
==== Front
PLoS One
PLoS One
plos
PLOS ONE
1932-6203
Public Library of Science San Francisco, CA USA

10.1371/journal.pone.0309919
PONE-D-24-26572
Research Article
Physical Sciences
Mathematics
Applied Mathematics
Algorithms
Research and Analysis Methods
Simulation and Modeling
Algorithms
Computer and Information Sciences
Cryptography
Physical Sciences
Mathematics
Cryptography
Research and Analysis Methods
Database and Informatics Methods
Information Retrieval
Physical Sciences
Physics
Thermodynamics
Entropy
Engineering and Technology
Civil Engineering
Transportation Infrastructure
Roads
Engineering and Technology
Transportation
Transportation Infrastructure
Roads
Earth Sciences
Geography
Cartography
Longitude
Earth Sciences
Geography
Cartography
Latitude
Earth Sciences
Geography
Cartography
A location-based service scheme with attribute information privacy
A location-based service scheme with attribute information privacy
https://orcid.org/0009-0006-5080-8616
Dai Zhiguo Formal analysis Funding acquisition Methodology Software *
Li Jichao Data curation Resources
College of Information Science and Electronic Technology, Jiamusi University, Jiamusi, China
Liu Zhiquan Editor
Jinan University, CHINA
Competing Interests: The authors have declared that no competing interests exist.

* E-mail: dzg0454123@163.com
6 9 2024
2024
19 9 e030991929 6 2024
20 8 2024
© 2024 Dai, Li
2024
Dai, Li
https://creativecommons.org/licenses/by/4.0/ This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.

In location-based service (LBS), private information retrieval (PIR) is an efficient strategy used for preserving personal privacy. However, schemes with traditional strategy that constructed by information indexing are usually denounced by its processing time and ineffective in preserving the attribute privacy of the user. Thus, in order to cope with above two weaknesses, in this paper, based on the conception of ciphertext policy attribute-based encryption (CP-ABE), a PIR scheme based on CP-ABE is proposed for preserving the personal privacy in LBS (location privacy preservation scheme with CP-ABE based PIR, short for LPPCAP). In this scheme, query and feedback are encrypted with security two-parties calculation by the user and the LBS server, so as not to violate any personal privacy and decrease the processing time in encrypting the retrieved information. In addition, this scheme can also preserve the attribute privacy of users such as the query frequency as well as the moving manner. At last, we analyzed the availability and the privacy of the proposed scheme, and then several groups of comparison experiment are given, so that the effectiveness and the usability of proposed scheme can be verified theoretically, practically, and the quality of service is also preserved.

Basic Scientifics Research Operating Expenses of Heilongjiang Provincial University and Colleges 2021-KYYWF-0581 https://orcid.org/0009-0006-5080-8616
Dai Zhiguo This study was supported by the Basic Scientifics Research Operating Expenses of Heilongjiang Provincial University and Colleges (Grant No. 2021-KYYWF-0581). The funder took role in study design and preparation of the manuscript, but had no role in data collection and analysis, or decision to publish. Data AvailabilityThe availability data is GeoLife GPS Trajectories which gets from the following URL. https://www.microsoft.com/en-us/research/publication/geolife-gps-trajectory-dataset-user-guide/.
Data Availability

The availability data is GeoLife GPS Trajectories which gets from the following URL. https://www.microsoft.com/en-us/research/publication/geolife-gps-trajectory-dataset-user-guide/.
==== Body
pmc1 Introduction

In current, along with the development of wireless communication and position technology, location-based service (LBS) becomes more and more popular in people’s daily life. However, as this type of service must have the location of the user in advance to prepare the feedback, more and more people begin to pay close attention to the problem of violating personal privacy [1,2]. In general, schemes of privacy preservation can be briefly classified into two categories: the strategy of generalization [3] as well as the strategy of obfuscation [4]. However, these schemes had to confront the same problem, as during the process of preparing feedback, it is unavoidable that the LBS server must learn the purpose of the user, so as to find the result and feedback it to the user. During this procedure, the personal privacy (such as the type of point of interests (PoI), the query types and so on) will be gained by an un-trusted LBS server by inferring the purpose, so these schemes cannot preserve the personal privacy effectively. Private information retrieval (PIR) can effectively cope with this problem [5]. In PIR, the LBS server encrypted the PoIs that stored in its database, and then with the comparison of binary index or hardware index to get feedback result without violating any privacy to any entity. Then based on the differential of longitude and latitude in geography, Wightman et al. [6] proposed a mapping based PIR. Yang et al. [7] optimized the calculable PIR with a trusted central server, so the speed of blind query disposing can be accelerated.

In spite of this, as a feature of LBS is the PoIs must be feeding back in real time, but the whole process of encryption and comparing in PIR needs a large amount of time. In addition, in order to preserve the privacy, the LBS server also needs to index more results to keep the privacy, so most times PIR will affect the quality of service in LBS [8]. Based on the conception of increasing the index efficiency, Hu et al. [9] proposed a hierarchical index structure and Yi et al. [10] proposed a fuzzy index structure for PIR. However, these structures did not consider the attributes of a user can also be used in identifying the privacy. Furthermore, in LBS, the location privacy can also be inferred by some attributes, such as the velocity of moving, the query interval and so on [11]. For preserving the attribute privacy, and at the same time reduce the cost of calculation and increase the quality of service, we consider utilizing the generalized attributes as an index and compared the encryption set to retrieve the feedback. Then based on above conception, we proposed a LPPCAP scheme that used in LBS to preserve the personal privacy. In this scheme, the query set is constructed by the set of attributes and the process of comparison also based on this set, so the process of retrieving will be simplified. In addition, the attributes are also encrypted to preserve the attribute privacy. Though above two aspects and compared with traditional PIR, the superiority of this scheme can be reflected in both privacy preservation and quality of service. At last, performance analysis as well as simulation experiment is given, so that the result will further demonstrate the superiority of the proposed scheme. The contribution of this paper can be summarized as the following three points.

We proposed a LPPCAP scheme, which can preserve the personal privacy for using location based service, and without any information be leaked to other entities.

We utilized the set of attributes and the process of comparison to retrieve the query result, so as to simplify the process of retrieving back the requiring result with privacy preservation, and further strengthen the resist ability of LPPCAP which makes the maximum uncertainty for the adversary to identify the user.

We conduct comprehensive experiments on efficiency and utility and with the results the superiority of the proposed scheme is demonstrated, then the results show the level of privacy preservation and the quality of service is better than other schemes.

The organizational structure of this paper can be briefly summarized as follows. In Section 1, we analyze related works such as anonymity and encryption in location privacy preservation. Section 2 shows the system environment and the requirement of privacy preservation. In Section 3, the specific strategy and workflow of LPPCAP is shown. Section 4 shows the experimental settings, comparison results as well as the reason for these results. At last, we conclude this work and analyze future works in Section 5.

2 Related works

In location-based privacy protection processing, existing privacy protection methods can be simply classified into two main strategies: anonymous and encryption.

Anonymous privacy protection is mainly divided into two categories: k-anonymity [12] and ε-indistinguishability [13]. The former finds at least k similar users through a central server [14] or user cooperation [15], and submits the information of all k users to the location service provider to disrupt the attacker’s accurate identification of the user, thus protecting the user’s personal privacy through the attacker’s misidentification. In the central server method, privacy protection is mainly achieved by k-anonymity generalization of user movement positions [16], online collaborative k-anonymity privacy protection for cloud services [17], and anonymous allocation of multiple tasks for differential privacy protection [18]. In the user cooperation method, current research focuses more on building collaborative anonymous groups through blockchain [19], providing effective feedback under anonymous collaboration [20], and privacy protection for multi-cooperative user perception under anonymity [21].

In privacy protection methods mainly based on differential privacy, various noises satisfying differential privacy are mainly added to achieve the indistinguishability between user sensitive information and other information [22]. Current research results mainly include road network indistinguishable algorithms for privacy protection in road environments [23], 3D geographic indistinguishable algorithms for indoor environments [24], spatial crowdsourcing indistinguishable algorithms for vehicle network crowd sensing [25], and personalized local location indistinguishable algorithms for user differences [26] etc.

