Local differential privacy protection method and system for position data

Abstract

The invention designs a local differential privacy protection method and a local differential privacy protection system for position data, and provides an efficient method for collecting user position information and counting user distribution in a whole area in a local differential privacy application scene. According to the method, a two-stage acquisition strategy is used, in the first stage, a discrete local differential privacy algorithm is used for acquiring user distribution information of a global map, and in the second stage, a continuous local differential privacy algorithm is used for acquiring accurate distribution information of an area with high user density distribution. The continuous local differential privacy algorithm is firstly provided by the invention. And finally, the collector cooperatively calculates the user position distribution by combining the estimation results of the two stages through modes such as maximum likelihood and an EM (Expectation Maximum) algorithm and the like. The acquisition strategy can prove that differential privacy is met, and an accurate distribution estimation result is obtained. A client and server architecture is adopted, data storage, processing, transmission and release modules are clear, and integration is easy to realize.

Description

Technical Field

[0001] The present invention belongs to the field of computer science and information security technology. In the scenario of mobile device data collection, a method for secure collection and trusted release of location data based on local differential privacy protection technology is proposed. Under the premise of ensuring that the original location data of individuals is not leaked, the interval query and spatial density release of group distribution are supported. It can be proved that the present invention can be used to protect the privacy security of user location data, and the published aggregated data has high accuracy and strong practicality. Background Art

[0002] Differential privacy is one of the fundamental theories in the field of privacy protection. Its principle is to add carefully calculated noise to the original real data so that the data protection effect can be quantified and has a rigorous mathematical proof. Specifically, after the data center obtains the collection of all user sensitive data, it needs to inject random noise into the information to be released to ensure that even if the attacker has an adjacent data set, he cannot obtain effective information gain from the published perturbed information. The size of the added noise in the data is cleverly designed to improve the availability of the perturbed data while ensuring a certain degree of privacy.

[0003] Furthermore, the above differential privacy technology assumes that the data center / data collector is completely trustworthy, but due to objective phenomena such as internal leaks or network attacks, it is difficult to confirm and find trusted data collectors in reality. Local differential privacy, as a localized protection technology, avoids the reliance on trusted collectors. It directly performs privacy processing on sensitive data on the user client (mobile app, browser), inheriting the strict and quantifiable privacy protection characteristics of differential privacy, while avoiding the privacy leakage threats that may be brought about by centralized storage.

[0004] Currently, location data is the most common and frequently collected personal sensitive data. Network service providers or government organizations hope to collect the location information of group users to improve their recommendation systems, traffic planning, and equipment deployment. Using local differential privacy technology to collect the location information of the target group will effectively protect personal privacy, while aggregating disturbance data can also achieve the purpose of collection. Therefore, appropriate methods and systems are needed to complete the process of collecting and analyzing location data, while achieving a balance between data privacy and availability as much as possible. Summary of the invention

[0005] The purpose of the present invention is to realize a method for secure collection and analysis of location data in local differential privacy application scenarios. This method is based on continuous and discrete random perturbations and the EM algorithm, which can ensure that the data collection process meets the local differential privacy security definition or the requirements of variant differential privacy definitions such as personalization, and complete statistical tasks such as urban geographic heat maps or spatial range queries through an aggregate estimation algorithm. The collection algorithm is deployed on the client, the aggregation algorithm is deployed on the server, and the transmission process supports trusted methods such as encryption.

[0006] The technical solution adopted by the present invention is as follows:

[0007] A local differential privacy protection method for location data includes a two-stage local differential privacy location collection process, wherein:

[0008] Phase 1 includes:

[0009] The client receives data collection tasks from the server, where the area is the original city or a larger map;

[0010] The client calls the local differential privacy discrete perturbation algorithm to discretely perturb its own location information;

[0011] The client sends the disturbed security data to the server through a trusted channel;

[0012] Phase II includes:

[0013] The client receives reassembled map information from the server. The area is a small sub-map of the assembly, that is, the assembly map;

[0014] The client calls the local differential privacy continuous perturbation algorithm to continuously perturb its own location information;

[0015] The client sends the disturbed security data to the server through a trusted channel.

