(w1) into the leaf node T. 14 The same operation is performed on the remaining ciphertext locations E(w2) and E(w3) to finally build a ciphertext quadtree index. When a range search is required, only the child nodes that intersect with the query range need to be searched.

[0059] Step 130: First, the service requesting terminal entity QU selects a rectangular query range h = (w) within the map area. l,b ,w r,t ), where w l,b and w r,t These represent the bottom-left and top-right coordinates of the query range, respectively; the service request terminal entity QU obtains the system's encrypted public key PK from the blockchain. mul The location query range h is encrypted using the MBFV encryption algorithm, and the range query ciphertext E(h) = (E(w)) is calculated. l,b ),E(w r,t The service request terminal entity QU generates a query request with a ciphertext range E(h) and sends it to the blockchain.

[0060] Step 140: First, the blockchain maintenance node collects query requests, verifies their legitimacy, packages them into new blocks, and executes the consensus protocol; the cloud computing node CN obtains the range query ciphertext E(h) and executes the range retrieval algorithm under the ciphertext on the ciphertext quadtree index T to calculate the set of ciphertext position points R for range retrieval.

[0061] like Figure 4 The diagram illustrates the process of performing a range search on a ciphertext quadtree based on the ciphertext query range. First, the cloud computing node CN determines the validity of the query range E(h). If the query range exceeds the map area, no processing is performed, and an exception message is returned. If the query range is valid, the root node is added to the filtering queue, awaiting range search execution. In the quadtree, all child nodes of the current node are added to the filtering queue. All nodes in the current filtering queue are traversed, and each node is checked for intersection with the query range E(h), with filtered nodes removed from the filtering queue. If the current node intersects with the query range, it is added to the filtering queue; otherwise, it is skipped. This process is repeated until the nodes in the filtering queue are leaf nodes of the quadtree. All leaf nodes in the filtering queue are traversed, and each ciphertext location point contained within a leaf node is checked for inclusion within the query range E(h). If the current location point is included in the query range, it is added to the ciphertext location point result set; otherwise, it is skipped. The ciphertext location point result set is returned.

[0062] Step 150: First, the cloud computing node CN obtains the public key PK owned by the terminal entity that initiated the query request from the blockchain. u The service requesting terminal entity QU will automatically possess the public key PK. u The cloud computing node CN sends the identity identifier of the service request terminal entity QU to the security committee P, and the security committee P obtains the public key PK of the terminal entity QU from the blockchain. u The cloud computing node CN will use the public key PK of the service request terminal entity QU. u The encrypted result set R of the range search is sent to the security committee P; the members of the security committee P jointly execute the key switching algorithm of MBFV, and input the private key set SK of the security committee P and the public key PK of the service request terminal entity QU. u The ciphertext set R is retrieved within a range; multiple parties jointly execute the MBFV key switching algorithm to calculate the re-encrypted ciphertext set R′ of ciphertext set R, where R′ is equivalent to QU using the public key PK. u The plaintext result set of the range search is encrypted using the MBFV encryption algorithm; the security committee P sends the re-encrypted ciphertext result set R′ to the cloud computing node CN, which then returns the range search ciphertext set R′ to the service requesting terminal entity QU; the security committee P directly sends the re-encrypted ciphertext result set R′ to the service requesting terminal entity QU and returns a successful execution response message to the cloud computing node CN; the service requesting terminal entity QU uses its own private key SK. u The MBFV decryption algorithm is executed on the range retrieval ciphertext set R′ to calculate the set of all location points within the map area covered by the query range h.

[0063] This invention also provides a location-based service-oriented privacy protection system, comprising:

[0064] Encryption and Storage Module: Used to perform public-key encryption and consistent storage of real location data using homomorphic encryption and distributed storage methods; including the following steps:

[0065] (11) Security Committee P uses homomorphic encryption algorithms to generate unique public and private keys for each security member and terminal entity; each member of Security Committee P jointly generates the system-wide homomorphic encryption public key and publishes it on the blockchain; the homomorphic encryption algorithm is a multi-key fully homomorphic encryption algorithm, MBFV, MCKKS, MBGV, MGSW, which supports any number of addition and multiplication operations in the ciphertext space; the security members of the Security Committee are composed of several blockchain maintenance nodes;

[0066] (12) The system-wide homomorphic encryption public key, denoted as PK, is generated from the public and private keys of each member according to the adopted multi-key homomorphic encryption algorithm. mul The system-wide decryption private key does not need to be generated.

