A trajectory data publishing method based on personalized local differential privacy

Abstract

The application discloses a kind of trajectory data publishing methods based on personalized local differential privacy, comprising: according to the number of grid, discretization is carried out to geographical space, and geographical space is organized into several identical grids;The trajectory data information consisting of longitude and latitude is converted into one-dimensional array consisting of grid serial number index;According to the privacy budget selected by user, data privacy processing operation is carried out in local environment, and the noise vector obtained is reported to third-party data collector, and the third-party data collector is grouped to carry out noise vector correction and aggregation operation, and according to the published trajectory data sampling operation of aggregated data is carried out.The application is suitable for the scene that the protection willingness of each party is different, can realize the trajectory data publishing of satisfying personalized local differential privacy, in the case where guaranteeing data privacy security and satisfying user personal demand, obtain the published trajectory data.

Description

TECHNICAL FIELD

[0001] The present application relates to information security technology, and relates to a trajectory data publishing method based on personalized local differential privacy. BACKGROUND

[0002] The progress of science and technology has brought great convenience to people's life, especially mobile users can enjoy various location-based services such as social interaction, access to life information, navigation, etc. by sharing real-time location. However, this also leads to the generation of massive location data. Billions of smart devices around the world generate more than 1 billion location data per second. Among them, the most is trajectory data. The study of trajectory data can provide important reference for business operation, urban planning and intelligent transportation, etc. The security aspect also needs to be vigilant against potential attackers threatening personal privacy, such as point-based privacy mechanisms vulnerable to location-based attacks, such as re-identification attacks and outlier leakage. These data contain users' behavior habits and social information, or other personal private data that may contain sensitive information.

[0003] The current society is in the era of big data, and with the continuous development of Internet of Things technology, a new computing mode of crowd-sensing has emerged. People use mobile devices or smart wearable devices to collect data such as temperature, humidity, noise, geographic location, etc. around the environment, and transmit them to data collectors such as servers. The server can statistically analyze the city environment and traffic conditions, predict future trends, and thus optimize the construction of smart cities, provide more convenient life and service experience.

[0004] On the other hand, the data left in the network also contains great value. Through data mining technology, the user's search engine settings, web browsing records, online shopping records can be analyzed to find out the popularity of products, the relevance between commodities, etc. It is beneficial for service providers to deeply understand user preferences, optimize product services, improve user experience and increase their own benefits. In the field of medical health, collecting patient condition, physical characteristics, etc. data is helpful for medical institutions to develop more effective treatment plans. Medical institutions can also combine patient medical record data and genetic information to find the relevance between genes and diseases, provide disease risk assessment for other users' genetic testing, and play a good preventive role. In general, deep analysis of massive data has a positive role in promoting social governance, improving people's livelihood and the development of various industries.

[0005] In current big data applications, security technologies mainly focus on privacy protection when processing sensitive data, such as data desensitization, secure multi-party computation, federated learning, etc. These technologies aim to protect personal data privacy while enabling normal analysis and mining of big data, and are referred to as privacy-preserving data analysis, which is a key trend in the development of big data technology. Although privacy protection measures for user data may affect the accuracy of data analysis, such as data desensitization may cause some user information to be lost, data analysis is usually based on a large amount of user data and aims to obtain overall statistical information and predict future trends, rather than analyzing individual users. Therefore, reasonable privacy protection technologies at the individual data level have relatively limited impact on overall data analysis results, and user privacy security and big data statistical results can be well coordinated.

[0006] The application of privacy-preserving data analysis technology is beneficial to both users and service providers. For service providers, applying privacy protection technologies during data processing can avoid losses caused by privacy breaches, and focusing on user privacy issues can also help to obtain more user data and optimize service quality. For users, privacy protection technologies can prevent privacy breaches during data collection and analysis, and safe data sharing can also promote service providers to improve products and enhance user experience. Therefore, privacy protection technologies have become an important driving force for the development of the big data industry, and research on this technology is of great significance, mainly including privacy models, definitions, usage scenarios, and the effectiveness of data analysis results.

