CN113573234B - A location privacy protection method in large indoor location service scenarios - Google Patents

Abstract

A location privacy protection method in a large indoor location service scenario, in the field of location service and information security. The protection method, aiming at the leakage of location privacy caused by untrusted servers or eavesdropping attackers in the process of 3D space location service, adopts geographical indistinguishability, based on the 3D Laplacian noise mechanism, the X, Y and Z coordinates of the location are simultaneously processed. Perturbation, using discretization and truncation methods to determine the perturbation position, analyze the mathematical quantification relationship of the privacy budget before and after discretization and truncation, and compensate for the privacy budget degradation caused by discretization by adding additional noise; deal with location privacy in a three-dimensional spatial location service environment Leakage, improve the location data privacy security performance of the location service system under location inference attacks. Advantages: Based on the geographic indistinguishability in three-dimensional space of differential privacy, the disturbance protection of the three dimensions of the location is realized at the same time, and the strict measurement method and implementation mechanism of the three-dimensional space location privacy protection are provided.

Description

A location privacy protection method in large indoor location service scenarios

technical field

The invention relates to the field of location service and information security, in particular to a location privacy protection method in a large indoor location service scenario.

Background technique

Due to the rapid development of 5G intelligent communication technology and the increasing high population density in cities, location-based services [[1] Wang Yuhang. Research on privacy protection technology for location data [D]. Harbin Institute of Technology, 2020] have been obtained in large indoor buildings. Wide range of applications, such as large hospitals, large shopping malls, etc. The global indoor LBS market size is expected to reach USD 18.74 billion by 2025. At the same time, the risk of leakage of user location privacy is becoming more and more serious. The FCC is proposing to fine four major mobile phone companies at least $200 million in 2020 for leaking real-time location data on consumers. The issue of location privacy protection in three-dimensional spaces such as various large-scale indoor buildings has received increasing attention from academia and industry. At present, most location privacy protection schemes focus on location privacy protection in two-dimensional space. When the user's location data contains high-level information, these mechanisms cannot deal with location inference attacks by untrusted location servers or eavesdropping attackers using existing background knowledge. .

In recent years, researchers at home and abroad have paid great attention to the problem of location privacy leakage in location services, and adopted K-anonymity [[2] Cui Yujuan. Research on privacy protection methods based on location services [D]. Northwest Normal University, 2020], mix- Location privacy is protected by methods such as zone, encryption, and perturbation. However, the encryption-based location privacy protection mechanism completely hides user location information, which is not suitable for location service application scenarios. In addition, the location privacy protection mechanism based on K-anonymity needs to rely on a trusted third party. Once the server is paralyzed or attacked, there is a threat of leakage of user privacy. The perturbation-based location privacy protection mechanism can generally be implemented locally on the user side, which can avoid the dependence on trusted and secure servers.

Two-dimensional geographic indistinguishability is an extension of traditional differential privacy and is used to protect the location privacy of a single user in two-dimensional planar space [[3] M.Andrés, N.Bordenabe, K.Chatzikokolakis, and C.Palamidessi, Geo -indistinguishability: Differential privacy for location-based systems [C]. ACM Conference Computer and Communications Security (CCS), 2013: 901-914]. The mobile user can locally generate a fake location by using the perturbation mechanism based on the indistinguishability of the two-dimensional geographic location and publish it to the location server for service requests. The real location is only known by the user itself. However, when the user is in a three-dimensional space such as a large hospital, due to the introduction of the user's height position information, the above-mentioned location privacy protection mechanism for the two-dimensional space cannot effectively prevent the location inference attack. For example, different floors of a high-rise hospital represent different kinds of diseases. If the user's floor information is leaked, his/her condition will also be leaked and exposed to the attacker. Therefore, it is very important to study the protection mechanism of user location data in 3D space location service.

SUMMARY OF THE INVENTION

The purpose of the present invention is to provide a location privacy protection method in a large indoor location service scenario, so as to protect the privacy security of location data in a location service scenario in a large indoor three-dimensional space.

