Differentially Private Real-Time Data Publishing over Infinite Trajectory Streams

Abstract

SUMMARYRecent emerging mobile and wearable technologies make it easy to collect personal spatiotemporal data such as activity trajectories in daily life. Publishing real-time statistics over trajectory streams produced by crowds of people is expected to be valuable for both academia and business, answering questions such as "How many people are in Kyoto Station now?" However, analyzing these raw data will entail risks of compromising individual privacy. -Differential Privacy has emerged as a well-known standard for private statistics publishing because of its guarantee of being rigorous and mathematically provable. However, since user trajectories will be generated infinitely, it is difficult to protect every trajectory under -differential privacy. On the other hand, in real life, not all users require the same level of privacy. To this end, we propose a flexible privacy model of -trajectory privacy to ensure every desired length of trajectory under protection of -differential privacy. We also design an algorithmic framework to publish -trajectory private data in real time. Experiments using four real-life datasets show that our proposed algorithms are effective and efficient.

ConTPL

“…In order to fulfill this system, we implement the major differentially private mechanisms for steaming data in literature, whose privacy budget allocation strategies can be categorized into two types: adaptive privacy budget allocation [3] [4] [12] [14] and non-adaptive privacy budget allocation [2] [7] [10] [11] [17] [8]. Our framework also includes a function for learning Markov model from time-series data.…”

“…However, privacy concerns hinder the wider use of these data. To this end, differentially private continuous aggregate release [2] [3] [4] [7] [10] [11] [12] [14] [17] [8] has received increased attention because it provides a rigorous privacy guarantee. Intuitively, differential privacy (DP) [9] ensures that the modification of any single user’s data in the database has a “slight” (bounded in ϵ) impact on the change in outputs.…”

“…Then, data curator selects a differentially private mechanism to use for releasing private streaming data, denoted as M in Figure 2. Many existing mechanisms for steaming data allocate privacy budget at each time point either adaptively [3] [4] [12] [14] (e.g., the current privacy budget depends on the outputs or previous allocated privacy budgets) or non-adaptively [2] [7] [10] [11] [17] [8]. In either case, our system can control TPL of the selected mechanism within [0, α ] by suggesting appropriate privacy budgets to data curator.…”

“…Existing works on differentially private continuous aggregate release [1] [2] [3] [4] [7] [10] [11] [12] [14] [17] [8] do no take temporal correlation into consideration. In other words, they assume data between different time points are independent or the attacker has no knowledge of such temporal correlations.…”

Partitioning-Based Mechanisms Under Personalized Differential Privacy

“…We observe that U ( n , ε ) can be considered as a general utility form in a series of existing state-of-the-art DP algorithms (e.g. [11, 13, 15, 3, 4, 20, 8, 12, 18, 17]). (i) Count query In the Laplace mechanism, the noisy result of a function f can be represented as f ( D ) + ν , where ν follows $\mathit{Lap}(\frac{{\mathrm{italic\Delta }}_f}{\epsilon })$, and Δ f is the sensitivity related to number of records n .…”