Location Privacy Protection Mechanisms Research Articles

Differential Privacy-Based Spatial-Temporal Trajectory Clustering Scheme for LBSNs

Location privacy preserving for location-based social networks (LBSNs) has been attracting a great deal of attention. Existing location privacy protection methods are disadvantaged by issues such as information leakage and low data availability, which are no longer suitable for the current diverse and personalized location-based services. To address these issues, we propose a differential privacy-based spatial-temporal trajectory clustering (DP-STTC) scheme, which mainly transforms the existing location privacy protection mechanism into a spatial-temporal trajectory protection mechanism by adjusting the privacy parameters. Then, the trajectories were clustered to uncover users with similar trajectory characteristics. Finally, experiments were conducted on two real datasets. The experimental results show that our DP-STTC scheme can not only achieve better accuracy in trajectory clustering, but also protect user privacy.

Privacy-preserving mobile crowd sensing task assignment with Stackelberg game

Mobile Crowd Sensing (MCS) has emerged as an effective method for sensing and collecting large-scale computational data in real time, which is favored by researchers from a wide range of industries. Task assignment is an important research direction in mobile crowd sensing. In the scenario of multiple workers and multiple tasks, it is a key challenge to develop an excellent task assignment scheme to ensure that both the platform and workers can also get high utility while workers’ location privacy is not leaked. In this regard, this paper proposes a task assignment scheme (PCTA-SG) with worker location privacy protection and worker merit-based selection mechanism, which improves platform utility and equilibrates worker utility through worker path planning and Stackelberg game under the constraint of a limited perceived budget. First, the platform publishes the task set and its related information. Next, each candidate worker perturbs its own location locally based on geographical indistinguishability, and uploads the required information to the platform after selecting the tasks. Then a worker priority factor model is established by comprehensively considering the factors such as worker credibility, perceived device power and so on. According to the priority factors of workers, the platform uses a greedy strategy to select high-quality and suitable workers and assign tasks to them, thereby forming an initial solution for task assignment. To enhance the utility of the platform, the initial solution for task assignment is continued as the initial population of the genetic algorithm to optimize the moving distance of workers and generate the final solution for task assignment. Finally, on the basis of the final solution for task assignment, a two-stage Stackelberg game is carried out between the platform and workers to further optimize the utility of the platform and take into account the utility of workers, thus perfecting the task assignment scheme. The experimental evaluation results with other baseline schemes under real-world dataset show that the scheme in this paper achieves the best overall effect. It not only protects the location privacy of workers, but also achieves good worker utility while obtaining the optimal platform utility and platform input–output ratio.

The Impact of Mobility on Location Privacy: A Perspective on Smart Mobility

People use smart transportation systems to move around in smart cities, producing a massive amount of valuable mobility data. Although this characteristic enables the development of many intelligent applications, it can expose users to privacy threats. Location privacy is an issue addressed in many mobility contexts, in which there is a privacy concern. Currently, there are some proposals to tackle this problem, and some questions naturally arise: Are these proposals suitable for a dynamic environment, such as smart mobility? What are the impacts of mobility on privacy? In this article, we answer these questions to explore location privacy in smart mobility considering open and online data, one of the fundamental pillars of smart city platforms. We have evidenced the hypothesis that mobility can impact privacy approaches of anonymization (mix zones) and obfuscation (GEO-I) in the context of smart mobility. For this, we performed experiments to characterize and find similarities in the statistical distributions extracted from two stay points metrics, which operate as substrates to build location privacy protection mechanisms. We use an accuracy metric to quantify the datasets’ distributions that matched each other. We conducted a comprehensive evaluation of seven real datasets of mono or multimodal mobility. The results showed that the stay point count metric reached 100% and 83.3% accuracy for coarse-grained (person and vehicle) and fine-grained (bus, taxi, and person) data. Additionally, we show a similarity between distributions for the same vehicle type for mono and multimodal datasets. Results suggest that privacy has a high dependence on mobility in different granularity levels.

