Trajectory Encryption Methods

• Trajectory encryption is a suite of methods that secure motion trajectories and location traces using diverse techniques (e.g., geo-encryption, homomorphic encryption, and format-preserving schemes).
• These methods are applied to protect sensitive movement data in mobile networks, swarm guidance, and automotive trajectory systems, balancing operational use with stringent privacy controls.
• Performance is evaluated using metrics like decryption ratio, relative distance retention, and computational efficiency, with each approach tailored to its specific security and recovery objectives.

to=arxiv_search.search 大发彩票官网 开号网址json {"query":"trajectory encryption geo-encryption trajectory privacy-preserving matrix completion motion-copying homomorphic encryption", "max_results": 10} to=arxiv.search 北京赛车开奖 েনেjson {"query":"trajectory encryption geo-encryption", "max_results": 10} Trajectory encryption denotes a family of methods for protecting, constraining, or obscuring motion trajectories and location traces. In the arXiv literature, the term is not used for a single primitive. It includes geo-encryption that binds decryption to a spatio-temporal region, cooperative-guidance designs in which heterogeneous time-to-go laws obscure a swarm’s collective interception intent, format-preserving encryption of geographic coordinates for trajectory privacy, lightweight masking of trajectory matrices for privacy-preserving recovery, and homomorphic storage and editing of recorded motion (Al-Fuqaha et al., 2017, Gopikannan et al., 22 Sep 2025, Ji et al., 23 Oct 2025, Guo et al., 2024, Takanashi et al., 2023). The common theme is control over who can recover, infer, or manipulate trajectory information, but the technical mechanisms and security objectives differ substantially across these strands.

1. Conceptual scope and formalizations

The literature uses at least five distinct formulations of trajectory encryption.

Modality	Core mechanism	Representative source
Geo-encryption	Key derived from region and time descriptor	(Al-Fuqaha et al., 2017)
Cooperative salvo guidance	Heterogeneous trajectories reduce distinguishability of impact-time hypotheses	(Gopikannan et al., 22 Sep 2025)
Coordinate privacy	Format-preserving encryption of latitude and longitude	(Ji et al., 23 Oct 2025)
Encrypted trajectory recovery	Lightweight masking plus low-rank matrix completion	(Guo et al., 2024)
Encrypted motion preservation	Homomorphic encryption of sampled motion and force data	(Takanashi et al., 2023)

In geo-encryption, a secret key $K$ is “locked” to a region-time pair $L \times T$ by a geo-locking function $G$, producing $K_{\mathrm{geo}} = G(K, L \Vert T)$, with a typical instantiation $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$; payload encryption then uses $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$ (Al-Fuqaha et al., 2017). In cooperative guidance, trajectory encryption is defined in an information-theoretic sense: a swarm trajectory set is $\varepsilon$-encrypted if distinct common-impact-time hypotheses induce observation distributions whose total-variation distance is at most $\varepsilon$, so that an adversary cannot reliably distinguish them from noisy observations (Gopikannan et al., 22 Sep 2025).

In coordinate-privacy systems, the emphasis is exact reversibility under authorized decryption together with format preservation: encrypted longitudes and latitudes remain valid GPS points with the same decimal digit count, while pairwise distances and clustering structure are deliberately perturbed (Ji et al., 23 Oct 2025). In privacy-preserving trajectory recovery, encryption is a lightweight per-column masking operation,

$$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$

followed by cloud-side matrix completion and local decryption (Guo et al., 2024). In encrypted motion-copying, sampled motion $\theta_k$ and estimated external torque $L \times T$0 are stored as ElGamal ciphertexts and can be spatially scaled homomorphically without decryption (Takanashi et al., 2023).

A common source of confusion is terminological. In some works, “trajectory encryption” is literal cryptographic encryption of trajectory data; in others, it is a control-theoretic obfuscation of adversarial inference in the trajectory domain. The distinction is substantive because the first class primarily targets confidentiality and reversible access control, whereas the second targets predictability of collective intent.