The purpose of the present invention is to achieve the following: a method for protecting location privacy in three-dimensional space, aiming at the location privacy leakage caused by untrusted servers or eavesdropping attackers in the process of three-dimensional space location service, using geographic indistinguishability, based on three-dimensional Laplace The noise-adding mechanism simultaneously perturbs the X, Y and Z coordinates of the location, uses the discretization and truncation method to determine the perturbed location, analyzes the mathematical quantification relationship of the privacy budget before and after discretization and truncation, and compensates for the resulting discretization by adding additional noise. The privacy budget is degraded; the location privacy leakage of the three-dimensional space location service environment is dealt with, and the location data privacy security performance of the location service system under the location inference attack is improved.

Specific steps are as follows:

Step 1: Define the geographic indistinguishability mechanism in 3D space; propose a rigorous and provable measurement method of location privacy in 3D space based on differential privacy - 3D geographic indistinguishability, which is defined as follows:

使得三维空间中所有

满足ε-地理不可区分性，其中

为真实位置的可能集合，

为扰动位置的可能集合，x₁为用户位置，x′为扰动位置，d₃(x₁,x₂)为以x₁为中心的球形区域的半径；Among them, ε is the privacy budget, the perturbation mechanism

make all three-dimensional space

Satisfy ε-geographic indistinguishability, where

is the possible set of real locations,

is the possible set of disturbed positions, x ₁ is the user position, x' is the disturbed position, and d ₃ (x ₁ , x ₂ ) is the radius of the spherical region centered on x ₁ ;

In step ₁ , 3D geographic indistinguishability ensures that for any two geographically close locations in 3D space, the probability distribution of perturbed locations is similar, determined by the privacy budget ε and the radius centered at the user location x1 as _{d3 (} x1 ,x ₂ ) of the spherical area determines that the true position in the space is protected.

Step 2: Simultaneously perturb the X, Y and Z coordinates of the position in the three-dimensional space;

In step 2, the specific steps are as follows:

Step 1), the probability density function of introducing the noise generation mechanism is

Among them, ε is the privacy budget, x ₁ is the user's real position, x' is the disturbance position, d ₃ (x ₁ , x ₂ ) is the radius of the spherical area centered at x ₁ , and A is the normalization coefficient;

Step 2), replace the Cartesian coordinate system with the spherical coordinate system to determine the perturbation position; the user's real position is x ₁ , and its perturbation position is x', expressed as (r, θ, ψ), where ε is the privacy budget, r Represents the distance between x ₁ and x′, θ is the polar angle, ψ is the azimuth angle, and the probability density function in the spherical coordinate system is:

极角θ，方位角Ψ，三个变量的边缘分布分别为：Define three variables expressed as radius

The polar angle θ, the azimuth angle Ψ, and the marginal distributions of the three variables are:

Step 3), send the disturbance position x' to the LBS server according to the noise distribution function;

In the above step 2), the method for obtaining the disturbance position x':

Step (1), select a random vector U=(θ,ψ) in the unit sphere;

即为伽马分布Γ(3,1/ε)的概率密度函数，根据伽马分布Γ(3,1/ε)确定一个半径r，扰动位置x′即服从分布x₁+Ur。In step (2), formula (3)

It is the probability density function of the gamma distribution Γ(3,1/ε), and a radius r is determined according to the gamma distribution Γ(3,1/ε), and the disturbance position x' is subject to the distribution x ₁ +Ur.

中，设计离散化加噪机制，推导离散化前后隐私预算的关系，确保离散化的加噪机制依然保证差分隐私特性；Step 3: Approximate the noise generated by the Laplace mechanism to a cubic mesh in 3D coordinates

In , the discretization noise addition mechanism is designed, and the relationship between the privacy budgets before and after discretization is deduced to ensure that the discretization noise addition mechanism still guarantees the differential privacy characteristics;

In step 3, the user's real position is x ₁ , and the disturbed position is generated by the following two steps

Step 1), in the spherical coordinate system with x ₁ as the center, use the three-variable Laplace noise mechanism to generate a perturbed position

重新映射到空间中距离最近的位置x′，此机制记为

Step 2),

Remap to the nearest position x' in space, this mechanism is denoted as

的步长和设备的精度决定，而退化的隐私预算通过添加额外噪声来进行补偿；The discretized privacy budget ε' consists of the privacy budget ε, the cube grid

is determined by the step size and the accuracy of the device, and the degraded privacy budget is compensated by adding additional noise;

Step 4: Design a truncated noise-adding mechanism to ensure geographic indistinguishability in three-dimensional space; the above mechanism cannot satisfy differential privacy in any three-dimensional space.