BioMixD: A Bio-Inspired and Traffic-Aware Mix Zone Placement Strategy for Location Privacy on the Internet of Drones

In the next years, drones will be part of our daily lives composing a parallel environment “over our heads,” having a dynamic traffic flow. The Internet of Drones (IoD) defines a robust and reliable distributed mobile network to manage and provide fair navigation and communication to drones. In this envisioned network environment, location privacy will be a paramount requirement to protect aerial and grounded devices. There is a lack of studies that investigate location privacy in the IoD. Our previous work was the first to propose a Location Privacy Protection Mechanism (LPPM) for IoD to the best of our knowledge. However, this mechanism does not consider the dynamics of the IoD traffic flow, hindering its performance. Hence, in this study, we present BioMixD, a bio-inspired and traffic-aware Mix Zone placement strategy for location privacy on the IoD. We integrate this strategy with our previous solution, leveraging an enhanced LPPM named t-MixDrones. We conducted an extensive experimental evaluation, investigating a wide range of IoD scenarios, and compared t-MixDrones with other mechanisms. The results highlighted that t-MixDrones overcomes the mechanisms in all scenarios, providing a better location privacy level, mainly drone coverage, and anonymization rate. Hence, we advance the state-of-the-art of LPPMs for the IoD environment.

A novel privacy protection scheme for location-based services using collaborative caching

Protecting privacy in Location-based services (LBSs) has been one of the major concerns over the last few years. Users’ queries can reveal sensitive information to LBSs, thus giving an opportunity for the adversaries to track the querying user. Existing location privacy protection mechanisms either use a trusted third party (TTP) or a location obfuscation-based scheme. TTP-based schemes require users to report their location-related information to the TTP before sending a query to the location-based service provider (LSP). Once the TTP is compromised, users’ privacy can be breached. On the other hand, location obfuscation schemes achieve privacy at the cost of accuracy. We address these problems by proposing a collaborative caching-based privacy-preserving scheme for LBSs. The scheme prevents the users’ location information leakage from untrusted communication channels as well as LSP while maintaining the quality of service. The scheme uses a novel dummy location generation technique and a virtual identity mechanism to improve users’ location and identity privacy. Furthermore, one-time spatial groups are created with the nearby neighbors to access the localized services, thus providing less interaction with the untrusted LSP. The proposed work has the potential to preserve users’ location privacy and reduce the computation and communication costs of the system. The aforementioned claims are verified by the experimental results.

Smart-Area-Selection Based Location Privacy Enhancement

Protecting location privacy from location-based service (LBS) providers is a challenging problem. Existing mechanisms either use a trusted third party (TTP) or location perturbation techniques. In TTP-based mechanisms, when the security of a TTP is compromised, the user’s privacy is breached. On the other hand, in location perturbation-based mechanisms, privacy is achieved at the expense of query accuracy. To overcome these problems, in this article, a novel smart-area-selection (SAS)-based location privacy protection algorithm is proposed. The proposed approach does not require the user to trust any party including LBS. The proposed efficient mechanism achieves privacy without compromising the accuracy of the query. Furthermore, our SAS-based mechanism uses a user-specific geographical coordinate system and public key encryption for additional security. In the existing location privacy protection mechanisms, when LBSs are accessed continuously, more location information can be extracted by a smart adversary. A specially designed query region spreading algorithm is used in the proposed mechanism to overcome this problem. The validity of the proposed SAS-based location privacy protection mechanism is demonstrated by simulation results.

Intermittent Private Information Retrieval With Application to Location Privacy

We study the problem of intermittent private information retrieval with multiple servers, in which a user consecutively requests one of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$K$ </tex-math></inline-formula> messages from <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$N$ </tex-math></inline-formula> replicated databases such that part of requests need to be protected while others do not need privacy. Motivated by the location privacy application, the correlation between requests is modeled by a Markov chain. We propose an intermittent private information retrieval scheme that concatenates an obfuscation scheme and a private information retrieval scheme for the time period when privacy is not needed, to prevent leakage incurred by the correlation over time. In the end, we illustrate how the proposed scheme for the problem of intermittent private information retrieval with Markov structure correlation can be applied to design a location privacy protection mechanism in the location privacy problem.

LPPS-AGC: Location Privacy Protection Strategy Based on Alt-Geohash Coding in Location-Based Services

The Internet of Things (IoT) connects billions of physical devices around the world to the Internet to collect and share massive data. Location privacy leakage has received considerable attention in the field of security. In order to implement the k -anonymity location privacy protection mechanism, a previous work constructed an anonymous location set by retrieving historical request record database from the trusted third anonymous server, which advantageously protects user’s location privacy. However, the performance of location-based services (LBSs) is weakened by the time overhead of continual retrieving database. Moreover, with the increasingly flourishing of the positioning technique, user location can be accurate to the user’s altitude beyond the two-dimensional latitude and longitude coordinates. In this paper, we present a location privacy protection strategy in LBSs based on Alt-Geohash coding (LPP-AGC) method synthetically considering the altitude of user location and time overhead. Specifically, we give the Alt-Geohash coding algorithm (AGCA) to retrieve the historical request record database, which greatly reduces the time overhead and ensures the immediacy of LBSs. In addition, we propose the dummy location generating algorithm (DLGA) and location filtering algorithm (LFA) to provide users with autonomous k -anonymity location privacy protection. Extensive simulations are performed to verify the performance and security of the proposed strategy.