[0007] Therefore, how to apply privacy protection technologies, how to ensure user privacy is not disclosed when publishing trajectory data, and how to meet different privacy needs of users, effective privacy protection measures need to be taken when publishing and utilizing trajectory data, while protecting individual privacy and maximizing the retention of useful information in trajectory data, have become one of the challenges that need to be solved. SUMMARY

[0008] The purpose of the present application is to provide a trajectory data publishing method based on personalized local differential privacy, which can process data in a localized scenario using existing privacy protection technologies and synthesize trajectories at the third-party data collection end, enabling wider application.

[0009] To achieve the above technical purposes, the technical solution adopted by the present application is:

[0010] A trajectory data publishing method based on personalized local differential privacy, the trajectory data publishing method comprising the following steps:

[0011] S1, discretize the geographical space according to the number of grids, and organize the geographical space into a plurality of grids of the same size;

[0012] S2, convert the trajectory data information composed of latitude and longitude into a one-dimensional array composed of grid indexes index;

[0013] S3, according to the privacy budget selected by the user, perform data privacy processing operation in the local environment, report the obtained noise vector to the third-party data collector, and perform noise vector correction and aggregation operation by the third-party data collector, and perform publishable trajectory data sampling operation according to the aggregated data.

[0014] Further, in step S3, according to the privacy budget selected by the user, the process of performing data privacy processing operation in the local environment and reporting the obtained noise vector to the third-party data collector includes the following steps:

[0015] A31, each participant u i selects a privacy budget ε according to his own protection intention strength i i ∈{ε1,ε2,ε3,…,ε A}, where {ε1,ε2,ε3,…,ε A} represents the set of privacy budgets to be selected, and A represents the total number of privacy budgets;

[0016] A32, slice the trajectory data converted into a one-dimensional array to obtain the position information combination of adjacent two time points;

[0017] A33, for each position information combination, use the frequency estimation method based on the OUE protocol to calculate v=n g ×(α-1)+(β-1) in the local environment, where α is the position information of the previous time point, β is the position information of the next time point, and v is the corresponding encoded position; One-Hot encoding is performed on v, and the encoding result is a one-dimensional array, whose length is n g 2 , n g is the number of grids;

[0018] A34, perturb the encoding result according to the following formula, and send the perturbed noise vector to the third-party data collector:

[0019]

[0020] In the formula, Pr[B ′ [θ]=1] represents the probability of B ′ [θ]=1, B ′ [θ] represents the result of perturbing the one-dimensional array θ position, B[θ] represents the one-dimensional array obtained after One-hot encoding, p and q represent the perturbation probability calculated, and ε i represents the privacy budget.​

[0021] Further, the process of grouping the third-party data collectors to correct and aggregate the noise vectors in step S3 includes the following steps:

[0022] B31, collect the noise vectors, and group the noise vectors according to the privacy budget ε i selected by the user according to different groups; i

[0023] B32, sum the noise vectors in the same group to obtain the value of each position combination, and correct the frequency of the position information combination according to the formula

[0024] B33, divide the frequency by the number of noise vectors in the current group to obtain the frequency vector of the position combination information between the previous time and the next time, and record the frequency vector of the first group;

[0025] B34, transform the frequency vector into an n g ×n g two-dimensional matrix, which is the joint probability distribution matrix P(x, y) of the position at the previous time and the position at the next time under the current privacy budget, and divide each value of the joint probability distribution matrix by the marginal distribution probability P(x) at the previous time to obtain the conditional probability distribution

[0026] B35, use the frequency vector of the first group to calculate the marginal distribution probability matrix at the first time and the transition probability matrix under the current privacy budget;

[0027] B36, group and aggregate the first-time position distribution and the transition probability matrix under each privacy budget according to the formula , where a represents different grouping conditions, and Var represents variance, to obtain the final aggregated first-time position distribution and transition probability matrix.

[0028] Further, the process of sampling the publishable trajectory data according to the aggregated data in step S3 includes the following steps:

[0029] C31, sample a plurality of starting points sp according to the first-time position distribution;

[0030] C32, for each starting point sp, select the sp-th row in the aggregated conditional probability matrix, randomly sample the position information np at the next time point, and take np as the position information at the previous time for the next sampling, and repeat the sampling until the position information of all time nodes of a trajectory is completed.

[0031] ​​C33, repeat step S32 to obtain the publishable trajectory data corresponding to all starting points.

