Location privacy protection method, device, vehicle and system

Abstract

The invention relates to the technical field of information security, in particular to a location privacy protection method and device, a vehicle and a system, and the method comprises the steps: obtaining a real location of a user; based on the real position, a false position candidate set is obtained, the false position candidate set comprises a plurality of initial false positions, and the absolute value of the difference between the query probability corresponding to the initial false positions and the query probability corresponding to the real position is smaller than or equal to a preset probability threshold value; the query probability is obtained by counting position information in a historical query request sent to a position service provider by a user; according to the real position and the false position candidate set, generating a target query request, and sending the target query request to a position service provider, so that the position service provider provides a position service based on the target query request; according to the method, the strong similarity constraint of the real position and the initial false position is well realized, and the security of the privacy protection of the real position is effectively improved.

Description

Technical Field

[0001] This application relates to the field of information security technology, and in particular to a method, device, vehicle and system for protecting location privacy. Background Technology

[0002] In today's era of rapid internet technology development, location-based services (LBS) have become a core technology in smart cities, navigation applications, and social networks. Users, such as vehicle users (mobile vehicle user terminals), can enjoy location-based services, such as traffic planning, nearby business searches, and emergency rescue services, by uploading their location information (such as latitude and longitude coordinates) in real time, greatly improving the convenience of life. However, this convenience also brings significant information security risks. Attackers can obtain users' location information through network eavesdropping, malicious applications, and other attack methods, seriously threatening users' personal privacy and security.

[0003] Related technologies typically employ data encryption (such as encrypting the location information to be uploaded before sending it to the Location Service Provider (LSP)) to protect user location information. However, this method still carries a significant risk of location information leakage and is insufficient to meet the location privacy protection needs of high-security scenarios. Summary of the Invention

[0004] This application provides a location privacy protection method, device, vehicle, and system to address the technical problem in the related art where there is a significant risk of location information leakage when users send their location information to location service providers.

[0005] This application provides a location privacy protection method, the method comprising: obtaining the user's real location; Based on the real location, a set of false location candidates is obtained. The set of false location candidates includes multiple initial false locations. The absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold. The query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider. Based on the real location and the set of false location candidates, a target query request is generated and sent to the location service provider so that the location service provider can provide location services based on the target query request.

[0006] In one embodiment of this application, generating a target query request based on the real location and the candidate set of false locations includes: Based on the true location and the set of candidate false locations, a set of anonymous false locations is obtained. The set of anonymous false locations includes the true location and multiple target false locations. The target false locations are determined from multiple initial false locations. The area enclosed by the true location and the multiple target false locations is greater than the area enclosed by the true location and the remaining initial false locations in the set of candidate false locations. Based on the fake location anonymity set, a target query request is generated and sent to the location service provider.

[0007] In one embodiment of this application, before obtaining the user's real location, the method further includes: The system receives a user public-private key pair sent by a third-party organization. The user public-private key pair includes a user public key and a user private key. The user public key is the product of a first hash value and the system private key of the third-party organization. The first hash value is determined based on the user's ID information and a preset hash function. The hash function has a range of q-order finite field, where q is the order of a preset additive elliptic curve group. The system private key is any value in a q-1 order cyclic group. The user private key is the product of the user public key and the generator of the additive elliptic curve group. Sending the target query request to the location service provider includes: obtaining the service public key of the location service provider; encrypting the target query request based on the service public key to obtain an encrypted request; sending the encrypted request to the location service provider, so that the location service provider decrypts the encrypted request based on its own service private key; performing a query based on the decrypted request information to obtain a query result; encrypting the query result based on the user's public key to obtain an encrypted result; and completing the feedback of the encrypted result; both the service public key and the service private key are generated and issued by the third-party organization. After sending the target query request to the location service provider, the method further includes: receiving the encrypted result, decrypting the encrypted result based on the user's private key to obtain the query result, and completing the location service request.

[0008] In one embodiment of this application, obtaining a set of candidate false locations based on the true location includes: The real location is generalized to obtain a generalized region, which contains the real location; the generalized region is then divided into grids to obtain multiple grid cells. Based on preset historical query records, multiple points of interest of the user in the generalized area are obtained, as well as the query probability of the points of interest. The historical query records include multiple historical query requests sent by the user to the location service provider in the past, and the points of interest are determined based on the location information in the historical query requests. The grid cell where the point of interest is located is defined as the point of interest grid. The query probability of the point of interest grid is the query probability of the corresponding point of interest. The multiple point of interest grids include the first point of interest grid where the real location is located and the second point of interest grid where the initial false location is located. There are multiple second point of interest grids. The difference between the query probability of the second point of interest grid and the query probability of the first point of interest grid is determined as a first value, and the absolute value of the first value is determined as a second value. If the second value is less than or equal to the preset probability threshold, the current position of the second point of interest grid is determined as the initial false position. Traverse the remaining second interest point grid to obtain the false location candidate set.

