Balltree-based differential privacy location protection method

Abstract

The application relates to the technical field of location privacy protection, and discloses a differential privacy location protection method based on a Balltree, which comprises the following steps: S1: receiving service request information containing a user identifier, a user real location and a query radius; S2: constructing a Balltree space partition structure based on historical or current user location data, wherein the Balltree comprises a plurality of spherical space partitions, each partition has a space centroid and a covering radius; S3: acquiring the covering radius of the corresponding partition according to the Balltree partition to which the user real location belongs, and using the radius r of the Balltree partition as a parameter of a differential privacy sensitivity function, namely Delta F=f(r); and S4: generating a disturbed location, which comprises: randomly sampling a disturbance angle and sampling a disturbance distance based on a disturbance scale. The application combines the Balltree space partition and the differential privacy disturbance mechanism, thereby realizing flexible privacy protection for different regions and avoiding the problems of privacy leakage or query quality decline caused by a single disturbance scale.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of location privacy protection, in particular to a differential privacy location protection method based on Balltree. BACKGROUND

[0002] With the wide application of location services, user's location information is increasingly becoming important data. However, the processing and use of such location information also brings the risk of privacy leakage. In order to effectively protect user privacy, differential privacy (DP) technology has become one of the common solutions. Differential privacy technology ensures that even in the case of data leakage, attackers cannot infer the user's real information by randomly perturbing user data. However, in the field of location privacy protection, the existing differential privacy implementation method still faces some challenges and limitations.

[0003] The existing differential privacy protection scheme relies on fixed perturbation strength or global perturbation scale to protect user's location information. This method often cannot be adjusted according to the density difference of the area where the user is located, so as to cause the privacy protection to be not accurate enough. For example, in a dense area, too large perturbation affects the quality of service, while in a sparse area, too small perturbation cannot effectively protect privacy. In addition, some schemes generate perturbation by using Gaussian distribution, although this method is simple, but due to the long tail of Gaussian distribution, the perturbation distance is too large, thereby affecting the accuracy of the query result, especially in the case of high-precision positioning requirement, the service effect is difficult to meet the requirements. Further, the existing technology lacks sufficient consideration of the spatial distribution characteristics of geographical areas, and usually does not differentiate different areas, and cannot flexibly adjust the perturbation strength, which often leads to an imbalance between privacy protection and service quality in the case of highly concentrated or relatively sparse user location data. In addition, the existing technology often adopts the method of directly sending user location information to the service server, which not only exposes the user's real location, but also makes the privacy protection measures less effective in actual application. SUMMARY

[0004] In view of the deficiencies of the prior art, the present application provides a differential privacy location protection method based on Balltree, which solves the problem of balancing between privacy protection and query accuracy in the prior art.

[0005] To achieve the above purpose, the present application realizes the following technical scheme: a differential privacy location protection method based on Balltree, comprising the following steps:

[0006] S1: receiving service request information containing user identification, user real location and query radius;

[0007] S2: Construct a Balltree spatial partition structure based on historical or current user location data, the Balltree comprising a plurality of spherical spatial partitions, each partition having a spatial centroid and a coverage radius;

[0008] S3: According to the Balltree partition to which the user's real location belongs, obtain the coverage radius of the corresponding partition, the maximum noise scale of each circular partition Then, independently process the location of each partition, and perform individual noise disturbance on each location;

[0009] S4: Generate a disturbed location, including: randomly sampling a disturbance angle, sampling a disturbance distance based on the disturbance scale, and calculating the disturbed location based on the user's real location, the disturbance angle, and the disturbance distance;

[0010] S5: Send a service request containing the user's identity, the disturbed location, and the query radius to a location service server;

[0011] S6: Receive the service result returned by the server based on the calculation of the disturbed location.

[0012] Preferably, in step S2, the Balltree is constructed in the following manner: based on the centroid of the current unpartitioned location point set, select the two points farthest from the centroid as the center of the sub-region, and divide the remaining points into two subsets according to the shortest distance, recursively perform sub-tree construction until the set partition depth or the minimum number of points in each subset is met.

