Protecting Location Privacy by Multiquery: A Dynamic Bayesian Game Theoretic Approach

Abstract

When using location-based services (LBSs), a user obtains points-of-interest (PoI) information by providing the LBS platform with his current geo-location. Such a search leads to potential privacy leakage if an adversary has access to his geo-data. Traditional <i>k</i>-anonymity mechanisms instruct a user to bear the overhead to report his current location together with <i>k</i> - 1 dummy locations to confuse the adversary, which only work well given a large number <i>k</i>. Aware of the common practices that a user is actually flexible in service requirement (e.g., as long as the searched PoIs are within his walking distance), we propose a novel approach to help the user gain location privacy from service flexibility for the challenging case of a small number <i>k</i>. By analyzing the strategic interaction between the user and the adversary in a dynamic Bayesian game, we prove that the user&#x2019;s equilibrium strategy depends on the adversary&#x2019;s capability of accessing geo-data. Take <i>k</i> = 2 for example, we find that if the adversary is not likely to access both geo-data, the user should report the two dummy locations at two different directions of his real location, and otherwise at the same direction. Perhaps surprisingly, the user may benefit from the adversary&#x2019;s access to more geo-data. Furthermore, we extend the game-theoretic approach for multi-query and arbitrary user location distributions. Numerical results show that our approach obviously outperforms <i>k</i>-anonymity mechanisms especially under a small number <i>k</i>.