Rethinking Location Privacy for Unknown Mobility Behaviors

Abstract

Location Privacy-Preserving Mechanisms (LPPMs) in the literature largely consider that users' data available for training wholly characterizes their mobility patterns. Thus, they hardwire this information in their designs and evaluate their privacy properties with these same data. In this paper, we aim to understand the impact of this decision on the level of privacy these LPPMs may offer in real life when the users' mobility data may be different from the data used in the design phase. Our results show that, in many cases, training data does not capture users' behavior accurately and, thus, the level of privacy provided by the LPPM is often overestimated. To address this gap between theory and practice, we propose to use blank-slate models for LPPM design. Contrary to the hardwired approach, that assumes known users' behavior, blank-slate models learn the users' behavior from the queries to the service provider. We leverage this blank-slate approach to develop a new family of LPPMs, that we call Profile Estimation-Based LPPMs. Using real data, we empirically show that our proposal outperforms optimal state-ofthe-art mechanisms designed on sporadic hardwired models. On non-sporadic location privacy scenarios, our method is only better if the usage of the location privacy service is not continuous. It is our hope that eliminating the need to bootstrap the mechanisms with training data and ensuring that the mechanisms are lightweight and easy to compute help fostering the integration of location privacy protections in deployed systems.• We empirically show that hardwiring the characteristics of a dataset into Location Privacy Preserving Mechanisms [1]-[9], arXiv:1809.04415v2 [cs.CR]

Impact of Frequency of Location Reports on the Privacy Level of Geo-indistinguishability

“…In fact, it has been discussed that the definition of in geoindistinguishability may be misleading in terms of the privacy level [13]. In contrast with [12], our results showed that the relation between the average quality loss and average adversary error is only linear after a non-negligible threshold. That is, there exists an upper bound on the value of the privacy budget necessary to guarantee relevant privacy protection, which in our setting was = 4 km −1 .…”

“…As in previous relevant works [7,10,12,14,17], we shall consider a user of an LBS which reports his location to the LBS provider to obtain information. We consider as adversary any entity with access to the location reports attempting to infer private information [2,16], including the LBS provider or any passive eavesdropper.…”

“…Generically [12], online user-centric obfuscation mechanisms can be described as a probability distribution in the form of equation (1).…”

“…Remapping techniques have been proposed for this LPPM to increase the utility of the queries without degrading the privacy level [7]. In fact, the PL mechanism with optimal remapping is considered the state-of-the-art of geoindistinguishability in sporadic location privacy [12].…”

“…While geo-indistinguishability bounds the amount of disclosure, it considers reports to be independent between each other. In fact, in the context of sporadic release of data this consideration has been assumed when designing LPPMs [9,12]. However, there is no formal nor quantitative distinction between sporadic and continuous reports and thus, the distinction is often based on the type of LBS application [10].…”