Track data publishing method based on personalized local differential privacy

Abstract

The invention discloses a trajectory data publishing method based on personalized local differential privacy, which comprises the following steps: discretizing a geographic space according to the number of grids, and organizing the geographic space into a plurality of grids with the same size; converting trajectory data information composed of longitude and latitude into a one-dimensional array composed of a grid sequence number index; according to the privacy budget selected by the user, data privacy processing operation in a local environment is carried out, obtained noise vectors are reported to a third-party data collector, the third-party data collector carries out correction and aggregation operation on the noise vectors in groups, and publishable trajectory data sampling operation is carried out according to aggregated data. The method is suitable for scenes with different protection intentions of all parties, can realize the release of the trajectory data meeting the personalized local differential privacy, and obtains the published trajectory data under the conditions of ensuring the data privacy security and meeting the personal requirements of the user.

Description

Technical Field

[0001] The invention relates to information security technology, and more particularly to a trajectory data publishing method based on personalized local differential privacy. Background Art

[0002] The advancement of science and technology has brought great convenience to people's lives, especially mobile users can enjoy various location-based services by sharing real-time locations, such as social interaction, obtaining life information, navigation, etc. However, this has also led to the generation of massive amounts of location data. Billions of smart devices around the world generate more than 1 billion pieces of location data every second. Among them, the largest amount is trajectory data. The study of trajectory data can provide important references for commercial operations, urban planning, and smart transportation. In terms of security, it is also necessary to pay attention to preventing potential attackers from threatening personal privacy. For example, point-based privacy mechanisms are vulnerable to location-based attacks, such as re-identification attacks and outlier leakage. These data contain user behavior habits and social information, or other personal private data that may contain sensitive information.

[0003] The current society is in the era of big data. With the continuous development of Internet of Things technology, a new computing model called crowd intelligence perception has emerged. People use mobile devices or smart wearable devices to collect data about the surrounding environment, such as temperature, humidity, noise, geographic location, etc., and transmit it to data collectors, such as servers. The server can perform statistical analysis on the urban environment and traffic conditions and predict future trends, thereby optimizing the construction of smart cities and providing a more convenient life and service experience.

[0004] On the other hand, the data retained on the Internet also contains huge value. By analyzing the user's search engine settings, web browsing records, and online shopping records through data mining technology, we can find information such as the popularity of products and the correlation between commodities, which is conducive to service providers to deeply understand user preferences, optimize product services, improve user experience and increase their own profits. In the field of medical health, collecting data such as patient conditions and physical characteristics can help medical institutions develop more effective treatment plans. Medical institutions can also combine patient medical records and genetic information to discover the correlation between genes and diseases, provide disease risk assessments for other users' genetic testing, and play a good preventive role. In general, in-depth analysis of massive data has a positive role in promoting social governance, improving people's livelihood, and the development of various industries.

[0005] In current big data applications, security technologies are mainly focused on privacy protection when processing sensitive data, such as data desensitization, secure multi-party computing, and federated learning. These technologies are designed to protect the privacy of personal data while enabling normal analysis and mining of big data, which is called privacy-preserving data analysis and is a key trend in the development of big data technology. Although privacy protection measures for user data may affect the accuracy of data analysis, such as data desensitization may cause the loss of some user information, data analysis is usually based on a large amount of user data, with the purpose of obtaining overall statistical information and predicting future development trends, rather than analyzing individual users. Therefore, the reasonable adoption of privacy protection technology at the level of personal data has a relatively limited impact on the overall data analysis results, and a good coordination can be achieved between user privacy security and big data statistical results.

[0006] The application of privacy-preserving data analysis technology is beneficial to both users and service providers. For service providers, applying privacy-preserving technology during data processing can avoid losses caused by privacy leaks. Paying attention to user privacy issues is also conducive to obtaining more user data and optimizing service quality. For users, privacy-preserving technology can prevent the risk of privacy leaks during data collection and analysis. Safely sharing data can also help service providers improve their products and enhance user experience. Therefore, privacy-preserving technology has become an important driving force for the development of the big data industry. Research on this technology is of great significance, mainly including privacy models, definitions, usage scenarios, and the effectiveness of data analysis results.