Undoubtedly, in addition to the above two main applications, there are other similar strategies that adopt different strategies depending on the focus of privacy protection, such as multi-anonymous privacy protection methods for online ride-hailing privacy protection [27], semantic privacy protection anonymity for data sharing [28], and privacy protection methods for inadvertent sharing of indoor privacy navigation [29]. Liu et al. [30] also proposed a fully-distributed context-aware trust model for location based service. These methods further enrich the application environment and scope of anonymous privacy protection strategies.

Based on encryption techniques, information can be hidden to make it more difficult for attackers to obtain user personal information, thereby providing effective privacy protection [1]. According to the differences in the use of encryption methods, they can be divided into encryption comparison and privacy information retrieval [31]. In the encryption comparison, the main strategy is to compare two encrypted quantities with each other, so as to complete the privacy protection task or location matching without obtaining any additional information between each other, such as the parking lot allocation algorithm for privacy-protected path matching [32], geographic range query matching algorithm for mobile crowdsensing, and access authorization for edge computing [33]. In privacy information retrieval, decentralized asynchronous retrieval feedback [34], privacy information retrieval for semantic information [35], and intermittent privacy information retrieval in location privacy processing [36] are mainly used. For schemes utilize the conception of PIR, Vithana et al. [35] utilized semantic as the index to generalize the user with similar semantic to preserve the privacy of the user. Then based on the differential of longitude and latitude in geography, Wightman et al. [6] proposed a mapping based PIR. Yang et al. [7] optimized the calculable PIR with a trusted central server, so the speed of blind query disposing can be accelerated. For schemes utilize the conception of CP-ABE, Li et al. [37] utilized adversarial attacks to protect personal attribute privacy. Huang et al. [38] utilized ABE to hidden policy in cloud services. Lai et al. [8] proposed a scheme with CP-ABE to achieve PIR.

Since classify of the privacy protection scheme of generalization is always a traceable way, there will always be a risk probability of producing location or location sets, so there is still a high privacy risk when the attacker has sufficient background knowledge. In the privacy protection strategy using encryption techniques, the comparison method in location privacy is difficult to implement throughout the entire service stage, so the PIR strategy that can complete information retrieval in a dense environment without displaying any plaintext user information is more practical and has better privacy protection effectiveness in location privacy protection.

3 Preliminaries

3.1 System architecture and privacy threat

In general, there are two types of system architectures used for preserving privacy in LBS: they are centralized architecture and distributed architecture. The centralized architecture usually employs a trusted central server that disposes the generalization or obfuscation, so the central server may become the attack focus or service bottleneck. The distributed architecture usually utilizes the mobile device and collaborates with other users or generates a generalized query set to conceal the real intention. As PIR is a scheme that whole process of query and feedback is encrypted, it does not need any central server or collaborative users, so the system architecture is a distributed architecture and the detail structure can be seen in Fig 1.

10.1371/journal.pone.0309919.g001 Fig 1 System architecture of LPPCAP.

From Fig 1, two entities can be seen and they are called the user as well as the LBS server. The user is the moving user equipped with location and communication device, so that he/she can send the service request to a LBS provider and gets the result. The LBS server is the service provider. This entity usually gets the request from a user and finds the result from historical data then feedback it to the user with service module. In most times, the LBS server is usually seen as a trusted entity, as it is usually established by the government or large enterprises. However, as the LBS server stores mass of personal data, it may become the attack focus and once breached by an adversary, and then the personal privacy will be violated. In addition, in case of attract by some huge commercial interests, the enterprise may also violate the privacy. Thus, in this paper, we assume the LBS server is a semi-trusted entity, as it may be curious about the privacy of the user, but can abide the agreement and find the result from historical data and feeds back the query result to the user.

Based on architecture mentioned above, the process of LBS can be depicted as the following. First, the user sends <id, location, query> to the LBS server and requires for the result (such as where is the nearest restaurant or the oil station along our journey). Secondly, the LBS server finds the result with <id, location, query>, and feeds back the result to the user. During this process the LBS server will get the privacy (such as location, query) of the user. In a classic model of k-anonymity, the location, the query is generalized with other locations, queries, so as the LBS server cannot distinguish which is the precise location or query of the user, and then the probability of guessing the precise user is p(id→l,q) = 1/k. However, as LBS server can get some background knowledge to make the probability of guessing the precise user become p(id→l,q|b)≪1/k. In addition, as the probability of guessing satisfy p(id1→l,q|b)≠p(id2→l,q|b) in these k users, the LBS server will be easier to get the privacy.

3.2 Requirements for privacy preservation

According to the threat introduced in section 3.1, we consider the LBS server as the adversary, so in order to preserve the personal privacy an efficient scheme must satisfy the following conditions.

During the process of getting LBS result, there will be less or nearly no personal information published to the LBS server.

Without any precise information about the query, the LBS server has the ability to find out the result and feedback it to the user.

The LBS server cannot identify any special attributes from the query request and the id has the same probability to correlate to others, so as p(id1→l,q|b)=p(id2→l,q|b)=…=p(idk→l,q|b).

The feedback result must be sent to the user in an endurable time.

Thus, based on above requirements and with the help of CP-ABE and PIR conception, in this paper, we propose a LPPCAP scheme to preserve the personal privacy of the user.

3.3 The conception of LPPCAP

In general, if a user wants to use the LBS, he/she must send a query to the LBS server, and then the LBS server finds result with the query and sends back the result to the user, the query may be “where is the nearest restaurant”, “find the shortest path to gas station”, “show me the service point every 5 minutes” and so on. So the query can be formalized as Q = {(x,y),t,c}, where (x,y) denotes the current location of the user, t is the query time and c is the content of query. If we see these elements as attributes, then the query can be seen as A = {A1,A2,…,An}, where Ai,0≤i≤n denotes an element used in query. As a result, the set of attributes can be used to retrieve the feedback result. In addition, if this set is obfuscate with other similar sets and encrypted by an encryption scheme, it will be more secure than other schemes. Meanwhile, the consistency of encrypted attributes will facilitate the process of finding the result in the LBS server. Thus, based on these ideas, the brief process of LPPCAP can be summarized as shown in Fig 2.

10.1371/journal.pone.0309919.g002 Fig 2 The protocol of LPPCAP.

4 LPPCAP

4.1 The parameters used in LPPCAP

According to the conception of LPPCAP, the whole process can be divided into two parts: the part of disposing attribute by the user and the part of disposing result retrieving by the LBS server. In order to facilitate the comprehension of disposing PIR, the parameters used in LPPCAP are shown in Table 1. Then based on the execution sequence of PIR proposed in literature [8], a detailed introduction on how the requirement changed into the feedback result is shown in follows.

10.1371/journal.pone.0309919.t001 Table 1 Parameters used in LPPCAP.

Notation	Description	
A	The set of attributes	
λ	The system secure parameter selected by the LBS server	
params	The published parameter by the LBS server	
G	The set of attributes that selected by the user	
ℤpn	The set that contains at least n elements selected from ℤp	
ℤp	The set that constructed by number of 0~p-1	
sk	The private key of the user	
β	The private key stored by the user	
←$	Consistently select an element from the right set and assign its value to the left set	
T(G)	The encrypted query that sent to the LBS server	
M	The result that the user needs	
A	The set of attributes that the LBS server stored	
k	The number of attributes that the LBS server stored	
M’	The encrypted information sent to the user	
n	The number of attributes that the user selected	
CT	The set of feedback results sent by the LBS server	

4.2 The process of LPPCAP

Before sending the requirement, the user as well as the LBS server must predispose the query information and the PoIs stored in the server. For the LBS server, the whole data of PoIs stored in this server must be encrypted with F(1λ)→(G,p,g), α←$ℤp,g1←gα. Then the LBS server publishes the public parameter params=(g,g1,G). Where g is the generator of G, G is a p order large prime cyclic group, F(∙) is a polynomial time probability algorithm. The key generation algorithm is given in algorithm 1.

Algorithm 1. The key generation algorithm.

