A Unified Framework for Location Privacy

transcript

Reza……..ShokriJulien.....FreudigerJean-Pierre....Hubaux

http://lca.epfl.ch/privacy

Exposing Location Information

Location Privacy

“… a special type of information privacy which concerns the claim of individuals to determine for themselves when, how, and to what extent location information about them is communicated to others.”

Duckham, M. and L. Kulik, Location privacy and location-aware computing, 2006.

Research on Location PrivacyAchievements So Far

• Attracted researchers from various disciplines– Database, Network Anonymity, Ubiquitous

Computing, Cryptography• Variety of protection mechanisms proposed

– Highly influenced by methods that are not tailored for location privacy (e.g., K-anonymity)

• Different terminologies and models make the proposed methods difficult to compare

A Unified Framework

• Organizing and classifying location privacy fundamental components

• Providing a generic model and terminology

• Modeling and understanding existing efforts• Identifying missing elements• Designing new schemes

Components of the Framework

• Basic elements– Spatial Model– Events and Traces

• Threat Model

• Protection Mechanisms

• Measurement

Basic Elements

Spatial ModelLayer I - location instances e.g., <latitude, longitude>

Layer II - location sites e.g., hospital A at 45th St.

Layer III - location types e.g., bar, hospital

Events and TracesEvents

<who, when, where>

- Who: identifier- When: time-stamp- Where: location-stamp

Trace- Set of events

Threat Model

LBS Operator

Eavesdroppers

Adversary is an observer of users’ events

Adversary Statistical InformationStatistical information about users’ actual events.

e.g., users’ spatiotemporal distribution and mobility pattern

Adversary Knowledge

• Real-time location information– A set of events (observed by the adversary)

• Statistical information– Users’ population– Users’ mobility pattern– Users’ spatiotemporal distribution– …

AttacksTargeting individuals or communities

Tracking Identification

Bob’s Home

Bob’s Workplace

Consequences Presence Disclosure

– Layer I: Finding mobility traces/patterns

– Layer II: Disclosing visits to some places

– Layer III: Profiling the type of visited locations• Personal activities => My Hobbies/Interests

• Professional activities => Where I Work

• Social activities => My Social Network

Absence Disclosure

Consequences

Protection

Location Privacy Preservation

Actual Events

Observable Events

Modifying the set of events before they are

observable to the adversary

Actual Events

MethodsEntities

Observable Events

Actual Events

Hiding Events

MethodsEntities

Observable Events

Actual Events

Hiding Events

Adding Dummy EventsU

MethodsEntities

Observable Events

Actual Events

Obfuscation

Hiding Events

MethodsEntities

Observable Events

Actual Events

Obfuscation

Hiding Events

MethodsEntities

Observable EventsAnonymization

Measurement

Location Privacy Measurement

• Notions of location privacy in two different scales:

• Microscopic Location Privacy– How far is the adversary’s estimation of a user’s location

by having a single event observed from the user?

• Macroscopic Location Privacy– How far is the adversary’s estimation of a user’s location

by observing a set of events from the users?

Microscopic Location Privacy with respect to a single observed event

<ID: abc, Location-stamp: Midtown Center Manhattan, Time-stamp: 1pm>

who is abc? Alice, Bob, …?

where is abc?

Macroscopic Location Privacy with respect to a set of observed events

what are the trajectories?

whom the trajectories belong to?

Bob’s House

Alice’s House

Eve’s House

Location Privacy Metrics

• Uncertainty-based Metrics

• K-anonymity, l-diversity, …

• Clustering-based Metrics

• Distortion-based Metrics

Distortion-based Metric

Darkness: the probability that a user is there. The darker, the more probable.

User’s actual locationHypothesized locations for the user

Obfuscated Area

Location Privacy=

Distortion in the user’s reconstructed location

by the adversary

Sumi (pi*di)

• Existing schemes only focus on measuring location privacy in 1st layer of the spatial model

• What about other layers?

Diversity matters

Layer II – Location Sites

Distance (to user’s location) matters

Suggestion: Distortion-based Metric

casino

Layer III – Location Types

Suggestion: Uncertainty-based or Distortion-based Metric

Conclusion

• Proposed a unified framework for location privacy– Helps to design, understand and compare location

privacy schemes

• Embedded existing schemes in our framework

A Unified Framework for Location Privacy

Documents