[0016] Furthermore, the local differential privacy continuous perturbation algorithm divides the mosaic map area into two probability intervals. When the position data is perturbed, it is perturbed to a new position close to the original data with a high probability, and to other remaining positions far away with a low probability.

[0017] Furthermore, the probability density function of all positions on the mosaic map has only two probability values, and the quotient of the two probability values ​​is less than or equal to e ∈ .

[0018] Furthermore, the method further includes the server selecting high-density areas from the original disturbance space and combining them into the mosaic map, including the following steps:

[0019] The server discretizes the original map area through grid processing to obtain coarse-grained sub-areas and sends them to the client;

[0020] The server estimates the approximate number of people in each sub-area based on the disturbance information submitted by the client, ignores sub-areas with a population below the threshold, and selects areas with high population density;

[0021] The server assembles the filtered areas to obtain a new map area, i.e., the assembled map, and sends it to the client.

[0022] Furthermore, the server estimates the density of the new map area from the disturbance information submitted by the client using the EM algorithm, and then converts the new map into the original map to obtain the final user statistical distribution information of the map area.

[0023] Furthermore, the discretization refers to dividing the map into grids of the same size, and all continuous position data in each grid are replaced by the number of the grid.

[0024] Furthermore, high-density areas are screened out and grouped through the information collected in the first stage; the grouping refers to translating the sub-maps represented by the grid areas with a large number of people according to the distribution of the grids in the original map, while maintaining the position grid distribution as much as possible, and synthesizing multiple sub-maps into a new map.

[0025] Furthermore, in the first stage, the server issues data collection tasks to all clients, divides the scope of the map area to be counted, and forms several larger geographical locations; after receiving the data collection task, the client responds to the first stage collection task with a certain probability through the random number generator. In the first stage, this type of client encodes the location according to the divided area, calls the local differential privacy frequency estimation algorithm (discrete perturbation algorithm) for perturbation, and sends the perturbation data to the server through a trusted channel after completion.

[0026] Furthermore, in the second stage, the server estimates the number of users in each area based on the disturbance data obtained in the first stage, selects the location areas with a large number of people, and combines these areas to obtain a synthetic area. The local continuity perturbation function (LCPF) is calculated based on the synthetic area and the function is sent to all clients. If the number of people in a certain area is lower than the preset threshold, the area is ignored. After the client receives the data collection task, the remaining clients that did not participate in the first stage collection task will respond to the second stage task. The client encodes and perturbs its own location data according to the local continuous perturbation function and the synthetic area, and then sends the perturbation data to the server through a trusted channel. The server receives the perturbation data and uses the EM algorithm to estimate the user location distribution on the synthetic area.

[0027] Furthermore, in the first stage, the range of the map area to be counted is divided into the entire collection area of ​​the same size by using the grid method, and the continuous area is discretized in this way. The encoding means that if the position is in the map area represented by a grid, the position is converted into the number of the grid. The frequency estimation algorithm refers to the existing local differential privacy mechanism GRR (General Random Response) and OLH (Optimal Local Hash), etc., which are used to perturb discrete data and count the frequency.

[0028] Furthermore, in the second stage, the grouping refers to removing the grids with few users in the original map, and then making the map compact again by translating left and right and up and down. The local continuous perturbation function LCPF refers to the continuous perturbation probability density function applied to the new map after grouping.

[0029] A client includes:

[0030] The original data storage module is responsible for storing and updating the user's original location data.

[0031] The local differential privacy algorithm module is responsible for storing the local differential privacy algorithm, which includes discrete perturbation algorithm and continuous perturbation algorithm. The user's sensitive data is perturbed using the corresponding budget factor.

[0032] The encrypted transmission module is responsible for encrypting and transmitting the user-perturbed data to the server.

[0033] A server, comprising:

[0034] The map information processing module is responsible for dividing the geographical location areas to be counted and transmitting the division results to the client. After the number of people in each area is counted, the areas where the number of people reaches the threshold are grouped into maps.

[0035] The perturbation function calculation module is responsible for calculating the parameters of the local continuous perturbation function LCPF in the present invention according to the privacy budget setting and the mosaic map, and sending them to all clients in the second phase of collection.