[0013] Preferably, the coverage radius of the circular partition is the maximum Euclidean distance from any point in the partition to the centroid of the partition.

[0014] Preferably, the disturbance scale is the ratio of the partition coverage radius to the preset privacy budget, used to control the intensity of location disturbance.

[0015] Preferably, the disturbance angle is obtained by uniformly distributed sampling within the range of 0 to 2π, and the radial noise is randomly generated from the noise scale interval [0, b].

[0016] Preferably, the disturbance distance is obtained by sampling a Laplace distribution with two-dimensional symmetry characteristics, which is centered on the real location and has an exponentially decreasing sampling probability with increasing distance.

[0017] Preferably, the disturbed location coordinates are calculated from the horizontal and vertical coordinates of the real location, the disturbance angle, and the disturbance distance, forming the disturbed location point used to replace the real location for participating in the query.

[0018] Preferably, the location service server performs a point-of-interest range query operation based on the disturbed location and returns the service result related to the disturbed location.

[0019] Preferably, the disturbance generation method meets the differential privacy definition and provides adaptive protection capability for different user density areas.

[0020] The application provides a Balltree-based differential privacy location protection method.

[0021] 1、The application adopts a technical scheme based on Balltree space division, achieves accurate division of user location information and dynamic disturbance control, and ensures privacy protection of user location data.

[0022] 2、The application realizes the balance between privacy protection and service quality by combining differential privacy technology and a dynamic disturbance scale adjustment scheme.

[0023] 3、The application introduces Laplace distribution when generating a disturbed location, ensuring the randomness and symmetry of the disturbance distance, thereby effectively hiding the real location of the user.

[0024] 4、The application sends the disturbed location to a location service server and makes a service request together with the query radius, effectively protecting the user privacy from being leaked while ensuring the effectiveness of the query result. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 The method steps of the application are shown in the figure. DETAILED DESCRIPTION

[0026] The technical solutions in the embodiments of the application will be described clearly and completely in conjunction with the drawings of the application specification. Obviously, the described embodiments are only a part of the embodiments of the application, not all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the application.

[0027] Please refer to the attached Figure 1 The embodiment of the application provides a Balltree-based differential privacy location protection method, including the following steps:

[0028] S1: receiving service request information containing user identification, user real location and query radius;

[0029] Firstly, the system receives service request information from the user client. The request information includes user identification, user real location and query radius. Through the request information, the system can obtain the user's location information and the range of the requested service, and then perform the next privacy protection processing according to the information.

[0030] In this embodiment, the request information sent by the client usually contains three parts: the unique identifier (UID) of the user, the real location coordinates of the user and the service range involved in the location query. Specifically, the location information of the user is usually represented as the horizontal coordinate and the vertical coordinate in the two-dimensional coordinate system, denoted as X=(x, y), wherein x and y represent the longitude and the latitude of the user respectively. The service radius r q represents the query range of the location query service, which is usually a circular area containing the current location of the user and the points of interest (POI) within a certain range around the user.

[0031] In some embodiments, the client request can also include other parameters such as the query type or priority of the user, depending on the needs of the specific service. However, the core content still contains the real location of the user and the query radius.

[0032] Specifically, the received service request information can be represented in the following set:

[0033] Q={UID, X=(x, y), rq};

[0034] Wherein, UID is the unique identifier of the user, X is the real location coordinates of the user, r q is the radius of the query service, which represents the range of the point of interest query.

[0035] In processing the request, the system first receives these basic information from the client, and then confirms the real location of the user through positioning technology. The location coordinates are usually provided in the form of longitude and latitude, or are converted according to the needs to adapt to the specific service environment. At this time, the query radius r q as the range parameter of the query service, defines the applicable area of the service, that is, the size of the service area based on the user location for query.