Input: G,p,g,λ

Output: the public parameter params=(g,g1,G)

1 The LBS server chooses

2 α←$ℤp

3 g1←gα

4 F(1λ)→(G,p,g)

5 Return (g,g1,G)

In the process of disposing PoIs, suppose that all attributes of PoIs can be denoted as A. The LBS server has to choose the secure parameter λ, the order of prime number p as well as the public parameter params in advance. At the same time, for the user, he/she has to generate the set of selected attributes with the private key, and sends the encrypted set to the LBS server. In order to get the encrypted set of selected attributes, the user has to complete the following operations. Suppose that the selected attributes of the user can be denoted as G={A1,A2,…,An}∈ℤpn, where n is the number of attributes that the user selected. With the set of attributes G = {A1,A2,…,An}⊂A as well as a random number β←ℤp, the user calculates the following parameters.

h←gβ

t→=(t1,t2,…,tn)←$ℤpn

s→=(s1,s2,…,sn)←$ℤpn

r→=(r1,r2,…,rn)←$ℤpn,g1≠g−βri,i=1,2,…,n

Then for each i the calculates:

ui←g1hri, vi←gri, Xi←gsi, Yi←gti

Ui←hsi∏j=1nujaj,i−1

Vi←hti∏j=1nvjaj,i−1

With parameters calculated by above operations, the user sends the encrypted attribute information T(G) = {Ui,Vi,Xi,Yi}, i = 1,2,…,n to the LBS server, and at the same time preserve the private key β. Where a←$b denotes the process of selecting an element from the set of a and assigns it to the set b. We elaborate above process in algorithm 2.

Algorithm 2. The query encryption.

Input: The set of attributes converted from user’s query G and the private key β←ℤp

Output: The encrypted query information T(G)

1 Randomly choose the initial parameters t→, s→, r→;

2 Calculates h←gβ;

3 for(i = 1,i< = n,i++)

4 ui←g1hri, vi←gri;

5 Xi←gsi, Yi←gti;

6 Ui←hsi∏j=1nujaj,i−1;

7 Vi←hti∏j=1nvjaj,i−1;

8 end

9 return T(G) = {Ui,Vi,Xi,Yi};

In algorithm 1, line 3–9 shows the process of encrypting each attribute that corresponds to the query for LBS. During the process of getting the encrypted information T(G), the time complexity seems equal to O(n), but as the multiplicative calculation in lines 6–8, the real time complexity may be O(n2).

Once the LBS server receives the encrypted query T(G) from the user, for the data set of PoIs M as well as the attributes set A,|A|=k, the LBS server has to calculate the following parameters according to the attribute set A.

Pi←V1⋅V2Ai⋅V3Ai2…VnAin−1=vi⋅ht1+t2Ai+…+tnAin−1=gri⋅hηi

Qi←U1⋅U2Ai⋅U3Ai2…UnAin−1=ui⋅hs1+s2Ai+…+snAin−1=g1gβri⋅hθi Wi←Qi⋅g1−1=gβrihθi

At the same time the LBS server calculates:

l1,l2,…,lk←$ℤp

P←∏i∈APili=g∑i∈Arili⋅h∑i∈Aηili

W←∏i∈AWili=g∑i∈Aβrili⋅h∑i∈Aθili

t←$ℤp

C0=∏i∈A(∏j=1nXjAij−1)tli=gt⋅∑i∈Aθili,θi=s1+s2Ai+…+snAin−1

C1=∏i∈A(∏j=1nYjAij−1)tli=gt⋅∑i∈Aηili,ηi=t1+t2Ai+…+tnAin−1

C2=Pt

C3=Wt⋅M

With parameters calculated by above operations, the LBS server gets the encrypted result set CT = (C0,C1,C2,C3) and sends this set to the user, the whole process of preparing the encrypted result is shown in algorithm 3.

Algorithm 3. The process of information retrieval in the LBS server.

Input: The encrypted information from the user T(G)

Output: The set of encrypted results CT established by the LBS server

1 for(i=1,i<=k,i++)

2   Calculates Pi,Qi,Wi;

3 end

4 Randomly chooses l1∼lk,t;

5 Repeat calculates the result of P×W;

6 Calculates C0,C1,C2,C3;

7 return CT = (C0,C1,C2,C3)

In algorithm 3, all probable PoIs is selected with the encrypt attributes sent by the user. In addition, as the scale of encrypted attributes is much higher than the user k≫n, the time complexity of algorithm 3 is O(k)+O(n) = O(k).

The user has to decrypt the plaintext from the encrypted set of results CT sent from the LBS server with the following calculation.

M'=(C1−sk⋅C2)−sk⋅C0−sk⋅C3=((gt⋅∑i∈Aηili)−β⋅(gt⋅∑i∈Arili⋅ht⋅∑i∈Aηili))−β⋅(gt⋅∑i∈Aθili)−β⋅gt⋅∑i∈Aβrili⋅ht⋅∑i∈Aθili⋅M=M

At last, the user refines the real result that he/she needs. The process of the user decrypts the plaintext is shown in Algorithm 4.

Algorithm 4. Decrypt the set of feedback results.

Input: The encrypted results set CT that sends from the LBS server, g,g1,G,sk

Output: The plaintext M’

1 M'=(C1−sk⋅C2)−sk⋅C0−sk⋅C3;

2 M'=(C1−sk⋅C2)−sk⋅C0−sk⋅C3=((gt⋅∑i∈Aηili)−β⋅(gt⋅∑i∈Arili⋅ht⋅∑i∈Aηili))−β⋅(gt⋅∑i∈Aθili)−β⋅gt⋅∑i∈Aβrili⋅ht⋅∑i∈Aθili⋅M=M

3 Return M’

In algorithm 4, each attribute is calculated by iterate addition, so as to get the plaintext of query result, as a result the time complexity of algorithm 4 is O(n).

With three algorithms mentioned in above, the process of LPPCAP is shown, and the user can utilize this scheme to get the service without leaking any private information.

5 Performance evaluation

5.1 Security and availability analysis

The security of LPPCAP depends on the security of attribute encryption scheme that is mentioned in literature [8], so we do not focus the features of encryption. In addition, LPPCAP can be seen as a practical of the theory produced in literature [8]. In security analysis, we mainly focus on the difficulty of adversary identifies the real attributes. In availability analysis, we focus on the accuracy of feedback as well as the running time in security retrieval.

In security, as the user’s attributes are encrypted by Amodp, and p is a prime that large enough. So according to the character of modular arithmetic, although the adversary gets the number of p, with the parameter β he/she still difficult to infer the real attributes by inverse calculation. Then, suppose that, if the adversary has obtained the encryption information T(G) and the number of attributes n, without t→, s→ and r→, the adversary still difficult to infer the real attributes, in spite of this information does not disposed by modular arithmetic, because t→, s→ and r→ are selected consistent with each other. At last, as the number of attributes that the LBS server stored is much higher than the user k≫n, it will be difficult for the LBS server to identify the real set from the user and the success ratio of identifying the real set will be less than 1/kn, because the process of finding at least n attributes sub-set from the set of at least k attributes is much more difficult. In addition, as the attributes sent by the user may contain some attributes that do not belong to the user, so it will be even more difficult for the adversary identify the real attributes. In addition, as the adversary cannot decrypt the query of the user, the probability of guessing the real user for each location and query will be p(id→l,q|b) = 1/k and the adversary also difficult to distinguish the probability of p(idi→l,q|b)and p(idj→l,q|b)i≠j, as p(id1→l,q|b)=p(id2→l,q|b)=…=p(idk→l,q|b). So if we utilize entropy to measure the privacy, we have p(i) = p(idi→l,q|b), H(i)=−∑i=1kp(i)log2p(i), the entropy H(i)will get the maximum value, which means the adversary will have the maximum uncertainty of the user.

For the availability of proposed scheme, the accuracy of LPPCAP can be denoted as params←$F(1λ), (T(G),n,sk)←$(params,G), 1←$(params,T(G),n) and CT←$(params,A,T(G),M), for parameters (params,CT,sk) the value of retrieving will be {MifA⊆G⊥ifA⊆G, so the result set retrieved by attributes must be included in the storage of the LBS server and the user can obtain the real result in this set. For the running time, according to the time complexity mentioned in section 2, with the result described under three algorithms we have the running time is less than O(n2)+O(k)+O(n) = O(m2), so it can be completed in binomial time, the detailed running time will be shown in the result of experiments.