[0036] The disturbance data aggregation processing module is responsible for processing the disturbance data collected in the first and second stages. The data in the first stage can be aggregated to obtain the number of people in each divided area, and the data in the second stage can be used to estimate the overall user distribution density.

[0037] The data publishing module is responsible for publishing the statistical information of the collection results, including geographic heat maps, ranking of popular areas, number of people in any interval, and other information.

[0038] A local differential privacy protection system for location data includes the client and server mentioned above.

[0039] Compared with the prior art, the advantages of the present invention are mainly reflected in:

[0040] 1) The location data collection method of the present invention meets the local differential privacy protection requirements, has high privacy security, and can attract more users to participate in the location data sharing task.

[0041] 2) The availability of the collected data is very high. Under the condition of high privacy protection, data collectors can still obtain high-precision statistical information of group location data. Specifically, the idea of ​​two-stage multi-granularity is introduced in the collection method. Through the data collection in the first stage, the area with a large number of users is screened out, which effectively reduces the scope of the collection space and increases the accuracy of the data collected in the second stage. The idea of ​​continuous perturbation is introduced in the algorithm design to avoid the loss of dimensional correlation caused by the grid division setting, and improve the accuracy of two-dimensional density estimation based on local differential privacy.

[0042] 3) The complexity of the algorithms in this system is only O(1) on the client side and O(n) on the server side. 2 ) level, high efficiency and high speed. The system includes data storage, processing, transmission and publishing modules, with clear functions and easy deployment and implementation. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] Figure 1 This is a schematic diagram of the architecture for collecting and analyzing location data using local differential privacy technology.

[0044] Figure 2It is a schematic diagram of the local continuous perturbation function (LCPF) of position data. DETAILED DESCRIPTION

[0045] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the present invention is further described in detail below through specific embodiments and drawings.

[0046] The local differential privacy protection system for location data of the present invention consists of two parts: a client and a server:

[0047] 1. Client

[0048] The client is located on the user's device, which can be a mobile app, browser plug-in, etc. The user's location or positioning data is only stored on the client, allowing the user to fully grasp their privacy-sensitive data. When the current location data needs to be shared, the user calls the local differential privacy algorithm to perturb the data according to parameters such as the privacy budget factor ∈ and the perturbation function, and finally sends the perturbed secure data to the data collector through an encrypted channel.

[0049] For the composition and architecture of the client's technical solution, see Figure 1 , mainly including the original data storage module, the local differential privacy algorithm module and the encrypted transmission module. The original data storage module obtains the current user location data by calling the GPS and other interfaces and stores it in a trusted environment. The local differential privacy algorithm module stores the local continuous perturbation algorithm and the existing GRR and OLH frequency estimation algorithms. The perturbation process of the local continuous perturbation algorithm LCPF can be used Figure 2 The probability density function shown in the figure shows that the perturbation of location data using this algorithm meets the local differential privacy protection level. The encrypted transmission module is responsible for sending the perturbed data to the data collector through a trusted channel.

[0050] 2. Server

[0051] The server is controlled by the data collector, whose purpose is to obtain statistical information of all user location data. The statistical information will be calculated from the perturbed data protected by the local differential privacy algorithm provided by the user. The accuracy of this statistical information depends on the number of users and the size of the privacy budget.

[0052] For the composition architecture of the server-side technical solution, see Figure 1, mainly including map information processing module, perturbation function calculation module, perturbation data aggregation processing module and data publishing module. The map information processing module is responsible for dividing the geographical location area to be counted and transmitting the division results to the client. After counting the number of people in each area, the area where the number of people reaches the threshold will be grouped. The perturbation function calculation module uses the grouped map information provided by the map information processing module, and calculates the parameter value of the local continuous perturbation function (LCPF) according to the privacy budget, and then returns it to the client. The perturbation data aggregation processing module is responsible for aggregating users with the same protection level and the same protection range into a group, bucketing their perturbation data using the grid division method, and obtaining a two-dimensional histogram of the perturbation data distribution. The data publishing module is responsible for using the EM algorithm to estimate the histogram of the real location distribution density. By merging the histograms of multiple groups, the target statistical information is obtained and published.

