Authentication of Moving Range Queries

Transcription

1 Authentication of Moving Range Queies Duncan Yung Eic Lo Man Lung Yiu Depatment of Computing Hong Kong Polytechnic Univesity {cskwyung, eiclo, STRACT A moving ange quey continuously epots the quey esult (e.g., estauants) that ae within adius fom a moving quey point (e.g., moving touist). To minimize the communication cost with the mobile clients, a sevice povide that evaluates moving ange queies also etuns a safe egion that bounds the validity of quey esults. Howeve, an untustwothy sevice povide may epot incoect safe egions to mobile clients. In this pape, we pesent efficient techniques fo authenticating the safe egions of moving ange queies. We theoetically poved that ou methods fo authenticating moving ange queies can minimize the data sent between the sevice povide and the mobile clients. Extensive expeiments ae caied out using both eal and synthetic datasets and esults show that ou methods incu small communication costs and ovehead. Categoies and Subject Desciptos H.. [Database Applications]: Spatial databases and GIS Geneal Tems Algoithms, Pefomance Keywods authentication, moving queies 1. INTRODUCTION Moving spatial queies [33, 1] continuously epot updated quey esult to a mobile client and they have numeous mobile applications. Fo example, a moving ange quey continuously epots all touist attactions that ae within 3 km fom a moving ca. Location-based sevice povides (LBS) that offe moving queying sevices etun mobile uses the quey esult and a coesponding safe egion [33, 1]. Given a moving quey point q, its safe egion is a egion whee the esult of q emains unchanged as long asq moves within it. In othe wods, it allows a mobile use to issue a new quey to the LBS (to get the latest quey esult) only when Suppoted by gant PolyU 5333/1E fom Hong Kong RGC. Pemission to make digital o had copies of all o pat of this wok fo pesonal o classoom use is ganted without fee povided that copies ae not made o distibuted fo pofit o commecial advantage and that copies bea this notice and the full citation on the fist page. To copy othewise, to epublish, to post on seves o to edistibute to lists, equies pio specific pemission and/o a fee. CIKM 1, Octobe 9 Novembe, 1, Maui, HI, USA. Copyight 1 ACM /1/1...$1.. the use leaves the safe egion, Thus, safe egion is a poweful optimization fo significantly educing the communication fequency between the use and the sevice povide. The quey esults and safe egions etuned by LBS, howeve, may not always be accuate. Fo instance, a hacke may infiltate the LBS s seves [5] so that esults of queies all include a paticula location (e.g., the White House). Futhemoe, the LBS may be self-compomised and thus anks sponsoed facilities highe than actual quey esult. The LBS may also etun an ovely lage safe egion to the clients fo the sake of saving computing esouces and communication bandwidth [, 1, 3]. On the othe hand, the LBS may opt to etun ovely small safe egions so that the clients have to equest new safe egions moe fequently, if the LBS chages fee fo each equest, o if the LBS wishes to boost its equest counts a figue that could influence its advetisement evenue. Recently, techniques fo authenticating quey esult have eceived significant attentions, e.g., the authentication of elational queies [15, 1, 7], data steam queies [11, ], text similaity queies [1], static spatial queies [, 19], and shotest path queies [3]. Most authentication techniques [1, 7, 11,,, 19, 1, 3] ae based on Mekle tee [1], which is an authenticated data stuctue (ADS) that is built on the dataset. Recently, Yang et al. [] developed an authenticated data stuctue called Mekle R-tee (MR-tee) fo authenticating spatial queies. The issue of authenticating moving spatial queies, howeve, has not been addessed yet. Existing techniques fo authenticating static spatial queies such as [, 19, ] cannot help in authenticating moving spatial queies because thei authentication taget is the quey esult, which is a subset of the dataset, wheeas the authentication tagets of moving queies include both the quey esult and the safe egion the latte is a geometic entity that is dynamically computed by the LBS at un-time and is not pat of the dataset. Since a safe egion is defined based on both points in the quey esult as well as points not in the quey esult, the missing of a non-esult point duing the authentication pocess may also fail the authentication of the safe egion. This pape is devoted to the authentication of moving ange queies. The specific technical contibutions include: 1. The design of veification objects VO specific fo authenticating the safe egions (and also the esult) of moving ange queies. Note that the existing notion of veification objects [1,, 1, 3, 31] cannot be used to authenticate safe egions of moving ange queies. Algoithms fo constucting and veifying those veification objects duing moving ange quey pocessing ae included in this pape as well.. Communication optimization techniques that allow a mobile client to efesh its safe egion without communicating