In step 4, the mechanism cannot satisfy differential privacy in any three-dimensional space; the specific reasons are as follows:

1) The above discretized noise-adding mechanism can only guarantee differential privacy in a limited range;

2) In actual scenarios, the user access space is limited; in order to ensure the geographical indistinguishability after discretization and limit the location to a limited area, the truncation method is used to map the unreasonable locations to the limited range to ensure that the geographic location in the three-dimensional space is indistinguishable. Distinguishing properties.

In step 3, the three-variable Laplacian noise mechanism in the three-dimensional space simultaneously perturbs the X, Y, and Z coordinates of the location to ensure geographic indistinguishability in the three-dimensional space.

In step 3, the noise is discretized in the spherical coordinate system of the three-dimensional space, and the perturbed position is generated while keeping the geographic indistinguishability parameter unchanged.

In step 4, in order to ensure the discrete geographic indistinguishability and limit the location to a limited area, the unreasonable location is mapped to the limited range by using the truncation method to ensure that the geographic location indistinguishability attribute remains unchanged. Based on device accuracy, limited space range, and discretization unit, analyze the mathematical quantification relationship of the privacy budget before and after discretization and truncation, and compensate the privacy budget degradation caused by discretization by adding additional noise, so that the noise addition mechanism after discretization and truncation is made. Geographic indistinguishability in three-dimensional space is still strictly guaranteed.

Beneficial effects, due to the adoption of the above scheme, in view of the problem of location privacy leakage caused by untrusted servers or eavesdropping attackers in the process of large-scale indoor three-dimensional space location services, a differential privacy-based three-dimensional spatial location indistinguishability is proposed to perform location privacy analysis. Strictly measure, use the three-dimensional Laplacian noise mechanism to simultaneously perturb the X, Y and Z coordinates of the location, so that the attacker cannot obtain the precise location information of the user. In addition, due to the limited precision of hardware devices in practical applications, mobile devices cannot generate arbitrary false positions based on a continuous noise-adding function; moreover, the user access space is limited in practical scenarios. Therefore, the discretization and truncation method is used to determine the perturbation position, analyze the mathematical quantification relationship of the privacy budget before and after discretization and truncation, and compensate the privacy budget degradation caused by discretization by adding additional noise, so that the added noise after discretization and truncation The mechanism still strictly guarantees differential privacy.

It solves the problem of location privacy leakage caused by untrusted servers or eavesdropping attackers in the process of location services in three-dimensional spaces such as large indoor spaces, and achieves the purpose of location privacy protection in location service scenarios in three-dimensional spaces such as large indoor spaces.

Geographically indistinguishable mechanism in three-dimensional space, that is, for any location within a given spherical region of radius R, no matter how much prior knowledge the attacker knows, the distribution of the inference results of the user's true location is similar; this means that despite the fact that The attacker can determine that the user is in the spherical area of radius R, and it cannot determine the exact location of the user, and for an attacker who already knows the user's area, no matter how much prior knowledge it has, it cannot be derived from the user's location. More information is inferred from the perturbed position.

和

越相似。Ensure that for any two geographically close locations in three-dimensional space, εd ₃ (x ₁ , x ₂ ) can be regarded as a measure of geographic indistinguishability: the closer x ₁ and x ₂ are, the more disturbed the location distribution

and

more similar.

时，传送区域内任意位置的可能性差异最多为

The X, Y and Z coordinates of the position in the three-dimensional space are simultaneously perturbed, and the three-dimensional Laplacian noise mechanism is proposed to achieve geographic indistinguishability in the three-dimensional space in a continuous space. According to the noise distribution function, the randomly generated perturbed position x 'Send to the server of location service, when the real location is x ₁ and x ₂ ,

, the probability difference at any location within the transfer area is at most

Considering the limited precision of hardware devices in practice, the limited precision makes it impossible for mobile devices to generate arbitrary false positions based on a continuous noise function.