[0067] (13) Security members and terminal entities publish their public keys on the blockchain; wherein, publishing on the blockchain means that the blockchain executes the consensus protocol, distributes the on-chain information to each node in the blockchain network, and maintains the consistency of the state of each node.

[0068] (14) The terminal entity DO obtains its own real location data through the terminal positioning function and obtains the homomorphic encryption public key of the system from any node of the blockchain; the terminal positioning function is for the terminal device to obtain the geographical location using GPS, and the real location data is the two-dimensional coordinate point w = (x, y) within the map area;

[0069] (15) The terminal entity DO uses the encryption public key and encryption algorithm to encrypt the real location data to obtain the real location ciphertext, and publishes it on the blockchain; the real location ciphertext is the system's global homomorphic encryption public key PK. mul The two-dimensional position data w is calculated using an encryption algorithm, as shown in the following formula: wc=(E(x),E(y));

[0070] (16) The terminal’s real location ciphertext is published on the blockchain and, after consensus is reached by the blockchain, is stored in the cloud storage agent SN; wherein, the cloud storage agent SN only stores the terminal location ciphertext wc.

[0071] Query module: Used to execute user location query requests by leveraging homomorphic ciphertext operations and key switching methods, and return a set of ciphertext location points to the user; includes the following steps:

[0072] (21) Before making a location service request, the service requesting terminal entity QU selects a location query range and obtains the system's homomorphic encrypted public key from any node in the blockchain; wherein, the location query range is any rectangular area within the map area, and the coordinates of the lower left and upper right corners of the rectangular area are marked h = (w l,b ,w r,t );

[0073] (22) The service request terminal entity QU uses the encryption public key and encryption algorithm to encrypt the location query range to obtain the range query ciphertext, and publishes it on the blockchain; wherein, the range query ciphertext is the system's global homomorphic encryption public key PK. mul The location query range h is calculated using the encryption algorithm, as shown in the following formula:

[0074] hc=(E(w l,b ),E(w r,t ));

[0075] (23) The blockchain executes the consensus protocol to reach a consensus. The cloud computing node CN executes the range retrieval algorithm based on the range query ciphertext and the quadtree index. The retrieval result is the location ciphertext set. The range retrieval algorithm recursively determines whether the query range intersects with the rectangular subspaces represented by the nodes at each level of the quadtree in the ciphertext space, and obtains all the real location ciphertexts in the intersecting child nodes. The location ciphertext set is a set of all the real location ciphertexts in each quadtree subspace that intersects with the query range. The location ciphertext set is traversed, and each location point is determined to be within the query range. Location points outside the query range are filtered out to form the final returned location ciphertext set.

[0076] (24) The cloud computing node CN and the security committee P perform collaborative computation to transform the obtained location ciphertext set into a ciphertext result that is decrypted by the service request terminal entity QU, and return the ciphertext result to the service request terminal entity QU; wherein, the collaborative computation is that the security committee P receives the location ciphertext set sent by the cloud computing node CN, obtains the public key of the terminal entity QU from the blockchain, and then re-encrypts the original ciphertext location set into a ciphertext set encrypted with the public key of the terminal entity QU;

[0077] (25) The service request terminal entity QU uses its own private key to decrypt the ciphertext result and obtain the plaintext set of location points within the location query range.

[0078] Index Module: Used to build and maintain the on-chain ciphertext quadtree location index, optimizing the efficiency of range retrieval within the ciphertext space; specifically: The cloud storage agent SN constructs a quadtree index based on the map region and the real location ciphertext, calculates the hash value of the quadtree index using a hash function, and publishes it on the chain; the quadtree index is constructed by building the nodes of the quadtree according to the tree height set by the system, dividing the map region into four rectangular subspaces, and recursively dividing the subspaces at different levels into smaller subspaces until the maximum height; the nodes at different levels of the quadtree represent different levels of subspaces; the real location ciphertext has a ciphertext... The algorithm performs arbitrary addition and multiplication operations in the ciphertext space, and executes quadtree insertion and query algorithms in the ciphertext space. The child nodes of the quadtree store the ciphertext of their true locations (wc). The quadtree insertion algorithm starts from the root node, recursively determining the specific node coordinates in the quadtree where a two-dimensional location point should be inserted, and storing the location point in that node. The quadtree query algorithm starts from the root node, recursively determining whether the query range intersects with the rectangular subspaces represented by nodes at each level of the quadtree in the ciphertext space, and obtaining the ciphertext of all true locations in the intersecting child nodes. Hash functions include SHA-2 and SHA-3.

