A Unified Framework for Location Privacy

1. A Unified Framework for Location Privacy Reza……..Shokri Julien.....Freudiger Jean-Pierre....Hubaux http://lca.epfl.ch/privacy

2. Exposing Location Information

3. Location Privacy “… a special type of information privacy which concerns the claim of individuals to determine for themselves when, how, and to what extent location information about them is communicated to others.” Duckham, M. and L. Kulik, Location privacy and location-aware computing, 2006.

4. Research on Location PrivacyAchievements So Far • Attracted researchers from various disciplines • Database, Network Anonymity, Ubiquitous Computing, Cryptography • Variety of protection mechanisms proposed • Highly influenced by methods that are not tailored for location privacy (e.g., K-anonymity) • Different terminologies and models make the proposed methods difficult to compare

5. A Unified Framework • Organizing and classifying location privacy fundamental components • Providing a generic model and terminology • Modeling and understanding existing efforts • Identifying missing elements • Designing new schemes

6. Components of the Framework • Basic elements • Spatial Model • Events and Traces • Threat Model • Protection Mechanisms • Measurement

7. Basic Elements

8. Spatial Model Layer I - location instances e.g., <latitude, longitude> Layer II - location sites e.g., hospital A at 45th St. Layer III - location types e.g., bar, hospital

9. Events and Traces Events <who, when, where> - Who: identifier - When: time-stamp - Where: location-stamp Trace - Set of events

10. Threat Model

11. Threat Model Adversary is an observer of users’ events LBS Operator Eavesdroppers

12. Adversary Statistical Information Statistical information about users’ actual events. e.g., users’ spatiotemporal distribution and mobility pattern

13. Adversary Knowledge • Real-time location information • A set of events (observed by the adversary) • Statistical information • Users’ population • Users’ mobility pattern • Users’ spatiotemporal distribution • …

14. Tracking Identification ? Bob’s Home Bob’s Workplace AttacksTargeting individuals or communities

15. Consequences Presence Disclosure • Layer I: Finding mobility traces/patterns • Layer II: Disclosing visits to some places • Layer III: Profiling the type of visited locations • Personal activities => My Hobbies/Interests • Professional activities => Where I Work • Social activities => My Social Network

16. Consequences Absence Disclosure

17. Protection

18. Location Privacy Preservation Modifying the set of events before they are observable to the adversary Observation Observable Events Actual Events

19. Location Privacy Preservation Users Applications Privacy Tools Observable Events Actual Events Entities Methods

20. Location Privacy Preservation Users Applications Privacy Tools Hiding Events Observable Events Actual Events Entities Methods

21. Location Privacy Preservation Users Applications Privacy Tools Hiding Events Adding Dummy Events Observable Events Actual Events Entities Methods

22. Location Privacy Preservation Users Applications Privacy Tools Hiding Events Adding Dummy Events Obfuscation Observable Events Actual Events Entities Methods

23. Location Privacy Preservation Users Applications Privacy Tools Hiding Events Adding Dummy Events Obfuscation Observable Events Actual Events Anonymization Entities Methods

24. Measurement

25. Location Privacy Measurement • Notions of location privacy in two different scales: • Microscopic Location Privacy • How far is the adversary’s estimation of a user’s location by having a single event observed from the user? • Macroscopic Location Privacy • How far is the adversary’s estimation of a user’s location by observing a set of events from the users?

26. Microscopic Location Privacy with respect to a single observed event ? who is abc? Alice, Bob, …? where is abc? <ID: abc, Location-stamp: Midtown Center Manhattan, Time-stamp: 1pm>

27. Macroscopic Location Privacy with respect to a set of observed events Alice’s House Bob’s House Eve’s House whom the trajectories belong to? what are the trajectories?

28. Location Privacy Metrics • Uncertainty-based Metrics • K-anonymity, l-diversity, … • Clustering-based Metrics • Distortion-based Metrics

29. Obfuscated Area User’s actual location Hypothesized locations for the user Distortion-based Metric Location Privacy = Distortion in the user’s reconstructed location by the adversary Sumi (pi*di) Darkness: the probability that a user is there. The darker, the more probable.

30. Location Privacy Measurement • Existing schemes only focus on measuring location privacy in 1st layer of the spatial model • What about other layers?

31. Location Privacy Measurement Layer II – Location Sites Diversity matters Distance (to user’s location) matters Suggestion: Distortion-based Metric

32. bar casino bar Location Privacy Measurement Layer III – Location Types bar Suggestion: Uncertainty-based or Distortion-based Metric

33. Conclusion

34. Conclusion • Proposed a unified framework for location privacy • Helps to design, understand and compare location privacy schemes • Embedded existing schemes in our framework