的步长和设备的精度决定，而退化的隐私预算通过添加额外噪声来进行补偿。The discretized noise-adding mechanism can still ensure geographic indistinguishability in three-dimensional space, but it will lead to the degradation of the privacy budget; the discretized privacy budget ε' is composed of the privacy budget ε, the cube grid

is determined by the step size and the accuracy of the device, while the degraded privacy budget is compensated by adding extra noise.

Since most location privacy protection schemes focus on location privacy protection in two-dimensional space, when the user's location data contains high-level information, these mechanisms cannot deal with location inference attacks by untrusted location servers or eavesdropping attackers using existing background knowledge. The encryption-based location privacy protection mechanism completely hides the user's location information, which is not suitable for location service application scenarios. In addition, some location privacy protection mechanisms, such as K-anonymity, need to rely on a trusted third party. Once the server is paralyzed or attacked, there is a threat of leakage of user privacy. Therefore, the present invention adopts the indistinguishability of geographic location, determines the disturbance location based on the three-dimensional Laplacian noise mechanism, and designs a discretized and truncated location disturbance scheme considering the limited precision of the equipment and the limited user access space in the actual scene, so that the attacker can It is impossible to obtain the precise location information of the user, resist the location inference attack in the three-dimensional space location service environment, and improve the privacy and security performance of the location data in the location service system.

Advantages: The present invention takes the location height information into account, proposes a strict and provable measurement method for privacy protection of three-dimensional space, designs a three-dimensional Laplacian noise addition mechanism, and protects the location service scenarios in three-dimensional spaces such as large indoor spaces. Location data privacy and security.

Description of drawings

1 is a scene diagram of a three-dimensional space location service system such as a medium and large hospital of the present invention;

2 is a flowchart of a method for protecting location privacy based on a three-dimensional spatial geographic indistinguishable mechanism adopted by the present invention;

Detailed ways

The location privacy protection method in 3D space, for location privacy leakage caused by untrusted servers or eavesdropping attackers in the process of 3D space location service, using geographic indistinguishability, based on the 3D Laplacian noise mechanism for the location X, Y Perform perturbation with Z coordinate at the same time, use discretization and truncation to determine the perturbation position, analyze the mathematical quantification relationship of the privacy budget before and after discretization and truncation, and compensate the privacy budget degradation caused by discretization by adding additional noise; deal with three-dimensional space position The location privacy of the service environment is leaked, and the location data privacy security performance of the location service system under location inference attacks is improved.

Specific steps are as follows:

Step 1: Define the geographic indistinguishability mechanism in 3D space; propose a rigorous and provable measurement method of location privacy in 3D space based on differential privacy - 3D geographic indistinguishability, which is defined as follows:

使得三维空间中所有

满足ε-地理不可区分性，其中

为真实位置的可能集合，

为扰动位置的可能集合，x₁为用户位置，x′为扰动位置，d₃(x₁,x₂)为以x₁为中心的球形区域的半径；Among them, ε is the privacy budget, the perturbation mechanism

make all three-dimensional space

Satisfy ε-geographic indistinguishability, where

is the possible set of real locations,

is the possible set of disturbed positions, x ₁ is the user position, x' is the disturbed position, and d ₃ (x ₁ , x ₂ ) is the radius of the spherical region centered on x ₁ ;

In step ₁ , 3D geographic indistinguishability ensures that for any two geographically close locations in 3D space, the probability distribution of perturbed locations is similar, determined by the privacy budget ε and the radius centered at the user location x1 as _{d3 (} x1 ,x ₂ ) of the spherical area determines that the true position in the space is protected.