[0032] Compared with the prior art, the application has the following beneficial effects:

[0033] Firstly, the personalized local differential privacy trajectory data publishing (PLDP-TDP) method based on the application, based on the OUE protocol, designs a new frequency estimation method, thereby completing the multi-time period trajectory information statistics;

[0034] Secondly, the personalized local differential privacy trajectory data publishing method based on the application, when the trajectory point information is counted, abstracts the trajectory point into a discretized graph of geographic space, improves the data usability, and reduces the data dimension.

[0035] Thirdly, the personalized local differential privacy trajectory data publishing method based on the application, when the personalization is realized in the local environment, sets that the user can allocate the privacy budget according to the own will, provides the user with sufficient protection strength distribution, and meets the personalized local differential privacy demand;

[0036] Fourthly, the personalized local differential privacy trajectory data publishing method based on the application allows the participants to select different privacy protection budgets based on the own will, is suitable for the scene that the protection wills of all parties are different; and effectively fuses the data processed by the different protection strength privacy, realizes the personalized local differential privacy trajectory data publishing, thereby can obtain the publishable trajectory data under the condition of guaranteeing the data privacy security and meeting the user personal demand; the application verifies that the scheme has good effects in the data practicability, the personalized effect and the like through the test on a large number of real data sets. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 The personalized local differential privacy trajectory data publishing method based on the application is a whole flowchart.

[0038] Figure 2 The user end flowchart of the application example is shown.

[0039] Figure 3 The data aggregation party flowchart of the application example is shown. DETAILED DESCRIPTION

[0040] The embodiments of the application are further described in detail below with reference to the accompanying drawings.

[0041] Reference Figure 1The application discloses a trajectory data publishing method based on personalized local differential privacy, and the trajectory data publishing method comprises the following steps:

[0042] S1, geographic space discretization, the geographic space is organized into a plurality of squares or other shaped geometric structures.

[0043] S2, the trajectory data information composed of longitude and latitude is converted into a one-dimensional array composed of grid serial numbers index.

[0044] S3, the client selects a privacy budget and performs data privacy processing operation in a local environment, and then reports a noise vector to a third-party data collector.

[0045] S4, the third-party data collector groups and performs data correction and aggregation operation.

[0046] S5, the server end performs publishable trajectory data sampling operation according to the aggregated data.

[0047] In step S3, the data processing process of each participant privacy protection technology is as follows:

[0048] S31, each participant u i selects a privacy budget epsilon according to the strength of his own protection intention i , wherein epsilon i ∈{epsilon1, epsilon2, epsilon3, …, epsilon A}.

[0049] S32, the converted trajectory data is subjected to slicing processing to obtain position information combination of adjacent two time points, that is, if a trajectory has 16 time nodes, there are 15 combination results.

[0050] S33, for each position combination, a frequency estimation method based on the OUE protocol is used in a local environment to calculate

[0051] v=n g ×(alpha-1)+(beta-1) wherein alpha is previous time position information, beta is next time position information, v is obtained by One-Hot coding, and the length is n g 2 , and n g is the number of grids.

[0052] S34, the coding result is disturbed according to .

[0053] S35, the disturbed noise vector is sent to the third-party data collector.

[0054] In step S4, the third-party data collector (i.e., the server side) corrects the noise data and performs grouping aggregation as follows:

[0055] S41, the server side groups the noise vectors according to the privacy budget ε i selected by the user according to different groups. i

[0056] S42, the server side first sums the noise vectors of the same group to obtain the value of each position combination, and then corrects the frequency of the position combination according to the formula .

[0057] S43, the server side divides the frequency by the number of noise vectors in the current group to obtain the frequency value of the combination.

[0058] S44, the server side reshapes the frequency vector into an n g × n g two-dimensional matrix, i.e., the joint probability matrix of the previous time position and the next time position under the current privacy budget, and divides each value of the joint distribution probability matrix by the marginal distribution probability of the previous time to obtain the conditional distribution probability.

[0059] S45, the first time marginal distribution probability matrix under the current privacy budget is calculated.

[0060] S46, the first time position distribution under each privacy budget grouping and the transition probability matrix are weighted and grouped according to the formula , where a represents different grouping conditions, and Var represents variance, to obtain the final first time position distribution and transition probability matrix.