[0079] The privacy protection system is a distributed network architecture consisting of several terminal entities, several cloud storage agents, and several cloud computing agents. Several terminal entities are located in the same map area, and several cloud storage agents and several service computing agents constitute the blockchain maintenance nodes. The blockchain maintenance nodes elect a security committee P. The terminal entities are denoted as DO, the cloud storage agents as SN, and the cloud computing agents as CN.

[0080] This invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded onto the processor, it implements any of the location-based service privacy protection methods described above.

[0081] This invention also provides a storage medium storing a computer program that, when executed by a processor, implements any of the location-based service privacy protection methods described above.

Claims

1. A location-based service-oriented privacy protection method, applied to a distributed network architecture consisting of several terminal entities, several cloud storage proxies, and several cloud computing proxies, characterized in that, Includes the following steps: (1) Using homomorphic encryption and distributed storage methods, public key encryption and consistent storage are performed on real location data; (2) Using the properties of homomorphic ciphertext operation and key switching method, execute the user's location query request and return the set of ciphertext location points to the user; (3) Construct and maintain the on-chain ciphertext quadtree position index to optimize the efficiency of range retrieval in the ciphertext space; In this system, several terminal entities are located in the same map area, and several cloud storage agents and several service computing agents constitute the blockchain maintenance nodes. The blockchain maintenance nodes elect a security committee P. The terminal entities are denoted as DO, the cloud storage agents as SN, and the cloud computing nodes as CN.

2. The privacy protection method for location-based services according to claim 1, characterized in that, Step (1) includes the following steps: (11) Security Committee P uses homomorphic encryption algorithms to generate unique public and private keys for each security member and terminal entity; each member of Security Committee P jointly generates the system-wide homomorphic encryption public key and publishes it on the blockchain; the homomorphic encryption algorithm is a multi-key fully homomorphic encryption algorithm, including MBFV, MCKKS, MBGV, and MGSW, which supports any number of addition and multiplication operations in the ciphertext space; the security members of the Security Committee are composed of several blockchain maintenance nodes; (12) A global homomorphic encryption public key is generated from the public and private keys of each member using the adopted multi-key homomorphic encryption algorithm, denoted as . The system-wide decryption private key does not need to be generated. (13) Security members and terminal entities publish their public keys on the blockchain; among them, publishing on the blockchain is the blockchain executing consensus protocol, distributing on-chain information to various nodes in the blockchain network, and maintaining the consistency of the state of each node; (14) The terminal entity DO obtains its own real location data through the terminal positioning function and obtains the homomorphic encryption public key of the system from any node of the blockchain; the terminal device uses GPS to obtain the geographical location to realize the terminal positioning function, and the real location data is two-dimensional coordinate points within the map area. ; (15) The terminal entity DO uses the encryption public key and encryption algorithm to encrypt the real location data to obtain the real location ciphertext, and publishes it on the blockchain; the real location ciphertext is the system's global homomorphic encryption public key. Two-dimensional coordinate points are encrypted using an encryption algorithm. Calculations show that ; (16) The encrypted location of the terminal is published on the blockchain and, after consensus is reached by the blockchain, is stored in the cloud storage agent SN; wherein, the cloud storage agent SN only stores the encrypted location of the terminal. .

