CN106792501A - A kind of LBS customer locations and privacy of identities guard method - Google Patents

Abstract

With the rapid development of mobile Internet technology, it has become the core communication device in modern people's daily life. With the increase of the number of devices and the maturity of related technologies, a large number of location-based service applications (Location Based Service) have emerged. The user needs to know the location of the user in order to provide corresponding services according to the location. However, the information provided by the user includes not only location information, but also private information such as id and requested service attributes. However, LBS servers are generally untrustworthy. Therefore, when the user sends this information to the LBS server, he may face the danger of privacy information leakage. Aiming at the above problems, the present invention proposes a method for protecting LBS user location and identity privacy. The method effectively prevents the user request information from being uploaded to the LBS server and being intercepted by malicious attackers by encrypting the user's location and identity privacy. And it also encrypts the response message of the LBS server to prevent deduction attacks by attackers.

Description

A method for protecting LBS user location and identity privacy

technical field

The invention relates to the field of mobile Internet security, more specifically, a method for protecting LBS user location and identity privacy.

Background technique

Nowadays, mobile Internet technology is developing rapidly, and the number of mobile devices is also increasing day by day, becoming the core communication device in modern people's daily life. With the increase in the number of devices and the maturity of related technologies, a large number of location-based service applications have emerged Program (Location Based Service), the service provider needs to know the location of the user in order to provide corresponding services according to the location, but the information provided by the user not only includes location information, but may also include private information such as id, request service attributes, etc. However, LBS servers are generally untrustworthy, so users may face the danger of private information leakage when they send these information to LBS servers. For example, if a user wants to find nearby restaurants, he needs to submit a request for nearby restaurants. Among them, the uploaded data contains sensitive information of the user, including user identity, location, and requested service attributes. Once the information is intercepted by the attacker, it may pose a threat to the user's privacy, and even serious damage may be caused.

Aiming at the problem of user location privacy protection in LBS, domestic and foreign researchers have carried out a lot of research work. The main idea is to reduce the ability of attackers to identify user location by using technical methods such as generalization, obfuscation or masking of user location. Gruteser et al. first introduced K anonymity of relational database into the field of LBS privacy protection, and proposed K anonymity measurement index; randomization technology is also used to protect privacy, such as the DUMMY-Q method, which confuses the attacker by generating dummy, It increases the uncertainty of the attacker identifying the real location, but this method neglects to consider the context and the user's motion model, resulting in a large difference between the generated dummy and the actual query, so that the attacker can easily identify the real dummy , can not play the role of protecting query privacy.

Therefore, in view of the above problems, the present invention proposes a method for protecting LBS user location and identity privacy. The method effectively prevents the user request information from being uploaded to the LBS server and being intercepted by malicious attackers by encrypting the user's location and identity privacy. And it also encrypts the response message of the LBS server to prevent deduction attacks by attackers.

Contents of the invention

In order to solve the security problems of LBS user location and identity privacy in the mobile Internet and protect users from receiving services while their sensitive information will not be identified by attackers, the present invention proposes a method for protecting LBS user location and identity privacy. Finally, the purpose of double encryption is achieved, and the encryption of the sent message effectively resists the interception attack; and the encryption of the response message effectively prevents the deduction attack.

In order to achieve the above object, the present invention is achieved through the following technical solutions:

A method for protecting LBS user location and identity privacy, comprising the following steps:

S1: CA generates a pair of user-owned key pairs <U _private , U _public > for each online user, where U _private represents the user's private key, which is used to decrypt encrypted messages received by itself; U _public represents the user's public key , and the public key U _public of all users can be found in a public public key library, which is convenient for other participants to find and use the public key to encrypt messages sent to them;

S2: The LBS server generates a pair of RSA key pairs <A _private , A _public> for each possible query attribute Service, where A _private represents the service private key, which the LBS server uses to decrypt the corresponding received encrypted message; A _public means the public key sent by the LBS server to the user terminal, before the user sends a query request, it will be encrypted with the corresponding public key and sent;

S3: Before sending the query request information, the user terminal encrypts the information with the corresponding public key according to the attributes of the requested service; the encryption includes encrypting the user's identity information and location information.

S4: After receiving the encryption request, the LBS server uses the corresponding private key to decrypt it;

S5: According to the user's location and query request, search the relevant database, select the appropriate response message from it, and find the corresponding public key of the user from the public key database, encrypt the response message and send it;

S6: After receiving the message, the user decrypts it with the private key to obtain the service.