[0061] In step S5, the server side performs the trajectory data sampling process as follows:

[0062] S51, the server side samples a series of starting points sp according to the first time position distribution.

[0063] S52, next, for the starting point sp, the sp-th row is selected in the aggregated conditional probability matrix, and the position information np of the next time point is randomly sampled, and np is taken as the previous time position information for the next sampling, i.e., the np-th row is selected, and this process is repeated until the position information of all time nodes of a trajectory is completed. If a row of the aggregated conditional probability matrix is all 0, it means that no transition occurs at the next time from the previous time position, and the position of the next time is the position of the current time.

[0064] S53, the S52 process is repeated for each starting point sp, and a series of publishable trajectory data is finally obtained.​

[0065] In combination Figure 2 , the privacy budget selection of the client in the local scenario and the operation flow steps of the data privacy processing method are as follows:

[0066] Step one: according to the grid number n g , the geographical space is divided into squares or other geometric figures of the same size.

[0067] Step two: convert the latitude and longitude trajectory information into grid serial number information.

[0068] Step three: the user selects the privacy budget epsilon i .

[0069] Step four: slice the trajectory, and for each time point combination, perform the processes of encoding, perturbation and reporting.

[0070] Step five: determine whether the current trajectory is processed, if not, continue to process the next slice, if yes, end.

[0071] In combination Figure 3 , the specific flow steps of the server in the method of data correction, aggregation and sampling are as follows:

[0072] Step one: collect the noise vector epsilon i reported by the client, and group according to the privacy budget.

[0073] Step two: correct each group according to the formula .

[0074] Step three: calculate the first moment position matrix and transition probability matrix of each group.

[0075] Step four: aggregate the calculation results of all groups according to , and then sample the publishable trajectory data.

[0076] According to the derivation and calculation, when the differential privacy technology is used, although the unbiased estimate about the mean can be obtained, the accuracy will decrease. Therefore, the effectiveness of the present application will be evaluated through experiments, and the scientific credibility of the present application in use will be measured.

[0077] The following is the experimental scene setting of the present application and the results obtained by the experiment. The simulation experiment uses the public data set taxi-trajectory-data, which provides an accurate data set describing the trajectories of all 442 taxis operating in the city of Porto, Portugal for a whole year (from July 1, 2013 to June 30, 2014), about 104W trajectories. At the same time, it is assumed that the experiment contains 104W clients, each of which has 16 time nodes and 12 grid quantities. Table 1 lists the data validity of data protection and the MSE of the final aggregated sampling results under different privacy budgets selected by the client.

[0078] After obtaining the transition probability model, the experiment design samples 1W trajectory data using the model, and according to the time point grouping, the distribution of each geographic space is counted and compared with the original data to obtain the value of MSE. The smaller the MSE value, the smaller the noise value added, the higher the accuracy of the model, and the smaller the error between the estimated sampling data and the real data. Correspondingly, the larger the value, the larger the error.

[0079] Table 1 Data validity of data protection under different privacy budgets

[0080] ε = 1 ε = 2 ε = 3 ε = 4 ε = 5 MSE 0.004 0.0018 0.001 0.0005 0.0002

[0081] As can be seen from Table 1, as the privacy budget ε increases, the MSE value becomes smaller and smaller. This means that as the noise value decreases, the accuracy of the model is higher, and the error between the estimated sampling data and the real data is smaller and smaller, thereby proving the relative practicality of the data.

[0082] In order to verify the individualization effect of the present application, the change of MSE under different privacy budget combination conditions is carried out.

[0083] Table 2 Change of MSE under the same privacy budget combination condition

[0084]

[0085] As can be seen from Table 2, by selecting the same ε proportion, as the value of ε becomes larger and larger, the value of MSE becomes smaller and smaller. This means that when the user selects the same proportion, the larger the ε, the higher the accuracy of the transition probability model. Because the same sample and the same proportion, the larger the privacy budget, the less noise is added, which reflects that the value of MSE is also smaller.

[0086] Those skilled in the art will appreciate that embodiments of the application can be readily used as software, hardware, or a combination of software and hardware. In one embodiment, the application can be implemented in software and / or firmware. In addition, the software implementation can be implemented by one or more computer programs.