3. The privacy protection method for location-based services according to claim 1, characterized in that, Step (2) includes the following steps: (21) Before making a location service request, the service requesting terminal entity DO selects a location query range and obtains the system's homomorphic encryption public key from any node in the blockchain; wherein, the location query range is any rectangular range within the map area, and the coordinates of the lower left and upper right corners of the rectangular range are marked. ; (22) The service request terminal entity DO uses the encryption public key and encryption algorithm to encrypt the location query range to obtain the range query ciphertext, and publishes it on the blockchain; wherein, the range query ciphertext is the system's global homomorphic encryption public key. Location query range is determined using an encryption algorithm. The calculation yields the following formula: ; The execution range retrieval algorithm is used to obtain the location ciphertext set. The range retrieval algorithm recursively determines whether the query range intersects with the rectangular subspaces represented by the nodes at each level of the quadtree in the ciphertext space, and obtains all the real location ciphertexts in the intersecting child nodes. The location ciphertext set is a set of all the real location ciphertexts in each quadtree subspace that intersects with the query range. The location ciphertext set is traversed, and each location point is determined to be within the query range. Location points outside the query range are filtered out to form the final returned location ciphertext set. (24) The cloud computing node CN and the security committee P perform collaborative computation to transform the obtained location ciphertext set into a ciphertext result decrypted by the service request terminal entity DO, and return the ciphertext result to the service request terminal entity DO; wherein, the collaborative computation is that the security committee P receives the location ciphertext set sent by the cloud computing node CN, obtains the public key of the terminal entity DO from the blockchain, and then re-encrypts the original ciphertext location set into a ciphertext set encrypted with the public key of the terminal entity DO; (25) The service request terminal entity DO uses its own private key to decrypt the ciphertext result and obtain the plaintext set of location points within the location query range.

4. The privacy protection method for location-based services according to claim 1, characterized in that, Step (3) is as follows: The cloud storage agent SN constructs a quadtree index based on the map area and the encrypted real location, calculates the hash value of the quadtree index using a hash function, and publishes it on the blockchain; wherein, the quadtree index is constructed by building the nodes of the quadtree according to the tree height set by the system, dividing the map area into four rectangular subspaces, and recursively dividing the subspaces at different levels into smaller subspaces until the maximum height; wherein, the nodes at different levels of the quadtree represent different levels of subspaces; the encrypted real location has the property of arbitrary addition and multiplication operations under the encrypted space, and the quadtree insertion algorithm and quadtree query algorithm are executed under the encrypted space; wherein, the child nodes of the quadtree store the encrypted real location. The quadtree insertion algorithm starts from the root node, recursively determines the specific node coordinates in the quadtree where a two-dimensional position point should be inserted, and stores the position point in that node; the quadtree query algorithm starts from the root node, recursively determines whether the query range intersects with the rectangular subspaces represented by the nodes at each level of the quadtree in the ciphertext space, and obtains the ciphertext of all real positions in the intersecting child nodes; hash functions include SHA-2 and SHA-3.

5. A privacy protection system for location services, characterized in that, include: Encryption and storage module: Used to perform public-key encryption and consistent storage of real location data using homomorphic encryption and distributed storage methods; Query module: Used to execute the user's location query request by utilizing the properties of homomorphic ciphertext operation and key switching method, and return the set of ciphertext location points to the user; Index module: Used to build and maintain the on-chain ciphertext quadtree position index, optimizing the efficiency of range retrieval in the ciphertext space; The privacy protection system is a distributed network architecture consisting of several terminal entities, several cloud storage agents, and several cloud computing agents. Several terminal entities are located in the same map area. Several cloud storage agents and several service computing agents constitute the blockchain maintenance nodes. The blockchain maintenance nodes elect a security committee P. The terminal entities are denoted as DO, the cloud storage agents as SN, and the cloud computing nodes as CN.