In step 3, the user encrypts the sent information, which specifically includes the following steps:

3.1 First, encode user attribute information, and establish a mapping between attribute values and digital strings, wherein the attribute values include the user's id and location information (latitude and longitude coordinates), and the specific format is as follows:

The above format is a mapping process, the user id is its 11-digit mobile phone number, so the phoneNum after mapping is 11 digits. location is longitude and latitude representation, where the longitude range is 0-180 (east longitude is E, west longitude is W); the latitude range is 0-90 (northern latitude is N, south latitude is S), so the following longitude is 4-bit representation, (E, W) indicates one of them, west longitude or east longitude; latitude is represented by 3 digits, and (N,S) is one of south latitude or north latitude.

3.2 Group the above digital strings into groups of two, assuming that the strings are k ₁ k ₂ k ₃ ...k ₁₁ (h ₁ h ₂ h ₃ (E)g ₁ g ₂ (S)), where g, Both h and k represent one of the Arabic numerals 0 to 9, and the format after grouping is as follows:

k ₁ k ₂ k ₃ k ₄ k ₅ k ₆ k ₇ k ₈ k ₉ k ₁₀ k ₁₁ (h ₁ h ₂ h ₃ Eg ₁ g ₂ S)

3.3 Use the public key A _public corresponding to the user's query attribute value to encrypt the obtained group data, then combine them in group order, add some necessary information and send them to the LBS server; the specific encryption process is as follows:

3.3.1 Assuming that the A _public key is (m, n), use the formula XX ^m modn=YY, XX/n=Q to calculate the grouped data obtained in 3.2, XX represents any two-digit grouping, and YY represents the obtained Encrypt data. Pay attention to the special case, if there is a single number X after grouping, use the formula X ^m modn = YY to calculate;

3.3.2 After all calculations, sort the obtained data to obtain the final sent ciphertext message, which includes the judgment of the Q value corresponding to each XX. If Q=0, the ciphertext message is directly YY; otherwise, the ciphertext message is directly YY; The text message is YY(Q), and the format is as follows:

k _1' k _{2 '} k _3' k _4' k _5' k _6' (Q ₁ )k _7' k _8' k _9' k _10' (Q ₂ )k _11' (h _1' h _2' h _{3 '} Eg _1' g _2' S)

3.3.3 Send the above ciphertext message together with the query attribute service to the LBS server.

In the identity and location information privacy protection method, the public key corresponding to each query attribute and the two prime numbers that generate n are randomly generated by the server according to requirements;

In step 4, the LBS server uses the private key of the query attribute to decrypt the received user request, and finds the response, which specifically includes the following steps:

4.1 The LBS server receives the request information uploaded by the user, and calls the corresponding RSA private key A _private according to the request service attribute in the request information;

4.2 The LBS server uses the obtained RSA private key A _private to decrypt the request message uploaded by the user, so as to obtain the user's identity and location, which specifically includes the following steps:

4.2.1 Assuming that the found corresponding private key is A _private (w, n), first divide the obtained ciphertext messages into two groups;

4.2.2 Use the formula YY ^w modn=ZZ, and judge whether there is Q after YY, if so, then ZZ=ZZ+Q*n, ZZ is the plaintext group obtained by decryption;

4.2.3 Arranging ZZ to get the plaintext message k ₁ k ₂ k ₃ …k ₁₀ 0k ₁₁ (0h ₁ h ₂ h ₃ Eg ₁ g ₂ S), note that the phone number obtained here is 12 digits, and the 11th digit is 0, remove. The first number in the location coordinate longitude is 0 and removed, and the remaining 0 is reserved, which is the plaintext message sent by the user;

4.3 Search the corresponding database according to the user's location and request attributes, and extract the response list that meets the requirements.

In the LBS user identity and location privacy protection method written in this patent, the RSA secret key includes the RSA public key A _public and the RSA private key _private .

In the LBS user identity and location privacy protection method written in this patent, there may be one or more service requests submitted by the LBS user.

In step S5, the LBS server encrypts the response message with the user public key and sends it. The specific steps include:

5.1 The LBS server looks up the user's public key U _public in the public key store according to the decrypted user id;

5.2 The LBS server encrypts the response message with the user's public key U _public ;

5.3 The LBS server sends the encrypted ciphertext response to the user terminal;

In the LBS user identity and location privacy protection method written in this patent, the public key library is composed of user public keys issued by CA.

In this identity and location information privacy protection method, each user's public-private key pair <U _public , U _private > is issued by the certification center CA, and each user's public-private key is unique.

Compared with the prior art, the beneficial effects of the present invention are as follows: the patent designs a method for protecting terminal user location privacy for querying service attributes in location-based services. This method proposes an encryption algorithm for the actual application registration id and location, which effectively protects the privacy of the user's id and location. The advantage of this method is double encryption, which encrypts the sent message, effectively resisting the interception attack; and encrypts the response message, effectively preventing the deduction attack.