[0009] In one embodiment of this application, the real location includes latitude and longitude information, and the generalization of the real location to obtain a generalized region includes: The latitude and longitude information is encoded using a space-filling method to obtain spatial binary code; The spatial binary code is converted into a binary sequence, and the binary sequence is converted into Geohash code, wherein the length of the Geohash code is a preset length; Based on the Geohash encoding, a reverse retrieval is performed to obtain the generalized region.

[0010] In one embodiment of this application, obtaining a set of anonymous fake locations based on the real location and the set of candidate fake locations includes: The initial false position that is farthest from the real position in the false position candidate set is determined as the first target false position, and the remaining initial false positions in the false position candidate set form the first candidate set; The area enclosed by the real location, the first target false location, and any one of the initial false locations in the first candidate set is defined as the first area, and the first area corresponds one-to-one with the initial false locations in the first candidate set. The maximum value among the multiple first areas is determined as the first target area, the initial false position corresponding to the first target area is determined as the second target false position, and the remaining initial false positions in the first candidate set form the second candidate set; The area of ​​the largest region enclosed by the real location, the first target false location, the second target false location, and any one of the initial false locations in the second candidate set is determined as the second area, and the second area corresponds one-to-one with the initial false locations in the second candidate set; The maximum value among the multiple second areas is determined as the second target area, the initial false position corresponding to the second target area is determined as the third target false position, and the remaining initial false positions in the second candidate set form the third candidate set; The initial false locations in the third candidate set are traversed to obtain the false location anonymity set, and the number of locations in the false location anonymity set is a preset number.

[0011] In one embodiment of this application, generating a target query request based on the fake location anonymity set includes: Obtain a set of query content and a set of identity identifiers. The set of query content includes real query content and multiple fake query content. The set of identity identifiers includes multiple fake identity identifiers of the user. Obtaining the fake identity identifiers includes: obtaining multiple fake IDs of the user; obtaining a second hash value based on any one of the fake IDs and a preset hash function; and concatenating the second hash value with a random number to obtain the fake identity identifier. The target query request is generated based on the set of fake location anonymities, the set of query content, the set of identity identifiers, and the current time.

[0012] This application also provides a location privacy protection device, including: The real location acquisition module is used to acquire the user's real location; The candidate set acquisition module is used to obtain a false location candidate set based on the real location. The false location candidate set includes multiple initial false locations. The absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold. The query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider. The query request generation module is used to generate a target query request based on the real location and the set of fake location candidates, and send the target query request to the location service provider so that the location service provider can provide location services based on the target query request.

[0013] This application also provides a vehicle including the location privacy protection device as described above.

[0014] This application also provides a location privacy protection system, including: A third-party organization is used to obtain the order and generator of a preset additive elliptic curve group, where q is the order of the additive elliptic curve group, and the system private key of the third-party organization is any value in a cyclic group of order q-1; based on the user's ID information and a preset hash function, a first hash value is determined; the product of the first hash value and the system private key of the third-party organization is determined as the user's public key; the product of the user's public key and the generator is determined as the user's private key; and the user's public key and the public-private key are sent to the location privacy protection device as described above. The location privacy protection device is used to obtain the service public key of the location service provider, encrypt the target query request based on the service public key to obtain an encrypted request, and send the encrypted request to the location service provider. The location service provider is used to decrypt the encrypted request based on its own service private key, perform a query based on the decrypted request information to obtain a query result, encrypt the query result based on the user's public key to obtain an encrypted result, and feed the encrypted result back to the location privacy protection device. Both the service public key and the service private key are generated and issued by the third-party organization.

[0015] The beneficial effects of this application: The location privacy protection method, device, vehicle, and system proposed in this application include: obtaining the user's real location; obtaining a set of false location candidates based on the real location, the set of false location candidates including multiple initial false locations, wherein the absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold, and the query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider; generating a target query request based on the real location and the set of false location candidates, and sending the target query request to the location service provider so that the location service provider provides location services based on the target query request. This method can effectively protect the user's real location privacy through location obfuscation, has high security, and prevents attackers from identifying the user's real location. Furthermore, by obtaining the aforementioned set of false location candidates from the user's query probability dimension, this method ensures a high similarity between the real location and the initial false locations in the set of false location candidates, effectively achieving a strong similarity constraint between the real location and the initial false locations, and effectively improving the security of real location privacy protection. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application. It is obvious that the drawings described below are merely some embodiments of this application, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0017] In the attached diagram: Figure 1 A flowchart illustrating a location privacy protection method provided in an embodiment of this application. Figure 1 ; Figure 2 This is a flowchart illustrating a location privacy protection method provided in one embodiment of this application. Figure 2 ; Figure 3 This is a schematic diagram of the process for obtaining a false location candidate set in a location privacy protection method provided in one embodiment of this application; Figure 4 This is a schematic diagram of the process for obtaining a false location anonymity set in a location privacy protection method provided in one embodiment of this application; Figure 5 This is an example diagram of location dispersion comparison in a location privacy protection method provided in one embodiment of this application; Figure 6 This is a schematic diagram of the location privacy protection device provided in one embodiment of this application; Figure 7 This is a schematic diagram of the location privacy protection system provided in one embodiment of this application; Figure 8 This is a schematic diagram of the structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0018] The following specific examples illustrate the implementation of this application. Those skilled in the art can easily understand other advantages and effects of this application from the content disclosed in this specification. This application can also be implemented or applied through other different specific embodiments. Various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of this application. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0019] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of this application. The drawings only show the components related to this application and are not drawn according to the actual number, shape and size of the components in the actual implementation. In the actual implementation, the form, quantity and proportion of each component can be arbitrarily changed, and the layout of the components may also be more complex.

