A region counting query method and system based on hybrid differential privacy

Abstract

The present invention relates to a region counting query method and system based on hybrid differential privacy, and belongs to the field of data security technology. The method includes: the user calculates the disturbance parameters according to the user's location, the size of the sub-region where he is located, and the privacy budget, and uploads the disturbed location information to the sub-location collection center corresponding to the sub-region where the user is located according to the disturbance parameters; the sub-location collection center counts the number of users in the sub-region under its jurisdiction and performs disturbance protection, and uploads the disturbed sub-region count value to the main location collection center; the main location collection center performs a legality check and correction on the disturbed sub-region count values ​​uploaded by each sub-location collection center, and provides a region counting query service to the outside. This method protects the user's location privacy, improves the accuracy of the query result, and can provide a high-precision region counting query service to the querying user.

Description

Technical Field

[0001] The present invention belongs to the field of data security technology, and in particular relates to a region counting query method and system based on hybrid differential privacy. Background Art

[0002] With the rapid development of the Internet of Things and big data technology, data collection and use are becoming more and more common, and the value of data is also increasing. Among them, two-dimensional location data is closely related to human daily life. Many interactions with the Internet in people's daily life will generate two-dimensional location data. For example, logging on to major websites anytime and anywhere, turning on navigation while driving a vehicle, downloading or uploading files, and even checking the weather will inadvertently generate location information. Statistical analysis of these two-dimensional location data provides a strong analytical basis for commercial decision-making. And statistics on the number of users in a certain area based on the collected location data is a very common data analysis method. However, once location data is obtained and used by criminals, unpredictable consequences will occur. For example, using the information of ordinary users getting on and off the bus is enough to find all the personal information of these people from the GPS route. In the highly informationized global village, this public information is no longer just for scientists. The re-mining of these public data has gradually caused people to be vigilant about the exposure of privacy. Therefore, how to use two-dimensional location data to the greatest extent while ensuring data privacy is an inevitable requirement for the safe and efficient analysis and use of location data.

[0003] The differential privacy model is based on rigorous mathematical theory. It can provide quantifiable privacy guarantees for data under the condition that the attacker has the most background knowledge. It has become the mainstream privacy protection model today. Its main idea is to perturb the original data set so that the calculation results on the data set are less sensitive to the changes in a specific record, thereby resisting differential attacks and protecting individual information in the data set. Common types of differential privacy include localized differential privacy and centralized differential privacy. Localized differential privacy is that the user perturbs the data locally and then sends it to the data collector for analysis and use. There are often problems such as excessive perturbation and low data availability. Centralized differential privacy assumes a trusted data collector. After the user directly sends the original data to the collector, the collector analyzes the original data and then perturbs the analysis results. This type of differential privacy can ensure that the data maintains a relatively high availability, but the data collector may not be completely trustworthy. If the user data is leaked by the collector, it will cause serious user privacy security issues. Summary of the invention

[0004] The main purpose of the present invention is to overcome the shortcomings and deficiencies of the prior art and to provide a region counting query method and system based on hybrid differential privacy, which protects the user's location privacy, improves the accuracy of the query results, and can provide a higher-precision region counting query service to the querying user.

[0005] According to one aspect of the present invention, the present invention provides a region counting query method based on hybrid differential privacy, the method comprising the following steps:

[0006] S1: The user calculates perturbation parameters according to his / her location, the size of the sub-region he / she is in, and the privacy budget. According to the perturbation parameters, the user's perturbed location information is calculated based on localized differential privacy, and the perturbed location information is uploaded to the sub-location collection center corresponding to the sub-region where the user is located; wherein the total region where the user is located is divided into multiple sub-regions, each sub-region is provided with a sub-location collection center, and the total region is provided with a total location collection center;

[0007] S2: The sub-location collection center performs a legitimacy check on the location information uploaded by users in the received sub-area. After completing the legitimacy check, it counts the number of users in the sub-area under its jurisdiction, and adds Laplace noise to the number of users for disturbance protection based on centralized differential privacy, obtains the sub-area count value after disturbance, and uploads the sub-area count value after disturbance to the main location collection center;

[0008] S3: The total location collection center performs a legitimacy check on the disturbed sub-area count values ​​uploaded by each sub-location collection center, processes and corrects illegal data, and corrects count values ​​less than zero to zero; the total location collection center provides external regional count query services, performs query calculations based on the received query range, and returns the query value to the inquirer to complete the query.

[0009] Preferably, the disturbance parameter is the center point c(x c ,y c ) and c(x c ,y c ) is the center, and the side length w of the square area that minimizes the expected value of the mean square error between the original point and the perturbation point;

[0010]

[0011] The original coordinates of the user are (x, y) and the sub-area is D j , the range is [DX1, DX2] × [DY1, DY2], and the sub-area D j The coordinate transformation is [-X, X] × [-Y, Y],

[0012] Preferably, the user uploading the disturbed location information to the sub-location collection center corresponding to the sub-area where the user is located includes:

[0013] The user randomly generates a disturbed position point of the user in the area according to the disturbance parameters, restores the disturbed position point to the original coordinate system, and uploads the restored coordinates to the sub-location collection center corresponding to the area where the user is located.

