Geo-Graph-Indistinguishability: Protecting Location Privacy for LBS over Road Networks

Takagi, Shun; Cao, Yang; Asano, Yasuhito; Yoshikawa, Masatoshi

doi:10.1007/978-3-030-22479-0_8

Cited by 28 publications

(20 citation statements)

References 33 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Andrés et al [1] defined Geo-Indistinguishability (Geo-I) as location privacy on the Euclidean plane based on differential privacy [2]. Our recent work [4] pointed out insufficiencies of Geo-I for LBSs such as UBER, which are caused by road networks which are public information. Then, we proposed a rigorous privacy definition for location privacy on a road network modeled by a graph, Geo-Graph-Indistinguishability (GG-I) to solve this issue.…”

Section: Several Methods For Protecting Location Information Have Beenmentioning

confidence: 99%

See 1 more Smart Citation

POSTER: Protecting Location Privacy on Road Networks

Takagi

Cao

Asano

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

Our recent proposed notion Geo-Graph-Indistinguishability (GG-I) is a theoretically rigorous location privacy notion which extends differential privacy to the setting of location privacy on a road network modeled by a graph. GG-I is practically more useful for protecting location privacy in location-based services (LBSs) such as UBER than a previously proposed Geo-Indistinguishability (Geo-I), which is a popular notion of location privacy defined on the Euclidean plane. We also proposed a Graph-Exponential Mechanism (GEM) based on GG-I. In this paper, we analyze the utility and privacy of GEM. This analysis makes following two contributions to build a user-friendly location perturbation system. First, our proposed system makes a privacy parameter easy to interpret. The privacy parameter of GEM is not interpretable for ordinary people. By converting to the interpretable value, a user can choose his/her preferred privacy level and utility. Second, we formalize an optimization problem to find the optimal range of GEM according to an arbitrary LBS w.r.t the utility-privacy trade-off for a certain user. Experimental results with real-world data show that our optimization improves the utility-privacy trade-off.

show abstract

Section: Several Methods For Protecting Location Information Have Beenmentioning

confidence: 99%

“…Here, we review the definition of GG-I and a mechanism satisfying GG-I, GEM [4]. We modeled a road network as an undirected graph = ( , ).…”

Section: Introductionmentioning

confidence: 99%

POSTER: Protecting Location Privacy on Road Networks

Takagi

Cao

Asano

et al. 2020

Proceedings of the 15th ACM Asia Conference on Computer and Communications Security

Self Cite

View full text Add to dashboard Cite

show abstract

“…This verifies the tradeoff between runtime and utility that can be achieved by the conservative release. [24] generally use some obfuscation methods, like spatial cloaking, cell merging, location precision reduction or dummy cells, to manipulate the probability distribution of users' locations. As differential privacy becomes a standard for privacy protection, [8] proposed a Geo-indistinguishability notion based on differential privacy and a planar Laplace mechanism to achieve it.…”

Section: Runtimementioning

confidence: 99%

Protecting Spatiotemporal Event Privacy in Continuous Location-Based Services

Cao

Xiao

Xiong

et al. 2021

IEEE Trans. Knowl. Data Eng.

Self Cite

View full text Add to dashboard Cite

Location privacy-preserving mechanisms (LPPMs) have been extensively studied for protecting users' location privacy by releasing a perturbed location to third parties such as location-based service providers. However, when a user's perturbed locations are released continuously, existing LPPMs may not protect the sensitive information about the user's spatiotemporal activities, such as "visited hospital in the last week" or "regularly commuting between Address 1 and Address 2" (it is easy to infer that Addresses 1 and 2 may be home and office), which we call it spatiotemporal event. In this paper, we first formally define spatiotemporal event as Boolean expressions between location and time predicates, and then we define -spatiotemporal event privacy by extending the notion of differential privacy. Second, to understand how much spatiotemporal event privacy that existing LPPMs can provide, we design computationally efficient algorithms to quantify the privacy leakage of state-of-the-art LPPMs when an adversary has prior knowledge of the user's initial probability over possible locations. It turns out that the existing LPPMs cannot adequately protect spatiotemporal event privacy. Third, we propose a framework, PriSTE, to transform an existing LPPM into one protecting spatiotemporal event privacy against adversaries with any prior knowledge. Our experiments on real-life and synthetic data verified that the proposed method is effective and efficient.

show abstract

“…However, there are still chances for GeoI to perturb locations to unreasonable points. Takagi defines an improvement notion of GeoI over road networks, which is called Geo‐Graph‐Indistinguishability [7]. This mechanism effectively avoids the problem of perturbing to unreasonable locations and shows empirical privacy and utility, but it is merely applicable to road networks.…”

Section: Related Workmentioning

confidence: 99%

Blockchain‐based indoor location paging and answering service with truncated‐geo‐indistinguishability

Yang

Liu

et al. 2021

IET Blockchain

View full text Add to dashboard Cite

Indoor location-based services have numerous applications built on indoor navigation. Over the years, researchers have proposed various indoor navigation methods to find a certain point of interest. This paper proposes location paging and answering service (LPAS) for finding out someone in an indoor environment . However, it may face serious problems of privacy disclosure of the clients' indoor location data . To ensure security, privacy and convenience, the authors leverage blockchain to model the indoor environment, and build blockchain-based indoor LPAS (BILPAS) on blockchain by embedding our three-way-handshake Diffie-Hellman Key Agreement procedures. Our BIL-PAS can automatically establish a secure and privacy communication tunnel between any two users, thus greatly liberating participants from unnecessary self-determining interactions . On the premise that the certain person can also be found, the authors introduce Truncated-Geo-Indistinguishability (TGeoI) to perturb the actual location within a limited, valid, user-defined distance, thereby allowing users to obtain reasonable location privacy. The authors have put a strong emphasis in the formal treatment of the reasonable privacy guarantees, giving a rigorous definition of TGeoI and providing a comparison with Geo-Indistinguishability that the authors' method satisfies such property. Then, the authors present the BILPAS prototype and implement it on Hyperledger Fabric. Finally, the authors conduct the security and privacy analysis and evaluate the time performance. The experiment results validate the reasonable privacy, high security and convenience of the authors' framework.

show abstract

Geo-Graph-Indistinguishability: Protecting Location Privacy for LBS over Road Networks

Cited by 28 publications

References 33 publications

POSTER: Protecting Location Privacy on Road Networks

POSTER: Protecting Location Privacy on Road Networks

Protecting Spatiotemporal Event Privacy in Continuous Location-Based Services

Blockchain‐based indoor location paging and answering service with truncated‐geo‐indistinguishability

Contact Info

Product

Resources

About