EDEN

Crowd sensing applications have demonstrated their usefulness in many real-life scenarios (e.g., air quality monitoring, traffic and noise monitoring). Preserving the privacy of crowd sensing app users is becoming increasingly important as the collected geo-located data may reveal sensitive information about these users (e.g., home, work places, political, religious, sexual preferences). In this context, a large variety of Location Privacy Protection Mechanisms (LPPMs) have been proposed. However, each LPPM comes with a given set of configuration parameters. The value of these parameters impacts not only the privacy level but also the utility of the resulting data. Choosing the right LPPM and the right configuration for reaching a satisfactory privacy vs. utility tradeoff is generally a difficult problem mobile app developers have to face. Solving this problem is commonly done by relying on a trusted proxy server to which raw geo-located traces are sent and privacy vs. utility assessment is performed enabling the selection of the best LPPM for each trace. In this paper we present EDEN, the first solution that selects automatically the best LPPM and its corresponding configuration without sending raw geo-located traces outside the user's device. We reach this objective by relying on a federated learning approach. The evaluation of EDEN on five real-world mobility datasets shows that EDEN outperforms state-of-the-art LPPMs reaching a better privacy vs. utility tradeoff.

Quantifying Location Privacy Risks Under Heterogeneous Correlations

Currently, increasingly ubiquitous location-based services are facilitating the activities of people in daily life. However, releasing real locations could lead to serious concerns about privacy. To remedy these issues, a number of location privacy protection mechanisms (LPPMs) have been proposed, e.g., spatial cloaking, dummy location generation, query caching, and perturbation. However, these LPPMs are vulnerable to inference attacks because of the incompleteness of the captured privacy risks caused by heterogeneous correlations in location data, e.g., semantical, temporal, and social correlations. Consequently, they cannot provide sufficient privacy guarantees due to the absence of embedded heterogeneous correlations in the design process of LPPM. To address these issues, we present QUAD, a framework for quantifying location privacy risks under heterogeneous correlations. QUAD has three features: 1) it enables the modeling and seamless fusion of multiple kinds of correlations that are available to adversaries; 2) it provides a probabilistic representation of the privacy risks faced under heterogeneous correlations; and 3) it achieves the quantification of privacy risks for multiple kinds of LPPMs that are widely used in the literature. To mitigate privacy threats, we propose a defense mechanism embedded with the quantified privacy risks. Extensive experiments on two real-world datasets confirm that QUAD can capture more privacy risks than competitors, and the risks can be dramatically reduced by our defense mechanism.

Semantic and Trade-Off Aware Location Privacy Protection in Road Networks Via Improved Multi-Objective Particle Swarm Optimization

Location privacy protection is an essential but challenging topic in the field of network security. Although the existing research methods, such as k-anonymity, mix zone, and differential privacy, show significant success, they usually neglect the location semantic and the proper trade-off between privacy and utility, which may allow attackers to obtain user privacy information by revealing the semantic correlation between the anonymous region and user's real location, thus causing privacy leakage. To solve this problem, we propose a location privacy protection scheme based on the k-anonymity technique, which provides practical location privacy-preserving through generating an anonymous set. This paper proposes a new location privacy attack strategy termed semantic relativity attack (SRA), which considers the location semantic problem. Correspondingly, a semantic and trade-off aware location privacy protection mechanism (STA-LPPM) is presented to achieve privacy protection with both high-level privacy and utility. To be specific, we model the location privacy protection as a multi-objective optimization problem and propose the Improved Multi-Objective Particle Swarm Optimization (IMOPSO) to generate the optimal anonymous set calculating the well-design fitness functions of the multi-objective optimization problem. In this way, the privacy scheme can provide mobile users with the right balance of privacy protection and service quality. Experiments reveal that our privacy scheme can effectively resist the semantic relativity attack while preventing significant utility degrading.