[0014] Preferably, the sub-location collection center uploading the disturbed sub-area count value to the main location collection center comprises:

[0015] After the location collection center completes the collection of user location coordinates within the jurisdiction and the legitimacy check, it counts the number of recorded data as the original count value count of the area and records it;

[0016] The location collection center adds Laplace noise Laplace to the original count value count to obtain the noise count count′=count+Laplace(1 / ε), where Laplace(1 / ε) is a random number generated by the Laplace distribution conforming to (0, 1 / ε), and ε is a parameter;

[0017] The sub-location collection center records the noise count count′ and the generated random noise value Laplace(1 / ε), and sends the noise count count′ to the main location collection center TCenter.

[0018] Preferably, the total location collection center provides an area count query service to the outside, performs query calculation according to the received query range, and returns the query value to the queryer to complete the query, including:

[0019] The total location collection center receives a query request sent by a query user, wherein the query request includes a query area range Q, where Q is a rectangular area [Qx1, Qx2]×[Qy1, Qy2];

[0020] The total location collection center initializes the query value QueryValue = 0, traverses the count value set CountSet, and for each element in CountSet [D j , count′ j ],like Skip this area if Q∩D j =D j , update query value QueryValue = QueryValue + count′ j , otherwise, proceed to the next step;

[0021] The general location collection center sends the query request to the sub-location collection center SCenter corresponding to the current sub-areaj , SCenter j After receiving the request, calculate the count estimate And the estimated value Return to the total location collection center, the total location collection center updates the query value

[0022] After completing the traversal of all elements in CountSet, the query value QueryValue is obtained and returned to the query user.

[0023] According to another aspect of the present invention, the present invention also provides a region counting query system based on hybrid differential privacy, the system comprising a total location collection center and a sub-location collection center, the total area where the user is located is divided into multiple sub-areas, each sub-area is provided with the sub-location collection center, and the total area is provided with the total location collection center;

[0024] The user calculates the perturbation parameters according to his / her location, the size of the sub-region and the privacy budget, calculates the perturbed location information of the user based on the perturbation parameters and localized differential privacy, and uploads the perturbed location information to the sub-location collection center corresponding to the sub-region where the user is located;

[0025] The sub-location collection center performs a legitimacy check on the location information uploaded by users in the received sub-area. After completing the legitimacy check, it counts the number of users in the sub-area under its jurisdiction, and adds Laplace noise to the number of users for disturbance protection based on centralized differential privacy, obtains the sub-area count value after disturbance, and uploads the sub-area count value after disturbance to the main location collection center;

[0026] The total location collection center performs a legitimacy check on the disturbed sub-area count values ​​uploaded by each sub-location collection center, processes and corrects illegal data, and corrects count values ​​less than zero to zero; the total location collection center provides an area count query service to the outside, performs query calculations based on the received query range, and returns the query value to the inquirer to complete the query.

[0027] Preferably, the disturbance parameter is the center point c(x c ,y c ) and c(x c ,y c ) is the center, and the side length w of the square area that minimizes the expected value of the mean square error between the original point and the perturbation point;

[0028]

[0029] The original coordinates of the user are (x, y) and the sub-area is D j, the range is [DX1, DX2] × [DY1, DY2], and the sub-area D j The coordinate transformation is [-X, X] × [-Y, Y],

[0030] Preferably, the user uploading the disturbed location information to the sub-location collection center corresponding to the sub-area where the user is located includes:

[0031] The user randomly generates a disturbed position point of the user in the area according to the disturbance parameters, restores the disturbed position point to the original coordinate system, and uploads the restored coordinates to the sub-location collection center corresponding to the area where the user is located.

[0032] Preferably, the sub-location collection center uploading the disturbed sub-area count value to the main location collection center comprises:

[0033] After the location collection center completes the collection of user location coordinates within the jurisdiction and the legitimacy check, it counts the number of recorded data as the original count value count of the area and records it;

[0034] The location collection center adds Laplace noise Laplace to the original count value count to obtain the noise count count′=count+Laplace(1 / ε), where Laplace(1 / ε) is a random number generated by the Laplace distribution conforming to (0, 1 / ε), and ε is a parameter;

[0035] The sub-location collection center records the noise count count′ and the generated random noise value Laplace(1 / ε), and sends the noise count count′ to the main location collection center TCenter.