[0007] Therefore, how to apply privacy protection technology, how to ensure that users' privacy is not leaked when publishing trajectory data, and at the same time meet users' different privacy needs, and take effective privacy protection measures when publishing and using trajectory data, while protecting personal privacy and retaining the useful information of trajectory data to the maximum extent, has become one of the challenges that need to be solved urgently. Summary of the invention

[0008] The purpose of the present invention is to provide a trajectory data publishing method based on personalized local differential privacy, which processes data in a localized scenario using existing privacy protection technology and performs trajectory synthesis at a third-party data collection terminal, thereby enabling a wider range of applications.

[0009] In order to achieve the above technical objectives, the technical solution adopted by the present invention is:

[0010] A trajectory data publishing method based on personalized local differential privacy, the trajectory data publishing method comprising the following steps:

[0011] S1. Discretize the geographic space according to the number of grids and organize the geographic space into several grids of the same size;

[0012] S2, converting the trajectory data information composed of longitude and latitude into a one-dimensional array composed of grid serial number index;

[0013] S3. Perform data privacy processing operations in the local environment according to the privacy budget selected by the user, and report the obtained noise vector to the third-party data collector, who will perform noise vector correction and aggregation operations in groups, and perform publishable trajectory data sampling operations based on the aggregated data.

[0014] Furthermore, in step S3, according to the privacy budget selected by the user, the data privacy processing operation is performed in the local environment, and the process of reporting the obtained noise vector to the third-party data collector includes the following steps:

[0015] A31, each participant u i Choose a privacy budget ε based on your willingness to protect i , ε i ∈{ε1,ε2,ε3,…,ε A}, where {ε1,ε2,ε3,…,ε A} represents the set of privacy budgets to be selected, and A represents the total privacy budget;

[0016] A32, slicing the trajectory data converted into a one-dimensional array to obtain a combination of position information at two adjacent moments;

[0017] A33, for each location information combination, calculate v=n using the frequency estimation method based on the OUE protocol in the local environment g ×(α-1)+(β-1), where α is the position information of the previous moment, β is the position information of the next moment, and v is the corresponding encoding position; v is One-Hot encoded, and the encoding result is a one-dimensional array with a length of n g 2 , n g is the number of grids;

[0018] A34, perturbs the encoding result according to the following formula, and sends the perturbed noise vector to the third-party data collector:

[0019]

[0020] In the formula, Pr[B ′ [θ]=1] represents B ′ The probability that [θ] = 1, B ′ [θ] represents the result of the perturbed one-dimensional array θ position, B[θ] represents the one-dimensional array obtained after One-hot encoding, p,q represents the calculated perturbation probability, ε i Represents a privacy budget.

[0021] Furthermore, in step S3, the process of the third-party data collectors performing the correction and aggregation operations of the noise vector in groups includes the following steps:

[0022] B31, collects noise vectors according to the privacy budget ε selected by the user i The noise vector is divided into two categories according to the privacy budget ε. i To group;

[0023] B32, sum the noise vector columns of the same group to get the value of each position combination Value, according to the formula Correct the frequency of the position information combination;

[0024] B33, divide the frequency by the number of noise vectors in the current group to obtain the frequency vector of the position combination information of the previous moment and the next moment, and record the frequency vector of the first group at the same time;

[0025] B34, transform the frequency vector into n g ×n g The two-dimensional matrix of , which is the joint probability distribution matrix of the previous moment position and the next moment position under the current privacy budget, that is, P(x, y). Each value of the joint probability distribution matrix is ​​divided by the marginal distribution probability P(x) at the previous moment to obtain the conditional probability distribution

[0026] B35, using the frequency vector of the first group, calculate the marginal distribution probability matrix and the transition probability matrix at the first moment under the current privacy budget condition;

[0027] B36, the first moment position distribution and transition probability matrix under each privacy budget grouping are calculated according to the formula Perform weighted grouping aggregation, where a represents different grouping situations and Var represents variance, to obtain the first-moment position distribution and transition probability matrix after final aggregation.

