Resilient privacy protection for location-based services through decentralization

Abstract

and RISE SICS, SwedenLocation-based Services (LBSs) provide valuable services, with convenient features for mobile users. However, the location and other information disclosed through each query to the LBS erodes user privacy. This is a concern especially because LBS providers can be honest-but-curious, collecting queries and tracking users' whereabouts and infer sensitive user data. This motivated both centralized and decentralized location privacy protection schemes for LBSs: anonymizing and obfuscating LBS queries to not disclose exact information, while still getting useful responses. Decentralized schemes overcome disadvantages of centralized schemes, eliminating anonymizers, and enhancing users' control over sensitive information. However, an insecure decentralized system could create serious risks beyond private information leakage. More so, attacking an improperly designed decentralized LBS privacy protection scheme could be an effective and low-cost step to breach user privacy. We address exactly this problem, by proposing security enhancements for mobile data sharing systems. We protect user privacy while preserving accountability of user activities, leveraging pseudonymous authentication with mainstream cryptography. We show our scheme can be deployed with off-the-shelf devices based on an experimental evaluation of an implementation in a static automotive testbed.Additional Key Words and Phrases: Location privacy, honest-but-curious, pseudonymous authentication INTRODUCTIONA Location-based Service (LBS) query targets a location/region and expresses one or more specific user interests; the LBS server responds with the most up-to-date relevant information, e.g., the latest menu of a restaurant, movies at a cinema, remaining parking slots at a shopping mall, or traffic conditions in the area. During this process, users' current or future whereabouts and interests are disclosed to the LBS server through their queries. All submitted information is deemed necessary to best serve users, and the LBS server is entrusted with rich data. However, many studies [5,15,62] reveal that service providers can be honest-but-curious, aggressively collecting information to profile users, e.g., identifying home or working places or inferring interests for commercial purposes.LBS privacy is studied extensively. Location k-anonymity [16] ensures that at least k − 1 other users are involved in an obfuscated region, R, used as the querier's location. Therefore, even in the presence of a local observer in R, the query cannot be linked to a certain user; the LBS server only learns the querier is one among k users in R. Protection can be achieved by centralized schemes [16,45,46] that introduce an anonymizer, a proxy between users and the LBS server, which anonymizes user queries before sending them to the LBS server. However, the assumed anonymizer trustworthiness merely "shifts" the trust from the LBS server to the anonymizer, holding rich information the same way that the LBS server would. Simply put, an anonymizer could be it...

Achieving User-Defined Location Privacy Preservation Using a P2P System

“…There are many schemes implementing caching mechanism to help protect privacy and improve user experience, such as [15], [48]- [52], and most of them cache data in peers. In [48], some special peers run as serving nodes who are responsible for caching all POI data for the region it is located in and serve neighboring peers' queries. Serving nodes are determined by a TTP-like entity and serving nodes themselves act like TTPs.…”

k-Trustee: Location injection attack-resilient anonymization for location privacy

“…However, the above P2P approaches are not reliable when there are malicious peers in the network. To secure the P2P scheme, Jin et al [23,24] introduced the pseudonymous authentication technique to provide message authentication and integrity for peer communication, thus significantly suppressing the impact of malicious peers.…”

An Improved Privacy-Preserving Framework for Location-Based Services Based on Double Cloaking Regions with Supplementary Information Constraints

“…Spatial cloaking [17][18][19][20][21][22][23][24][25] is a fairly popular mechanism. Chow et al [17] propose Casper cloak algorithm, which uses a quad-tree data structure and allows users to determine the size of and the minimum anonymous area, but the privacy can be guaranteed only when users' positions are distributed evenly.…”

“…Chow et al [17] propose Casper cloak algorithm, which uses a quad-tree data structure and allows users to determine the size of and the minimum anonymous area, but the privacy can be guaranteed only when users' positions are distributed evenly. Jin and Papadimitratos [18] allow P2P responses to be validated with very low fraction of queries affected even if a significant fraction of nodes are compromised. Chen and Pang [21] propose that the cloaking region is randomly chosen from the ones with top-k largest position entropy.…”

“…It is common to generate Security and Communication Networks add query count to Sets (6) end if (7) end for (8) e Sets are randomly divided into set 1 and set 2 equally (9) Do (10) akg 1 = average(set 1 ); akg 2 = average(set 2 ); (11) for in Sets (12) if (s − akg 1 ) 2 < (s − akg 2 ) 2 then (13) s belong to c 1 (14) else (15) s belong to c 2 (16) end if (17) end for (18) while there are changes on the elements in c 1 and c 2 (19) if the number of GID belongs to c 1 then (20) FCR isselected randomly from the regions with the number in c 1 except RCR (21) else FCR is selected randomly from the regions with the number in c 2 except RCR (22) dummy positions randomly in the double cloaking regions; however, we propose defining two rules to generate fixed dummy positions according to . In Figure 8, the red solid circle represents the user's real position and the solid circles represent the fixed dummy positions according to our rules, while the dotted circles represent the dummy positions generated randomly.…”