[0036] Preferably, the total location collection center provides an area count query service to the outside, performs query calculation according to the received query range, and returns the query value to the queryer to complete the query, including:

[0037] The total location collection center receives a query request sent by a query user, wherein the query request includes a query area range Q, where Q is a rectangular area [Qx1, Qx2]×[Qy1, Qy2];

[0038] The total location collection center initializes the query value QueryValue = 0, traverses the count value set CountSet, and for each element in CountSet [D j , count′ j ],like Skip this area if Q∩D j =D j, update query value QueryValue = QueryValue + count′ j , otherwise, proceed to the next step;

[0039] The general location collection center sends the query request to the sub-location collection center SCenter corresponding to the current sub-area j , SCenter j After receiving the request, calculate the count estimate And the estimated value Return to the total location collection center, the total location collection center updates the query value

[0040] After completing the traversal of all elements in CountSet, the query value QueryValue is obtained and returned to the query user.

[0041] Beneficial effect: Based on localized differential privacy, the present invention performs a small disturbance on the user's location coordinates locally, and then sends the disturbed data to the data collector. After the data collector completes the collection and analysis to obtain the corresponding results, the results are secondary noised based on centralized differential privacy. This fully improves the poor availability of localized differential privacy data and the problem that centralized differential privacy data collectors are not necessarily trustworthy, protects the user's location privacy, improves the accuracy of query results, and can provide high-precision area counting query services to query users.

[0042] The features and advantages of the present invention will become clear through reference to the following drawings and detailed description of specific embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a flow chart of the region counting query method based on hybrid differential privacy;

[0044] Figure 2 This is a schematic diagram of the region counting query system based on hybrid differential privacy. DETAILED DESCRIPTION

[0045] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Example 1

[0047] Figure 1 This is the flow chart of the region counting query method based on hybrid differential privacy. Figure 1As shown, this embodiment provides a region counting query method based on hybrid differential privacy, and the method includes the following steps:

[0048] S1: The user calculates perturbation parameters according to his / her location, the size of the sub-region he / she is in, and the privacy budget. According to the perturbation parameters, the user's perturbed location information is calculated based on localized differential privacy, and the perturbed location information is uploaded to the sub-location collection center corresponding to the sub-region where the user is located; wherein the total region where the user is located is divided into multiple sub-regions, each sub-region is provided with a sub-location collection center, and the total region is provided with a total location collection center;

[0049] S2: The sub-location collection center performs a legitimacy check on the location information uploaded by users in the received sub-area. After completing the legitimacy check, it counts the number of users in the sub-area under its jurisdiction, and adds Laplace noise to the number of users for disturbance protection based on centralized differential privacy, obtains the sub-area count value after disturbance, and uploads the sub-area count value after disturbance to the main location collection center;

[0050] S3: The total location collection center performs a legitimacy check on the disturbed sub-area count values ​​uploaded by each sub-location collection center, processes and corrects illegal data, and corrects count values ​​less than zero to zero; the total location collection center provides external regional count query services, performs query calculations based on the received query range, and returns the query value to the inquirer to complete the query.

[0051] Specifically, in this embodiment, the following concepts are involved:

[0052] Total area: The maximum range area of ​​all users, the total area is called the map MAP, which is represented by a rectangle. All subsequent operations such as user location submission and queryer query area count value are performed on this map.

[0053] Sub-area: A series of small rectangular areas contained in the map obtained by dividing the map into uniform grids according to a certain granularity. User locations are submitted in this unit, which is also the smallest unit managed by the location collection center.

[0054] User: Also known as the data owner, who has ownership and control over his or her own location data. He or she needs to submit his or her location coordinates to the sub-location collection center corresponding to his or her area. He or she can perform disturbance protection on his or her location coordinates based on localized differential privacy and submit his or her location to the sub-location collection center while ensuring the security of his or her own privacy.

[0055] Sub-location collection center: usually a semi-trusted server with certain computing and storage capabilities, responsible for collecting the location coordinates of users in the jurisdiction sub-area, performing legitimacy checks on the user's location coordinates and storing them. In the present invention, multiple sub-location collection centers are usually set up.

[0056] Total location collection center: usually a semi-trusted server with strong computing and storage capabilities, responsible for receiving the sub-area count values ​​counted by each sub-location collection center, checking their legitimacy and storing them; responding to the area count query request sent by the inquirer and returning the query result. In the present invention, there is only one total location collection center.

[0057] Queryer: The entity that requests to query the user count in a specific area sends the desired query area to the general location collection center and obtains the query results.

[0058] In this embodiment, the entire map is initialized, a total location collection center is set, the map is evenly divided into a series of grids at a certain granularity, a sub-location collection center is set for each grid area, and the grids under the jurisdiction of each sub-location center are further evenly divided at a finer granularity, and necessary information is added to the divided fine-grained grids in combination with real knowledge.

[0059] For example, initialize the entire map and place the map in a minimum rectangular Map that can just cover the map area. Use longitude and latitude to determine its boundary range, such as longitude [2, 362] × latitude [15, 105]. Adjust the Map to be symmetrical around the origin of the coordinate axis, and record its range as [-TX, TX] × [-TY, TY]. That is, the above Map range is recorded as [-180, 180] × [-90, 90]. Subsequent calculations are performed in this coordinate system.