[0036] Generally, the accuracy of the user's real location is a key factor affecting the quality of service, so the system needs to ensure that the received location data is accurate and avoid the failure of location protection due to positioning errors. Therefore, the system will perform basic verification and confirmation when receiving client data, such as verifying the coordinate format of the user and the rationality of the radius value, etc.

[0037] As an option, the received request information may be pre-processed to ensure consistency, validity, and coordinate conversion or standardization in the background. For example, the location coordinates may be converted from GPS coordinates to a coordinate system conforming to a certain map system standard to ensure the accuracy of subsequent spatial division and location perturbation.

[0038] Specifically, the system processes each user's request independently through the received query request, and then performs the following privacy protection steps according to the user's location information, including Balltree spatial division and differential privacy perturbation calculation. At this time, the user's real location and query range become the key input of the privacy protection process.

[0039] In some embodiments, when the system receives the request, the system will obtain the corresponding perturbation scale based on the Balltree partition to which the user's actual location belongs. This process is based on the geographical area density where the user is located and the privacy protection requirements of the area, so different privacy protection strategies are applied to different areas.

[0040] In addition, as an option, the system may further preprocess and screen the received query request according to different privacy budgets and service types when receiving the request. For example, in the scenario of high privacy demand, the system may reduce the query radius to reduce the possible leakage of privacy information.

[0041] In summary, the core purpose of this step is to ensure that the service request information received by the system is complete and effective, and to provide accurate input for the subsequent privacy protection steps. By receiving the user's real location and query range, the system can effectively protect the user's privacy in the subsequent steps and improve the accuracy of the service.

[0042] In the implementation process, the technical details of this step include ensuring the accurate reception and processing of request information, and correctly passing it to the subsequent modules for spatial division, perturbation generation, and service query operations according to the user's location.

[0043] S2: Construct a Balltree spatial division structure based on historical or current user location data, the Balltree including a plurality of spherical spatial partitions, each partition having a spatial centroid and a coverage radius;

[0044] After receiving the service request from the user, the next step is to construct a Balltree spatial partition structure based on the user's historical or current location information. This process provides spatial structure support for subsequent privacy protection steps. By dividing the user's location into several regions with spatial characteristics, the system can more accurately perform privacy protection operations and improve efficiency.

[0045] In this embodiment, the main purpose of Balltree spatial partitioning is to organize user location data into an efficient data structure for fast querying and processing. Specifically, Balltree is a binary tree data structure, where each node represents a spatial region, and leaf nodes represent spherical regions containing multiple user locations. Each region has a center point and a radius, and the system can quickly determine the region where the user is located and the corresponding perturbation operation through this structure.

[0046] In some embodiments, the construction of Balltree can be based on an existing user location data set is performed. This data set contains historical location data of multiple users, where each location point X i = (x i , y i ) represents the geographical coordinates of a user.

[0047] Balltree construction steps

[0048] The process of constructing Balltree starts with calculating the centroid of all location data sets. The centroid C is the weighted average of all data points, representing the central location of the entire data set. The formula for calculating the centroid is as follows:

[0049]

[0050] where n is the number of location points in the data set, x i and y i represent the longitude and latitude of the i-th location point, respectively. By calculating the centroid, the system can understand the central tendency of the entire data set.

[0051] Next, the two points farthest from the centroid are selected as the initial partition centers. These two points are selected as the center points X p and X q of the first and second sub-regions, respectively, which are the pair of points farthest from the centroid. The purpose of this step is to increase the diversity of partitioning by dividing the data set into two larger regions, ensuring that each region contains a relatively uniform distribution of user locations.

[0052] In the following operation, the system divides the data set into two sub-regions based on the selected two partition centers X p and Xq The distances of all remaining points to the two center points are calculated. For each remaining point, the system selects the center of the partition that is closest to it and assigns the point to the corresponding region. The construction of each region relies on the distance relationship between the points in the region and the center points.

[0053] X r The distance of X p to X q and X p is d q and d r respectively. The point X i will be assigned to the region that is closer to it. For each location point, the partition that is closer in distance becomes the Balltree node that the point belongs to.

