A Predictive Differentially-Private Mechanism for Mobility Traces

Chatzikokolakis, Konstantinos; Palamidessi, Catuscia; Stronati, Marco

doi:10.1007/978-3-319-08506-7_2

Cited by 78 publications

(62 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, this solution is not optimal and can be outperformed by [22] when the adversary has prior knowledge. In Section 5, we show that our algorithm compares favorably against that of Shokri et al when protecting trajectory privacy, hence we can conclude that our algorithm also offers better protection than that of Andrés et al The solution in [6] deals with mobility traces, but is non optimal.…”

Section: Related Workmentioning

confidence: 72%

See 1 more Smart Citation

Prolonging the Hide-and-Seek Game

Theodorakopoulos

Shokri

Troncoso

et al. 2014

Proceedings of the 13th Workshop on Privacy in the Electronic Society

View full text Add to dashboard Cite

Human mobility is highly predictable. Individuals tend to only visit a few locations with high frequency, and to move among them in a certain sequence reflecting their habits and daily routine. This predictability has to be taken into account in the design of location privacy preserving mechanisms (LPPMs) in order to effectively protect users when they expose their whereabouts to location-based services (LBSs) continuously. In this paper, we describe a method for creating LPPMs tailored to a user's mobility profile taking into her account privacy and quality of service requirements. By construction, our LPPMs take into account the sequential correlation across the user's exposed locations, providing the maximum possible trajectory privacy, i.e., privacy for the user's past, present location, and expected future locations. Moreover, our LPPMs are optimal against a strategic adversary, i.e., an attacker that implements the strongest inference attack knowing both the LPPM operation and the user's mobility profile. The optimality of the LPPMs in the context of trajectory privacy is a novel contribution, and it is achieved by formulating the LPPM design problem as a Bayesian Stackelberg game between the user and the adversary. An additional benefit of our formal approach is that the design parameters of the LPPM are chosen by the optimization algorithm.

show abstract

Section: Related Workmentioning

confidence: 72%

“…Other formal approaches to the location privacy problem extend the concept of differential privacy to location privacy, defining a new privacy metric: geo-indistinguishability [2,5,6,20]. The solutions in [2,5,20] focus on sporadic locations and are not applied on trajectory privacy.…”

Section: Related Workmentioning

confidence: 99%

Prolonging the Hide-and-Seek Game

Theodorakopoulos

Shokri

Troncoso

et al. 2014

Proceedings of the 13th Workshop on Privacy in the Electronic Society

View full text Add to dashboard Cite

show abstract

“…Unfortunately, the Gowalla dataset is not ideal for such an evaluation since it contains only 5216 users in the training set for the SF area. As a consequence, we perform two evaluations, one with N = 5000, which is relatively small for averag-3 Note that the maximum metric is a natural choice for location traces [6,44], although we here use it for single locations.…”

Section: Using a Differentially Private Priormentioning

confidence: 99%

Efficient Utility Improvement for Location Privacy

Chatzikokolakis

ElSalamouny

Palamidessi

2017

Proceedings on Privacy Enhancing Technologies

Self Cite

View full text Add to dashboard Cite

Abstract:The continuously increasing use of locationbased services poses an important threat to the privacy of users. A natural defense is to employ an obfuscation mechanism, such as those providing geoindistinguishability, a framework for obtaining formal privacy guarantees that has become popular in recent years. Ideally, one would like to employ an optimal obfuscation mechanism, providing the best utility among those satisfying the required privacy level. In theory optimal mechanisms can be constructed via linear programming. In practice, however, this is only feasible for a radically small number of locations. As a consequence, all known applications of geo-indistinguishability simply use noise drawn from a planar Laplace distribution. In this work, we study methods for substantially improving the utility of location obfuscation, while maintaining practical applicability as a main goal. We provide such solutions for both infinite (continuous or discrete) as well as large but finite domains of locations, using a Bayesian remapping procedure as a key ingredient. We evaluate our techniques in two real world complete datasets, without any restriction on the evaluation area, and show important utility improvements with respect to the standard planar Laplace approach.

show abstract

“…In the geo-indistinguishability framework [15], [16] (i.e., the application of differential privacy to geo-location), each observation has a privacy cost that depends on the level of noise added by the mechanism used (typically drawn from a planar Laplace distribution). For instance, in order to guarantee ε-differential privacy, one must introduce noise with an amplitude such that the expected distance between the actual location and the reported location is proportional to 1/ε.…”

Section: Differential-privacy Perspectivementioning

confidence: 99%

Quantifying Interdependent Privacy Risks with Location Data

Olteanu

Huguenin

Shokri

et al. 2017

IEEE Trans. on Mobile Comput.

View full text Add to dashboard Cite

Abstract-Co-location information about users is increasingly available online. For instance, mobile users more and more frequently report their co-locations with other users in the messages and in the pictures they post on social networking websites by tagging the names of the friends they are with. The users' IP addresses also constitute a source of co-location information. Combined with (possibly obfuscated) location information, such co-locations can be used to improve the inference of the users' locations, thus further threatening their location privacy: As co-location information is taken into account, not only a user's reported locations and mobility patterns can be used to localize her, but also those of her friends (and the friends of their friends and so on). In this paper, we study this problem by quantifying the effect of co-location information on location privacy, considering an adversary such as a social network operator that has access to such information. We formalize the problem and derive an optimal inference algorithm that incorporates such co-location information, yet at the cost of high complexity. We propose some approximate inference algorithms, including a solution that relies on the belief propagation algorithm executed on a general Bayesian network model, and we extensively evaluate their performance. Our experimental results show that, even in the case where the adversary considers co-locations of the targeted user with a single friend, the median location privacy of the user is decreased by up to 62% in a typical setting. We also study the effect of the different parameters (e.g., the settings of the location-privacy protection mechanisms) in different scenarios.

show abstract

A Predictive Differentially-Private Mechanism for Mobility Traces

Cited by 78 publications

References 27 publications

Prolonging the Hide-and-Seek Game

Prolonging the Hide-and-Seek Game

Efficient Utility Improvement for Location Privacy

Quantifying Interdependent Privacy Risks with Location Data

Contact Info

Product

Resources

About