Description of drawings

Fig. 1 is a flow chart of the steps of user privacy protection of the present invention;

Figure 2 is a flowchart of the user instance encryption process.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings, but the embodiments of the present invention are not limited thereto.

As shown in Figure 1, using the improved RSA algorithm and service attributes to protect the LBS user location and identity privacy method, its implementation process specifically includes the following steps:

First, CA generates a pair of user-owned key pairs <U _private , U _public > for each online user, and the public key U _public of all users can be found in a public public key library;

Next, the LBS server generates a pair of RSA key pairs <A _private , A _public> for each possible query attribute, and sends the query attribute and the public key in the generated key pair to the online user terminal;

Next, before the user terminal sends the query request information, it encrypts the information with the corresponding public key according to the attribute of the requested service; the encryption includes encrypting the user's identity information and location information.

Encrypting private information with a public key includes the following steps:

First, user attribute information is encoded, and a mapping between attribute values and digital strings is established, wherein the attribute values include the user's id and location information (latitude and longitude coordinates);

Group the number strings into groups of two, and use the public key corresponding to the query attribute value to encrypt the obtained grouped data. Then assemble and send according to the grouping order;

In the identity and location information privacy protection method, the public key corresponding to each query attribute and the two prime numbers that generate n are randomly generated by the server according to requirements;

Then, in step 4, after receiving the encryption request, the LBS server utilizes the corresponding private key to decrypt;

Specifically, use the private key to decrypt the ciphertext message and find the response, including the following steps:

The LBS server receives the request information uploaded by the user, and retrieves the corresponding RSA private key according to the request service attribute in the request information;

The LBS server uses the obtained RSA private key to decrypt the request message uploaded by the user to determine the user's identity and location;

Then, in step 5, for the user's location and query request, search the relevant database, select a suitable response message therefrom, and find the corresponding public key of the user from the public key database, and send the encrypted response message; the specific implementation includes the following steps:

The LBS server looks up the user's public key in the public key store according to the decrypted user id;

The LBS server encrypts the response message with the user's public key;

The LBS server sends the encrypted ciphertext response to the user terminal;

Then, after receiving the message, the user decrypts the message with his private key to obtain the corresponding service.

In order to better understand the method for protecting LBS user identity and location privacy using the improved RSA algorithm and query attributes in this application, the user id is the mobile phone number (13189340078), the location is (98(E), 45(N)), and the query attributes are Take a nearby bus station, the corresponding RSA public key is (3,33), and the private key is (7,33) as an example, how the LBS user identity and location privacy protection method of this application realizes the protection of user identity and location privacy in detail For details, see Figure 2 of the description.

First, group the 11 digits of the mobile phone number into groups of two by two, and the grouping is as follows:

13 18 93 40 07 8

Then use the public key (3,33) to encrypt the user id, and the results are as follows:

19 24 15 13 13 17

The user's coordinates (98(E), 45(N)) are encrypted with the public key (3,33), and the results are as follows:

32(E), 12(N)

Next, construct the ciphertext message to be sent by the user as:

T192415(2)13(1)131732(2)E12(1)Nbus station

After receiving the user's ciphertext, the LBS server finds the corresponding private key (7,33) according to the bus station, and decrypts the ciphertext. The result is as follows:

T131827(2)07(1)070832(2)E12(1)N

For further processing, the

User id: 13189340078, coordinates (98E, 45N)

Then search the corresponding database to get the result list, encrypt it with the user's public key, and return it to the user terminal, and then the user terminal uses its private key to decrypt the response message to obtain the corresponding service.

To sum up, this patent proposes to use the RSA algorithm and service attributes to protect the location and identity privacy of LBS users for the above-mentioned user identity and location privacy security issues. First, the CA generates a pair of user-owned key pairs <U _private , U _public > for each online user, and the public key U _public of all users can be found in a public key storehouse; the LBS server for each Generate a pair of RSA secret key pair <A _private , A _public> for the attribute that may be queried, and send the query attribute and the public key in the generated key pair to the online user terminal; before the user terminal sends the query request information, according to The attribute of the requested service is encrypted with the corresponding public key; after receiving the encrypted request, the LBS server decrypts it with the corresponding private key; and searches the list corresponding to the user's request, selects the appropriate response message, and retrieves it from the public key. The keystore finds the public key corresponding to the user, and sends the encrypted response message; after receiving the message, the user decrypts it with the private key to obtain the service. The advantage of this method is double encryption, which encrypts the sent message and effectively resists the interception attack; and encrypts the response message, which effectively prevents the deduction attack.