[0028] Furthermore, in step S3, the process of performing a publishable trajectory data sampling operation according to the aggregated data includes the following steps:

[0029] C31, sample several starting points sp according to the position distribution at the first moment;

[0030] C32, for each starting point sp, select the sp-th row in the aggregated conditional probability matrix, randomly sample the position information np of the next time point, use np as the position information of the previous moment of the next sampling, and repeat the sampling until the position information of all time nodes of a trajectory is completed;

[0031] C33, repeat step S32 to obtain publishable trajectory data corresponding to all starting points.

[0032] Compared with the prior art, the present invention has the following beneficial effects:

[0033] First, the personalized local differential privacy trajectory data publishing (PLDP-TDP) method of the present invention designs a new frequency estimation method based on the OUE protocol, thereby completing the trajectory information statistics of multiple time periods;

[0034] Second, the trajectory data publishing method based on personalized local differential privacy of the present invention abstracts the trajectory points into discrete graphics of geographic space when counting trajectory point information, thereby improving data availability and reducing data dimension.

[0035] Third, the trajectory data publishing method based on personalized local differential privacy of the present invention, when realizing personalization in a local environment, allows users to allocate privacy budgets according to their own wishes, providing users with sufficient protection strength distribution to meet personalized local differential privacy requirements;

[0036] Fourth, the trajectory data publishing method based on personalized local differential privacy of the present invention allows participants to choose different privacy protection budgets based on their own wishes, which is suitable for scenarios where the protection wishes of all parties are different; and effectively integrates privacy-processed data with different protection strengths to achieve trajectory data publishing that meets personalized local differential privacy, thereby obtaining publishable trajectory data while ensuring data privacy security and meeting user personal needs; the present invention is tested on a large number of real data sets, and verifies that the scheme has good effects in terms of data practicality and personalization effects. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 This is an overall flow chart of the trajectory data publishing method based on personalized local differential privacy of the present invention;

[0038] Figure 2 A schematic diagram of a user end process of an example of the present invention;

[0039] Figure 3 The figure is a flow chart of the data aggregation method of an example of the present invention. DETAILED DESCRIPTION

[0040] The embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings.

[0041] See also Figure 1The present invention discloses a trajectory data publishing method based on personalized local differential privacy, and the trajectory data publishing method comprises the following steps:

[0042] S1. Discretize geographic space and organize it into numerous squares or other geometric structures.

[0043] S2. Convert the trajectory data information consisting of longitude and latitude into a one-dimensional array consisting of grid index.

[0044] S3. The client selects a privacy budget and performs data privacy processing operations in the local environment, and then reports the noise vector to the third-party data collector.

[0045] S4. Third-party data collectors are divided into groups to perform data correction and aggregation operations.

[0046] S5. The server performs a sampling operation on publishable trajectory data based on the aggregated data.

[0047] In step S3, the data processing process of the privacy protection technology of each participant is as follows:

[0048] S31. Each participant u i Choose a privacy budget ε based on your willingness to protect i , where ε i ∈{ε1,ε2,ε3,…,ε A}.

[0049] S32, slicing the converted trajectory data to obtain a combination of position information at two adjacent moments, that is, if a trajectory has 16 time nodes, then there are 15 combinations.

[0050] S33. For each position combination, use the frequency estimation method based on the OUE protocol in the local environment to calculate

[0051] v=n g ×(α-1)+(β-1) where α is the position information at the previous moment, and β is the position information at the next moment. The result is that v is One-Hot encoded with a length of n. g 2 , n g is the number of grids.

[0052] S34, according to Perturb the encoding result.

[0053] S35. Send the disturbed noise vector to a third-party data collector.

[0054] In step S4, the third-party data collector (i.e., the server) performs the following operations to correct and group the noise data:

[0055] S41, the server side selects the privacy budget ε according to the user i The noise vector is divided into two categories according to the privacy budget ε. i to group.

[0056] S42, the server first sums the noise vector columns of the same group to obtain the noise vectors of each position combination. value, and then according to the formula Correct the frequency of the position combination.

[0057] S43: The server divides the frequency by the number of noise vectors in the current group to obtain a frequency value of the combination.

[0058] S44, the server reshapes the frequency vector into n g ×n g The two-dimensional matrix is ​​the joint probability matrix of the position at the previous moment and the position at the next moment under the current privacy budget. Each value of the joint distribution probability matrix is ​​divided by the marginal distribution probability at the previous moment to obtain the conditional distribution probability.