[0020] In the following description, numerous details are explored to provide a more thorough explanation of embodiments of the present application. However, it will be apparent to those skilled in the art that embodiments of the present application may be practiced without these specific details. In other embodiments, well-known structures and devices are shown in block diagram form rather than in detail to avoid obscuring embodiments of the present application.

[0021] Please refer to Figure 1 , Figure 1 A flowchart illustrating a location privacy protection method provided in an embodiment of this application. Figure 1 ,like Figure 1 As shown, the method includes: S110: Obtain the user's real location.

[0022] In some examples of this embodiment, the user can be a vehicle user or an end-user, etc. The real location can be the user's current location or any location entered by the user. When a user has a location service requirement, such as needing to query a food delivery app to see if there are any food delivery restaurants at their current location, the user's current location is obtained to generate a subsequent target query request. It is understood that this target query request can be used to request services based on the user's current location from the food delivery app, such as providing feedback on nearby food delivery restaurants.

[0023] S120: Based on the real location, a set of false location candidates is obtained. The set of false location candidates includes multiple initial false locations. The absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold. The query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider.

[0024] In some examples of this embodiment, the real location can be input into a preset fake location candidate set acquisition program to obtain a fake location candidate set output by the fake location candidate set acquisition program.

[0025] In some examples of this embodiment, by retaining a user's historical query records, it is convenient to statistically analyze the user's points of interest (locations the user has queried, i.e., the actual locations in historical query requests sent to the location service provider) and the number of queries for each point of interest, thereby obtaining the user's query probability for each point of interest. This statistical process can be executed automatically in the background, storing the statistically obtained query probabilities in the historical query records, or it can be performed in real time.

[0026] In some examples of this embodiment, the difference between the query probability of an interest point and the query probability of the real location can be obtained by subtracting the query probability of multiple interest points from the query probability of the real location. If the absolute value of this difference is less than or equal to a preset probability threshold, the location of the interest point can be determined as an initial false location, thereby obtaining a candidate set of false locations. It can be understood that by obtaining the candidate set of false locations in the above manner, a strong similarity constraint between the real location and the initial false location can be effectively achieved, making it easier for the real location and the initial false location to be confused, thereby helping to improve the security of protecting the privacy of the real location.

[0027] In some examples of this embodiment, the preset probability threshold can be set according to the actual situation, such as 0.1, etc., which will not be elaborated here.

[0028] S130: Generate a target query request based on the real location and the set of false location candidates, and send the target query request to the location service provider so that the location service provider provides location services based on the target query request.

[0029] In some examples of this embodiment, the target query request can be generated directly based on the real location, the initial false location in the false location candidate set, and the user's query content (such as querying nearby food delivery merchants).

[0030] In some examples of this embodiment, the location service provider can be a map software / platform, a food delivery software / platform, a social software / platform, or a logistics tracking software / platform, etc., which can be adapted to the actual application scenario. The location service provided by the location service provider is related to its own functions. For example, map software / platforms provide map data around the location based on the location in the target query request; food delivery software / platforms provide information on nearby food delivery merchants based on the location in the target query request; social software / platforms provide information on people near the location based on the location in the target query request; and logistics tracking software / platforms provide information on the distance between the package and the location based on the location in the target query request, etc.

[0031] In addition to generating the target query request directly based on the real location, the initial fake locations in the fake location candidate set, and the user's query content, in order to further improve the security of real location privacy protection, some embodiments introduce a method to further filter the initial fake locations in the fake location candidate set. Figure 2 This is a flowchart illustrating a location privacy protection method provided in one embodiment of this application. Figure 2 Please refer to Figure 2 In some embodiments, the method includes: S210: Obtain the user's real location.

[0032] S220: Based on the real location, a set of false location candidates is obtained. The set of false location candidates includes multiple initial false locations. The absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold. The query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider.

[0033] S230: Based on the real location and the set of candidate false locations, a set of anonymous false locations is obtained. The set of anonymous false locations includes the real location and multiple target false locations. The target false locations are determined from multiple initial false locations. The area enclosed by the real location and the multiple target false locations is greater than the area enclosed by the real location and the remaining initial false locations in the set of candidate false locations.