2. Geo-encryption for moving receivers

The mobile geo-encryption protocol in “Geo-Encryption Protocol For Mobile Networks” formalizes decryption as contingent on both location and time (Al-Fuqaha et al., 2017). Node $L \times T$1 is the moving recipient and node $L \times T$2 the sender. At update event $L \times T$3, $L \times T$4’s movement state is

$L \times T$5

where $L \times T$6 is average speed, $L \times T$7 is heading, and $L \times T$8 encode maneuverability along major and minor axes.

Using an initial state $L \times T$9, the sender predicts the center of the decryption zone by constant-velocity propagation,

$G$0

The decryption region is a moving $G$1 ellipse centered at $G$2, with

$G$3

correlation $G$4, and acceptance region $G$5 with $G$6 (Al-Fuqaha et al., 2017). This construction combines mobility prediction, maneuverability, and positioning uncertainty into a single decryption predicate.

The protocol assumes a pre-established symmetric session key $G$7 from a conventional authenticated key exchange. For a payload $G$8, the sender computes the current region descriptor

$G$9

derives $K_{\mathrm{geo}} = G(K, L \Vert T)$0, encrypts with $K_{\mathrm{geo}} = G(K, L \Vert T)$1, and transmits $K_{\mathrm{geo}} = G(K, L \Vert T)$2. The recipient checks GPS-derived $K_{\mathrm{geo}} = G(K, L \Vert T)$3, verifies $K_{\mathrm{geo}} = G(K, L \Vert T)$4 and $K_{\mathrm{geo}} = G(K, L \Vert T)$5 inside the ellipse, re-derives $K_{\mathrm{geo}} = G(K, L \Vert T)$6, and decrypts (Al-Fuqaha et al., 2017).

To support mobility, the recipient sends movement-update packets whenever speed, heading, or maneuverability deviates significantly from advertised values. Each update $K_{\mathrm{geo}} = G(K, L \Vert T)$7 carries $K_{\mathrm{geo}} = G(K, L \Vert T)$8 geo-encrypted under a region around the sender’s stationary location. The sender then replaces its previous parameters and recomputes the prediction equations (Al-Fuqaha et al., 2017).

Parameter refinement uses a discrete Gauss–Markov model,

$K_{\mathrm{geo}} = G(K, L \Vert T)$9

for $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$0, together with sample-variance estimates of recent position deviations to update $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$1 and $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$2. Advertisement thresholds suppress updates while the node remains inside a “2$$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$3-advertisement-free” ellipse with approximately $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$4 stay-inside probability (Al-Fuqaha et al., 2017).

Security analysis in this model addresses eavesdropping, replay, and compromise resilience under standard HMAC-security assumptions. Off-trajectory or off-time adversaries cannot re-derive $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$5 because their reconstructed descriptor $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$6. Each message carries a fresh timestamp and nonce, and mobility updates remain protected unless side-channel attacks such as GPS spoofing are considered, which are explicitly assumed out of scope (Al-Fuqaha et al., 2017).

Performance was evaluated over DSR in ns-2.28 with 50 mobile nodes following real bus traces in a $$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$7 area, CBR traffic at 4 pkts/s, and packet size 256 B. The principal metrics were decryption ratio

$$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$8

and overhead

$$K_{\mathrm{geo}} = \mathrm{HMAC}(K,\mathrm{Encode}(L,T))$$9

At pause time $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$0 s, $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$1, rising to approximately $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$2 at $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$3 s; adding CBR flows from 10 to 30 lowers DR by up to $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$4 at high mobility. Overhead falls from approximately $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$5 at $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$6 s to approximately $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$7 at $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$8 s. At $$C=\mathrm{Enc}_{k_{\mathrm{enc}}}(K_{\mathrm{geo}};M)$$9 s with 10 CBR flows, increasing tolerance from 3 m to 100 m raises DR from $\varepsilon$0 to $\varepsilon$1, while OH decays approximately exponentially with tolerance (Al-Fuqaha et al., 2017).

3. Trajectory-domain encryption in cooperative salvo guidance

“Trajectory Encryption Cooperative Salvo Guidance” introduces a different use of the term: adversarial obscuration by heterogeneous guidance rather than key-based ciphertext protection (Gopikannan et al., 22 Sep 2025). For a swarm of $\varepsilon$2 interceptors with trajectories

$\varepsilon$3

an adversary observes

$\varepsilon$4

and seeks to infer a common interception time $\varepsilon$5. The swarm is $\varepsilon$6-encrypted if

$\varepsilon$7

Here the “encryption layer” is induced by heterogeneity in the vehicles’ time-to-go formulations, which enlarges the set of feasible trajectory families and degrades distinguishability of impact-time hypotheses (Gopikannan et al., 22 Sep 2025).