[0060] Set a total location collection center TCenter for the entire map, and divide the map into M1×M2 sub-grid area sets according to the fine-grained M1 and M2. Each sub-grid area is recorded as D j , (j=1, 2, ...M1×M2), for each D j Set up a sub-location collection center SCenter j , (j=1, 2, ...M1×M2) manages the user location collection work of the sub-area. Assuming that M1=10 and M2=10 in this scenario, each sub-area is 36 (longitude) long and 18 (latitude) wide.

[0061] For each sub-location collection center, the sub-area D j , further divide it into m1×m2 fine-grained grids according to the fine-grained m1 and m2, and collect the center SCenter by location jInitialize an m1×m2 matrix matrix, where each element of the matrix corresponds to a fine-grained grid. Traverse the m1×m2 fine-grained grids. For each grid, based on real-world knowledge, if the area where the grid is located is an inaccessible area in reality, such as a mountain range or the center of a lake, then set the corresponding element of the matrix to 0, otherwise set it to 1. After the traversal is completed, SCenter j Save the matrix matrix for subsequent data validity checks, and the entire system is initialized.

[0062] Preferably, the disturbance parameter is the center point c(x c ,y c ) and c(x c ,y c ) is the center, and the side length w of the square area that minimizes the expected value of the mean square error between the original point and the perturbation point;

[0063]

[0064] The original coordinates of the user are (x, y) and the sub-area is D j , the range is [DX1, DX2] × [DY1, DY2], and the sub-area D j The coordinate transformation is [-X, X] × [-Y, Y],

[0065] The specific steps include:

[0066] Parameter calculation: Each user calculates the parameters required to perturb the user's position based on its own location, the size of the sub-region it is in, and the privacy budget, where the user's location is a two-dimensional coordinate and the area where the user is located is a rectangle. After the parameter calculation is completed, the parameters are saved locally in the user for use in the calculation of the perturbation position when the user's location is subsequently uploaded.

[0067] User i The original coordinates are (ux, uy) and the sub-area is D j , the range is [DX1, DX2] × [DY1, DY2]. For the convenience of calculation, first transform the coordinate system of the sub-area where the user is located. j The coordinate system is transformed to be symmetrical around the origin. The subsequent position calculation of the user is based on this coordinate system. The coordinate range after transformation is [-X, X] × [-Y, Y], where User i The position coordinates after conversion are p(x, y), the position coordinates after user perturbation are p′(x′, y′), the privacy budget is ε, and the center point of the high perturbation probability area to be calculated is c(x c ,y c), with a side length of w, denoted as S(c, w), calculate the expected value of the MSE between the original point and the perturbation point

[0068] Currently, Zhang San is in sub-area D1 ([-180, -144][72, 90]), and his original position coordinates are (-157.5, 84.5). After the coordinate system is converted, the range of D1 is [-18, 18]×[-9, 9], and Zhang San’s position coordinates are (4.5, 3.5).

[0069] Taking point c as the variable and finding the extreme value of E[MSE(p′, p)|p], we can get the coordinates of the center point that minimizes the expected value:

[0070] After calculation based on Zhang San’s location, the expected minimum center point coordinates are (4, 3).

[0071] Assuming that all users are evenly distributed in area D, further calculation

[0072]

[0073] Solve the optimization problem: Get the side length w of S(c,w) that minimizes the expected value * , after calculation, the expected minimum side length w corresponding to Zhang San * =0.249.

[0074] The necessary parameters S(c, w) required for adding noise to the user position data are obtained by calculation, and the center point c(x c ,y c ) and side length w, that is, the necessary noise parameter corresponding to Zhang San is c(x c ,y c )=(4,3), w=0.249.

[0075] Preferably, the user uploading the disturbed location information to the sub-location collection center corresponding to the sub-area where the user is located includes:

[0076] The user randomly generates a disturbed position point of the user in the area according to the disturbance parameters, restores the disturbed position point to the original coordinate system, and uploads the restored coordinates to the sub-location collection center corresponding to the area where the user is located.

[0077] Specifically, user location perturbation and upload: According to the perturbation parameters calculated in the previous step, the user's perturbed location coordinates are calculated based on localized differential privacy; after obtaining the perturbed coordinates, the user uploads his or her perturbed location to the corresponding sub-location collection center in the area where he or she is located.

[0078] The user randomly generates a user-perturbed position point p′(x′, y′) in the area according to the area parameter S(c, w): in After random perturbation, Zhang San's position coordinates become (4.16, 3.66).

[0079] After the user obtains the disturbance position point p′(x′, y′), the disturbance position point is restored to the original coordinate system. The restored coordinates are (ux′, uy′). The restored coordinates (ux′, uy′) are uploaded to the sub-location collection center SCenterj corresponding to the user's area. The disturbed position point in the original coordinate system is restored to (-157.84, 84.66) based on the disturbed position coordinates (4.16, 3.66), and the position coordinates are uploaded to the sub-location collection center SCenter1 corresponding to D1.