[0034] In some examples of this embodiment, the real location and the number of locations k in the false location candidate set false location anonymity set can be input into a preset false location anonymity set acquisition program to obtain the false location anonymity set output by the false location anonymity set acquisition program, etc.

[0035] In some examples of this embodiment, based on the number k-1 of target false locations in a preset set of anonymous false locations, the maximum area enclosed by the real location and any k-1 initial false locations in the candidate set of false locations can be obtained. By comparing multiple such maximum areas, the aforementioned multiple target false locations are obtained. That is, if the maximum area enclosed by the real location and the current k-1 initial false locations is greater than the maximum area enclosed by the real location and the initial false locations of the remaining groups, then the current k-1 initial false locations are determined as target false locations.

[0036] In some examples of this embodiment, the region enclosed by the real location and multiple initial illusory locations can be divided into multiple triangles. The area of ​​each triangle is obtained based on its side length. The sum of the areas of the multiple triangles yields the area enclosed by the real location and the multiple initial illusory locations.

[0037] Understandably, this embodiment selects the target fake location by starting with the dispersion dimension of the initial fake locations in the fake location candidate set. This makes the distance between the target fake location and the real location as far as possible, thereby confusing attackers to a greater extent and protecting the user's real location privacy.

[0038] S240: Based on the fake location anonymity set, generate a target query request and send the target query request to the location service provider.

[0039] In some examples of this embodiment, the target query request can be generated directly based on the real location, the target fake location in the fake location anonymization set, and the user's query content.

[0040] In some embodiments, prior to obtaining the user's real location, the method further includes: The system receives a user public-private key pair sent by a third-party organization. The user public-private key pair includes a user public key and a user private key. The user public key is the product of a first hash value and the system private key of the third-party organization. The first hash value is determined based on the user's ID information and a preset hash function. The hash function has a range of q-th order finite field, where q is the order of a preset additive elliptic curve group. The system private key is any value in a q-1 order cyclic group. The user private key is the product of the user public key and the generator of the additive elliptic curve group.

[0041] In some examples of this embodiment, the third-party organization can be an authoritative body (TA, Tracking Area), etc. The additive elliptic curve group can be preset or obtained in the following way: the authoritative body can first select a large prime number p (usually 256 bits or longer), and then in the finite field corresponding to p... Define an elliptic curve on (of order p). ,in, Modulo operation is represented. Both b and are coefficients of the elliptic curve E. and This represents the coordinates on the elliptic curve E. ,and, By making the elliptic curve E and the point at infinity together form an additive elliptic curve group c, we obtain the order q of c and the generator P.

[0042] In some examples of this embodiment, the authoritative body may start from the q-1 order cyclic group. A random value is selected as the system private key. Obtain the private key of this system. Corresponding system public key ,in," This indicates a scalar multiplication operation. Then, a preset hash function is selected. ,in, Indicates the input field. The range is the output domain, which is a finite field of order q. This is a deterministic function that compresses and maps a binary input message of arbitrary length into an integer within a fixed range (0 to q-1). System parameters disclosed by authoritative bodies may include: Next, it can generate corresponding public-private key pairs for all entities within its jurisdiction (including users and location service providers, etc.). Specifically, the mathematical expression for generating public-private key pairs can be: (Equation 1) (Equation 2) in, This represents the public key of the i-th entity. This represents the private key of the i-th entity. This represents the hash value obtained after inputting the ID information of the i-th entity into the hash function described above.

[0043] Understandably, the above method facilitates subsequent encryption and decryption of data based on each entity's own public and private key pair, thereby enhancing the security of data transmission.

[0044] In some embodiments, sending the target query request to the location service provider includes: obtaining the service public key of the location service provider; encrypting the target query request based on the service public key to obtain an encrypted request; sending the encrypted request to the location service provider so that the location service provider decrypts the encrypted request based on its own service private key; performing a query based on the decrypted request information to obtain a query result; encrypting the query result based on the user public key to obtain an encrypted result; and completing the feedback of the encrypted result; both the service public key and the service private key are generated and issued by the third-party organization.

[0045] In some embodiments, after sending the target query request to the location service provider, the method further includes: receiving the encrypted result, decrypting the encrypted result based on the user's private key to obtain the query result, and completing the location service request.

[0046] Understandably, the above methods can effectively enhance the security of data transmission between the location privacy protection device (the device that operates the location information protection method) and the location service provider.

[0047] Please refer to Figure 3 In some embodiments, obtaining a set of false location candidates based on the true location includes: S310: Generalize the real location to obtain a generalized region, the generalized region containing the real location; divide the generalized region into grids to obtain multiple grid cells.