5.2 Experiment preparation

Based on the analysis of security and availability in the above sub-section, we can conclude that the proposed LPPCAP has a better performance in both privacy preservation and the availability in theoretically. In this section, we will further verify the performance of our proposed scheme with several groups of simulation experiments, and the schemes used for comparison include that the intermittent PIR [36], the semantic PIR [35] the approximate PIR [10], the attribute encryption scheme [39] as well as the correlation indistinguishable scheme [14]. We utilize the central part of the Geilife data to simulate the user in LBS. Then the simulation experiments are deployed in a laptop with Intel core I7, 8GB memories and windows10 operation system, and we utilize Matlab R2017a as the instrument to verify the performance. In addition, the results are calculated at least 500 times and utilize the average result to construct the line charts.

5.3 Results with brief explanations

Table 2 shows the performance of various schemes in both privacy preservation and execution efficiency. From this table we can see the LPPCAP has a middle accuracy in feeding back result, and has a lower running time compared with other schemes. In addition, as all information used in this scheme is encrypted during the process of querying, LPPCAP also leads zero knowledge leakage as other PIR scheme. Then this scheme also has a better performance in concealing the attribute as well as the attributes un-correlation than other schemes.

10.1371/journal.pone.0309919.t002 Table 2 The comparison result with other similar schemes.

Scheme	Attributes conceal	Zero knowledge leakage	Attributes un-correlation	Accuracy	Running time	
Intermittent PIR [36]	√	√	×	middle	high	
Semantic PIR [35]	√	√	×	middle	middle	
Approximate PIR [10]	√	√	×	middle	middle	
Attributes encryption [39]	√	×	√	high	low	
Correlation indistinguishable [14]	√	×	√	low	low	
LPPCAP	√	√	√	middle	low	

Fig 3 shows the success ratio of an adversary identifies the real attribute, which increases along with the increasing number of attributes. In this figure, we can see that the success ratio of LPPCAP does not changed dramatically, as this scheme utilize the encrypted attributes as index to find the result. Furthermore, this scheme can also add some dummy attributes in the query set to obfuscate the real attributes. For other scheme with PIR, performances of the intermittent PIR, the semantic PIR as well as the approximate PIR are similar to LPPCAP but a bit higher, as these schemes also conceal the real attribute but fail to dispose the attributes correlation, so that the results are different with each other. For the scheme of attributes encryption, although this scheme encrypts the attributes of the user, it needs to send the real attribute to the LBS server, so the success ratio is higher than others. On the other hand, the scheme mainly defined with other collaborative users, the more attributes used the more difficult to find the collaborative user, and without these user this scheme will be failed to preserve the privacy. At last, the correlation indistinguishable is mainly designed to generalize the correlation of attributes but not conceal the attributes or conceal the attribute correlation, so the success ratio is the highest.

10.1371/journal.pone.0309919.g003 Fig 3 The success ratio of identifying the privacy vs. the number of attributes.

Fig 4 shows the success ratio of an adversary identifies the real attribute, which increases along with the increasing number of queries. From this figure, we can see that success ratios of all schemes are increasing with a higher number of queries, as more queries mean more information sent to the LBS server and more risk to be identified by the adversary. Among these schemes, LPPCAP performs best, as this scheme has the advantage of both attribute encryption as well as PIR, so the possibility of revealing the real attribute is the lowest. In addition, as the correlation of attributes also obfuscated by dummies, the success ratio will be even lower. For other schemes with PIR strategy, such as the intermittent PIR, the semantic PIR as well as the approximate PIR, as they mainly utilize the encryption without disposing attribute to preserve the privacy, the success ratio is lower than the scheme without PIR, but higher than LPPCAP. Although the scheme of attributes encryption also encrypts the user’s attributes, the collaborative users lack will affect the security and the success ratio of identifying will be higher. At last, the scheme of correlation indistinguishable that without encryption performs the worst.

10.1371/journal.pone.0309919.g004 Fig 4 The entropy of various algorithms vs. queries.

Fig 5 shows the running time of various schemes changes along with attributes increasing. From this figure, we can see that the running time of all schemes is increasing with a higher number of attributes, as all schemes have to conceal or generalize each attribute, no matter of encryption or generalization, and the disposition for attribute occupied the running time. Among these schemes, the LPPCAP performs better than schemes with encryption, as this scheme utilizes the set of attributes as index, and can be used to compare with multidimensional data to find the results simultaneously, so the running time is shorter than others. But the running time of LPPCAP scheme is higher than the scheme of correlation indistinguishable, as the encryption costs much more time than selecting collaborative users. For schemes with encryption, as strategies of indexing are different from each other, the running time decreasing with the enhancement of index capability.

10.1371/journal.pone.0309919.g005 Fig 5 The entropy of various algorithms vs. the number of attributes.

Fig 6 shows the running time of various schemes changes along with queries increasing. From this figure, we can see that the running time of all schemes is increasing with a higher number of queries, as more queries mean more sets of attributes have to be disposed, so the running time is higher. Among these schemes, the LPPCAP performs the best, as the running time in every query is shorter. However, the running time of scheme of correlation indistinguishable is higher than LPPCAP, as more queries mean more dummies added and longer distance shifted, so the running time is higher. For other schemes, such as the intermittent PIR, the semantic PIR as well as the approximate PIR, as strategies of indexing are different from each other, the running time also decreasing with the enhancement of index capability.

10.1371/journal.pone.0309919.g006 Fig 6 The entropy of various algorithms vs. queries.

Fig 7 shows the differences in algorithm success rates caused by changes in the number of user attributes during the execution process. It can be seen from the figure that privacy information retrieval algorithms (such as intermittent PIR, semantic PIR, approximate PIR, and the algorithm proposed in this paper) have relatively high success rates. This is mainly because these algorithms achieve privacy protection by encrypting their own information or attributes, without the need to find generalized users with similar attributes or features like generalization methods. Although the algorithm proposed in this chapter requires encryption of various attributes displayed by users, this processing does not cause significant fluctuations due to changes in the number of attributes. Therefore, like other PIR-based algorithms, the success rate of this algorithm is better than that of generalization algorithms. For the other two generalization algorithms participating in the comparison, both algorithms require finding generalized users with similar attributes to complete privacy protection processing for the applicant user. Therefore, as the number of attributes increases, the degree of reduction in the success rate of the algorithm is higher than that of PIR algorithms. In addition, the main reason for the reduction in the success rate of non-attribute encryption strategy algorithms in the above PIR algorithms with the increase in the number of attributes is similar to the success rate of attacks. The increase in the number of attributes increases the amount of background knowledge available to adversaries and more background knowledge directly allows attackers to guess, associate, and obtain user privacy information, leading to the failure of algorithm privacy protection. Therefore, these PIR algorithms will also experience a decrease in the success rate of algorithm execution due to an increase in the number of attributes.

10.1371/journal.pone.0309919.g007 Fig 7 The success ratio of various algorithms vs. the number of attributes.

Fig 8 shows the difference in algorithm success rates caused by changes in query frequency for different algorithms. It can be seen from the figure that algorithm query frequency is independent of algorithm success rate, meaning that the success rate of algorithm execution does not increase or decrease with changes in query frequency. This is mainly because each user query may or may not be successful. After averaging multiple queries, all unsuccessful executions are converted into an unsuccessful probability, which is not significant in overall comparison. Additionally, the success rate of generalization-based privacy protection algorithms (such as attribute-based encryption algorithms and probabilistic indistinguishability-based algorithms) is lower than that of PIR retrieval-based privacy protection algorithms. This is because generalization-based algorithms need to find generalized users who can generalize real users to complete privacy protection processing. If there are fewer generalized users in the current area or their willingness to participate in generalization is low, it is difficult for these algorithms to find enough generalized users, resulting in lower execution success rates for their privacy protection algorithms than for PIR retrieval-based privacy protection algorithms. Among many PIR retrieval-based privacy protection algorithms, the algorithm proposed in this article has little difference in algorithm execution success rate affected by query frequency compared with other algorithms. It can be regarded as having a high algorithm execution success rate along with changes in query frequency among similar algorithms.

10.1371/journal.pone.0309919.g008 Fig 8 The success ratio of various algorithms vs. Queries.

In conclusion, we can consider that the LPPCAP has a better performance in both privacy preservation and the availability, no matter in theoretically or simulation experiment, and then the superiority of LPPCAP has been verified.

