Impact of Frequency of Location Reports on the Privacy Level of Geo-indistinguishability

Abstract

Location privacy has became an emerging topic due to the pervasiveness of Location-Based Services (LBSs). When sharing location, a certain degree of privacy can be achieved through the use of Location Privacy-Preserving Mechanisms (LPPMs), in where an obfuscated version of the exact user location is reported instead. However, even obfuscated location reports disclose information which poses a risk to privacy. Based on the formal notion of differential privacy, Geo-indistinguishability has been proposed to design LPPMs that limit the amount of information that is disclosed to a potential adversary observing the reports. While promising, this notion considers reports to be independent from each other, thus discarding the potential threat that arises from exploring the correlation between reports. This assumption might hold for the sporadic release of data, however, there is still no formal nor quantitative boundary between sporadic and continuous reports and thus we argue that the consideration of independence is valid depending on the frequency of reports made by the user. This work intends to fill this research gap through a quantitative evaluation of the impact on the privacy level of Geo-indistinguishability under different frequency of reports. Towards this end, state-of-the-art localization attacks and a tracking attack are implemented against a Geo-indistinguishable LPPM under several values of privacy budget and the privacy level is measured along different frequencies of updates using real mobility data.

A Privacy-Aware Remapping Mechanism for Location Data

“…The dataset contains data from 182 users, 17,621 trajectories and roughly 25 million reports. Following [15], we first limited the distribution of reports to a bounding box over 5 th ring road of Beijing, China. It is defined from South and North by the latitudes 39.753, 40.026, and from West and East by longitudes 116.199, 116.547, still leaving us with approximately 16 million reports.…”

“…As constant spacing of the cell's grid, we fixed the value of 100 meters [3,28], which we found to provide a reasonably high level of resolution for most practical purposes. For values of the privacy budget 𝜖, we used multiple values in the typical ranges of privacy-preserving mechanisms for continuous reports [1,5,15], specifically 𝜖 = [4, 8, 16, 32] km −1 . For the PL, this corresponds to an average obfuscation of [500, 250, 125, 62.5] m, respectively.…”

Constructing dummy query sequences to protect location privacy and query privacy in location-based services

“…The location perturbation refers to intentionally adding some errors (or noises) into each query in a controllable fashion [7]. In order to provide a better privacy guarantee, in recent studies, the differential privacy model is used to control the quantity of errors being added into continuous queries, where the geoindistinguishability model [21] and its derivative models [22,23] are the most representative.…”

Towards a Modular On-Premise Approach for Data Sharing

“…Differential privacy [ 27 ] can also be used for data protection. The methods of differential privacy involve adding noise to the data or using generalization methods to obscure certain sensitive attributes until the third party cannot distinguish the individual (an example of this is shown by Ricardo Mendes et al [ 28 ]). However, the methods still require data to be transmitted from the device to an unknown external server, which often involves a trade-off between accuracy and privacy.…”