[0054] Recursive construction

[0055] This process is recursive. The system will continuously divide each sub-region further until a stopping condition is met, which is usually that the partitions reach a set maximum depth or that each sub-region contains a number of points below a certain pre-set value. The radius of each sub-region is determined by the maximum Euclidean distance between all points in the region and its center. Specifically, the radius r i of a region is the maximum distance between all points X j in the region and the center C i , i.e.,

[0056]

[0057] where X denotes all points in the i-th region, X j is the coordinate of the j-th point in the region, and C i is the center of the region.

[0058] In one possible implementation, the construction of the Balltree can be processed in parallel to accelerate the spatial partitioning of large-scale user location datasets. In this way, multiple sub-trees can be constructed simultaneously in a multi-core processor environment, thereby improving the efficiency of the construction process.

[0059] Flexibility of region partitioning

[0060] The flexibility of the Balltree structure lies in its ability to dynamically adjust the size of each region according to the actual user location dataset. For regions with dense locations, the system will generate smaller spatial partitions, ensuring that the user data in the more densely populated regions can be accurately partitioned. Conversely, for regions with sparse locations, the Balltree will generate larger partitions to avoid over-partitioning and wasting computational resources.

[0061] In some embodiments, the construction of Balltree is not limited to using static historical data sets, but can also be dynamically adjusted according to the real-time location of the user. For example, in large-scale applications, the system can update the Balltree in real time when the user queries to ensure the balance between query efficiency and privacy protection needs.

[0062] In summary, step S2 provides effective support for privacy protection through Balltree space partitioning. By dynamically partitioning user locations, the system can improve query efficiency and accuracy while ensuring privacy protection. This partitioning method is flexible and efficient, and can be applied to different sizes of user data sets and optimized according to different privacy needs.

[0063] S3: According to the Balltree partition to which the user's real location belongs, obtain the covering radius of the corresponding partition, and the maximum noise scale of each circular partition Then, process each partition's location independently, and perform individual noise perturbation on each location;

[0064] After completing the Balltree space partitioning, the next step is to obtain the corresponding partition radius according to the Balltree partition to which the user's real location belongs, and then calculate the perturbation scale. This step provides key parameters for subsequent perturbation generation and is the basis for the privacy protection process.

[0065] In this embodiment, the system first determines the area where the user's real location X is located by querying the Balltree data structure. At this time, the system will find the leaf node where the user's real location is located according to the spatial partitioning of each partition in the location data set. Each leaf node contains a spatial partition, which has a center point and a covering radius. In this process, the system will find the area where the user's real location coordinate X is located and extract the radius parameter r of the partition from the Balltree node of the area i .

[0066] Specifically, the radius r i of the area where the user's location X is located is determined by calculating the maximum Euclidean distance between all points in the area and its centroid. The radius r i is used to define the scale of the partition, representing the "density range" around the user's location. The radius r i of each area will affect the calculation of subsequent perturbation parameters.

[0067] Generally, if the user is located in a dense area in the data set, the area radius r i is small, indicating that the distribution of users in the area is more concentrated. Conversely, if the user is located in a sparsely populated area, the radius r iThe larger, the more dispersed the user's location in the region. In this way, the system can reasonably adjust the strength of the disturbance according to different spatial densities.

[0068] In some embodiments, each region of the Balltree is not fixed in size and can be dynamically adjusted according to real-time changes in user queries. For example, when a user requests a larger range of queries, the system will accordingly expand the range of the partition and obtain a larger radius value r i , and then adjust the disturbance parameter.

[0069] As an option, after obtaining the radius parameter r i , the system further calculates the disturbance scale b, i.e. the strength of the disturbance, according to the preset privacy budget ε. The disturbance scale b is calculated by combining the partition radius with the privacy budget:

[0070]

[0071] Where r i is the partition radius obtained in the foregoing step, and ε is the differential privacy budget, which controls the strength of the disturbance. The larger the privacy budget ε, the larger the disturbance scale b, and the higher the privacy protection strength, but the service accuracy brought by the disturbance may be reduced; conversely, the smaller the privacy budget, the smaller the disturbance scale, and the privacy protection strength is weakened, but the accuracy of the service result is higher.