[0053] The following will provide an exemplary explanation of the specific implementation of the key technical modules described in the content of the invention, but this explanation does not limit the scope of the invention. The position data perturbation algorithms used in the two stages are mainly introduced.

[0054] 1. Explain the main process of the technology:

[0055] 1.1) Statistical task release

[0056] The server sends the grid information T of the map to be counted and the privacy budget factor ∈ to all clients, such as Figure 1 Step ①. The privacy budget ∈ refers to the quantitative value of the degree of privacy protection of the local differential privacy model. The smaller this value is, the higher the level of local differential privacy protection of the client location information.

[0057] 1.2) Use frequency estimation algorithm to perturb the position number

[0058] A portion of clients are randomly selected to participate in the first phase of collection. After receiving the map grid information T, they determine which grid their own location information v is included in and replace v with the number t of the grid area. Then, according to the privacy budget ∈ and the size of the grid number |T|, they decide to use the OLH or GRR algorithm to perturb t. For example, when |T|>3e ∈ +2, OLH is used to randomly perturb t to

[0059] 1.3) Map area selection and assembly

[0060] In the disturbance data aggregation processing module, the server collects the client data from the first stage. The number of people in each grid is counted by the local differential privacy estimation algorithm. When the number of people in a grid does not exceed the threshold θ (for example, 50), this grid is ignored. In the map information processing module, the server merges the remaining grids after screening into a new map by translating left and right and up and down, that is, obtaining the assembled map area S. For example, the original map contains 81 (9*9) sub-areas before and after division, and only 9 sub-areas after screening, which can be converted into a 3*3 continuous area by translation.

[0061] 1.4) Continuous perturbation algorithm and LCPF parameter setting

[0062] This algorithm is stored in the local differential privacy algorithm module of the user client. The input is the user's location data v and the privacy factor ∈. The output is the perturbed data. Specifically, the intermediate perturbation process can be expressed as constructing a central symmetric graph H with v as the center v , the figure can be a rectangle, a circle, or a centrally symmetrical polygon. Here, we take the figure as a rectangle as an example, let, with probability p in H v A point is randomly selected from the geographic location area of ​​the graph as the output result, or it is selected with probability q in the combined map area S and H v A point is randomly selected from the non-intersecting area as the output result. The above perturbation process can be expressed by the following probability density function pdf(·):

[0063]

[0064] Figure 2 Shows when H v The probability density function is a rectangle or a circle. By adjusting the numerical ratio of probability p and q to be less than e ∈ , it can be proved that the algorithm satisfies the local differential privacy definition.

[0065] pdf(·) is calculated by the server and sent to the client, where:

[0066] p=e ∈ / (|S|-b 2 +b 2 e ∈ )

[0067] q=1 / (|S|-b 2 +b 2 e ∈ )

[0068]

[0069] The input of the continuous perturbation algorithm is v,∈, and the output is

[0070] 1.5) The server estimates the probability density distribution on the map based on the disturbance results

[0071] The server collects the data received in the second stage in the disturbance data aggregation processing module. Use the EM algorithm to iteratively estimate and obtain the probability density of the map area, that is, the overall user distribution density. The specific implementation of the EM algorithm is the same as that in the local differential privacy algorithm SW. The EM algorithm is an expectation maximization algorithm. By treating the perturbed position data of all users as random samples drawn from the original overall user density distribution function, the density distribution is estimated through iterative optimization to maximize the probability of extracting perturbed position data from the distribution. This process can be expressed by maximizing the maximum likelihood function:

[0072]

[0073] in Represents the overall user distribution density, Represents the sample obtained by random sampling perturbation under this density distribution probability.

[0074] Experimental data:

[0075] This section provides experimental data on 670,000 and 920,000 location data on the New York Taxi Public Dataset (https: / / www1.nyc.gov / site / tlc / about / tlc-trip-record-data.page) and Tokyo Foursquare Dataset (Yang Dingqi, Zhang Daqing, Vincent W, et al. Modeling User Activity Preference by Leveraging User SpatialTemporal Characteristics in LBSNs[J]. IEEE Transactions on Systems Man&Cybernetics Systems, 2014, 45(1):129-142). When the privacy budget is 0.5 to 2.5, the location data is securely collected and analyzed by the method of the present invention, and the results of calculating the mean absolute error (MAE) of the overall user distribution density using the interval query method are shown in Table 1.