Deloc: a delegation-based privacy-preserving mechanism for location-based services

Location-based services (LBSs) are everywhere; we found them in several fields such as healthcare, entertainment, transportation, and many other daily activities. Besides, along with their presence in almost every daily task, their usefulness cannot be ignored. Moreover, with smartphone ownership growth, getting one's location became easier, and the privacy-related issues became almost inescapable. Hence, more severe solutions are strongly required to handle privacy issues and to keep LBS utility. We present in this paper Deloc, a novel location privacy protection mechanism founded on the idea of preserving location privacy without altering geographical coordinates. We introduce a new set of concepts and definitions that allow us to meet high privacy guarantees and data accuracy by delegating one's request to other LBS users. Similarly, we investigate the privacy issues related to LBSs along with state-of-art protection approaches and techniques. We evaluate Deloc on both synthetic and real-world data in a finely simulated environment with tunable parameters, and demonstrate its efficiency and usefulness in today's LBS applications, along with its higher privacy guarantees in respect to differential privacy standards.

Research on Location Privacy Protection Mechanism Based on No-Trusted User Cooperation

With the development of Internet and wireless location technology, location-based service makes people’s life more convenient, and the threat to user privacy is growing. After analyzing the advantages and disadvantages of the existing location privacy protection models, this paper proposes a new MHT model based on untrusted users. Through the multi hop transmission of the request information, the user’s location information can be rid of the correlation with the user, and the query request can be desensitized. It can provide precise location service and resist the collusion attack and reasoning attack, which effectively protects the user Location privacy.

Deloc: Delegation-Based Privacy-Preserving Mechanism for Location-Based Services

Location-based services (LBSs) are everywhere; we found them in several fields such as healthcare, entertainment, transportation, and many other daily activities. Besides, along with their presence in almost every daily task, their usefulness cannot be ignored. Moreover, with smartphone ownership growth, getting one's location became easier, and the privacy-related issues became almost inescapable. Hence, more severe solutions are strongly required to handle privacy issues and to keep LBS utility. We present in this paper Deloc, a novel location privacy protection mechanism founded on the idea of preserving location privacy without altering geographical coordinates. We introduce a new set of concepts and definitions that allow us to meet high privacy guarantees and data accuracy by delegating one's request to other LBS users. Similarly, we investigate the privacy issues related to LBSs along with state-of-art protection approaches and techniques. We evaluate Deloc on both synthetic and real-world data in a finely simulated environment with tunable parameters, and demonstrate its efficiency and usefulness in today's LBS applications, along with its higher privacy guarantees in respect to differential privacy standards.

User location privacy protection mechanism for location-based services

With the rapid development of the Internet of Things (IoT), Location-Based Services (LBS) are becoming more and more popular. However, for the users being served, how to protect their location privacy has become a growing concern. This has led to great difficulty in establishing trust between the users and the service providers, hindering the development of LBS for more comprehensive functions. In this paper, we first establish a strong identity verification mechanism to ensure the authentication security of the system and then design a new location privacy protection mechanism based on the privacy proximity test problem. This mechanism not only guarantees the confidentiality of the user’s information during the subsequent information interaction and dynamic data transmission, but also meets the service provider’s requirements for related data.

Aggregation-based location privacy: An information theoretic approach

We explore the problem of quantifying and protecting aggregation-based location privacy and study the privacy-utility tradeoff, which are essential to protect user’s location privacy when releasing aggregate statistics. Existing works on Aggregation-based Location Privacy Protection Mechanisms (ALPPMs) are mainly based on differential privacy, and metrics for evaluating information leakage introduced by releasing aggregates are normally built on adversary’s estimation error. However, there lacks privacy metrics for measuring the fundamental leakage on individual user’s data that is independent of specific data instances or attack algorithms. In this paper, we aim to solve this problem using an information-theoretic approach. We first propose a privacy metric based on the mutual information between the individual user’s location profile and the released location aggregates, and formulate the optimal location aggregate release problem that minimizes the mutual information given a utility constraint for each user. Since solving this optimization problem causes exponential complexity, we turn to prove and evaluate an upper bound, i.e., the mutual information between the original and the perturbed location aggregates, and propose a Blahut-Arimoto based algorithm to solve the optimization problem minimizing the mutual information to derive an ALPPM. We validate the actual leakage of our ALPPM and compare it to a differentially private mechanism through experiments over both synthetic and real-world location datasets. Results show the advantage of the proposed ALPPM in terms of privacy-utility tradeoff, which is enhanced when users’ location prior distributions are more skewed.