The embodiments of the present invention described above are not intended to limit the protection scope of the present invention. Any modifications, equivalent replacements and improvements made within the spirit and principle of the present invention shall be included in the protection scope of the claims of the present invention.

Claims (3)

1. A method for LBS user position and identity privacy protection, is characterized in that, comprises the steps: S1: CA generates a pair of user-owned key pair <U _private , U _public > for each online user, and the public key U _public of all users can be found in a public public key library; S2: The LBS server generates a pair of RSA key pairs <A _private , A _public> for each possible query attribute, and sends the query attribute and the public key in the generated key pair to the online user terminal; S3: Before sending the query request information, the user terminal encrypts the information with the corresponding public key according to the attributes of the requested service; the encryption includes encrypting the user's identity information and location information; S4: After receiving the encryption request, the LBS server uses the corresponding private key to decrypt it; S5: According to the user's location and query request, search the relevant database, select the appropriate response message, and find the corresponding public key of the user from the public key database, encrypt the response message and send it; S6: After receiving the message, the user decrypts it with the private key to obtain the service. 2. The user location and identity privacy protection method according to claim 1, said step S3, encrypting information with a corresponding public key, specifically comprising the following steps: 3.1 First encode the user attribute information, and establish a mapping between attribute values and digital strings, where the attribute values include the user's id and location information, and the specific format is as follows: The above format is a mapping process, the user id is its 11-digit mobile phone number, so the phoneNum after mapping is 11 digits. location is longitude and latitude representation, where the longitude range is 0-180, east longitude is E, west longitude is W; latitude range is 0-90, north latitude is N, south latitude is S, so the following longitude is 4-bit representation, (E, W) Indicates one of them, west longitude or east longitude; latitude is 3 digits, (N,S) is one of south latitude or north latitude 3.2 Group the digital strings in the above format into groups of two, assuming that the strings are k ₁ k ₂ k ₃ ...k ₁₁ (h ₁ h ₂ h ₃ (E)g ₁ g ₂ (S)), where g, h, and k all represent one of the Arabic numerals 0 to 9, and the format after grouping is as follows: k ₁ k ₂ k ₃ k ₄ k ₅ k ₆ k ₇ k ₈ k ₉ k ₁₀ k ₁₁ (h ₁ h ₂ h ₃ Eg ₁ g ₂ S) 3.3 Use the public key A _public corresponding to the user's query attribute value to encrypt the obtained group data, then combine them in group order, add some necessary information and send them to the LBS server; the specific encryption process is as follows: 3.3.1 Assuming that the A _public key is (m, n), use the formula XX ^m modn=YY, XX/n=Q to calculate the grouped data obtained in 3.2, XX represents any two-digit grouping, and YY represents the obtained Encrypted data; a single number X after grouping is calculated using the formula X ^m mod n = YY; n is the product of two confidential prime numbers p, q. 3.3.2 After the calculation, sort the obtained data to obtain the final sent ciphertext message, which includes the judgment of the Q value corresponding to each XX. If Q=0, the ciphertext message is directly YY; otherwise, the ciphertext message is directly YY; The text message is YY(Q), and the format is as follows: k _1' k _2' k _3' k _4' k _5' k _6' (Q ₁ )k _7' k _8' k _9' k _10' (Q ₂ )k _11' (h _1' h _2' h _{3 '} Eg _1' g _2' S) 3.3.3 Send the above ciphertext message together with the query attribute service to the LBS server. 3. The user location and identity privacy protection method according to claim 2, in the step S4, the LBS server utilizes the corresponding private key to decrypt after receiving the encryption request, specifically comprising the following steps: 4.1 The LBS server receives the request information uploaded by the user, and calls the corresponding RSA private key A _private according to the request service attribute in the request information; 4.2 The LBS server uses the obtained RSA private key A _private to decrypt the request message uploaded by the user, so as to obtain the user's identity and location, which specifically includes the following steps: 4.2.1 Assuming that the found corresponding private key is A _private (w, n), first divide the obtained ciphertext messages into two groups; 4.2.2 Use the formula YY ^w modn=ZZ, and judge whether there is Q after YY, if so, then ZZ=ZZ+Q*n, ZZ is the plaintext group obtained by decryption; 4.2.3 Arranging ZZ to get the plaintext message k ₁ k ₂ k ₃ …k ₁₀ 0k ₁₁ (0h ₁ h ₂ h ₃ Eg ₁ g ₂ S), note that the phone number obtained here is 12 digits, and the 11th digit is 0, remove; the first number in the location coordinate longitude is 0 to remove, and the remaining 0 is reserved, which is the plaintext message sent by the user; 4.3 Search the corresponding database according to the user's location and request attributes, and extract the response list that meets the requirements.