Step 2: Simultaneously perturb the X, Y and Z coordinates of the position in the three-dimensional space;

In step 2, the specific steps are as follows:

Step 1), the probability density function of introducing the noise generation mechanism is

Among them, ε is the privacy budget, x ₁ is the user's real position, x' is the disturbance position, d ₃ (x ₁ , x ₂ ) is the radius of the spherical area centered at x ₁ , and A is the normalization coefficient;

Step 2), replace the Cartesian coordinate system with the spherical coordinate system to determine the perturbation position; the user's real position is x ₁ , and its perturbation position is x', expressed as (r, θ, ψ), where ε is the privacy budget, r Represents the distance between x ₁ and x′, θ is the polar angle, ψ is the azimuth angle, and the probability density function in the spherical coordinate system is:

极角θ，方位角Ψ，三个变量的边缘分布分别为：Define three variables expressed as radius

The polar angle θ, the azimuth angle Ψ, and the marginal distributions of the three variables are:

Step 3), send the randomly generated disturbance position x' to the LBS server according to the noise distribution function;

In the above step 2), the method for obtaining the disturbance position x':

Step (1), select a random vector U=(θ,ψ) in the unit sphere;

即为伽马分布Γ(3,1/ε)的概率密度函数，根据伽马分布Γ(3,1/ε)确定一个半径r，扰动位置x′即服从分布x₁+Ur。In step (2), formula (3)

It is the probability density function of the gamma distribution Γ(3,1/ε), and a radius r is determined according to the gamma distribution Γ(3,1/ε), and the disturbance position x' is subject to the distribution x ₁ +Ur.

中，设计离散化加噪机制，推导离散化前后隐私预算的关系，确保离散化的加噪机制依然保证差分隐私特性；Step 3: Approximate the noise generated by the Laplace mechanism to a cubic mesh in 3D coordinates

In , the discretization noise addition mechanism is designed, and the relationship between the privacy budgets before and after discretization is deduced to ensure that the discretization noise addition mechanism still guarantees the differential privacy characteristics;

In step 3, the user's real position is x ₁ , and the disturbed position is generated by the following two steps

Step 1), in the spherical coordinate system with x ₁ as the center, use the three-variable Laplace noise mechanism to generate a perturbed position

重新映射到空间中距离最近的位置x′，此机制记为

Step 2),

Remap to the nearest position x' in space, this mechanism is denoted as

的步长和设备的精度决定，而退化的隐私预算通过添加额外噪声来进行补偿；The discretized privacy budget ε' consists of the privacy budget ε, the cube grid

is determined by the step size and the accuracy of the device, and the degraded privacy budget is compensated by adding additional noise;

Step 4: Design a truncated noise-adding mechanism to ensure geographic indistinguishability in three-dimensional space; the above mechanism cannot satisfy differential privacy in any three-dimensional space.

In step 4, the mechanism cannot satisfy differential privacy in any three-dimensional space; the specific reasons are as follows:

1) The above discretized noise-adding mechanism can only guarantee differential privacy in a limited range;

2) In actual scenarios, the user access space is limited; in order to ensure the geographical indistinguishability after discretization and limit the location to a limited area, the truncation method is used to map the unreasonable locations to the limited range to ensure that the geographic location in the three-dimensional space is indistinguishable. Distinguishing properties.

In step 3, the three-variable Laplacian noise mechanism in the three-dimensional space simultaneously perturbs the X, Y, and Z coordinates of the location to ensure geographic indistinguishability in the three-dimensional space.

In step 3, the noise is discretized in the spherical coordinate system of the three-dimensional space, and the perturbed position is generated while keeping the geographic indistinguishability parameter unchanged.

In step 4, in order to ensure the discrete geographic indistinguishability and limit the location to a limited area, the unreasonable location is mapped to the limited range by using the truncation method to ensure that the geographic location indistinguishability attribute remains unchanged. Based on device accuracy, limited space range, and discretization unit, analyze the mathematical quantification relationship of the privacy budget before and after discretization and truncation, and compensate the privacy budget degradation caused by discretization by adding additional noise, so that the noise addition mechanism after discretization and truncation is made. Geographic indistinguishability in three-dimensional space is still strictly guaranteed.

The technical solutions of the present invention are further described below in conjunction with examples, but the claimed scope is not limited to the description.