6 Conclusion

In this paper, we focus on the problem of reducing the running time as well as the problem of identifying the privacy with user’s attributes in LBS, so we proposed a LPPCAP. This scheme utilizes the conception of CP-ABE and with the obfuscated attributes to provide privacy preservation for the user in LBS. In this scheme, three algorithms are proposed for the user, the LBS server as well as the decryption to complete the process of secure retrieval. Furthermore, as the index with attribute is much easier, the running time of the proposed scheme is much lower than others. At last, we analyze security as well as availability of the proposed scheme, and then the results of simulation experiment further demonstrate the superiority.

Supporting information

S1 Data set (ZIP)

We would like to present our thanks to anonymous reviewers for their helpful suggestions.

10.1371/journal.pone.0309919.r001
Decision Letter 0
Liu Zhiquan Academic Editor
© 2024 Zhiquan Liu
2024
Zhiquan Liu
https://creativecommons.org/licenses/by/4.0/ This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Submission Version0
30 Jul 2024

PONE-D-24-26572A location-based service scheme with attribute information privacyPLOS ONE

Dear Dr. Dai,

Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process.

Please submit your revised manuscript by Sep 13 2024 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file.

Please include the following items when submitting your revised manuscript:A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'.

A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'.

An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'.

If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter.

If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols. Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols.

We look forward to receiving your revised manuscript.

Kind regards,

Prof. Zhiquan Liu 

Academic Editor

PLOS ONE

Journal Requirements:

1. When submitting your revision, we need you to address these additional requirements.

Please ensure that your manuscript meets PLOS ONE's style requirements, including those for file naming. The PLOS ONE style templates can be found at 

https://journals.plos.org/plosone/s/file?id=wjVg/PLOSOne_formatting_sample_main_body.pdf and 

https://journals.plos.org/plosone/s/file?id=ba62/PLOSOne_formatting_sample_title_authors_affiliations.pdf

2. Please note that PLOS ONE has specific guidelines on code sharing for submissions in which author-generated code underpins the findings in the manuscript. In these cases, we expect all author-generated code to be made available without restrictions upon publication of the work. Please review our guidelines at https://journals.plos.org/plosone/s/materials-and-software-sharing#loc-sharing-code and ensure that your code is shared in a way that follows best practice and facilitates reproducibility and reuse.

3. We note that the grant information you provided in the ‘Funding Information’ and ‘Financial Disclosure’ sections do not match. 

When you resubmit, please ensure that you provide the correct grant numbers for the awards you received for your study in the ‘Funding Information’ section.

4. Thank you for stating the following in the Acknowledgments Section of your manuscript: 

We would like to present our thanks to anonymous reviewers for their helpful suggestions. This work was supported by the Basic Research Project of Higher Education Institutions in Heilongjiang Province, Project Number: 2021-KYYWF-0581, Project Name: Research on Student Class Concentration Based on Multi feature Cascading and Multi task Learning.

We note that you have provided funding information that is not currently declared in your Funding Statement. However, funding information should not appear in the Acknowledgments section or other areas of your manuscript. We will only publish funding information present in the Funding Statement section of the online submission form. 

Please remove any funding-related text from the manuscript and let us know how you would like to update your Funding Statement. Currently, your Funding Statement reads as follows: 

The author(s) received no specific funding for this work.

Please include your amended statements within your cover letter; we will change the online submission form on your behalf.

5. Thank you for uploading your study's underlying data set. Unfortunately, the repository you have noted in your Data Availability statement does not qualify as an acceptable data repository according to PLOS's standards.

At this time, please upload the minimal data set necessary to replicate your study's findings to a stable, public repository (such as figshare or Dryad) and provide us with the relevant URLs, DOIs, or accession numbers that may be used to access these data. For a list of recommended repositories and additional information on PLOS standards for data deposition, please see https://journals.plos.org/plosone/s/recommended-repositories.

6. When completing the data availability statement of the submission form, you indicated that you will make your data available on acceptance. We strongly recommend all authors decide on a data sharing plan before acceptance, as the process can be lengthy and hold up publication timelines. Please note that, though access restrictions are acceptable now, your entire data will need to be made freely accessible if your manuscript is accepted for publication. This policy applies to all data except where public deposition would breach compliance with the protocol approved by your research ethics board. If you are unable to adhere to our open data policy, please kindly revise your statement to explain your reasoning and we will seek the editor's input on an exemption. Please be assured that, once you have provided your new statement, the assessment of your exemption will not hold up the peer review process.

[Note: HTML markup is below. Please do not edit.]

Reviewers' comments:

Reviewer's Responses to Questions

Comments to the Author

1. Is the manuscript technically sound, and do the data support the conclusions?

The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented.

Reviewer #1: No

Reviewer #2: Partly

Reviewer #3: Partly

**********

2. Has the statistical analysis been performed appropriately and rigorously?

Reviewer #1: No

Reviewer #2: I Don't Know

Reviewer #3: Yes

**********

3. Have the authors made all data underlying the findings in their manuscript fully available?

The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified.

Reviewer #1: No

Reviewer #2: Yes

Reviewer #3: Yes

**********

4. Is the manuscript presented in an intelligible fashion and written in standard English?

PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here.

Reviewer #1: Yes

Reviewer #2: Yes

Reviewer #3: Yes

**********

5. Review Comments to the Author

Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters)

Reviewer #1: In this paper, the authors try to propose a CP-ABE based PIR by utilizing CP-ABE technology.

However, the following questions should be considered.

(1) Inadequate motivation and problem formulation: The introduction fails to convincingly motivate the need for a CP-ABE based PIR. The specific research problems and challenges that the paper aims to address are not clearly articulated. The claimed contributions are not well-positioned against prior works, making it hard to gauge their significance. A stronger case needs to be made for why the proposed CP-ABE based PIR is an important advancement over existing solutions.

(2) Lack of technical depth and insights: The proposed construction does not offer significant technical innovations beyond combining existing techniques from CP-ABE based PIR. The paper lacks new concepts, insights, or design principles that push forward the state-of-the-art in this domain.

(3) In this paper, the authors proposed a CP-ABE based PIR by utilizing CP-ABE technology. However, the authors do not give the related works about CP-ABE.

(4) The authors proposed a CP-ABE based PIR. However, they do not give the concrete name of the related algorithms.

(5) The proposed CP-ABE based PIR is not complete. Especially, key generation algorithm is not given. How can you encrypt and decrypt?

Reviewer #2: 1. It is not clear, what is the role of f(x) in algorithm 1?2. No threat model is presented in the paper. It will be good to include the threat model and present the security analysis accordingly.

3. It is not clear whether the LBS will know who is sending the query or not? If the LBS knows the individual who sends the query then privacy is lost.4. Decryption proof of correctness may be with all steps involved. It is not clear how the second step is derived from the first step.

5. Zero Knowledge conceal is used in table 2 however no where it is described.6. Figure 8 should be rechecked. X-axis is not clear. Is it time or the number of queries? Similarly figure 6.

6. The novelty should be clearly presented.

Reviewer #3: In this manuscript, in this paper, based on the conception of ciphertext policy attribute-based encryption (CP-ABE), a PIR scheme based on CP-ABE is proposed for preserving the personal privacy in LBS. Personal privacy in LBS is a topic worth studying. However, there are some issues to consider:

1. In the “Introduction”, the authors described that “the superiority of this scheme can be reflected in both privacy preservation and quality of service”. However, the quality of service is not represented in the scheme, if the quality of service is the innovation point, it should be described in detail in the scheme, and it needs to be reflected in the abstract and contribution.

2. The “3.1 The conception of CP-ABE based PIR” should describ in the “Preliminaries”, and the system architecture and privacy threats are more appropriate in the “CP-ABE based PIR”, the front of the scheme description.

3. What is the relationship between this scheme and literature 8, and what are the advantages of this scheme compared with literature 8?

**********

6. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files.

If you choose “no”, your identity will remain anonymous but your review may still be made public.

Do you want your identity to be public for this peer review? For information about this choice, including consent withdrawal, please see our Privacy Policy.

Reviewer #1: No

Reviewer #2: No

Reviewer #3: No

**********

[NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.]

While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/. PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org. Please note that Supporting Information files do not need this step.

10.1371/journal.pone.0309919.r002
Author response to Decision Letter 0
Submission Version1
6 Aug 2024

Response to reviewer's comments

Reviewer #1: In this paper, the authors try to propose a CP-ABE based PIR by utilizing CP-ABE technology.