[0059] S45. Calculate the marginal distribution probability matrix at the first moment under the current privacy budget condition.

[0060] S46. The first moment position distribution and transition probability matrix under each privacy budget grouping are calculated according to the formula Perform weighted grouping aggregation, where a represents different grouping situations and Var represents variance, to obtain the final first-moment position distribution and transition probability matrix.

[0061] In step S5, the server performs trajectory data sampling as follows:

[0062] S51. The server side samples a series of starting points sp according to the position distribution at the first moment.

[0063] S52, next, for the starting point sp, select the spth row in the aggregated conditional probability matrix, randomly sample the position information np of the next time point, and then use np as the position information of the previous moment of the next sampling, that is, select the npth row, and repeat this process until the position information of all time nodes of a trajectory is completed. If a row of the aggregated conditional probability matrix is ​​all 0, it means that under the position of the previous moment, there will be no transfer at the next moment, and the position at the next moment is the position at the current moment.

[0064] S53, repeat the S52 process for each starting point sp, and finally obtain a series of publishable trajectory data.

[0065] Combination Figure 2 ,The operation process steps of client privacy budget selection and data privacy processing method in ,localization scenario are as follows:

[0066] Step 1: According to the number of grids n g , dividing geographic space into squares or other geometric shapes of equal size.

[0067] Step 2: Convert the longitude and latitude trajectory information into grid number information.

[0068] Step 3: User chooses privacy budget ε i .

[0069] Step 4: Slice the trajectory and encode, perturb, and report each time point combination.

[0070] Step 5: Determine whether the current trajectory has been processed. If not, continue processing the next slice. If yes, end.

[0071] Combination Figure 3 , the specific process steps of the server side in the method of data correction, aggregation, and sampling in the server scenario are as follows:

[0072] Step 1: Collect the noise vector ε of customer feedback i , grouped according to privacy budget.

[0073] Step 2: For each group, Make corrections.

[0074] Step 3: Calculate the first moment position matrix and transition probability matrix of each grouping.

[0075] Step 4: Calculate the results of all groups according to Perform aggregation operations and then sample publishable trajectory data.

[0076] According to the derivation and calculation, when using differential privacy technology, although an unbiased estimate of the mean can be obtained, it will be accompanied by a certain decrease in accuracy. Therefore, the effectiveness of the present invention will be evaluated through experiments to measure the scientific credibility of the present invention during use.

[0077] The following is the experimental scenario setting and experimental results of the present invention. The simulation experiment uses the public dataset taxi-trajectory-data, which provides an accurate dataset that describes the trajectories of all 442 taxis operating in Porto, Portugal for a whole year (from July 1, 2013 to June 30, 2014), about 1.04W trajectories. At the same time, it is assumed that the experiment contains 1.04W clients, each of which has 16 time nodes and 12 grids. Table 1 lists the data validity of data protection when the client selects different privacy budgets, as well as the MSE of the final aggregate sampling results.

[0078] After obtaining the transition probability model, this experimental design uses this model to sample 10,000 trajectory data, and then groups and counts the distribution of each geographic space according to the time point, and compares it with the original data to obtain the MSE value. Its significance is that the smaller the MSE value, the smaller the noise value added, the higher the accuracy of the model, and the smaller the error between the estimated sampled data and the real data. Correspondingly, the larger its value, the greater the error.

[0079] Table 1 Data effectiveness of data protection under different privacy budgets

[0080] ε=1 ε=2 ε=3 ε=4 ε=5 MSE 0.004 0.0018 0.001 0.0005 0.0002

[0081] As can be seen from Table 1, as the privacy budget ε increases, the MSE value becomes smaller and smaller. This means that as the added noise value decreases, the accuracy of the model increases, and the error between the estimated sampled data and the real data becomes smaller and smaller, thus proving the relative practicality of the data.

[0082] In order to verify the personalization effect of the present invention, the change of MSE is tested under different privacy budget combinations.

