Attack-Resilient Mix-zones over Road Networks: Architecture and Algorithms

Abstract

Abstract-Continuous exposure of location information, even with spatially cloaked resolution, may lead to breaches of location privacy due to statistics-based inference attacks. An alternative and complementary approach to spatial cloaking based location anonymization is to break the continuity of location exposure by introducing techniques, such as mix-zones, where no application can trace user movements. Several factors impact on the effectiveness of mix-zone approach, such as user population, mix-zone geometry, location sensing rate and spatial resolution, as well as spatial and temporal constraints on user movement patterns. However, most of the existing mix-zone proposals fail to provide effective mix-zone construction and placement algorithms that are resilient to timing and transition attacks. This paper presents MobiMix, a road network based mix-zone framework to protect location privacy of mobile users traveling on road networks. It makes three original contributions. First, we provide the formal analysis on the vulnerabilities of directly applying theoretical rectangle mix-zones to road networks in terms of anonymization effectiveness and resilience to timing and transition attacks. Second, we develop a suite of road network mix-zone construction methods that effectively consider the above mentioned factors to provide higher level of resilience to timing and transition attacks, and yield a specified lower-bound on the level of anonymity. Third, we present a set of mix-zone placement algorithms that identify the best set of road intersections for mix-zone placement considering the road network topology, user mobility patterns and road characteristics. We evaluate the MobiMix approach through extensive experiments conducted on traces produced by GTMobiSim on different scales of geographic maps. Our experiments show that MobiMix offers high level of anonymity and high level of resilience to timing and transition attacks, compared to existing mix-zone approaches.

Users Collaborative Mix-Zone to Resist the Query Content and Time Interval Correlation Attacks

“…Le et al [30] improved the effectiveness of mix-zone with dynamic deployment. Palanisamy et al [5,6,31,32] further this scheme with delay-tolerant and non-rectangular structure, which made the mix-zone able to resist such as timing attack, transition attack and continuous query correlation attack. Gao et al [33] utilized this scheme in participatory sensing.…”

“…Assume that Alice queries for the nearest gas station and Bob queries for the restaurant. Although their trajectories are disturbed by mix-zone deployed in n 6 , query contents of them are not changed. As the adversary may gain the sub-trajectories between n 5 -n 6 and n 9 -n 6 , the request for gas station is denoted as triangles and the request for restaurants as pentagons may be mined out, so the real location with these contents will be correlated.…”

“…These algorithms can be classified into two main categories: the whole trajectory disturbance [1][2][3][4] and the subsequent location generalization [5][6][7][8][9][10]. As subtrajectories can be obtained before preserving, the adversary may infer the location correlation and identify the real trajectory from the anonymous group, which makes algorithms of whole trajectory disturbance failed.…”

“…After ID transformation, the adversary becomes difficult to track subsequent locations of users through ID correlation. Palanisamy et al further optimized the mix-zone with delay-tolerant and nonrectangular structure [5,6], and their algorithms can resist the timing and transition attacks as well as query correlation attack. However, as it can monitor the whole process of servicing, the adversary can obtain a subtrajectory of the user before entering the mix-zone, and infer the query content and time interval from it.…”

De-anonymizable Location Cloaking for Privacy-Controlled Mobile Systems

“…Various privacy protection algorithms proposed for data privacy have been adopted for protecting location privacy of mobile users. The types of privacy protection algorithms include anonymization [1,5,8,10,13,20], data suppression [18], trajectory inference prevention [2,3,[14][15][16] and encryption [11]. While most of the existing schemes are aimed at preventing the adversary from distinguishing the location of a given user from that of other users, their perturbation techniques are mostly unidirectional and lack the ability to de-anonymize the perturbed information even when a user accessing the information has suitable credentials for obtaining finer information.…”