NRand‐K: Minimizing the impact of location obfuscation in spatial analysis

Abstract

Location privacy, or geoprivacy, is critical to secure users’ privacy in context‐aware applications. Location‐based services pose privacy risks for users, due to the inferences that could be made about them from their location information and the potential misuse of this data by service providers or third‐party companies. A common solution is to apply masking or location obfuscation, which degrades location information quality while keeping a geographic coordinate structure. However, there is a trade‐off between privacy, quality of service, and quality of information, the last one being a valuable asset for companies. NRand is a location privacy mechanism with obfuscation capabilities and resistance against filtering attacks. In order to minimize the impact on location information quality, NRand‐K has been introduced. This algorithm is designed for use when releasing location information to third parties or as open data with privacy concerns. To assess the impact of location obfuscation on exploratory spatial data analysis (ESDA), a comparison is performed between obfuscated data with NRand, NRand‐K, and unaltered data. For the experiments, geolocated tweets collected during the Central Italy 2016 earthquake are used. Results show that NRand‐K reduces the impact on ESDA, where inferences were similar to those obtained with the unaltered data.

Intelligent pseudo‐location recommendation for protecting personal location privacy

“…There are two typical random-based generators; they are also most related to the proposed IPLR method. One is the NRand algorithm, 14,15 which generates N (eg, N = 4) uniformly distributed random points within a circular neighborhood of the real location and selects the farthest one to be the pseudo-location. NRand has a high risk of invert attack by statistical analysis since choosing the farthest location to avoid proximity to the real location reduces the attack search range and thus increases the risk of location privacy leakage.…”

“…Note that we simulate the real‐world residential or city areas using grids; each guess (black dot) of the attacker is mapped to grid lines (eg, streets). A, NRand distribution; B, (Uniform) random distribution…”

“…The technical contribution of this paper is threefold: ‐We provide a novel IPLR method to generate a pseudo‐location for a real location. It does not require a centralized obfuscator and is open to anonymous users without registration. ‐We simulate continuous querying attacks to demonstrate the effectiveness of the IPLR method by comparing it with two counterpart methods (NRand and the random method) in terms of three levels of semantic location privacy (ie, address, street, and district) according to real‐life requirements. Few previous researchers have studied different levels of location privacy and evaluated their risks. ‐We study the scalability of the IPLR method relative to service quality and demonstrate that the lower the service quality (the greater distance between the pseudo‐location and the real location) tolerated by the user, the lower the risk of location privacy leakage. …”

“…There are two typical approaches to generate inaccurate points as pseudo-locations that are most related to this paper. One is the NRand algorithm, 14,15 which generates N (for example N = 4) uniformly distributed random points within a circular neighborhood of the real location and select the farthest one as the pseudo-location. Unfortunately, continuous query using pseudo-location can disclose the probability distribution of the user's position, denoted by a large number of black dots as shown in Figure 1A, and thus, it is easy for the adversary to infer the user's real exact position in the obfuscated area.…”

“…-We simulate continuous querying attacks to demonstrate the effectiveness of the IPLR method by comparing it with two counterpart methods (NRand 15 and the random method) in terms of three levels of semantic location privacy (ie, address, street, and district) according to real-life requirements. Few previous researchers have studied different levels of location privacy and evaluated their risks.…”