Embodiment 1: A technical method for location privacy protection in a three-dimensional space in a large-scale indoor location service scenario, the specific implementation steps are as follows:

Step 1: Set the three-dimensional space environment, consider the position disturbance mechanism in three dimensions at the same time, and design the three-dimensional Laplacian noise mechanism. Figure 1 shows the scene diagram of the 3D spatial location service system of a large hospital. Assuming that the hospital is in a cube map with a length and width of 600 meters and a height of 60 meters, the map is divided into 30 × 30 × 20 cubic grids. There are a total of 18,000 cube grids with a length and width of 20 meters and a height of 3 meters. Different grids represent different location areas, and the area numbers are {c ₁ ,c ₂ ,c ₃ ,...}. When the user is active in the hospital, the user sends his current location to the location server to request location services. At this time, the untrusted location server or eavesdropping attacker will use the existing background knowledge to reason and attack the user's location privacy, and send a message to the user. Spam or scam, etc. At this time, using the indistinguishability of geographic location in three-dimensional space, the user publishes a disturbed location to the location server to prevent attackers from stealing the user's location privacy in the hospital, thereby improving the location data privacy and security performance of the location service system under location inference attacks. .

In the large-scale indoor location service scenario, the location privacy protection method of the present invention is mainly divided into defining a geographical indistinguishable mechanism in a three-dimensional space, generating a disturbed position based on the geographical indistinguishable mechanism in a three-dimensional space, designing a discretization and noise-adding mechanism, and using a truncation method to ensure three-dimensional The four processes of spatial geography indistinguishable properties.

Step 2: Define the geographic indistinguishability mechanism in 3D space, and propose a rigorous and provable 3D spatial location privacy measurement method based on differential privacy. The geographic indistinguishability mechanism in 3D space is defined as follows:

使得三维空间中所有

满足ε-地理不可区分性，其中

为真实位置的可能集合，

为扰动位置的可能集合。该定义确保对于三维空间中的任意两个地理相近的位置，其扰动位置的概率分布相似，由隐私预算ε和以用户位置x₁为中心的半径为d₃(x₁,x₂)的球形区域决定。即εd₃(x₁,x₂)可被看作地理不可区分性度量：x₁和x₂距离越近，其扰动位置分布

和

越相似。由于球形空间内的所有位置都会产生近似的扰动位置分布，空间内的真实位置得到保护。The perturbation mechanism

make all three-dimensional space

Satisfy ε-geographic indistinguishability, where

is the possible set of real locations,

is the possible set of perturbation locations. This definition ensures that for any two geographically close locations in three-dimensional space, the probability distributions of their perturbed locations are similar, given by the privacy budget ε and a sphere of radius d ₃ (x ₁ ,x ₂ ) centered at the user location x ₁ Regional decision. That is, εd ₃ (x ₁ , x ₂ ) can be regarded as a geographical indistinguishability measure: the closer the distance between x ₁ and x ₂ , the more disturbed the location distribution

and

more similar. Since all positions within the spherical space produce an approximate distribution of perturbed positions, the true positions within the space are protected.

定义三个变量，分别为半径

极角θ，方位角Ψ，其边缘分布函数为：Step 3: Generate perturbed locations in 3D space based on a 3D geographic indistinguishability mechanism. In order to make the operation more convenient and efficient, the present invention replaces the Cartesian coordinate system with the spherical coordinate system. The user's real position is x ₁ , and its perturbed position is x', which can be expressed as (r, θ, ψ), where r represents the distance between x ₁ and x', θ is the polar angle, and ψ is the azimuth angle. Substitute Formula (2) know:

Define three variables, namely the radius

Polar angle θ, azimuth angle Ψ, the edge distribution function is:

Finally, the disturbance position x′ is obtained according to the following two steps: (1) Select a random vector U=(θ,ψ) in the unit sphere (2) Select a radius r according to the gamma distribution Γ(3,1/ε), The perturbation position x' follows the distribution x ₁ +Ur.

为立方体网格，假设

的长为u、宽为v、高为h，且u＞v＞h：Step 4: Discretized Laplace mechanism. At the user's actual position x ₁ , the perturbed position is generated by the following two steps

is a cube mesh, assuming

The length is u, the width is v, and the height is h, and u>v>h:

1) In the spherical coordinate system centered at x ₁ , use the Laplace mechanism of the 3 variables in step 3 to generate a perturbed position

重新映射到距离

最近的位置x′，即：2) will

Remap to distance

The nearest position x', i.e.:

分别表示r,θ,

三个方向上的设备精度，B表示步骤1)中

产生的离散点集。每个点

是由r,r+dr,θ,θ+dθ,

连接的区域的概率生成的。在步骤1)中生成

的概率为N_B(x')＝N(x')∩B。Let dr, dθ,

respectively represent r, θ,

Device accuracy in three directions, B means in step 1)

The resulting set of discrete points. each point

is composed of r, r+dr, θ, θ+dθ,

Probabilities of connected regions are generated. generated in step 1)

The probability of is N _B (x')=N(x')∩B.