[0048] In some examples of this embodiment, the region can be expanded based on the real location to obtain a region of preset area, which can then be used as a generalized region. By determining this generalized region, it is possible to ensure that the locations within the generalized region have a high degree of similarity at the geographic level, which helps to improve the similarity between the real location and the initial false location, thereby enhancing the security of real location privacy protection. Mesh partitioning using this generalized region facilitates the subsequent acquisition of a set of false location candidates on a grid cell basis, maximizing the protection of the user's real location.

[0049] S320: Based on preset historical query records, obtain multiple points of interest (POIs) of the user in the generalized area, and the query probability of the POIs. The historical query records include multiple historical query requests sent by the user to the location service provider in the past, and the POIs are determined based on the location information in the historical query requests.

[0050] In some examples of this embodiment, a probability table can be generated based on the user's multiple points of interest in the generalized region and the query probability of the points of interest, so as to facilitate subsequent searches, etc.

[0051] S330: The grid cell where the point of interest is located is determined as the point of interest grid. The query probability of the point of interest grid is the query probability of the corresponding point of interest. The multiple point of interest grids include the first point of interest grid where the real location is located and the second point of interest grid where the initial false location is located. There are multiple second point of interest grids.

[0052] S340: The difference between the query probability of the second point of interest grid and the query probability of the first point of interest grid is determined as a first value, and the absolute value of the first value is determined as a second value. If the second value is less than or equal to the preset probability threshold, the current position of the second point of interest grid is determined as the initial false position.

[0053] In some examples of this embodiment, the logic for determining the initial false position is as follows: (Equation 3) in, Indicates the second value. This represents the query probability of the r-th second interest point grid. This represents the query probability of the first point of interest grid. This indicates a preset probability threshold.

[0054] S350: Traverse the remaining second interest point grid to obtain the false location candidate set.

[0055] Understandably, by determining the generalization region and based on the difference between the query probability of the first interest point grid and the query probability of the second interest point grid in the generalization region, the initial false location in the false location candidate set can be determined. This can better achieve the strong similarity constraint between the real location and the initial false location at the geo-indistinguishability level, thereby helping to improve the security of real location privacy protection.

[0056] It should be noted that the above method maximizes the anonymity entropy of multiple initial fake locations in the fake location candidate set. Understandably, the main purpose of this method is to hide the user's real location among multiple fake locations. Anonymity entropy represents the degree of privacy protection, and its magnitude is directly proportional to the degree of privacy protection. Anonymity entropy is maximized when the query probability of the real location and the query probability of the fake location are both the same. Therefore, in constructing the fake location candidate set, the above embodiment, from the perspective of query probability, strives to ensure that the query probability of the initial fake locations in the fake location candidate set is the same as or close to the query probability of the real location. The following is the calculation method for anonymity entropy: (Equation 4) in, Represents anonymous entropy. This indicates finding the maximum value. This represents the query probability at position t. It represents the logarithmic operation with base 2.

[0057] In some embodiments, the real location includes latitude and longitude information, and the generalization of the real location to obtain a generalized region includes: First, the latitude and longitude information is encoded using a space-filling method to obtain spatial binary code.

[0058] In some examples of this embodiment, before encoding latitude and longitude information, users can customize the length of the Geohash encoding according to their privacy requirements.

[0059] 2. Convert the spatial binary code into a binary sequence, and then convert the binary sequence into Geohash code, wherein the length of the Geohash code is a preset length.

[0060] In some examples of this embodiment, starting from 0 (longitude), the latitude and longitude codes in the spatial binary encoding are alternately merged into a binary sequence. Every 5 bits of the binary sequence are converted into Base32 (30-bit binary encoding) code to form Geohash encoding.

[0061] Third, based on the Geohash encoding, a reverse retrieval is performed to obtain the generalized region.

[0062] Understandably, compared to methods such as region expansion, the method of obtaining a generalized region using Geohash encoding can help speed up the response and avoid excessively long response times.

[0063] Please refer to Figure 4 In some embodiments, obtaining the anonymity set of false locations based on the true location and the candidate set of false locations C includes: S410: Determine the initial false position that is farthest from the real position in the false position candidate set C as the first target false position. The remaining initial false positions in the false position candidate set C constitute the first candidate set. . This indicates removal, specifically, the removal of false location candidate set C from the first target false location. The set of the remaining initial spurious positions.

[0064] S420: The area enclosed by the real location, the first target false location, and any one of the initial false locations in the first candidate set is determined as a first area, and the first area corresponds one-to-one with the initial false locations in the first candidate set.

[0065] S430: Determine the maximum value among the multiple first areas as the first target area, and determine the initial false position corresponding to the first target area as the second target false position. The remaining initial false positions in the first candidate set constitute the second candidate set. .

[0066] S440: The area of ​​the largest region enclosed by the real location, the first target false location, the second target false location, and any one of the initial false locations in the second candidate set is determined as the second area, and the second area corresponds one-to-one with the initial false locations in the second candidate set.