Each pursuer has a guidance-law-dependent time-to-go

$\varepsilon$8

with affine dynamics

$\varepsilon$9

Defining the time-to-go error $\varepsilon$0, the distributed cooperative command is

$\varepsilon$1

where $\varepsilon$2 is the graph Laplacian, $\varepsilon$3, and $\varepsilon$4 (Gopikannan et al., 22 Sep 2025). This feedback drives all $\varepsilon$5 by prescribed time $\varepsilon$6, thereby enforcing simultaneous impact while allowing heterogeneous vehicle classes.

The paper gives closed-form instances for DPG and TPNG time-to-go laws, together with corresponding $\varepsilon$7, $\varepsilon$8, and acceleration commands. It also proposes an objective-function interpretation combining impact-time error, pairwise time-to-go diversity, and control effort,

$\varepsilon$9

This formulation makes explicit that simultaneous interception and trajectory diversity are not treated as contradictory objectives (Gopikannan et al., 22 Sep 2025).

The simulations use four pursuers $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$0–$$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$1, with two DPG and two TPNG vehicles, fixed directed graphs, and actuator limit $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$2. Scenario 1 uses a cycle graph $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$3, all pursuers launched from $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$4, target at $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$5, $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$6 m/s, heading $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$7, TPNG gain $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$8, and controller parameters $$\widetilde X_{:,k}=\Bigl(v_0^{(k)}X_{:,k}+\sum_{i=1}^I v_i^{(k)}P_i\Bigr)\circ Q_{:,k},$$9, $\theta_k$0, $\theta_k$1 s. Scenario 2 uses a denser graph and different launch points and target kinematics. Scenario 3 introduces guidance morphing at $\theta_k$2 s, and Scenario 4 mixes DPG, TPNG, and Predicted-Interception-Point laws (Gopikannan et al., 22 Sep 2025).

Qualitatively, DPG pursuers follow pronounced arcs while TPNG pursuers take comparatively straighter paths; morphing adds trajectory “kinks” at the switching time, yielding additional trajectory families (Gopikannan et al., 22 Sep 2025). Quantitatively, all scenarios achieve $\theta_k$3 s, with consensus times approximately 3 s in Scenario 1, 2 s in Scenario 2, and 4 s pre- and post-morph in Scenario 3. Against an adversary fitting a single-law PN model from noisy LOS data over 100 trials, the empirical total-variation bound is $\theta_k$4, whereas a homogeneous PN swarm yields $\theta_k$5; the heterogeneous design therefore reduces the adversary’s distinguishing statistic by more than $\theta_k$6. Under $\theta_k$7 random acceleration noise, worst-case $\theta_k$8 increases by only 0.02 s and final miss distance by less than 0.5 m (Gopikannan et al., 22 Sep 2025).

The main limitations stated for this formulation are the need for a strongly connected directed communications graph, the assumption of perfect state feedback of LOS and relative velocities, and the restriction to non-maneuvering targets in the current analysis (Gopikannan et al., 22 Sep 2025).

4. Format-preserving encryption of trajectory coordinates

For automotive trajectory data, “Privacy Protection of Automotive Location Data Based on Format-Preserving Encryption of Geographical Coordinates” targets confidentiality of raw coordinates, exact authorized reversibility, and preservation of GPS-valid syntax (Ji et al., 23 Oct 2025). The threat model includes external eavesdroppers, compromised cloud nodes, and malicious insiders who can observe or store streaming coordinates or full trajectories, with attacks including trajectory reconstruction, sensitive point-of-interest inference, and linkage across multiple releases.

The method splits each coordinate into sign, integer part, and fractional part, encrypts integer and fraction separately, and maintains a bijective mapping keyed by coordinate identifier and encrypted value: $\theta_k$9 The implementation uses four mappings for longitude/latitude and integer/fractional components. This keyed dictionary is introduced specifically to ensure zero error after repeated encrypt/decrypt cycles and to distinguish different coordinates that happen to encrypt to the same number (Ji et al., 23 Oct 2025).