的步长有关，N_B(x')由立方体

的步长和设备精度共同影响。离散化后的隐私预算ε'与之前的隐私预算ε，

的长u、宽v、高h和设备的精度有关。由于离散化降低了隐私预算ε'，根据ε'和ε的差异量化需要添加的噪声，通过添加这部分额外的噪声补偿由于离散化导致的隐私预算退化，从而确保离散化的加噪机制依然保证三维空间中地理不可分区特性。N(x') and cube

is related to the step size, N _B (x') is determined by the cube

The step size and device accuracy together affect. The discretized privacy budget ε' and the previous privacy budget ε,

The length u, width v, and height h are related to the accuracy of the equipment. Since discretization reduces the privacy budget ε', the noise that needs to be added is quantified according to the difference between ε' and ε. By adding this part of the extra noise, the privacy budget degradation caused by the discretization is compensated, so as to ensure that the noise addition mechanism of the discretization is still guaranteed. Geographically indistinguishable properties in three-dimensional space.

为截断后的加噪机制。有

该阶段机制类似离散的拉普拉斯机制，区别在于扰动位置被重新映射在

中最近的点，即将空间α外的位置映射到空间内的一点。通过这种方法本发明同样保证了截断后的拉普拉斯加噪机制依然满足三维空间中地理不可区分性。Step 5: Guarantee geographic indistinguishability of discrete Laplacian mechanisms by means of truncation. Suppose that α represents a finite area, the diameter of which is D _α . make

It is the truncated noise-adding mechanism. Have

The phase mechanism is similar to the discrete Laplace mechanism, except that the perturbation position is remapped in

The closest point in the space, that is, the position outside the space α is mapped to a point in the space. Through this method, the present invention also ensures that the truncated Laplacian noise mechanism still satisfies the geographic indistinguishability in three-dimensional space.

Claims (7)

1. A position privacy protection method under a large indoor position service scene is characterized by comprising the following steps: a position privacy protection method in a three-dimensional space aims at position privacy leakage caused by an untrusted server or an eavesdropper in the three-dimensional space position service process, geographical position indistinguishability is adopted, X, Y and Z coordinates of a position are simultaneously disturbed based on a three-dimensional Laplace noise mechanism, the disturbed position is determined by a discretization and truncation method, the mathematical quantization relation of privacy budgets before and after discretization and truncation is analyzed, and budget degradation caused by discretization is compensated by adding extra noise; the position privacy of the three-dimensional space position service environment is revealed, and the position data privacy security performance of the position service system under the position inference attack is improved;

step 1: defining a geographically indistinguishable mechanism in three-dimensional space; a strict and provable measurement method for position privacy in a three-dimensional space based on differential privacy, namely three-dimensional geographic indistinguishability, is provided, and is defined as follows:

wherein epsilon is privacy budget and perturbation mechanism

So that all real positions x in the three-dimensional space₁,

Location of disturbance

Satisfies epsilon-geographic indistinguishability, wherein

Is a possible set of real positions of the mobile terminal,

to perturb the possible set of locations, x₁For the user's true position, x' is the disturbance position, d₃(x₁,x₂) Is given by x₁The radius of the central spherical region;

step 2: simultaneously disturbing the X, Y and Z coordinates of the position in the three-dimensional space;

and step 3: cubic grid for approximating noise generated by Laplace mechanism under three-dimensional coordinates

In the method, a discretization noise adding mechanism is designed, the relation of privacy budgets before and after discretization is deduced, and the discretization noise adding mechanism is ensured to still ensure the differential privacy characteristics;

and 4, step 4: designing a noise adding mechanism after cutting to ensure geographical indistinguishability in a three-dimensional space; the above mechanism cannot satisfy differential privacy in any three-dimensional space;

in the step 2, the concrete steps are as follows:

step 1), introducing a noise generation mechanism as a probability density function