[0067] S450: The maximum value among the multiple second areas is determined as the second target area, and the initial false position corresponding to the second target area is determined as the third target false position. The remaining initial false positions in the second candidate set constitute the third candidate set. .

[0068] Understandably, this process can be repeated until the (k-1)th false target location is found.

[0069] S460: By traversing the initial false positions in the third candidate set, the false position anonymity set is obtained, and the number of positions in the false position anonymity set is a preset number k.

[0070] In some examples of this embodiment, the set of fake anonymous locations is: ,in, Indicates the actual location. Let represent the (k-1)th false target location. Understandably, by using the above method, we can maximize the area enclosed by the k locations in the set of false anonymous locations while satisfying the condition of maximizing anonymity entropy.

[0071] Figure 5 This is an example diagram showing the location dispersion comparison in a location privacy protection method provided in one embodiment of this application. Please refer to... Figure 5 Assume k=4, Figure 5 In (a), the query probabilities of the four grid cells are the same and relatively concentrated. Figure 5 In (b), the query probabilities of the four grid cells are the same and relatively dispersed. Compared to Figure 5 (b) Figure 5 The scenario in (a) is more likely to result in location privacy breaches. Understandably, an attacker could potentially lock a user's real location... Figure 5 In (a), the risk of real location privacy leakage is significantly increased within the smaller area enclosed by multiple location points. Therefore, the above embodiment, by maximizing the area enclosed by the k locations in the false anonymity location set while satisfying the maximum anonymity entropy, can minimize the risk of real location leakage and improve the security of real location privacy protection.

[0072] In some embodiments, obtaining the first area includes: 1. Obtain the side length of the triangle region formed by the real location, the first target false location, and any initial false location in the first candidate set. The side length of the triangle includes the first side length, the second side length, and the third side length. Half of the perimeter of the triangle region is the half perimeter.

[0073] Second, the difference between the half perimeter and the first side length is determined as the first difference value, the difference between the half perimeter and the second side length is the second difference value, and the difference between the half perimeter and the third side length is the third difference value.

[0074] Third, the product of the semi-perimeter, the first difference, the second difference, and the third difference is determined as the target product, and the square root of the target product is the first area.

[0075] In some examples of this embodiment, the mathematical expression for the first area is: (Equation 5) in, Indicates the first area. Indicates half the perimeter. Indicates the length of the first side. Indicates the length of the second side. This indicates the length of the second side.

[0076] In some embodiments, obtaining the second area includes: 1. Divide the largest region enclosed by the real location, the first false target location, the second false target location, and any one of the initial false locations in the second candidate set into triangles to obtain two target triangle regions.

[0077] In some examples of this embodiment, any n-fold deformation can be divided into n-2 triangles. Therefore, by dividing the largest region enclosed by the real position, the first target false position, the second target false position, and any initial false position in the second candidate set into triangles, two target triangular regions can be obtained.

[0078] 2. Based on the side length of the target triangular region, the area of ​​the target triangular region is obtained.

[0079] In some examples of this embodiment, the area of ​​the target triangular region can be obtained by using the method in Equation 5 above.

[0080] Third, the sum of the areas of the multiple target triangular regions is determined as the second area.

[0081] In some embodiments, generating a target query request based on the fake location anonymity set includes: I. Obtain the set of query content With identity token set The query content set includes real query content and multiple fake query content, and the identity identifier set includes multiple fake identity identifiers of the user. Obtaining the fake identity identifier includes: obtaining multiple fake IDs of the user, obtaining a second hash value based on any one of the fake IDs and a preset hash function, and concatenating the second hash value with a random number to obtain the fake identity identifier. This represents k query results. This is the actual search result; all others are fake search results. Indicates splicing, Represents a random number.

[0082] 2. Based on the set of fake location anonymities, the set of query content, the set of identity identifiers, and the current time, generate the target query request.

[0083] In some examples of this embodiment, the mathematical expression of the target query request can be: (Equation 6) in, Indicates the target query request. This represents the service public key of the location-based service provider. Encrypt it. This represents k fake identity identifiers.

[0084] Please refer to Figure 6 This embodiment also provides a location privacy protection device, including: The real location acquisition module 610 is used to acquire the user's real location; The candidate set acquisition module 620 is used to obtain a false location candidate set based on the real location. The false location candidate set includes multiple initial false locations. The absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold. The query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider. The query request generation module 630 is used to generate a target query request based on the real location and the set of candidate fake locations, and send the target query request to the location service provider so that the location service provider can provide location services based on the target query request. The location privacy protection device in this embodiment achieves the technical effects of the location privacy protection method in the above embodiments, and will not be elaborated further here.

[0085] It should be noted that the location privacy protection method and the location privacy protection device provided in the above embodiments belong to the same concept. The specific way in which each module performs its operation has been described in detail in the method embodiments and will not be repeated here. In practical applications, the location privacy protection device provided in the above embodiments can assign the above functions to different functional modules as needed, that is, divide the internal structure of the system into different functional modules to complete all or part of the functions described above. This is not a limitation here.