Format preservation is enforced by domain-aware range classification and range constraint. Longitude integer parts lie in $L \times T$00, latitude integer parts in $L \times T$01, and a fractional part with $L \times T$02 decimal digits lies in $L \times T$03. After Feistel-network processing, the intermediate integer $L \times T$04 is mapped back into a valid interval by

$L \times T$05

The high-level encryption routine uses a secret master key $L \times T$06, a coordinate ID, a 32-bit MD5-derived tweak, 32 Feistel rounds, dynamic key selection, and dynamic shift; decryption reverses the Feistel steps and then uses the mapping $L \times T$07 to recover the exact original component (Ji et al., 23 Oct 2025).

The paper evaluates privacy loss of spatial structure through the relative distance retention rate (RDR). For four distinct points,

$L \times T$08

with Haversine distance for $L \times T$09, and

$L \times T$10

Restoration accuracy is exact pointwise matching between decrypted and original coordinates (Ji et al., 23 Oct 2025).

Experiments use T-drive taxi trajectories with 10,308 vehicles and approximately 17.3 million GPS points. The average RDR is 0.0844, the median is 0.0515, 33.09% of vehicles achieve $L \times T$11, and 80% have $L \times T$12. Restoration accuracy is 100%, with all 17,374,292 points matching the original after decryption. DBSCAN hotspot analysis finds 787 hotspots in the original data and only 9 in the encrypted data, a 98.9% reduction; after decryption, the 787 hotspots reappear with perfect location matching and 0 km average error (Ji et al., 23 Oct 2025). These results show deliberate destruction of microscopic and macroscopic spatial structure under encryption while retaining exact authorized recoverability.

Because encrypted coordinates remain valid numeric GPS values with preserved digit counts, the paper further describes two integration patterns for encrypted spatial services: client-driven query rewriting for range queries and enclave-assisted $L \times T$13-nearest or distance queries. A plausible implication is that the scheme is designed not only for archival privacy but also for operational use in indexed geospatial systems, provided exact geometric relations are either post-filtered client-side or computed inside a TEE/MPC component.

5. Encrypted computation over trajectories

Trajectory encryption is also used to enable computation on protected data rather than only access restriction. “High-Performance Privacy-Preserving Matrix Completion for Trajectory Recovery” encrypts each user’s trajectory column by mixing it with public basis columns and then performs low-rank completion directly on the encrypted matrix (Guo et al., 2024). With $L \times T$14 the true trajectory matrix, $L \times T$15 the observation mask, and $L \times T$16 a public matrix, user $L \times T$17 samples private weights $L \times T$18 with $L \times T$19 and forms

$L \times T$20

After cloud-side completion, decryption is

$L \times T$21

The completion objective uses tri-factorization with an $L \times T$22-norm penalty and orthogonality constraints, solved by ADMM with thin-QR updates for $L \times T$23 and $L \times T$24, closed-form shrinkage for $L \times T$25, and a closed-form quadratic update for $L \times T$26 (Guo et al., 2024). Recovery quality is measured by relative squared error,

$L \times T$27

The reported trade-off is favorable: PPLNM-QR uses two QR decompositions with cost $L \times T$28, compared with ALT-MIN cost $L \times T$29 per iteration, yielding practical speedups of $L \times T$30 to $L \times T$31 for large matrices, while the RSE remains essentially identical to baseline within $L \times T$32 (Guo et al., 2024).

A different computational model appears in “Secure Motion-Copying via Homomorphic Encryption,” which stores and reproduces a one-degree-of-freedom yaw-axis trajectory as encrypted samples $L \times T$33 (Takanashi et al., 2023). The scheme uses ElGamal over a multiplicative group $L \times T$34 of prime order $L \times T$35 with safe prime $L \times T$36, public key $L \times T$37, encryption

$L \times T$38

and multiplicative homomorphism

$L \times T$39

Real signals are quantized before encryption. The stored dataset is

$L \times T$40

and spatial scaling by $L \times T$41 is performed homomorphically by ciphertext multiplication with encrypted scale factors (Takanashi et al., 2023).