[0080] Preferably, the sub-location collection center uploading the disturbed sub-area count value to the main location collection center comprises:

[0081] After the location collection center completes the collection of user location coordinates within the jurisdiction and the legitimacy check, it counts the number of recorded data as the original count value count of the area and records it;

[0082] The location collection center adds Laplace noise Laplace to the original count value count to obtain the noise count count′=count+Laplace(1 / ε), where Laplace(1 / ε) is a random number generated by the Laplace distribution conforming to (0, 1 / ε), and ε is a parameter;

[0083] The sub-location collection center records the noise count count′ and the generated random noise value Laplace(1 / ε), and sends the noise count count′ to the main location collection center TCenter.

[0084] Specifically, data check at the location collection center: After receiving the location data uploaded by users in the area under its jurisdiction, the location collection center needs to perform a legitimacy check on the received data to prevent users from maliciously uploading invalid locations and polluting the count values ​​in the final area.

[0085] SCenter, a collection center based on different locations j After receiving the disturbance location data sent by the user in the jurisdiction, check whether the location coordinates are indeed in the jurisdiction area D jIf it is within the area, proceed to the next step, otherwise the data is discarded. After checking by SCenter1, the location coordinates uploaded by Zhang San are indeed within the sub-area range of [-180, -144][72, 90] under its jurisdiction, and can pass the legitimacy check of this step.

[0086] After the previous step, the user coordinates are further checked in combination with publicly available knowledge: the location data uploaded by the user is mapped to the corresponding element of the matrix matrix. If the element value is 0, the location coordinates uploaded by the user are considered to be a place that cannot be reached in reality. The data is invalid and will be discarded. Otherwise, proceed to the next step. After checking the location coordinates sent by Zhang San, it is found that the element value of the corresponding position of the matrix stored in SCenter1 is 1, so the location uploaded by Zhang San is legal and passes the check.

[0087] After the location coordinates sent by the user pass the legality check, the location collection center stores the user's location coordinates, and SCenter1 stores the location coordinates uploaded by Zhang San.

[0088] Sub-area counting statistics and upload: After completing the legitimacy check on all location data uploaded by users, the sub-location collection center counts the number of users in its jurisdiction, and performs perturbation protection on this value based on centralized differential privacy, and uploads the count perturbation value to the total location collection center.

[0089] After the location center completes the collection and legality check of the user location coordinates in the jurisdiction, it counts the number of recorded data as the original count value count of the area and records it. After completing the collection and check of the user locations in the areas of Zhang San, Li Si, Wang Wu, etc., it counts the number of users in the area. Assuming that the number of users in the current area is 198, that is, count = 198.

[0090] Based on centralized differential privacy, the original count value is protected, and Laplace noise Laplace is added to the original value count to obtain the noise count count′=count+Laplace(1 / ε), where Laplace(1 / ε) is a random number generated by the Laplace distribution conforming to (0, 1 / ε). After random sampling based on the Laplace distribution, SCenter1 obtains the noise value Laplace(1 / ε)=2, and the calculated noise count is count′=count+Laplace(1 / ε)=198+2=200.

[0091] The sub-location collection center records the noise count count′ and the generated random noise value Laplace(1 / ε), and sends the noise count count′=200 to the main location collection center TCenter.

[0092] Preferably, the total location collection center provides an area count query service to the outside, performs query calculation according to the received query range, and returns the query value to the queryer to complete the query, including:

[0093] The total location collection center receives a query request sent by a query user, wherein the query request includes a query area range Q, where Q is a rectangular area [Qx1, Qx2]×[Qy1, Qy2];

[0094] The total location collection center initializes the query value QueryValue = 0, traverses the count value set CountSet, and for each element in CountSet [D j , count′ j ],like Skip this area if Q∩D j =D j , update query value QueryValue = QueryValue + count′ j , otherwise, proceed to the next step;

[0095] The general location collection center sends the query request to the sub-location collection center SCenter corresponding to the current sub-area j , SCenter j After receiving the request, calculate the count estimate And the estimated value Return to the total location collection center, the total location collection center updates the query value

[0096] After completing the traversal of all elements in CountSet, the query value QueryValue is obtained and returned to the query user.

[0097] Specifically, the data check of the total location collection center: the legality of the sub-area count values ​​uploaded by each sub-location collection center is checked, and the illegal data is post-processed and corrected to reduce the error in the final query count.

[0098] When the total location collection center TCenter receives the sub-area count value sent by each sub-location collection center, it first checks the legitimacy of the count value. If the current count value is greater than or equal to zero, it is legal and proceeds to the next step. Otherwise, post-processing is performed to correct the current negative count value to zero and proceed to the next step. After checking, it is found that the count value submitted by SCenter1 is positive, which meets the legitimacy requirements and passes the check.