[0072] In specific implementation, the privacy budget ε is usually set by the system according to specific application scenarios. For example, in some scenarios that require high privacy protection, a larger privacy budget may be used to ensure that the real location of the user is not disclosed. In some scenarios that require high service accuracy, a smaller privacy budget may be used to reduce the impact of the disturbance on the query result.

[0073] Calculation of the disturbance parameter and its role

[0074] At this time, the disturbance scale b calculated by the system will be a key parameter for subsequent disturbance generation, used to determine the range of the disturbance when generating the disturbance location. The relationship between the disturbance scale b and the partition radius enables the system to adjust the strength of the disturbance according to the density distribution of different regions, thereby improving the accuracy of the query result and user experience while ensuring privacy protection.

[0075] Specifically, in a dense region, the system will select a smaller disturbance scale b to keep the disturbance location close to the real location, thereby ensuring service quality. In a sparse region, the system will select a larger disturbance scale b to ensure the protection of user privacy in a wider range.

[0076] In summary, the key of this step is to calculate the perturbation scale by the partition radius provided by the Balltree space partition, which provides an effective privacy protection parameter for the subsequent perturbation generation process. In this way, the system can dynamically adjust the perturbation strength according to the density of different regions and the privacy needs of users, thereby ensuring the accuracy and efficiency of query services while protecting privacy.

[0077] S4: generating a perturbed position, including: randomly sampling a perturbation angle, sampling a perturbation distance based on the perturbation scale, and calculating a perturbed position based on the user's real position, the perturbation angle, and the perturbation distance;

[0078] After completing the calculation of the perturbation parameters, the next task of the system is to generate the perturbed position. This step is crucial and directly determines the effectiveness of user privacy protection and the accuracy of service queries. The system perturbs the user's real position to ensure that it cannot be directly inferred from the user's real position when sent to the location service server.

[0079] In this embodiment, the core of the perturbation process is to generate a new perturbed position X'=(x',y') from the perturbation scale b and the user's real position X=(x,y) as follows: This perturbation process is achieved through randomized position offset, and uses Laplace distribution to generate perturbation distance, combined with a randomly sampled angle to generate the final perturbed position.

[0080] Detailed description of the perturbation process

[0081] When generating the perturbation, the system first randomly samples an angle θ from a uniform distribution. The angle θ ranges from 0 to 2π, ensuring that the direction of the perturbed position is random and symmetrical. In this way, the perturbed position is not only randomly distributed within a uniform range, but also unpredictable, thereby enhancing privacy protection.

[0082] Specifically, the angle θ is generated as follows:

[0083] θ ~ U(0, 2π);

[0084] where U(0, 2π) represents a uniform distribution between 0 and 2π. The uniform distribution of the angle ensures the randomness of the perturbed position in the two-dimensional plane, and does not deviate to a certain direction.

[0085] Then, the system samples the perturbation distance r' from the Laplace distribution. The probability density function of this distribution decreases exponentially with the increase of distance, ensuring that most perturbed points are close to the real position, while a few perturbed points are far away. The specific probability density function is as follows:

[0086]

[0087] Here, r′ is the perturbation distance, and b is the perturbation scale, which controls the intensity of the perturbation. A larger perturbation scale b will produce a larger perturbation distance r′, while a smaller b will limit the range of the perturbation distance. The use of the Laplace distribution ensures the symmetry of the perturbation and generates more perturbations within a smaller range, thus enhancing the privacy protection effect.

[0088] Calculation of disturbance location

[0089] Once the angle θ and the disturbance distance r′ are determined, the system can calculate the disturbance position Z = (zx, zy) based on the true position X = (x, y). The calculation process for the disturbance position is as follows:

[0090] z x =x + r′·cos(θ);

[0091] z y =y+r′·sin(θ);

[0092] Where x and y represent the user's actual location coordinates, r′ is the perturbation distance, and θ is the randomly sampled perturbation angle. In this way, the perturbation position z is randomly generated around the user's actual location and remains randomly distributed within a certain range.