The same work embeds encrypted motion data into a four-channel bilateral control system. Multiplicative components of the controller are computed on ciphertexts, while remaining linear combinations are applied after decryption through a modified $L \times T$42. The security basis is IND-CPA ElGamal under DDH, with a safe-prime construction intended to resist small-subgroup attacks. The implementation uses a 20 ms sampling period, sequence length $L \times T$43, key length 128 bit, and quantization gains $L \times T$44. Reported scenarios include free motion, object contact with an aluminum block, and spatial scaling with $L \times T$45 or vice versa; all homomorphic multiplications fit within the 20 ms budget, and memory per trajectory is approximately a few megabytes (Takanashi et al., 2023).

These two strands illustrate a broader divide within trajectory encryption research. One line uses encryption as a preprocessing layer for outsourced inference or reconstruction; the other treats encrypted trajectories as persistent control objects that can be edited and replayed without exposure of the underlying motion.

6. Evaluation criteria, misconceptions, and open directions

Evaluation criteria vary sharply with the operational meaning of trajectory encryption. Geo-encryption emphasizes decryption ratio and movement-update overhead under mobility (Al-Fuqaha et al., 2017). Cooperative-guidance formulations evaluate simultaneous-impact error $L \times T$46, final miss distance, empirical $L \times T$47 through total-variation distance, differential-entropy-based unpredictability, and robustness under bounded disturbances (Gopikannan et al., 22 Sep 2025). Coordinate-encryption systems focus on RDR, restoration accuracy, and hotspot suppression (Ji et al., 23 Oct 2025). Encrypted completion uses RSE, convergence speed, and computational cost (Guo et al., 2024). Homomorphic motion-copying is assessed by real-time feasibility, control tracking, and correctness of reproduced contact forces and scaled motion (Takanashi et al., 2023).

A recurring misconception is that stronger trajectory encryption always means greater distortion of the underlying data. The cited literature shows both possibilities. Some schemes intentionally destroy spatial relations in the encrypted domain, as in low-RDR coordinate FPE and hotspot suppression (Ji et al., 23 Oct 2025). Others preserve exact recoverability or faithful execution under authorized access, as in 100% restoration accuracy for decrypted coordinates, exact decryption formulas in matrix completion, and encrypted motion replay under homomorphic control (Ji et al., 23 Oct 2025, Guo et al., 2024, Takanashi et al., 2023). Geo-encryption occupies a different point in this design space: it does not primarily distort trajectory data, but restricts when and where a valid decryption can occur (Al-Fuqaha et al., 2017).

Another common misunderstanding is to equate trajectory encryption solely with classical key-based cryptography. The cooperative-salvo literature uses the term for an adversarial indistinguishability property of trajectory ensembles induced by heterogeneous guidance laws rather than for ciphertext confidentiality in the conventional sense (Gopikannan et al., 22 Sep 2025). This suggests that trajectory encryption should be understood as a broader research area at the intersection of cryptography, mobility modeling, estimation, and guidance-and-control.

Open directions stated in the cited works remain diverse. Cooperative-guidance studies identify time-varying topologies, drop-out-robust consensus, explicit observer-in-the-loop adversarial inference, 3D geometry, altitude constraints, maneuverable targets, and information-theoretic measures such as mutual information and Rényi divergence (Gopikannan et al., 22 Sep 2025). Coordinate-FPE work points to encrypted spatial indexing, TEE/MPC-assisted nearest-neighbor queries, and ciphertext-domain geospatial services (Ji et al., 23 Oct 2025). Homomorphic motion-copying identifies temporal scaling or time-warping as future work because direct encrypted additions are unavailable in the multiplicative ElGamal setting (Takanashi et al., 2023). Geo-encryption for mobile networks leaves GPS-spoofing side channels out of scope, indicating a boundary between protocol-level guarantees and physical-layer trust assumptions (Al-Fuqaha et al., 2017).

Taken together, these works show that trajectory encryption is less a single protocol family than a set of technical responses to a shared problem: trajectory information is both operationally valuable and strategically sensitive. The resulting designs differ in whether they bind decryption to motion, hide intent through heterogeneous dynamics, preserve coordinate syntax while scrambling geometry, enable low-rank recovery over masked data, or support homomorphic preservation and manipulation of motion records.