[0099] The sub-region count values ​​that have been checked for legality and post-processed are recorded, that is, the data record submitted by SCenter1 is [D1, 200]. After completing the data collection of all sub-location collection centers, a corresponding set of sub-location collection center sub-regions and their corresponding noise count values ​​is constructed: CountSet = {[D1, 200], [D2, count′2], ... [D j , count′ j ]…}, the total location collection center provides regional counting query services to the outside.

[0100] Count query: After completing the collection and post-processing of the count values ​​of each sub-area, the total location collection center provides regional count query. The inquirer sends the desired query area range to the total location collection center. The total location collection center calculates based on the received query range and returns the query value to the inquirer to complete the query. Specifically, it includes:

[0101] 1. The query user sends the area range Q that he wants to query to the total location collection center TCenter, which is a rectangular area [Qx1, Qx2]×[Qy1, Qy2]. At this time, there is a user named Xiao Ming who wants to query the number of users within the range of [-162, -144]×[81, 90].

[0102] 2. After receiving the query request sent by the user, the total location collection center initializes the query value QueryValue = 0, traverses CountSet, and for each element in CountSet [D j , count′ j ],like Skip this area if Q∩D j =D j , proceed to step 3, otherwise, proceed to step 4. According to Xiao Ming’s query request, CountSet is traversed and it is found that area D1 intersects with the query area, so step 4 is entered for further calculation.

[0103] 3. Performing this step indicates that the current sub-area traversed is included in the query area, and the query value QueryValue=QueryValue+count′ is updated. j .

[0104] 4. This step indicates that the current sub-area traversed partially intersects with the query area. The general location collection center further sends the query request to the sub-location collection center SCenter corresponding to the current sub-area j , SCenter j After receiving the request, calculate the count estimate Calculate query area Q and D j The intersection area and area D jThe ratio of the area The noise allocation ratio noiserate is calculated according to the following probability: Further calculation of count estimates The estimated value is returned to the total location collection center, and the total location collection center updates the query value In this scenario, SCenter1 receives the query request forwarded by the total location collection center and calculates the area ratio of the query area to D1. According to the random response mechanism, the noise distribution ratio noiserate=0.75 is randomly obtained, so the count estimate calculated by SCenter1 is After returning the result to the total location collection center, update the query value

[0105] 5. After traversing all elements in CountSet, it is found that only D1 intersects with the query area, and the query value QueryValue=51 is obtained. It is returned to the query user, completing the query. That is, Xiao Ming finally obtains the query result 51.

[0106] This embodiment uses differential privacy technology to protect the two-dimensional location data generated by users, ensuring the security of user data while ensuring the availability of submitted data. Users and data collectors can adjust the size of the privacy budget to balance the degree of data protection and the availability of collected data. After collecting user data and performing certain analysis, a high-precision area counting query service is provided to the querying user.

[0107] This embodiment adopts a differential privacy solution that combines localized differential privacy and centralized differential privacy. First, the user's location coordinates are disturbed to a small extent locally based on localized differential privacy, and then the disturbed data is sent to the data collector. After the data collector completes the collection and analysis to obtain the corresponding results, the results are noised again based on centralized differential privacy. This fully improves the problem of poor availability of localized differential privacy data and the problem that centralized differential privacy data collectors are not necessarily trustworthy.

[0108] In this embodiment, multiple sub-location collection centers and one main location collection center are set up in the data collector part. Multiple sub-location collection centers can collect user data in parallel to improve data collection efficiency. At the same time, the sub-location collection centers can check the legitimacy of the data after collecting the user data to reduce disturbance errors. Finally, the main location collection center summarizes the counting results of each sub-location collection center and provides regional counting query services to the inquirer.

[0109] This embodiment designs a noise distribution mechanism in the query stage, and distributes the counting noise based on the random response mechanism according to the characteristics of the specific query area, so as to further improve the accuracy of the query result.

[0110] Example 2

[0111] Figure 2 This is a schematic diagram of the region counting query system based on hybrid differential privacy. Figure 2 As shown, this embodiment provides a region counting query system based on hybrid differential privacy, the system includes a total location collection center and a sub-location collection center, the total area where the user is located is divided into multiple sub-areas, each sub-area is provided with the sub-location collection center, and the total area is provided with the total location collection center;

[0112] The user calculates the perturbation parameters according to his / her location, the size of the sub-region and the privacy budget, calculates the perturbed location information of the user based on the perturbation parameters and localized differential privacy, and uploads the perturbed location information to the sub-location collection center corresponding to the sub-region where the user is located;

[0113] The sub-location collection center performs a legitimacy check on the location information uploaded by users in the received sub-area. After completing the legitimacy check, it counts the number of users in the sub-area under its jurisdiction, and adds Laplace noise to the number of users for disturbance protection based on centralized differential privacy, obtains the sub-area count value after disturbance, and uploads the sub-area count value after disturbance to the main location collection center;

[0114] The total location collection center performs a legitimacy check on the disturbed sub-area count values ​​uploaded by each sub-location collection center, processes and corrects illegal data, and corrects count values ​​less than zero to zero; the total location collection center provides an area count query service to the outside, performs query calculations based on the received query range, and returns the query value to the inquirer to complete the query.