[0086] This embodiment also provides a vehicle including the location privacy protection device as described above.

[0087] Please refer to Figure 7 This embodiment also provides a location privacy protection system, including: A third-party organization 710 is used to obtain the order and generator of a preset additive elliptic curve group, where q is the order of the additive elliptic curve group, and the system private key of the third-party organization is any value in a cyclic group of order q-1; based on the user's ID information and a preset hash function, a first hash value is determined; the product between the first hash value and the system private key of the third-party organization is determined as the user's public key; the product between the user's public key and the generator is determined as the user's private key; and the user's public key and the public-private key are sent to the location privacy protection device 720 as described above. The location privacy protection device 720 is used to obtain the service public key of the location service provider, encrypt the target query request based on the service public key to obtain an encrypted request, and send the encrypted request to the location service provider 730. The location service provider 730 is used to decrypt the encrypted request based on its own service private key, perform a query based on the decrypted request information to obtain a query result, encrypt the query result based on the user's public key to obtain an encrypted result, and feed the encrypted result back to the location privacy protection device. Both the service public key and the service private key are generated and issued by the third-party organization 710. The location privacy protection system in this embodiment can effectively protect the privacy of the user's real location and has high security.

[0088] Figure 8 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 8 As shown, the electronic device may include a processor 810, a communications interface 820, a memory 830, and a communication bus 840. The processor 810, communications interface 820, and memory 830 communicate with each other via the communication bus 840. The processor 810 can call logical instructions in the memory 830 to execute a location privacy protection method. This method includes: obtaining the user's real location; obtaining a set of false location candidates based on the real location, the false location candidate set including multiple initial false locations, the absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location being less than or equal to a preset probability threshold, the query probability being obtained by statistically analyzing the location information in the user's past query requests to the location service provider; generating a target query request based on the real location and the set of false location candidates; and sending the target query request to the location service provider so that the location service provider can provide location services based on the target query request.

[0089] Furthermore, the logical instructions in the aforementioned memory 830 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0090] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the location privacy protection method provided by the above methods. The method includes: obtaining the user's real location; obtaining a set of false location candidates based on the real location, the false location candidate set including multiple initial false locations, wherein the absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold, the query probability being obtained by statistically analyzing location information in historical query requests previously sent by the user to a location service provider; generating a target query request based on the real location and the set of false location candidates; and sending the target query request to a location service provider so that the location service provider provides location services based on the target query request.

[0091] The device embodiments described above are merely illustrative. The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0092] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0093] The above embodiments are merely illustrative of the principles and effects of this application and are not intended to limit this application. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of this application. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in this application should still be covered by the claims of this application.

Claims

1. A method for protecting location privacy, characterized in that, include: Obtain the user's real location; Based on the real location, a set of false location candidates is obtained. The set of false location candidates includes multiple initial false locations. The absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold. The query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider. Based on the real location and the set of false location candidates, a target query request is generated and sent to the location service provider so that the location service provider can provide location services based on the target query request.

2. The location privacy protection method according to claim 1, characterized in that, The step of generating a target query request based on the real location and the candidate set of false locations includes: Based on the true location and the set of candidate false locations, a set of anonymous false locations is obtained. The set of anonymous false locations includes the true location and multiple target false locations. The target false locations are determined from multiple initial false locations. The area enclosed by the true location and the multiple target false locations is greater than the area enclosed by the true location and the remaining initial false locations in the set of candidate false locations. Based on the fake location anonymity set, a target query request is generated and sent to the location service provider.

3. The location privacy protection method according to claim 1, characterized in that, Before obtaining the user's actual location, the process also includes: The system receives a user public-private key pair sent by a third-party organization. The user public-private key pair includes a user public key and a user private key. The user public key is the product of a first hash value and the system private key of the third-party organization. The first hash value is determined based on the user's ID information and a preset hash function. The hash function has a range of q-order finite field, where q is the order of a preset additive elliptic curve group. The system private key is any value in a q-1 order cyclic group. The user private key is the product of the user public key and the generator of the additive elliptic curve group. Sending the target query request to the location service provider includes: obtaining the service public key of the location service provider; encrypting the target query request based on the service public key to obtain an encrypted request; sending the encrypted request to the location service provider, so that the location service provider decrypts the encrypted request based on its own service private key; performing a query based on the decrypted request information to obtain a query result; encrypting the query result based on the user's public key to obtain an encrypted result; and completing the feedback of the encrypted result; both the service public key and the service private key are generated and issued by the third-party organization. After sending the target query request to the location service provider, the method further includes: receiving the encrypted result, decrypting the encrypted result based on the user's private key to obtain the query result, and completing the location service request.