[0093] Output of the perturbation result

[0094] The generated perturbation position Z = (z x ,z y )

[0095] This will be sent to the location service server as the final service request information, replacing the user's actual location. The system will encapsulate the disturbed location along with the query radius into the service request information, ensuring that the query request received by the server only contains disturbed data and does not expose the user's true location information.

[0096] In some embodiments, to further ensure privacy protection, the system may introduce additional perturbation mechanisms. For example, different perturbation locations can be generated through multiple perturbations, and then the final perturbation location can be determined according to a certain strategy (such as random selection or weighted averaging). This approach can further reduce the possibility of attackers guessing the true location.

[0097] Privacy protection effect generated by perturbation

[0098] The perturbation generation not only protects the user's location information but also maintains the validity and accuracy of the query. The randomness of the perturbation distance and direction ensures that, while meeting differential privacy requirements, the perturbation location does not deviate excessively from the user's true location, thus avoiding a significant decrease in the accuracy of the query results.

[0099] Generally, the system can ensure the quality of location-based services under the premise of privacy protection through a reasonable perturbation generation strategy. This method provides an efficient and reliable privacy protection means for location-based services, especially for scenarios that require real-time processing and querying of large amounts of user data.

[0100] In summary, step S4 ensures that the user's real location will not be disclosed to the service provider by introducing a perturbation location generation mechanism. At the same time, the use of randomized perturbation methods not only improves privacy protection effects, but also does not significantly affect the accuracy and real-time performance of the query.

[0101] S5: Send a service request containing user identification, perturbed location, and query radius to the location service server;

[0102] In the foregoing steps, the system obtains the perturbed location of the user through the perturbation generation mechanism. Next, the system needs to encapsulate the perturbed location together with the query radius into a service request and send it to the untrusted location information service server. In this way, the system can effectively conceal the user's real location information while maintaining the effectiveness of the query results.

[0103] In this embodiment, the core of step S5 is that after the perturbation generation is completed, the system encapsulates the perturbed location Z = (z x ,z y ) and the query radius r q as the key parameters of the service request, forming a complete query request information Q′. This query request information is sent to the untrusted LBS (Location-Based Service) server, requiring the server to perform related queries based on the perturbed location.

[0104] Specifically, the service request information composed of the perturbed location Z and the query radius r q can be represented as:

[0105] Q′ = {UID, Z = (z x ,z y ), r q};

[0106] Where UID is the user's unique identifier, Z is the perturbed location coordinates, r q is the radius of the query, representing the effective area of the location query.

[0107] Details of the request sending

[0108] Generally, in the process of sending a request, the system will first encrypt the query information or use some form of anonymization processing to increase the security of information transmission. Although the location service server cannot access the user's real location, the system still initiates a request to the server by perturbing the location and the query radius. The query radius r q will affect the size of the area queried by the server, so when determining the radius, the system needs to consider the strength of privacy protection and the range of query services to ensure that useful service results can be effectively returned without exposing the user's real location.

[0109] In some embodiments, the query request can be sent through a secure transmission protocol, such as using the SSL / TLS encryption protocol, to ensure that the user's request information is not stolen or tampered with during transmission. In addition, the system can also generate a temporary anonymous identifier for each query to avoid the leakage of the user's identity.

[0110] Interaction with the location service server

[0111] In this embodiment, the service request information Q' is sent to the location service server. After receiving the request, the server performs query processing based on the perturbed location. Since the server only receives the perturbed location and not the user's real location, the server cannot directly infer the user's actual location.

[0112] When performing a query, the location service server will usually calculate the points of interest (POI) near the perturbed location or perform other related location queries. The server uses the perturbed location as the center point of the query and returns a set of service results around that point, such as store, restaurant, hotel, and other location service information.