[0087] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart

[0088] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart

[0089] The computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart block or blocks. Figure 1 one or more flowcharts and / or blocks Figure 1 means for functionally implementing the steps listed in the flowchart

[0090] While the preferred embodiments of the application have been described, additional variations and modifications can be employed. Therefore, the terms and expressions

[0091] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method for publishing trajectory data based on personalized local differential privacy, characterized in that, The trajectory data publishing method includes the following steps: S1. Discretize the geospatial space according to the number of grids, and organize the geospatial space into several grids of the same size; S2. Convert the trajectory data information composed of latitude and longitude into a one-dimensional array composed of grid indexes; S3. Based on the privacy budget selected by the user, perform data privacy processing operations in the local environment, report the obtained noise vector to the third-party data collector, and the third-party data collector will perform noise vector correction and aggregation operations in groups, and perform publishable trajectory data sampling operations based on the aggregated data. In step S3, the process by which the third-party data collector performs noise vector correction and aggregation operations in groups includes the following steps: B31, collect noise vectors, based on the user-selected privacy budget ε i The noise vector is adjusted according to the privacy budget ε, depending on the different conditions. i Grouping; B32 sums the noise vectors of the same group to obtain the combination of each position. Value, according to the formula The frequency of the corrected location information combination is obtained, where p and q represent the calculated perturbation probabilities; B33, divide the frequency by the number of noise vectors in the current group to obtain the frequency vector of the position combination information of the previous time and the next time, and record the frequency vector of the first group at the same time. B34 transforms the frequency vector into n g ×n g This is a two-dimensional matrix, which is the joint probability distribution matrix P(x,y) of the previous and next time step positions under the current privacy budget. Dividing each value of the joint probability distribution matrix by the marginal probability P(x) of the previous time step yields the conditional probability distribution. B35, using the frequency vectors of the first group, calculate the edge distribution probability matrix and transition probability matrix at the first time step under the current privacy budget condition; B36, for each privacy budget group, the first-time position distribution and transition probability matrix are calculated according to the formula. We perform weighted grouping aggregation, where 'a' represents different grouping cases and 'Var' represents variance, to obtain the final aggregated first-time position distribution and transition probability matrix.

2. The trajectory data publishing method based on personalized local differential privacy according to claim 1, characterized in that, In step S3, the process of performing data privacy processing operations in a local environment based on the user's selected privacy budget and reporting the resulting noise vector to the third-party data collector includes the following steps: A31, each participant u i Choose your privacy budget ε based on your level of protection. i , ε i ∈{ε1,ε2,ε3,…,ε A }, where {ε1,ε2,ε3,…,ε A } represents the set of privacy budgets to be selected, and A represents the total privacy budget. A32 slices the trajectory data, which is converted into a one-dimensional array, to obtain a combination of position information from two adjacent time points. A33, for each combination of location information, calculate v=n using a frequency estimation method based on the OUE protocol in the local environment. g ×(α-1)+(β-1), where α is the position information of the previous time step, β is the position information of the next time step, and v is the corresponding encoded position; one-hot encoding is performed on v, and the encoded result is a one-dimensional array with a length of n. g 2 n g It is the number of grid cells; A34, the encoded result is perturbed according to the following formula, and the perturbed noise vector is sent to a third-party data collector: In the formula, Pr[B ′ [θ] = 1 represents B ′ The probability that [θ] = 1, B ′ [θ] represents the result of the perturbation of the one-dimensional array θ, B[θ] represents the one-dimensional array obtained after one-hot encoding, p, q represent the calculated perturbation probabilities, and ε i Represents the privacy budget.

3. The trajectory data publishing method based on personalized local differential privacy according to claim 1, characterized in that, Step S3, the process of sampling publishable trajectory data based on the aggregated data, includes the following steps: C31, several starting points sp are sampled based on the position distribution at the first moment; C32, for each starting point sp, select the sp-th row in the aggregated conditional probability matrix, randomly sample the position information np of the next time point, use np as the position information of the previous moment before the next sampling, repeat the sampling until the position information of all time points of a trajectory is completed; C33, repeat step S32 to obtain publishable trajectory data corresponding to all starting points.

Images