Prolonging the Hide-and-Seek Game

Abstract

Human mobility is highly predictable. Individuals tend to only visit a few locations with high frequency, and to move among them in a certain sequence reflecting their habits and daily routine. This predictability has to be taken into account in the design of location privacy preserving mechanisms (LPPMs) in order to effectively protect users when they expose their whereabouts to location-based services (LBSs) continuously. In this paper, we describe a method for creating LPPMs tailored to a user's mobility profile taking into her account privacy and quality of service requirements. By construction, our LPPMs take into account the sequential correlation across the user's exposed locations, providing the maximum possible trajectory privacy, i.e., privacy for the user's past, present location, and expected future locations. Moreover, our LPPMs are optimal against a strategic adversary, i.e., an attacker that implements the strongest inference attack knowing both the LPPM operation and the user's mobility profile. The optimality of the LPPMs in the context of trajectory privacy is a novel contribution, and it is achieved by formulating the LPPM design problem as a Bayesian Stackelberg game between the user and the adversary. An additional benefit of our formal approach is that the design parameters of the LPPM are chosen by the optimization algorithm.

Rethinking Location Privacy for Unknown Mobility Behaviors

“…In this work, we assume that X , Z and X are discrete sets of locations (i.e., the users can only report locations in a grid). We do this for computational simplicity and for compatibility with previous proposals [5], [7], [13]. However, all of our findings can be extended to other scenarios (e.g., Z = R 2 is the plane [9], Z is a discrete set of cloaking regions [16], or a powerset of points of interest [6]).…”

“…Memoryless LPPMs are used in sporadic location privacy and works that consider a single location release [3], [5], [6], [8], [9], [17]. Output-based LPPMs are typically used in non-sporadic location privacy works [7], [13] and, to the best of our knowledge, no optimal full-LPPM has been proposed due to the computational complexity inherent to its design.…”

“…In this work, we integrate the training/testing separation as part of the framework. We also consider the selection of a model for the real locations p(x) as a crucial part of the designing step, which was considered as given by previous works [1]- [9], [13]. Finding a suitable theoretical model for the user mobility p(x) and fitting it to the training data is part of the LPPM design process.…”

“…• We empirically show that hardwiring the characteristics of a dataset into Location Privacy Preserving Mechanisms [1]- [9], arXiv:1809.04415v2 [cs.CR] 23 May 2019 [13] yields mechanisms that do not adequately protect users whose behavior deviates from that observed in training.…”

“…• To carry out this comparison we extend efficient remapping techniques used in optimal sporadic LPPMs [8] to build optimal non-sporadic Markov-based LPPMs [7], [13]. This considerably reduces the computational cost of building nonsporadic LPPMs and allows us to evaluate them empirically.…”