6. A location-based service-oriented privacy protection system according to claim 5, characterized in that, The encryption and storage module includes the following steps: (11) Security Committee P uses homomorphic encryption algorithms to generate unique public and private keys for each security member and terminal entity; each member of Security Committee P jointly generates the system-wide homomorphic encryption public key and publishes it on the blockchain; the homomorphic encryption algorithm is a multi-key fully homomorphic encryption algorithm, including MBFV, MCKKS, MBGV, and MGSW, which supports any number of addition and multiplication operations in the ciphertext space; the security members of the Security Committee are composed of several blockchain maintenance nodes; (12) A global homomorphic encryption public key is generated from the public and private keys of each member using the adopted multi-key homomorphic encryption algorithm, denoted as . The system-wide decryption private key does not need to be generated. (13) Security members and terminal entities publish their public keys on the blockchain; among them, publishing on the blockchain is the blockchain executing consensus protocol, distributing on-chain information to various nodes in the blockchain network, and maintaining the consistency of the state of each node; (14) The terminal entity DO obtains its own real location data through the terminal positioning function and obtains the homomorphic encryption public key of the system from any node of the blockchain; the terminal device uses GPS to obtain the geographical location to realize the terminal positioning function, and the real location data is two-dimensional coordinate points within the map area. ; (15) The terminal entity DO uses the encryption public key and encryption algorithm to encrypt the real location data to obtain the real location ciphertext, and publishes it on the blockchain; the real location ciphertext is the system's global homomorphic encryption public key. Two-dimensional coordinate points are encrypted using an encryption algorithm. The calculation yields the following formula: ; (16) The encrypted location of the terminal is published on the blockchain and, after consensus is reached by the blockchain, is stored in the cloud storage agent SN; wherein, the cloud storage agent SN only stores the encrypted location of the terminal. .

7. A location-based service-oriented privacy protection system according to claim 5, characterized in that, The query module includes the following steps: (21) Before making a location service request, the service requesting terminal entity DO selects a location query range and obtains the system's homomorphic encryption public key from any node in the blockchain; wherein, the location query range is any rectangular range within the map area, and the coordinates of the lower left and upper right corners of the rectangular range are marked. ; (22) The service request terminal entity DO uses the encryption public key and encryption algorithm to encrypt the location query range to obtain the range query ciphertext, and publishes it on the blockchain; wherein, the range query ciphertext is the system's global homomorphic encryption public key. Location query range is determined using an encryption algorithm. The calculation yields the following formula: ; (23) The blockchain executes the consensus protocol to reach a consensus. The cloud computing node CN executes the range retrieval algorithm based on the range query ciphertext and the quadtree index. The retrieval result is the location ciphertext set. The range retrieval algorithm recursively determines whether the query range intersects with the rectangular subspaces represented by the nodes at each level of the quadtree in the ciphertext space, and obtains all the real location ciphertexts in the intersecting child nodes. The location ciphertext set is a set of all the real location ciphertexts in each quadtree subspace that intersects with the query range. The location ciphertext set is traversed, and each location point is determined to be within the query range. Location points outside the query range are filtered out to form the final returned location ciphertext set. (24) The cloud computing node CN and the security committee P perform collaborative computation to transform the obtained location ciphertext set into a ciphertext result decrypted by the service request terminal entity DO, and return the ciphertext result to the service request terminal entity DO; wherein, the collaborative computation is that the security committee P receives the location ciphertext set sent by the cloud computing node CN, obtains the public key of the terminal entity QU from the blockchain, and then re-encrypts the original ciphertext location set into a ciphertext set encrypted by the public key of the terminal entity DO; (25) The service request terminal entity DO uses its own private key to decrypt the ciphertext result and obtain the plaintext set of location points within the location query range.

8. A location-based service-oriented privacy protection system according to claim 5, characterized in that, In the index module, the specific steps are as follows: The cloud storage agent SN constructs a quadtree index based on the map region and the encrypted real location. A hash function is used to calculate the hash value of the quadtree index, which is then published on the blockchain. The quadtree index is constructed by building the nodes of the quadtree according to the system-defined tree height, dividing the map region into four rectangular subspaces, and recursively dividing the subspaces at different levels into smaller subspaces until the maximum height is reached. Nodes at different levels of the quadtree represent different levels of subspaces. The encrypted real location has the property of performing any number of addition and multiplication operations within the encrypted space, and quadtree insertion and query algorithms are executed within the encrypted space. The child nodes of the quadtree store the encrypted real location. The quadtree insertion algorithm starts from the root node, recursively determines the specific node coordinates in the quadtree where a two-dimensional position point should be inserted, and stores the position point in that node; the quadtree query algorithm starts from the root node, recursively determines whether the query range intersects with the rectangular subspaces represented by the nodes at each level of the quadtree in the ciphertext space, and obtains the ciphertext of all real positions in the intersecting child nodes; hash functions include SHA-2 and SHA-3.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements a privacy protection method for location-oriented services according to any one of claims 1-4.

10. A storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements a privacy protection method for location-oriented services according to any one of claims 1-4.

Images