[0115] Preferably, the disturbance parameter is the center point c(x c ,y c ) and c(x c ,y c ) is the center, and the side length w of the square area that minimizes the expected value of the mean square error between the original point and the perturbation point;

[0116]

[0117] The original coordinates of the user are (x, y) and the sub-area is D j , the range is [DX1, DX2] × [DY1, DY2], and the sub-area D jThe coordinate transformation is [-X, X] × [-Y, Y],

[0118] Preferably, the user uploading the disturbed location information to the sub-location collection center corresponding to the sub-area where the user is located includes:

[0119] The user randomly generates a disturbed position point of the user in the area according to the disturbance parameters, restores the disturbed position point to the original coordinate system, and uploads the restored coordinates to the sub-location collection center corresponding to the area where the user is located.

[0120] Preferably, the sub-location collection center uploading the disturbed sub-area count value to the main location collection center comprises:

[0121] After the location collection center completes the collection of user location coordinates within the jurisdiction and the legitimacy check, it counts the number of recorded data as the original count value count of the area and records it;

[0122] The location collection center adds Laplace noise Laplace to the original count value count to obtain the noise count count′=count+Laplace(1 / ε), where Laplace(1 / ε) is a random number generated by the Laplace distribution conforming to (0, 1 / ε), and ε is a parameter;

[0123] The sub-location collection center records the noise count count′ and the generated random noise value Laplace(1 / ε), and sends the noise count count′ to the main location collection center TCenter.

[0124] Preferably, the total location collection center provides an area count query service to the outside, performs query calculation according to the received query range, and returns the query value to the queryer to complete the query, including:

[0125] The total location collection center receives a query request sent by a query user, wherein the query request includes a query area range Q, where Q is a rectangular area [Qx1, Qx2]×[Qy1, Qy2];

[0126] The total location collection center initializes the query value QueryValue = 0, traverses the count value set CountSet, and for each element in CountSet [D j , count′ j ],like Skip this area if Q∩D j =D j , update query value QueryValue = QueryValue + count′ j , otherwise, proceed to the next step;

[0127] The general location collection center sends the query request to the sub-location collection center SCenter corresponding to the current sub-area j , SCenter j After receiving the request, calculate the count estimate And the estimated value Return to the total location collection center, the total location collection center updates the query value

[0128] After completing the traversal of all elements in CountSet, the query value QueryValue is obtained and returned to the query user.

[0129] The specific implementation process of the functions realized by each sub-location collection center and the main location collection center in this embodiment 2 is the same as the implementation process in embodiment 1, and will not be repeated here.

[0130] The above description is only a preferred embodiment of the present invention, and does not limit the patent scope of the present invention. All equivalent structural changes made by using the contents of the present invention specification and drawings under the concept of the present invention, or directly / indirectly applied in other related technical fields are included in the patent protection scope of the present invention.

Claims

1. A region counting query method based on hybrid differential privacy, characterized in that: The method comprises the following steps: S1: The user calculates perturbation parameters according to his / her location, the size of the sub-region he / she is in, and the privacy budget. According to the perturbation parameters, the user's perturbed location information is calculated based on localized differential privacy, and the perturbed location information is uploaded to the sub-location collection center corresponding to the sub-region where the user is located; wherein the total region where the user is located is divided into multiple sub-regions, each sub-region is provided with a sub-location collection center, and the total region is provided with a total location collection center; S2: The sub-location collection center performs a legitimacy check on the location information uploaded by users in the received sub-area. After completing the legitimacy check, it counts the number of users in the sub-area under its jurisdiction, and adds Laplace noise to the number of users for disturbance protection based on centralized differential privacy, obtains the sub-area count value after disturbance, and uploads the sub-area count value after disturbance to the main location collection center; S3: The total location collection center performs a legitimacy check on the disturbed sub-area count values ​​uploaded by each sub-location collection center, processes and corrects illegal data, and corrects count values ​​less than zero to zero; the total location collection center provides external regional count query services, performs query calculations based on the received query range, and returns the query value to the inquirer to complete the query.

2. The method according to claim 1, characterized in that The disturbance parameter is the center point c(x c ,y c ) and c(x c ,y c ) is the center, and the side length w of the square area that minimizes the expected value of the mean square error between the original point and the perturbation point; The original coordinates of the user are (x, y) and the sub-area is D j , the range is [DX1,DX2]×[DY1,DY2], and the sub-area D j The coordinate transformation is [-X,X]×[-Y,Y], 3. The method according to claim 2, characterized in that The user uploading the disturbed location information to the sub-location collection center corresponding to the sub-area where the user is located includes: The user randomly generates a disturbed position point of the user in the area according to the disturbance parameters, restores the disturbed position point to the original coordinate system, and uploads the restored coordinates to the sub-location collection center corresponding to the area where the user is located.