[0076] Table 1

[0077] ∈＝0.5 ∈＝1 ∈＝2 ∈＝2.5 New York(MAE) 0.0065 0.0060 0.0042 0.0036 Tokyo(MAE) 0.0053 0.0048 0.0032 0.0029

[0078] The above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit the same. A person skilled in the art may modify or make equivalent substitutions for the technical solutions of the present invention without departing from the principle and scope of the present invention. The protection scope of the present invention shall be subject to the claims.

Claims

1. A local differential privacy protection method for location data, characterized in that: It includes a two-stage local differential privacy location collection process, where: Phase 1 includes: The client receives data collection tasks from the server, where the area is the original city or a larger map; The client calls the local differential privacy discrete perturbation algorithm to discretely perturb its own location information; The client sends the disturbed security data to the server through a trusted channel; The second phase includes: The client receives reassembled map information from the server. The area is a small sub-map of the assembly, that is, the assembly map; The client calls the local differential privacy continuous perturbation algorithm to continuously perturb its own location information; The client sends the disturbed security data to the server through a trusted channel.

2. The method according to claim 1, characterized in that The local differential privacy continuous perturbation algorithm divides the assembled map area into two probability intervals. When the position data is perturbed, it is perturbed to a new position close to the original data with a high probability, and to other remaining positions far away with a low probability.

3. The method according to claim 2, characterized in that The probability density function of all positions on the mosaic map has only two probability values, and the quotient of the two probability values ​​is less than or equal to e ∈ .

4. The method according to claim 1, characterized in that: The server also selects high-density areas from the original disturbance space and combines them into the mosaic map, including the following steps: The server discretizes the original map area through grid processing to obtain coarse-grained sub-areas and sends them to the client; The server estimates the approximate number of people in each sub-area based on the disturbance information submitted by the client, ignores sub-areas with a population below the threshold, and selects areas with high population density; The server assembles the filtered areas to obtain a new map area, i.e., the assembled map, and sends it to the client.

5. The method according to claim 4, characterized in that The server uses the EM algorithm to estimate the density of the new map area from the disturbance information submitted by the client, and then converts the new map into the original map to obtain the final user statistical distribution information of the map area.

6. The method according to claim 4, characterized in that The discretization refers to dividing the map into grids of the same size, and all continuous position data in each grid are replaced by the number of the grid.

7. The method according to claim 4, characterized in that The high-density areas are screened out and grouped through the information collected in the first stage; the grouping refers to translating the sub-maps represented by the grid areas with a large number of people according to the distribution of the grids in the original map, while maintaining the position grid distribution as much as possible, and synthesizing multiple sub-maps into a new map.

8. A client, characterized in that: include: The original data storage module is responsible for storing and updating the user's original location data; The local differential privacy algorithm module is responsible for storing the local differential privacy algorithm, including the discrete perturbation algorithm and the continuous perturbation algorithm, and perturbing the user's sensitive data using the corresponding budget factor; The encrypted transmission module is responsible for encrypting and transmitting the user-perturbed data to the server.

9. A server, characterized in that: include: The map information processing module is responsible for dividing the geographical location area to be counted and transmitting the division results to the client. After the number of people in each area is counted, the area with the number of people reaching the threshold is grouped into maps; The perturbation function calculation module is responsible for calculating the parameters of the local continuous perturbation function according to the privacy budget setting and the assembly map, and sending it to all clients in the second phase of collection; The disturbance data aggregation processing module is responsible for processing the disturbance data collected in the first and second stages, aggregating the disturbance data in the first stage to obtain the number of people in each divided area, and using the disturbance data in the second stage to estimate the overall user distribution density; The data publishing module is responsible for publishing the statistical information of the collection results, including geographic heat maps, ranking of popular areas, and the number of people in any interval.

10. A local differential privacy protection system for location data, characterized in that: It includes the client described in claim 8 and the server described in claim 9.

Images