Location privacy via geo-indistinguishability

Abstract

In this paper we report on our ongoing project aimed at protecting the privacy of the user when dealing with location-based services. The starting point of our approach is the principle of geo-indistinguishability, a formal notion of privacy that protects the user's exact location, while allowing approximate information -- typically needed to obtain a certain desired service -- to be released. We then present two mechanisms for achieving geo-indistinguishability, one generic to sanitize locations in any setting with reasonable utility, the other custom-built for a limited set of locations but providing optimal utility. Finally we extend our mechanisms to the case of location traces, where the user releases his location repeatedly along the day and we provide a method to limit the degradation of the privacy guarantees due to the correlation between the points. All the mechanisms were tested on real datasets and compared both among themselves and with respect to the state of the art in the field.

An Analysis of Differential Privacy Research in Location and Trajectory Data

“…Another way to improve the consumption of the privacy budget is by making use of the predictability of users movements [60], [61]. At each timestamp, the privacy algorithm predicts a location based on the previously released ones.…”

Perturbation Methods for Protection of Sensitive Location Data: Smartphone Travel Survey Case Study

“…At radius r1, a high level of privacy is achieved, making the real location indistinguishable among the nearest point locations (there are three). At radius r2 and r3, the level of noise added to obfuscate li decreases at a rate that is dependent on the desired level of privacy, e. As an example, an adversary may be able to make a confident guess of the area where a respondent is located, but would not be able to predict the exact location of a respondent within the area (19). The random noise of perturbation for Geo-I can be implemented from a Laplacian distribution with respect to perturbation distance from original location.…”

“…That is, the query results were relevant to the original location of the user, even though only perturbed data was provided to the LBS. Finally, Chatzikokolakis et al ( 19 ) protected the privacy of LBS users by applying the principle of Geo-I. Using the foundations of differential privacy, their work protected the user’s exact location while providing sufficiently accurate location information to allow satisfactory results to be provided by the LBS.…”

“…The random noise of perturbation for Geo-I can be implemented from a Laplacian distribution with respect to perturbation distance from original location. This approach is intended to ensure robustness with respect to the composition of attacks, as the level of privacy decreases in a controlled way (linearly) ( 19 ). This study implements an experimental simulation that achieves Geo-I by perturbing home locations of respondents in the MTL Trajet survey.…”

“…It guarantees a respondent’s location is protected within a specified protection distance with a level of added noise that decreases with the distance, at a rate depending on the desired level of privacy. In other words, the original location is highly indistinguishable from locations that are close to it, and gradually becomes more distinguishable from locations that are farther away ( 19 ). This is intended to maintain anonymity while at the same time maintaining the utility of the underlying data.…”