Automatic Privacy and Utility Preservation for Mobility Data: A Nonlinear Model-Based Approach

The widespread use of mobile devices and location-based services has generated a large number of mobility databases. While processing these data is highly valuable, privacy issues can occur if personal information is revealed. The prior art has investigated ways to protect mobility data by providing a wide range of Location Privacy Protection Mechanisms (LPPMs). However, the privacy level of the protected data significantly varies depending on the protection mechanism used, its configuration and on the characteristics of the mobility data. Meanwhile, the protected data still needs to enable some useful processing. To tackle these issues, we present PULP, a framework that finds the suitable protection mechanism and automatically configures it for each user in order to achieve user-defined objectives in terms of both privacy and utility. PULP uses nonlinear models to capture the impact of each LPPM on data privacy and utility levels. Evaluation of our framework is carried out with two protection mechanisms from the literature and four real-world mobility datasets. Results show the efficiency of PULP, its robustness and adaptability. Comparisons between LPPMs’ configurators and the state of the art further illustrate that PULP better realizes users’ objectives, and its computation time is in orders of magnitude faster.

Location Privacy Protection in Vehicle-Based Spatial Crowdsourcing via Geo-Indistinguishability

Nowadays, vehicles have been increasingly adopted in many spatial crowdsourcing (SC) applications. Similar to other SC applications, location privacy is of great concern to vehicle workers as they are required to disclose their own location to servers to facilitate the service utilities. Traditional location privacy protection mechanisms cannot be applied to vehicle-based SC since they assume workers’ mobility on a 2-dimensional plane without considering the network-constrained mobility features of vehicles. Accordingly, in this paper, we aim at addressing issues related to Vehicle-based spatial crowdsourcing Location Privacy (VLP) over road networks. Our objective is to design a location obfuscation strategy to minimize the quality loss due to obfuscation with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">geo-indistinguishability</i> satisfied. Considering the computational complexity of VLP, by resorting to discretization, we first approximate VLP to a linear programming problem that can be solved by well-developed approaches. To further improve the time-efficiency, we conduct constraint reduction for VLP by exploiting key features of geo-indistinguishability in road networks and problem decomposition based on VLP’s constraint structure. Finally, we carry out both trace-driven simulation and real-world experiments, where our experimental results demonstrate the superiority of our approach over a known state-of-the-art location obfuscation strategy in terms of both quality-of-service and privacy.

A Survey of System Architectures, Privacy Preservation, and Main Research Challenges on Location-Based Services

Location-based services (LBSs) have become popular in recent years due to the ever-increasing usage of smart mobile devices and mobile applications through networks. Although LBS application provides great benefits to mobile users, it also raises a sever privacy concern of users due to the untrusted service providers. In the lack of privacy enhancing mechanisms, most applications of the LBS may discourage the user’s acceptance of location services in general, and endanger the user’s privacy in particular. Therefore, it is a great interest to discuss on the recent privacy-preserving mechanisms in LBSs. Many existing location-privacy protection-mechanisms (LPPMs) make great efforts to increase the attacker’s uncertainty on the user’s actual whereabouts by generating a multiple of fake-locations together with user’s actual positions. In this survey, we present a study and analysis of existing LPPMs and the state-of-art privacy measures in service quality aware LBS applications. We first study the general architecture of privacy qualification system for LBSs by surveying the existing framework and outlining its main feature components. We then give an overview of the basic privacy requirements to be considered in the design and evaluation of LPPMs. Furthermore, we discuss the classification and countermeasure solutions of existing LPPMs for mitigating the current LBS privacy protection challenges. These classifications include anonymization, obfuscation, and an encryption-based technique, as well as the combination of them is called a hybrid mechanism. Finally, we discuss several open issues and research challenges based on the latest progresses for on-going LBS and location privacy research.

A Survey on Recent Advances in Vehicular Network Security, Trust, and Privacy

Vehicular ad hoc networks (VANETs) are becoming the most promising research topic in intelligent transportation systems, because they provide information to deliver comfort and safety to both drivers and passengers. However, unique characteristics of VANETs make security, privacy, and trust management challenging issues in VANETs’ design. This survey article starts with the necessary background of VANETs, followed by a brief treatment of main security services, which have been well studied in other fields. We then focus on an in-depth review of anonymous authentication schemes implemented by five pseudonymity mechanisms. Because of the predictable dynamics of vehicles, anonymity is necessary but not sufficient to thwart tracking an attack that aims at the drivers’ location profiles. Thus, several location privacy protection mechanisms based on pseudonymity are elaborated to further protect the vehicles’ privacy and guarantee the quality of location-based services simultaneously. We also give a comprehensive analysis on various trust management models in VANETs. Finally, considering that current and near-future applications in VANETs are evaluated by simulation, we give a much-needed update on the latest mobility and network simulators as well as the integrated simulation platforms. In sum, this paper is carefully positioned to avoid overlap with existing surveys by filling the gaps and reporting the latest advances in VANETs while keeping it self-explained.