[0113] In some embodiments, in order to improve query efficiency, the location service server may use spatial indexing techniques such as R-tree, Quad-tree, etc. to index and manage the points of interest, thereby reducing the calculation time of the query. Even if there is a difference between the perturbed location and the real location, the results returned by the server can still meet most service requirements, because the perturbed range is usually small and does not affect the effectiveness of the query results.

[0114] Dynamic adjustment of the request

[0115] In some cases, the system may dynamically adjust the parameters of the query request according to different user needs or privacy budgets. Specifically, if the user has high requirements for privacy protection, the system may increase the perturbation scale b, thereby increasing the difference between the perturbed location and the real location; on the contrary, if the user is more concerned about the accuracy of the query results, the system may reduce the perturbation scale to reduce the impact of location perturbation on the query results.

[0116] As an alternative, the system can also optimize the request parameters based on historical query records. For example, if the user frequently uses similar service or location queries, the system can optimize the query radius r according to the user's preferences q to improve the efficiency and accuracy of the query while ensuring privacy.

[0117] Implementation of privacy protection

[0118] By sending the perturbed location along with the query radius to the location service server, the user's real location is always protected. The perturbation generation process ensures differential privacy protection of the user's location information, and the server cannot obtain enough information to infer the user's real location when processing the query. Even if multiple query requests are sent continuously, since the perturbed location in each request is randomized, an attacker cannot infer the user's real location from the service results.

[0119] In summary, this step ensures that the user's real location is always effectively protected by sending the perturbed location and query radius to the untrusted LBS server. The server can only process the query based on the perturbed location and cannot obtain the user's real location, thereby avoiding the risk of location leakage. At the same time, the effectiveness of the query results and the quality of service are guaranteed.

[0120] S6: Receive the service results returned by the server based on the perturbed location calculation;

[0121] After the previous steps, the user's query request has been successfully sent to the location service server, and the user's real location information has been protected by perturbation. The next task is to receive the query results returned by the location service server based on the perturbed location. At this time, the system needs to obtain the query results from the server and further display or process them in order to ultimately meet the user's needs.

[0122] In this embodiment, the core of step S6 is to receive the response from the location service server. The service results returned by the server usually include points of interest (POI) or related service information within the query radius, such as stores, restaurants, hotels, etc. Although the server cannot know the user's real location, based on the perturbed location, it can still provide query results that meet the requirements. The accuracy of the query results depends on the deviation between the perturbed location and the user's real location.

[0123] Receiving and processing of query results

[0124] In general, the received service results will include a list of points of interest and their associated information that satisfy the user's query. For example, if the user requests to query nearby restaurants, the server returns information such as restaurant names, locations, and ratings. Although the results are based on the perturbed location, the results are still meaningful and accurate due to the small perturbation scale.

[0125] Specifically, the system will perform further processing based on the returned service results A. The service results are typically presented in the form of a set of data records, which contain information such as the coordinates, names, and categories of the points of interest. After receiving these results, the system presents them to the user or further filters or sorts them as needed. For example, in some embodiments, the system may adjust the order of the returned results based on the user's historical preferences or ratings to ensure that the user can see the options they are most likely interested in first.

[0126] Protection and privacy assurance

[0127] After receiving the service results, the system also ensures that the results do not reveal the user's real location. Since the server only knows the perturbed location, it cannot infer the user's actual location from the returned service results. Even if an attacker has access to some of the query history data, since the perturbed location for each query is random and the perturbation scale b is adjusted according to privacy requirements, the user's real location information remains unpredictable.

[0128] As an option, after receiving the service results, the system can further enhance the security and privacy protection of the data through further privacy processing mechanisms, such as differential encryption based on privacy protection. In this way, although the server provides the query results, the user's real location information is never exposed.

[0129] Service result display and subsequent processing

[0130] In this embodiment, the received service results are not just a simple data set, but the system will perform various displays according to the specific needs of the query. For example, if the query request involves multiple points of interest, the system may sort them by distance from the user's location or filter the results based on other criteria such as ratings, user preferences, etc.