4. The location privacy protection method according to claim 1, characterized in that, The process of obtaining a candidate set of false locations based on the true locations includes: The real location is generalized to obtain a generalized region, which contains the real location; the generalized region is then divided into grids to obtain multiple grid cells. Based on preset historical query records, multiple points of interest of the user in the generalized area are obtained, as well as the query probability of the points of interest. The historical query records include multiple historical query requests sent by the user to the location service provider in the past, and the points of interest are determined based on the location information in the historical query requests. The grid cell where the point of interest is located is defined as the point of interest grid. The query probability of the point of interest grid is the query probability of the corresponding point of interest. The multiple point of interest grids include the first point of interest grid where the real location is located and the second point of interest grid where the initial false location is located. There are multiple second point of interest grids. The difference between the query probability of the second point of interest grid and the query probability of the first point of interest grid is determined as a first value, and the absolute value of the first value is determined as a second value. If the second value is less than or equal to the preset probability threshold, the current position of the second point of interest grid is determined as the initial false position. Traverse the remaining second interest point grid to obtain the false location candidate set.

5. The location privacy protection method according to claim 4, characterized in that, The real location includes latitude and longitude information, and the generalization of the real location to obtain the generalized region includes: The latitude and longitude information is encoded using a space-filling method to obtain spatial binary code; The spatial binary code is converted into a binary sequence, and the binary sequence is converted into Geohash code, wherein the length of the Geohash code is a preset length; Based on the Geohash encoding, a reverse retrieval is performed to obtain the generalized region.

6. The location privacy protection method according to claim 2, characterized in that, The step of obtaining the anonymous set of false locations based on the true locations and the candidate set of false locations includes: The initial false position that is farthest from the real position in the false position candidate set is determined as the first target false position, and the remaining initial false positions in the false position candidate set form the first candidate set; The area enclosed by the real location, the first target false location, and any one of the initial false locations in the first candidate set is defined as the first area, and the first area corresponds one-to-one with the initial false locations in the first candidate set. The maximum value among the multiple first areas is determined as the first target area, the initial false position corresponding to the first target area is determined as the second target false position, and the remaining initial false positions in the first candidate set form the second candidate set; The area of ​​the largest region enclosed by the real location, the first target false location, the second target false location, and any one of the initial false locations in the second candidate set is determined as the second area, and the second area corresponds one-to-one with the initial false locations in the second candidate set; The maximum value among the multiple second areas is determined as the second target area, the initial false position corresponding to the second target area is determined as the third target false position, and the remaining initial false positions in the second candidate set form the third candidate set; The initial false locations in the third candidate set are traversed to obtain the false location anonymity set, and the number of locations in the false location anonymity set is a preset number.

7. The location privacy protection method according to claim 2, characterized in that, The step of generating a target query request based on the fake location anonymity set includes: Obtain a set of query content and a set of identity identifiers. The set of query content includes real query content and multiple fake query content. The set of identity identifiers includes multiple fake identity identifiers of the user. Obtaining the fake identity identifiers includes: obtaining multiple fake IDs of the user; obtaining a second hash value based on any one of the fake IDs and a preset hash function; and concatenating the second hash value with a random number to obtain the fake identity identifier. The target query request is generated based on the set of fake location anonymities, the set of query content, the set of identity identifiers, and the current time.

8. A location privacy protection device, characterized in that, include: The real location acquisition module is used to acquire the user's real location; The candidate set acquisition module is used to obtain a false location candidate set based on the real location. The false location candidate set includes multiple initial false locations. The absolute value of the difference between the query probability corresponding to the initial false location and the query probability corresponding to the real location is less than or equal to a preset probability threshold. The query probability is obtained by statistically analyzing the location information in the user's past query requests to the location service provider. The query request generation module is used to generate a target query request based on the real location and the set of fake location candidates, and send the target query request to the location service provider so that the location service provider can provide location services based on the target query request.

9. A vehicle, characterized in that, Includes the location privacy protection device as described in claim 8.

10. A location privacy protection system, characterized in that, include: A third-party organization is used to obtain the order and generator of a preset additive elliptic curve group, where q is the order of the additive elliptic curve group, and the system private key of the third-party organization is any value in a cyclic group of order q-1; a first hash value is determined based on the user's ID information and a preset hash function; the product between the first hash value and the system private key of the third-party organization is determined as the user's public key; The product between the user's public key and the generator is determined as the user's private key; the user's public key and the public / private key are sent to the location privacy protection device as described in claim 8; The location privacy protection device is used to obtain the service public key of the location service provider, encrypt the target query request based on the service public key to obtain an encrypted request, and send the encrypted request to the location service provider. The location service provider is used to decrypt the encrypted request based on its own service private key, perform a query based on the decrypted request information to obtain a query result, encrypt the query result based on the user's public key to obtain an encrypted result, and feed the encrypted result back to the location privacy protection device. Both the service public key and the service private key are generated and issued by the third-party organization.

Images