Where ε is the privacy budget, x₁True user position, x' disturbance position, d₃(x₁X') is x₁Radius of the spherical area as the center, A is a normalization coefficient; the formula is represented by x₁A three-variable laplace function centered;

step 2), replacing a Cartesian coordinate system with a spherical coordinate system to determine a disturbance position; the user real position is x₁The disturbance position is x' and is expressed as

Where ε is the privacy budget and r represents x₁And x', theta is the polar angle,

is the azimuth, in a spherical coordinate system, at a true position x₁The probability density function of the centered three-variable laplace is:

defining three random variables as radii

The polar angle Θ, the azimuth angle Φ, and the edge distribution of three random variables are:

step 3), sending the disturbance position x' to an LBS server according to the noise distribution function, wherein the LBS in the LBS server is Location Based Services, namely the position-Based service;

in step 3, the user true position is x₁The perturbation position x' is generated by the following two steps:

step 1) in the presence of x₁In a spherical coordinate system as a center, a disturbance position is generated by utilizing a three-variable Laplace plus noise mechanism

Step 2) mixing

Remapping to nearest disturbance locations

This mechanism is described as

The discretized privacy budget Epsilon' is composed of the privacy budget Epsilon and a cubic grid

And the accuracy of the device, while the degraded privacy budget is compensated by adding extra noise.

2. The method as claimed in claim 1, wherein the method for protecting location privacy in a large indoor location service scenario comprises: in step 1, the three-dimensional geographic indistinguishability ensures that for any two geographically close locations in three-dimensional space, the probability distributions of the disturbance locations are similar, as measured by the privacy budget ε and the user location x₁A radius of d as a center₃(x₁,x₂) The true position in space is protected.

3. The method as claimed in claim 1, wherein the method for protecting location privacy in a large indoor location service scenario comprises: in the step 2), which is a specific step, the method for obtaining the disturbance position x' includes:

step (1) selecting a random vector in a unit ball

In the step (2) and the formula (3)

Namely a probability density function of gamma distribution gamma (3, 1/epsilon), a radius r is determined according to the gamma distribution gamma (3, 1/epsilon), and the disturbance position x' follows the distribution x₁+Ur。

4. The method as claimed in claim 1, wherein the method for protecting location privacy in a large indoor location service scenario comprises: in step 4, the mechanism cannot meet the difference privacy in any three-dimensional space; the specific reasons are as follows:

1) the discretization noise adding mechanism can ensure the differential privacy only in a limited range;

2) the user access space is limited in an actual scene; in order to ensure the indistinguishable geography after dispersion and limit the position in a limited area, an unreasonable position is mapped into a limited range by a truncation method, and the indistinguishable attribute of the geography position in a three-dimensional space is ensured.

5. The method as claimed in claim 1, wherein the method for protecting location privacy in a large indoor location service scenario comprises: in step 3, the three-variable laplacian noise mechanism in the three-dimensional space simultaneously perturbs X, Y and the Z coordinate of the position to ensure geographical indistinguishability in the three-dimensional space.

6. The method as claimed in claim 1, wherein the method for protecting location privacy in a large indoor location service scenario comprises: in step 3, the noise is dispersed in a spherical coordinate system of the three-dimensional space, and the disturbance position is generated while the geographic indistinguishable parameters are kept unchanged.

7. The method as claimed in claim 1, wherein the method for protecting location privacy in a large indoor location service scenario comprises: in step 4, in order to ensure the geographical indistinguishability after the dispersion and to limit the position in a limited area, an unreasonable position is mapped into a limited range by using a truncation method, and the indistinguishable attribute of the geographical position is ensured to be unchanged; based on the equipment precision, the limited space range and the discretization unit, the mathematical quantization relation of the privacy budgets before and after discretization and truncation is analyzed, and extra noise is added to compensate privacy budget degradation caused by discretization, so that a noise adding mechanism after discretization and truncation still strictly ensures geographical indistinguishability in a three-dimensional space.

Images