However, the following questions should be considered.

(1) Inadequate motivation and problem formulation: The introduction fails to convincingly motivate the need for a CP-ABE based PIR. The specific research problems and challenges that the paper aims to address are not clearly articulated. The claimed contributions are not well-positioned against prior works, making it hard to gauge their significance. A stronger case needs to be made for why the proposed CP-ABE based PIR is an important advancement over existing solutions.

We add the formulation for the threat model to further promote the innovation of the motivation, and add the proof for why the LPPCAP utilizes CP-ABE based PIR to preserve the privacy of user in LBS. In addition, in the introduction, we also add the motivation of why we utilize CP-ABE based PIR and the claim the contribution of this work.

(2) Lack of technical depth and insights: The proposed construction does not offer significant technical innovations beyond combining existing techniques from CP-ABE based PIR. The paper lacks new concepts, insights, or design principles that push forward the state-of-the-art in this domain.

We change the construction of this manuscript and emphasize the innovation of LPPCAP to further demonstrate the insights of this manuscript.

(3) In this paper, the authors proposed a CP-ABE based PIR by utilizing CP-ABE technology. However, the authors do not give the related works about CP-ABE.

We add some CP-ABE and PIR algorithms used in LBS in the related work to demonstrate these schemes can be used in LBS. However the quality of service of these existing schemes is weaker than LPPCAP and we demonstrate this in the experiment result.

(4) The authors proposed a CP-ABE based PIR. However, they do not give the concrete name of the related algorithms.

We change the proposed scheme into LPPCAP and then modify the whole manuscript.

(5) The proposed CP-ABE based PIR is not complete. Especially, key generation algorithm is not given. How can you encrypt and decrypt?

We add the key generation algorithm in 3.2.

Reviewer #2: 

1.It is not clear, what is the role of f(x) in algorithm 1?

We delete the f(x) in algorithm 1.

2.No threat model is presented in the paper. It will be good to include the threat model and present the security analysis accordingly.

We add the threat model in 2.1, and formulate it with probabilityand then present the security analysis in 4.1.

3.It is not clear whether the LBS will know who is sending the query or not? If the LBS knows the individual who sends the query then privacy is lost.

We add the process of how the LBS server know the query and location of the user in the threat model in 2.1, in this part, the way of privacy leakage of user is given.

4. Decryption proof of correctness may be with all steps involved. It is not clear how the second step is derived from the first step.

We add the precise step in algorithm 4, so as to give a clear steps for decryption.

5. Zero Knowledge conceal is used in table 2 however no where it is described.

We add the description of Zero Knowledge leakage about our scheme below table 2.

6. Figure 8 should be rechecked. X-axis is not clear. Is it time or the number of queries? Similarly figure 6.

The X-axis of figure 8 is queries, and we change all figures in the whole manuscript.

7. The novelty should be clearly presented.

We change the introduction as well as the abstract to further emphasize the novelty of this manuscript.

Reviewer #3: In this manuscript, in this paper, based on the conception of ciphertext policy attribute-based encryption (CP-ABE), a PIR scheme based on CP-ABE is proposed for preserving the personal privacy in LBS. Personal privacy in LBS is a topic worth studying. However, there are some issues to consider:

1. In the “Introduction”, the authors described that “the superiority of this scheme can be reflected in both privacy preservation and quality of service”. However, the quality of service is not represented in the scheme, if the quality of service is the innovation point, it should be described in detail in the scheme, and it needs to be reflected in the abstract and contribution.

The quality of service of LPPCAP is a part of innovation, so we add the reflection of this point in both the abstract and contribution.

2. The “3.1 The conception of CP-ABE based PIR” should describ in the “Preliminaries”, and the system architecture and privacy threats are more appropriate in the “CP-ABE based PIR”, the front of the scheme description.

We change the conception of LPPCAP in the “Preliminaries”, and then change the system architecture and the threat model to further appropriate to the conception of LPPCAP in 2.3.

3. What is the relationship between this scheme and literature 8, and what are the advantages of this scheme compared with literature 8?

The basic idea and conception of our proposed LPPCAP is derived from literature 8, however, in literature 8, the proposed scheme is mainly in theoretical and without any practice. So in this manuscript,we attempt to utilize the theoretical result in LBS to further the utilization of protocol proposed in literature. In addition, LPPCAP can be seen as a practical of the theory produced in literature [8]. We add the description of above in 4.1.

Attachment Submitted filename: Response to Reviewers.docx

10.1371/journal.pone.0309919.r003
Decision Letter 1
Liu Zhiquan Academic Editor
© 2024 Zhiquan Liu
2024
Zhiquan Liu
https://creativecommons.org/licenses/by/4.0/ This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Submission Version1
14 Aug 2024

PONE-D-24-26572R1A location-based service scheme with attribute information privacyPLOS ONE

Dear Dr. Dai,

Thank you for submitting your manuscript to PLOS ONE. After careful consideration, we feel that it has merit but does not fully meet PLOS ONE’s publication criteria as it currently stands. Therefore, we invite you to submit a revised version of the manuscript that addresses the points raised during the review process.

Please submit your revised manuscript by Sep 28 2024 11:59PM. If you will need more time than this to complete your revisions, please reply to this message or contact the journal office at plosone@plos.org. When you're ready to submit your revision, log on to https://www.editorialmanager.com/pone/ and select the 'Submissions Needing Revision' folder to locate your manuscript file.

Please include the following items when submitting your revised manuscript:A rebuttal letter that responds to each point raised by the academic editor and reviewer(s). You should upload this letter as a separate file labeled 'Response to Reviewers'.

A marked-up copy of your manuscript that highlights changes made to the original version. You should upload this as a separate file labeled 'Revised Manuscript with Track Changes'.

An unmarked version of your revised paper without tracked changes. You should upload this as a separate file labeled 'Manuscript'.

If you would like to make changes to your financial disclosure, please include your updated statement in your cover letter. Guidelines for resubmitting your figure files are available below the reviewer comments at the end of this letter.

If applicable, we recommend that you deposit your laboratory protocols in protocols.io to enhance the reproducibility of your results. Protocols.io assigns your protocol its own identifier (DOI) so that it can be cited independently in the future. For instructions see: https://journals.plos.org/plosone/s/submission-guidelines#loc-laboratory-protocols. Additionally, PLOS ONE offers an option for publishing peer-reviewed Lab Protocol articles, which describe protocols hosted on protocols.io. Read more information on sharing protocols at https://plos.org/protocols?utm_medium=editorial-email&utm_source=authorletters&utm_campaign=protocols.

We look forward to receiving your revised manuscript.

Kind regards,

Zhiquan Liu, Ph.D.

Academic Editor

PLOS ONE

Journal Requirements:

Please review your reference list to ensure that it is complete and correct. If you have cited papers that have been retracted, please include the rationale for doing so in the manuscript text, or remove these references and replace them with relevant current references. Any changes to the reference list should be mentioned in the rebuttal letter that accompanies your revised manuscript. If you need to cite a retracted article, indicate the article’s retracted status in the References list and also include a citation and full reference for the retraction notice.

Additional Editor Comments:Almost all reviewers are very positive about the contribution of this paper, and also point out some constructive comments. Please revise as much as possible according to the opinions as soon as possible, and submit the revised version to ensure that this paper can be published quickly.

[Note: HTML markup is below. Please do not edit.]

Reviewers' comments:

Reviewer's Responses to Questions

Comments to the Author

1. If the authors have adequately addressed your comments raised in a previous round of review and you feel that this manuscript is now acceptable for publication, you may indicate that here to bypass the “Comments to the Author” section, enter your conflict of interest statement in the “Confidential to Editor” section, and submit your "Accept" recommendation.

Reviewer #2: All comments have been addressed

Reviewer #4: (No Response)

**********

2. Is the manuscript technically sound, and do the data support the conclusions?

The manuscript must describe a technically sound piece of scientific research with data that supports the conclusions. Experiments must have been conducted rigorously, with appropriate controls, replication, and sample sizes. The conclusions must be drawn appropriately based on the data presented.