[0131] In some embodiments, the system can also dynamically update the query results according to the user's real-time location changes. For example, if the user moves frequently during use, the system will continuously resend the query request and return the latest results based on the new perturbed location. In this way, the system can provide privacy protection while maintaining the smoothness and accuracy of the user experience.

[0132] Balancing user privacy protection and service quality

[0133] Throughout the process, the system consistently strives to find a reasonable balance between privacy protection and service quality. Through the reasonable design of the perturbation generation mechanism and the dynamic adjustment of the privacy budget, the system can ensure that the user's location information is not leaked, while still providing high-quality query results.

[0134] Specifically, the protection of user privacy is effectively guaranteed through the random generation of perturbed positions and reasonable control of perturbation scales for each query. At the same time, the accuracy of the query results is maintained by ensuring that the deviation between the perturbed position and the true position is within a reasonable range. Therefore, the system can provide privacy protection while still meeting the user's demand for query result accuracy and timeliness.

[0135] Step S6 ensures that the user's true position is always protected, and through a reasonable query result return mechanism, the balance between service quality and privacy protection is guaranteed. Through this step, users can obtain accurate location information services in a privacy-protected environment, while ensuring the effectiveness and timeliness of the query results. The system can adapt to different privacy requirements and service quality requirements by continuously adjusting the perturbation strategy, providing flexible privacy protection and query experience.

[0136] Although embodiments of the present application have been shown and described, it will be understood by those having ordinary skill in the art that various changes, modifications, substitutions and alterations can be made therein without departing from the principles and spirit of the application, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for Balltree-based differential privacy location protection, characterized in that, The method comprises the following steps: S1: receiving service request information containing user identification, user real position and query radius; S2: constructing a Balltree space partition structure based on historical or current user position data, the Balltree comprising a plurality of spherical space partitions, each partition having a spatial centroid and a coverage radius; S3: According to the Balltree partition to which the user's real position belongs, obtain the coverage radius of the corresponding partition, and calculate the maximum noise scale of each circular partition , wherein, is the noise scale, is the coverage radius of the corresponding partition, is a preset differential privacy budget; S4: then, performing noise disturbance processing on the user real position, comprising: obtaining a disturbance angle by random sampling from a uniform distribution in the range of 0 to 2π; obtaining a disturbance distance by sampling from a Laplace distribution based on the noise scale, specifically, the probability density function of the distribution decreases exponentially with the increase of distance, and the probability density function is as follows: ； wherein, is the perturbation distance, is the noise scale, controlling the strength of the perturbation; and calculating a disturbed position according to the user real position, the disturbance angle and the disturbance distance, specifically, the calculation process of the disturbed position is as follows: ； ； wherein, and respectively represent real position coordinates, is a perturbation distance, is a perturbation angle; S5: sending service request containing user identification, disturbed position and query radius to a location service server; S6: receiving service results calculated based on the disturbed position returned by the server.

2. The Balltree-based differential privacy location protection method of claim 1, wherein, In the step S2, the construction method of the Balltree comprises: selecting two points farthest from the centroid of the current unpartitioned position point set as the center of the sub-region, and partitioning the remaining points into two subsets according to the shortest distance, and recursively constructing the sub-tree until the set partition depth or the minimum point number condition of each subset is met. 3.The Balltree-based differential privacy location protection method of claim 1, wherein, The coverage radius of the circular partition is the maximum Euclidean distance from any point in the partition to the centroid of the partition.

4. The Balltree-based differential privacy location protection method of claim 1, wherein, The disturbed position coordinates are calculated from the horizontal and vertical coordinates of the real position, the disturbance angle and the disturbance distance, and the disturbed position point is used to replace the real position to participate in the query.

5. The Balltree-based differential privacy location protection method of claim 1, wherein, The location service server performs a point of interest range query operation based on the disturbed position, and returns service results related to the disturbed position.

Images