Protecting Locations with Differential Privacy under Temporal Correlations

Abstract

Concerns on location privacy frequently arise with the rapid development of GPS enabled devices and location-based applications. While spatial transformation techniques such as location perturbation or generalization have been studied extensively, most techniques rely on syntactic privacy models without rigorous privacy guarantee. Many of them only consider static scenarios or perturb the location at single timestamps without considering temporal correlations of a moving user's locations, and hence are vulnerable to various inference attacks. While differential privacy has been accepted as a standard for privacy protection, applying differential privacy in location based applications presents new challenges, as the protection needs to be enforced on the fly for a single user and needs to incorporate temporal correlations between a user's locations.In this paper, we propose a systematic solution to preserve location privacy with rigorous privacy guarantee. First, we propose a new definition, "δ-location set" based differential privacy, to account for the temporal correlations in location data. Second, we show that the well known 1-norm sensitivity fails to capture the geometric sensitivity in multidimensional space and propose a new notion, sensitivity hull, based on which the error of differential privacy is bounded. Third, to obtain the optimal utility we present a planar isotropic mechanism (PIM) for location perturbation, which is the first mechanism achieving the lower bound of differential privacy. Experiments on real-world datasets also demonstrate that PIM significantly outperforms baseline approaches in data utility.

An Edge Correlation Based Differentially Private Network Data Release Method

“…Liu et al [25] inferred the dependence coefficient, distributed in interval [0, 1], to evaluate the probabilistic correlation between two tuples in a more fine-grained manner, thus reducing the query sensitivity which results in less noise. Considering temporal correlations of a moving user's locations, the work in [26] leveraged a hidden Markov model to establish a location set and proposed a variant of DP to protect location privacy. Wu et al [27] proposed the definition of correlated differential privacy to evaluate the real privacy level of a single dataset influenced by the other datasets when multiple datasets are correlated.…”

Efficient Utility Improvement for Location Privacy

“…Indeed, probably thanks to its efficiency, geoindistinguishability via the Laplacian mechanism has been adopted as the basis or as a component of several tools and frameworks for location privacy, including: Location Guard [10], LP-Guardian [11], LP-Doctor [12], the system for secure nearby-friends discovery in [13], SpatialVision QGIS plugin [14], and it is one of the possible input methods in STAC [15]. Furthermore, the PIM mechanism [16] can be considered an extension of the planar Laplacian to the case of traces (temporally correlated sequences of points): The authors of [16] attack the problem of the degradation of privacy due to correlation by adding Laplacian noise directly to the convex hull of the trace.…”

A Context‐Aware Location Differential Perturbation Scheme for Privacy‐Aware Users in Mobile Environment

“…Once the adversary has no such side information, the expected distance error is not sufficient for quantifying location privacy. As a result, differential privacy [6,26] that abstract from the adversary's side information has been growing popularity in LBS privacy protection, which measures the ability of the adversary with arbitrary background knowledge to obtain the user's real location. However, as noted in [27], this metric can be problematic if prior is taken into account.…”

“…Expected distance error based schemes [4,9] obfuscate user's location by taking the adversary's side information into account, which also suffer from background knowledge attacks. Differential privacy based schemes [6,26] have gained popularity as they abstract from the adversary's side information and are capable of providing strong worst-case privacy guarantees. However, these approaches do not take the contextual information of the user's location and are not sufficient to protect users from reidentification [34].…”