[0083] Table 2. Changes in MSE under the same privacy budget combination conditions

[0084]

[0085] As can be seen from Table 2, when the same ε ratio is selected, as the ε value increases, the MSE value decreases. This means that when the user selects the same ratio, the larger the ε, the higher the accuracy of the transition probability model. Because for the same sample and the same ratio, the larger the privacy budget, the less noise is added, which reflects the smaller the MSE value.

[0086] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0087] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0088] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0089] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0090] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0091] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A trajectory data publishing method based on personalized local differential privacy, characterized in that: The trajectory data publishing method comprises the following steps: S1. Discretize the geographic space according to the number of grids and organize the geographic space into several grids of the same size; S2, converting the trajectory data information composed of longitude and latitude into a one-dimensional array composed of grid serial number index; S3. Perform data privacy processing operations in the local environment according to the privacy budget selected by the user, and report the obtained noise vector to the third-party data collector, who will perform noise vector correction and aggregation operations in groups, and perform publishable trajectory data sampling operations based on the aggregated data.

2. The trajectory data publishing method based on personalized local differential privacy according to claim 1 is characterized in that: In step S3, according to the privacy budget selected by the user, the data privacy processing operation is performed in the local environment, and the process of reporting the obtained noise vector to the third-party data collector includes the following steps: A31, each participant u i Choose a privacy budget ε based on your willingness to protect i , ε i ∈{ε1,ε2,ε3,…,ε A }, where {ε1,ε2,ε3,…,ε A } represents the set of privacy budgets to be selected, and A represents the total privacy budget; A32, slicing the trajectory data converted into a one-dimensional array to obtain a combination of position information at two adjacent moments; A33, for each location information combination, calculate v=n using the frequency estimation method based on the OUE protocol in the local environment g ×(α-1)+(β-1), where α is the position information of the previous moment, β is the position information of the next moment, and v is the corresponding encoding position; v is One-Hot encoded, and the encoding result is a one-dimensional array with a length of n g 2 , n g is the number of grids; A34, perturbs the encoding result according to the following formula, and sends the perturbed noise vector to the third-party data collector: In the formula, Pr[B ′ [θ]=1] represents B ′ The probability that [θ] = 1, B ′ [θ] represents the result of the perturbed one-dimensional array θ position, B[θ] represents the one-dimensional array obtained after One-hot encoding, p,q represents the calculated perturbation probability, ε i Represents a privacy budget.

3. The trajectory data publishing method based on personalized local differential privacy according to claim 1 is characterized in that: In step S3, the process of the third-party data collectors performing the correction and aggregation operations of the noise vector in groups includes the following steps: B31, collects noise vectors according to the privacy budget ε selected by the user i The noise vector is divided into two categories according to the privacy budget ε. i To group; B32, sum the noise vector columns of the same group to get the value of each position combination Value, according to the formula Correct the frequency of the position information combination; B33, divide the frequency by the number of noise vectors in the current group to obtain the frequency vector of the position combination information of the previous moment and the next moment, and record the frequency vector of the first group at the same time; B34, transform the frequency vector into n g ×n g The two-dimensional matrix of , which is the joint probability distribution matrix of the previous moment position and the next moment position under the current privacy budget, that is, P(x, y). Each value of the joint probability distribution matrix is ​​divided by the marginal distribution probability P(x) at the previous moment to obtain the conditional probability distribution B35, using the frequency vector of the first group, calculate the marginal distribution probability matrix and the transition probability matrix at the first moment under the current privacy budget condition; B36, the first moment position distribution and transition probability matrix under each privacy budget grouping are calculated according to the formula Perform weighted grouping aggregation, where a represents different grouping situations and Var represents variance, to obtain the first-moment position distribution and transition probability matrix after final aggregation.

4. The trajectory data publishing method based on personalized local differential privacy according to claim 1 is characterized in that: In step S3, the process of performing a publishable trajectory data sampling operation based on the aggregated data includes the following steps: C31, sample several starting points sp according to the position distribution at the first moment; C32, for each starting point sp, select the sp-th row in the aggregated conditional probability matrix, randomly sample the position information np of the next time point, use np as the position information of the previous moment of the next sampling, and repeat the sampling until the position information of all time nodes of a trajectory is completed; C33, repeat step S32 to obtain publishable trajectory data corresponding to all starting points.

Images