4. The method according to claim 1, characterized in that: The sub-location collection center uploading the disturbed sub-area count value to the main location collection center includes: After the location collection center completes the collection of user location coordinates within the jurisdiction and the legitimacy check, it counts the number of recorded data as the original count value count of the area and records it; The location collection center adds Laplace noise Laplace to the original count value count, and obtains the noise count count'=count+Laplace(1 / ε), where Laplace(1 / ε) is a random number generated by the Laplace distribution conforming to (0,1 / ε), and ε is a parameter; The sub-location collection center records the noise count count' and the generated random noise value Laplace(1 / ε), and sends the noise count count' to the main location collection center TCenter.

5. The method according to claim 1, characterized in that The total location collection center provides an area count query service, performs query calculation according to the received query range, and returns the query value to the queryer to complete the query, including: The total location collection center receives a query request sent by a query user, wherein the query request includes a query area range Q, where Q is a rectangular area [Qx1, Qx2]×[Qy1, Qy2]; The total location collection center initializes the query value QueryValue = 0, traverses the count value set CountSet, and for each element in CountSet [D j ,count' j ],like Skip this area if Q∩D j =D j , update query value QueryValue = QueryValue + count' j , otherwise, proceed to the next step; The general location collection center sends the query request to the sub-location collection center SCenter corresponding to the current sub-area j , SCenter j After receiving the request, calculate the count estimate And the estimated value Return to the total location collection center, the total location collection center updates the query value After completing the traversal of all elements in CountSet, the query value QueryValue is obtained and returned to the query user.

6. A region counting query system based on hybrid differential privacy, characterized in that: The system includes a total location collection center and a sub-location collection center. The total area where the user is located is divided into multiple sub-areas, each sub-area is provided with the sub-location collection center, and the total area is provided with the total location collection center; The user calculates the perturbation parameters according to his / her location, the size of the sub-region and the privacy budget, calculates the perturbed location information of the user based on the perturbation parameters and localized differential privacy, and uploads the perturbed location information to the sub-location collection center corresponding to the sub-region where the user is located; The sub-location collection center performs a legitimacy check on the location information uploaded by users in the received sub-area. After completing the legitimacy check, it counts the number of users in the sub-area under its jurisdiction, and adds Laplace noise to the number of users for disturbance protection based on centralized differential privacy, obtains the sub-area count value after disturbance, and uploads the sub-area count value after disturbance to the main location collection center; The general location collection center performs a legality check on the disturbed sub-area count values ​​uploaded by each sub-location collection center, processes and corrects the illegal data, and corrects the count values ​​less than zero to zero; The total location collection center provides area counting query services to the outside, performs query calculations based on the received query range, and returns the query value to the inquirer to complete the query.

7. The system according to claim 6, characterized in that The disturbance parameter is the center point c(x c ,y c ) and c(x c ,y c ) is the center, and the side length w of the square area that minimizes the expected value of the mean square error between the original point and the perturbation point; The original coordinates of the user are (x, y) and the sub-area is D j , the range is [DX1,DX2]×[DY1,DY2], and the sub-area D j The coordinate transformation is [-X,X]×[-Y,Y], 8. The system according to claim 7, characterized in that The user uploading the disturbed location information to the sub-location collection center corresponding to the sub-area where the user is located includes: The user randomly generates a disturbed position point of the user in the area according to the disturbance parameters, restores the disturbed position point to the original coordinate system, and uploads the restored coordinates to the sub-location collection center corresponding to the area where the user is located.

9. The system according to claim 6, characterized in that The sub-location collection center uploading the disturbed sub-area count value to the main location collection center includes: After the location collection center completes the collection of user location coordinates within the jurisdiction and the legitimacy check, it counts the number of recorded data as the original count value count of the area and records it; The location collection center adds Laplace noise Laplace to the original count value count, and obtains the noise count count'=count+Laplace(1 / ε), where Laplace(1 / ε) is a random number generated by the Laplace distribution conforming to (0,1 / ε), and ε is a parameter; The sub-location collection center records the noise count count' and the generated random noise value Laplace(1 / ε), and sends the noise count count' to the main location collection center TCenter.

10. The system according to claim 6, characterized in that The total location collection center provides an area count query service, performs query calculation according to the received query range, and returns the query value to the queryer to complete the query, including: The total location collection center receives a query request sent by a query user, wherein the query request includes a query area range Q, where Q is a rectangular area [Qx1, Qx2]×[Qy1, Qy2]; The total location collection center initializes the query value QueryValue = 0, traverses the count value set CountSet, and for each element in CountSet [D j ,count' j ],like Skip this area if Q∩D j =D j , update query value QueryValue = QueryValue + count' j , otherwise, proceed to the next step; The general location collection center sends the query request to the sub-location collection center SCenter corresponding to the current sub-area j , SCenter j After receiving the request, calculate the count estimate And the estimated value Return to the total location collection center, the total location collection center updates the query value After completing the traversal of all elements in CountSet, the query value QueryValue is obtained and returned to the query user.

Images