Reviewer #2: Partly

Reviewer #4: Yes

**********

3. Has the statistical analysis been performed appropriately and rigorously?

Reviewer #2: I Don't Know

Reviewer #4: Yes

**********

4. Have the authors made all data underlying the findings in their manuscript fully available?

The PLOS Data policy requires authors to make all data underlying the findings described in their manuscript fully available without restriction, with rare exception (please refer to the Data Availability Statement in the manuscript PDF file). The data should be provided as part of the manuscript or its supporting information, or deposited to a public repository. For example, in addition to summary statistics, the data points behind means, medians and variance measures should be available. If there are restrictions on publicly sharing data—e.g. participant privacy or use of data from a third party—those must be specified.

Reviewer #2: Yes

Reviewer #4: Yes

**********

5. Is the manuscript presented in an intelligible fashion and written in standard English?

PLOS ONE does not copyedit accepted manuscripts, so the language in submitted articles must be clear, correct, and unambiguous. Any typographical or grammatical errors should be corrected at revision, so please note any specific errors here.

Reviewer #2: Yes

Reviewer #4: Yes

**********

6. Review Comments to the Author

Please use the space provided to explain your answers to the questions above. You may also include additional comments for the author, including concerns about dual publication, research ethics, or publication ethics. (Please upload your review as an attachment if it exceeds 20,000 characters)

Reviewer #2: The grammatical error in the revision part (in yellow color) has to be rechecked. The sentences are not complete or not conveying the meaning.

Reviewer #4: In this scheme, query and feedback are encrypted with security two-parties calculation by the user and the LBS server, so as not to violate any personal privacy and decrease the processing time in encrypting the retrieved information. In addition, this scheme can also preserve the attribute privacy of users such as the query frequency as well as the moving manner. This article is well written, I think it can be accepted, while the following comments should be revised.

(1) The title of the picture is recommended to be placed below the picture, not above it. (2) In the figure of experimental results, it is suggested to add references for comparison schemes. (3) A related work, fct: a fully-distributed context-aware trust model for location based service recommendation, is suggested to be discussed or compared in related work. (4) It is recommended that the serial number before Introduction be changed to 1.

**********

7. PLOS authors have the option to publish the peer review history of their article (what does this mean?). If published, this will include your full peer review and any attached files.

If you choose “no”, your identity will remain anonymous but your review may still be made public.

Do you want your identity to be public for this peer review? For information about this choice, including consent withdrawal, please see our Privacy Policy.

Reviewer #2: No

Reviewer #4: No

**********

[NOTE: If reviewer comments were submitted as an attachment file, they will be attached to this email and accessible via the submission site. Please log into your account, locate the manuscript record, and check for the action link "View Attachments". If this link does not appear, there are no attachment files.]

While revising your submission, please upload your figure files to the Preflight Analysis and Conversion Engine (PACE) digital diagnostic tool, https://pacev2.apexcovantage.com/. PACE helps ensure that figures meet PLOS requirements. To use PACE, you must first register as a user. Registration is free. Then, login and navigate to the UPLOAD tab, where you will find detailed instructions on how to use the tool. If you encounter any issues or have any questions when using PACE, please email PLOS at figures@plos.org. Please note that Supporting Information files do not need this step.

10.1371/journal.pone.0309919.r004
Author response to Decision Letter 1
Submission Version2
19 Aug 2024

Response to reviewer's comments

Reviewer #2: The grammatical error in the revision part (in yellow color) has to be rechecked. The sentences are not complete or not conveying the meaning.

We rechecked the revision part (in yellow color) and changed these sentences.

Reviewer #4: In this scheme, query and feedback are encrypted with security two-parties calculation by the user and the LBS server, so as not to violate any personal privacy and decrease the processing time in encrypting the retrieved information. In addition, this scheme can also preserve the attribute privacy of users such as the query frequency as well as the moving manner. This article is well written, I think it can be accepted, while the following comments should be revised.

(1) The title of the picture is recommended to be placed below the picture, not above it. (2) In the figure of experimental results, it is suggested to add references for comparison schemes. (3) A related work, fct: a fully-distributed context-aware trust model for location based service recommendation, is suggested to be discussed or compared in related work. (4) It is recommended that the serial number before Introduction be changed to 1.

(1)We change the title of the picture to the place below the picture.

(2)The references are added in figure of experimental results.

(3)A related work is discussed in related work, and we added it as “Liu et al. [30] also proposed a fully-distributed context-aware trust model for location based service. ” in section 2.

(4)The serial number before Introduction is changed to 1.

Attachment Submitted filename: Response to Reviewers.docx

10.1371/journal.pone.0309919.r005
Decision Letter 2
Liu Zhiquan Academic Editor
© 2024 Zhiquan Liu
2024
Zhiquan Liu
https://creativecommons.org/licenses/by/4.0/ This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
Submission Version2
21 Aug 2024

A location-based service scheme with attribute information privacy

PONE-D-24-26572R2

Dear Dr. Dai,

We’re pleased to inform you that your manuscript has been judged scientifically suitable for publication and will be formally accepted for publication once it meets all outstanding technical requirements.

Within one week, you’ll receive an e-mail detailing the required amendments. When these have been addressed, you’ll receive a formal acceptance letter and your manuscript will be scheduled for publication.

An invoice will be generated when your article is formally accepted. Please note, if your institution has a publishing partnership with PLOS and your article meets the relevant criteria, all or part of your publication costs will be covered. Please make sure your user information is up-to-date by logging into Editorial Manager at Editorial Manager® and clicking the ‘Update My Information' link at the top of the page. If you have any questions relating to publication charges, please contact our Author Billing department directly at authorbilling@plos.org.

If your institution or institutions have a press office, please notify them about your upcoming paper to help maximize its impact. If they’ll be preparing press materials, please inform our press team as soon as possible -- no later than 48 hours after receiving the formal acceptance. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org.

Kind regards,

Prof. Zhiquan Liu

Academic Editor

Jinan University

zqliu@vip.qq.com

https://www.zqliu.com

Additional Editor Comments (optional):

Accept

Reviewers' comments:

10.1371/journal.pone.0309919.r006
Acceptance letter
Liu Zhiquan Academic Editor
© 2024 Zhiquan Liu
2024
Zhiquan Liu
https://creativecommons.org/licenses/by/4.0/ This is an open access article distributed under the terms of the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original author and source are credited.
28 Aug 2024

PONE-D-24-26572R2

PLOS ONE

Dear Dr. Dai,

I'm pleased to inform you that your manuscript has been deemed suitable for publication in PLOS ONE. Congratulations! Your manuscript is now being handed over to our production team.

At this stage, our production department will prepare your paper for publication. This includes ensuring the following:

* All references, tables, and figures are properly cited

* All relevant supporting information is included in the manuscript submission,

* There are no issues that prevent the paper from being properly typeset

If revisions are needed, the production department will contact you directly to resolve them. If no revisions are needed, you will receive an email when the publication date has been set. At this time, we do not offer pre-publication proofs to authors during production of the accepted work. Please keep in mind that we are working through a large volume of accepted articles, so please give us a few weeks to review your paper and let you know the next and final steps.

Lastly, if your institution or institutions have a press office, please let them know about your upcoming paper now to help maximize its impact. If they'll be preparing press materials, please inform our press team within the next 48 hours. Your manuscript will remain under strict press embargo until 2 pm Eastern Time on the date of publication. For more information, please contact onepress@plos.org.

If we can help with anything else, please email us at customercare@plos.org.

Thank you for submitting your work to PLOS ONE and supporting open access.

Kind regards,

PLOS ONE Editorial Office Staff

on behalf of

Professor Zhiquan Liu

Academic Editor

PLOS ONE
==== Refs
References

1 Kim J.W. , Edemacu K. , Jang B. , Privacy-preserving mechanisms for location privacy in mobile crowdsensing: A survey, Journal of Network and Computer Applications, 200 (2022) 103315.
2 Lin S.-Y. , Zhang L. , Li J. , Ji L.-l. , Sun Y. , A survey of application research based on blockchain smart contract, Wireless Networks, 28 (2022) 635–690.
3 Xing L. , Jia X.F. , Gao J.P. , Wu H.H. , A Location Privacy Protection Algorithm Based on Double K-Anonymity in the Social Internet of Vehicles, Ieee Communications Letters, 25 (2021) 3199–3203.
4 Niu B. , Chen Y.H. , Wang Z.B. , li F.H. , Wang B.Y. , Li H. , Eclipse: Preserving Differential Location Privacy Against Long-Term Observation Attacks, Ieee Transactions on Mobile Computing, 21 (2022) 125–138.
5 Khoshgozaran A. , Shahabi C. , Shirani-Mehr H. , Location privacy: going beyond K-anonymity, cloaking and anonymizers, Knowledge and Information Systems, 26 (2011) 435–465.
6 P.M. Wightman, M. Zurbaran, M. Rodriguez, M.A. Labrador, MaPIR: Mapping-Based private information retrieval for location privacy in LBISs, Proceedings of the 2013 38th Annual IEEE Conference on Local Computer Networks Workshops (Lcn Workshops), (2013) 964–971.
7 Yang Song-tao MA Chun-guang. Random anonymity method for location privacy [J]. Journal of Harbin Engineering University, 2015,36 (03 ):374–378.
8 Lai J. , Mu Y. , Guo F. , Jiang P. , Susilo W. , Privacy-enhanced attribute-based private information retrieval, Information Sciences, 454–455 (2018) 275–291.
9 H. Haibo, X. Jianliang, X. Xizhong, K. Pei, B. Choi, Z. Shuigeng, Private search on key-value stores with hierarchical indexes, in: Data Engineering (ICDE), 2014 IEEE 30th International Conference on, 2014, pp. 628–639.
10 Yi X. , Paulet R. , Bertino E. , Varadharajan V. , Practical Approximate k Nearest Neighbor Queries with Location and Query Privacy, Ieee Transactions on Knowledge and Data Engineering, 28 (2016) 1546–1559.
11 Han Y.L. , Zhu S.S. , Li Y. , Lin X. , APPLSS: Adaptive Privacy Preserved Location Sharing Scheme Based on Attribute-Based Encryption, China Communications, 18 (2021) 105–121.
12 M. Gruteser, D. Grunwald, Anonymous usage of location-based services through spatial and temporal cloaking, in: Proceedings of the 1st international conference on Mobile systems, applications and services, ACM, San Francisco, California, 2003, pp. 31–42.
13 M.E. Andrés, N.E. Bordenabe, K. Chatzikokolakis, C. Palamidessi, Geo-indistinguishability: Differential privacy for location-based systems, in: Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, ACM, 2013, pp. 901–914.
14 Zhang L. , Ma C. , Yang S. , Zheng X. , Probability Indistinguishable: A Query and Location Correlation Attack Resistance Scheme, Wireless Personal Communications, 97 (2017) 6167–6187.
15 Ghaffari M. , Ghadiri N. , Manshaei M.H. , Lahijani M.S. , P(4)QS: A Peer-to-Peer Privacy Preserving Query Service for Location-Based Mobile Applications, Ieee Transactions on Vehicular Technology, 66 (2017) 9458–9469.
16 Zhang L. , Chen M.N. , Liu D.S. , Li J. , Moving without association: an association shifting scheme for protecting destination, Journal of Ambient Intelligence and Humanized Computing, 14 (2023) 1659–1674.
17 Wang T. , Xu L. , Zhang M. , Zhang H. , Zhang G. , A New Privacy Protection Approach Based on K-Anonymity for Location-Based Cloud Services, Journal of Circuits Systems and Computers, 31 (2022) 2250083.
18 Ding Y. , Zhang L. , Guo L. , Dynamic Delayed-Decision Task Assignment Under Spatial-Temporal Constraints in Mobile Crowdsensing, Ieee Transactions on Network Science and Engineering, 9 (2022) 2418–2431.
19 Zhang L. , Liu D. , Chen M. , Li H. , Wang C. , Zhang Y. , Du Y. , A user collaboration privacy protection scheme with threshold scheme and smart contract, Information Sciences, 560 (2021) 183–201.
20 Tao X. , Hafid A.S. , ChainSensing: A Novel Mobile Crowdsensing Framework With Blockchain, Ieee Internet of Things Journal, 9 (2022) 2999–3010.
21 Zhao P. , Li C. , Fu Y. , Hui Y. , Zhang Y. , Cheng N. , Blockchain-Enabled Conditional Decentralized Vehicular Crowdsensing System, Ieee Transactions on Intelligent Transportation Systems, 23 (2022) 18937–18950.
22 Luo H.W. , Zhang H.M. , Long S.G. , Lin Y. , Enhancing frequent location privacy-preserving strategy based on geo-Indistinguishability, Multimedia Tools and Applications, 2021 (2021) 21823–21841.
23 Ma B. , Wang X. , Ni W. , Liu R.P. , Personalized Location Privacy With Road Network-Indistinguishability, Ieee Transactions on Intelligent Transportation Systems, 23 (2022) 20860–20872.
24 Min M. , Xiao L. , Ding J. , Zhang H. , Li S. , Pan M. , Han Z. , 3D Geo-Indistinguishability for Indoor Location-Based Services, Ieee Transactions on Wireless Communications, 21 (2022) 4682–4694.
25 Qiu C. , Squicciarini A.C. , Pang C. , Wang N. , Wu B. , Location Privacy Protection in Vehicle-Based Spatial Crowdsourcing via Geo-Indistinguishability, Ieee Transactions on Mobile Computing, 21 (2022) 2436–2450.
26 Xue Q. , Zhu Y. , Wang J. , Mean estimation over numeric data with personalized local differential privacy, Frontiers of Computer Science, 16 (2022).
27 Zhang L. , Lin S. , Wang C. , Li J. , Liu Y. , Sun Y. , IRDP Ride system: A Privacy Preservation System for Online Ride-hailing, IEEE Internet of Things Journal, 10 (2023) 9108–9121.
28 Zheng Z. , Li Z. , Jiang H. , Zhang L.Y. , Tu D. , Semantic-Aware Privacy-Preserving Online Location Trajectory Data Sharing, Ieee Transactions on Information Forensics and Security, 17 (2022) 2256–2271.
29 Yang H. , Vijayakumar P. , Shen J. , Gupta B.B. , A location-based privacy-preserving oblivious sharing scheme for indoor navigation, Future Generation Computer Systems-the International Journal of Escience, 137 (2022) 42–52.
30 Liu Z. , Ma J. , Jiang Z. , Miao Y. , FCT: a fully-distributed context-aware trust model for location based service recommendation, Science China Information Sciences, 60 (2017) 082102.
31 Wazirali R. , A Review on Privacy Preservation of Location-Based Services in Internet of Things, Intelligent Automation and Soft Computing, 31 (2022) 767–779.
32 Xu Q. , Zhu H. , Zheng Y. , Zhao J. , Lu R. , Li H. , An Efficient and Privacy-Preserving Route Matching Scheme for Carpooling Services, IEEE Internet of Things Journal, 9 (2022) 19890–19902.
33 Deebak D.B. , Al-Turjman F. , Lightweight privacy-aware secure authentication scheme for cyber-physical systems in the edge intelligence era, Concurrency and Computation-Practice & Experience, (2021) e6510.
34 Liang Y. , Li Y. , Shin B.-S. , Private decentralized crowdsensing with asynchronous blockchain access, Computer Networks, 213 (2022) 109088.
35 Vithana S. , Banawan K. , Ulukus S. , Semantic Private Information Retrieval, Ieee Transactions on Information Theory, 68 (2022) 2635–2652.
36 Ye F. , El Rouayheb S. , Intermittent Private Information Retrieval With Application to Location Privacy, Ieee Journal on Selected Areas in Communications, 40 (2022) 927–939. doi: 10.1109/JSAC.2022.3142301
37 Li X.T. , Chen L.W. , Wu D.H. , Adversary for Social Good: Leveraging Adversarial Attacks to Protect Personal Attribute Privacy, Acm Transactions on Knowledge Discovery from Data, 18 (2024).
38 Huang C. , Wei S. , Fu A. , An Efficient Privacy-Preserving Attribute-Based Encryption with Hidden Policy for Cloud Storage, Journal of Circuits Systems and Computers, 28 (2019) 1950816.
39 Lei Z. , Lili H. , Desheng L. , Jing L. , Qingfeng J. , Qi Y. , An Attribute Generalization Mix-Zone Without Privacy Leakage, IEEE Access, 7 (2019) 57088–57099. doi: 10.1109/ACCESS.2019.2898996