2 with the LBS even when the client leaves its cuent safe egion. These techniques ae useful to educe the communication ovehead duing authentication-enabled moving spatial quey pocessing. 3. We intoduce a new notion called VO-optimal, to descibe authentication techniques that put the minimum data points and MR-tee enties into thevo. We show that ou solutions achieve such optimality.. An extensive expeimental study on eal data and synthetic data to study the efficiency of ou poposed methods. The est of this pape is oganized as follows. We discuss elated wok in Section. We pesent the famewok fo authenticating moving queies in Section 3. In Section, we pesent ou VO-optimal methods fo authenticating moving ange queies. The expeimental study is pesented in Section 5. Finally, we conclude this pape in Section.. RELATED WORK Quey authentication In the liteatue, most authentication techniques [1, 7, 11,,, 19, 1, 3] ae based on Mekle tee [1] with the public key infastuctue [1]. Mekle tee is an authenticated data stuctue (ADS) that is built on the dataset. Digests of nodes in the tee ae fist ecusively computed fom the leaf level to the oot level. 1 Then, the signatue of the dataset is obtained by signing the oot digest using the data owne s pivate key. Signatue aggegation [15, 17] is an altenative of Mekle tee. It woks by having a signatue fo each tuple in the dataset. Recently, Yi et al. [9] popose a pobabilistic appoach fo authenticating aggegation queies; and Kundu et al. study the authentication of tees [] and gaphs [9] without evealing any data objects beyond the use s access ights. To authenticate spatial queies, Yang et al. [] develops an authenticated data stuctue (ADS) called Mekle R-tee (MR-tee) based on R -tee [1] and Mekle tee [1]. Figue 1b shows an MR-tee fo the dataset shown in Figue 1a. A leaf enty p i stoes a data point. A non-leaf entye i stoes a ectanglee i.b and a digest e i.α, whee e i.b is the minimum bounding ectangle of its child node, and e i.α is the digest of the concatenation (denoted by ) of binay epesentation of all enties in its child node. Fo instance, e 1.α = h(p 1 p ), e 5.α = h(e 1 e ), and e oot.α = h(e 5 e ). The oot signatue is geneated by signing the digest of the oot node e oot.α using the data owne s pivate key. Conside the ange queyq with adius in Figue 1. Its esult is p 1. In ode to let the client veify the coectness of the ange esults, the LBS utilizes the MR-tee (povided by the data owne) to geneate a veification object VO. Fist, it defines a cicula veification egion (q,) with centeq and adius. Then, it computes the VO by a depth-fist tavesal of the MR-tee, with the following conditions: (i) if a non-leaf enty e does not intesect (q,), then e is added to thevo (e.g.,e,e ) and its subtee will not be visited; (ii) data points in any visited leaf node ae added into thevo (e.g., p 1,p ). In this example, we have VO = {{{p 1,p },e },e }, whee{and}ae tokens fo making the stat and end of a node. Upon eceiving thevo, the client fist checks the coectness of thevo by econstucting the digest of oot of the MR-tee fom the VO and then veifying it against the oot signatue using the data owne s public key. If the veification is successful, the client next finds the ange esult diectly fom the data points extacted fom 1 A secue-hash function is often used to compute a fix-length digest. q p 1 p e 3 1 p e p p 5 p p 7 e 3 e p e 5 e e 5 (,α) e oot (,α) e (,α) e 1 (,α) e (,α) e 3 (,α) e (,α) p 1 p p 3 p p 5 p p 7 p (a) data points on a plane (b) Mekle R-tee (T D ) Figue 1: Authentication of ange queies thevo (ignoing the non-leaf enties). Then, the client defines the veification egion (q, ) and checks whethe evey non-leaf enty in the VO satisfies e.b (q,) =. If so, the client can assue that the computed ange esult is coect. The eason is that, if a non-leaf enty e in the VO does not intesect (q,), that means all the points inecannot become the ange esult ofq. In this pape, we use MR-tee because of its populaity and low constuction cost, and ou concept of VO-optimality is also based on MR-tee. MR*-tee is an extension of MR-tee [], whee each node is embedded with a conceptual Mekle KD-tee defined on enties in the node. If a quey egion intesects with only one side of a split axis (in a KD-tee), then it skips inseting the enties on the othe side into the VO. This technique can educe the numbe of enties in the VO at the cost of highe constuction and computation time. Refeence [13] discusses anothe spatial ADS called PMKdtee, which sepaates the quey pocessing pat and the VO constuction pat in ode to obtain bette quey efficiency and smalle veification objects. To the best of ou knowledge, we ae the fist to study the authentication of moving ange queies. Existing spatial authentication techniques [, 19, ] cannot help in authenticating moving queies because they focus on static queies, so that the authentication tagets (i.e., the quey esults) ae pat of the dataset. In contast, authentication of moving queies equie authenticating both the quey esults (pat of the dataset) and the safe egions (not pat of the dataset). Ou ecent wok [31] examined how to authenticate the safe egions of moving knn queies. Howeve, the safe egions fo knn queies (e.g., convex polygons) ae diffeent fom those fo ange queies (e.g., set unions/diffeences of cicles). This endes the specific techniques in [31] inapplicable to ou poblem hee. Also, we will pove that ou method isvo-optimal, in which [31] did not intoduce this notion yet. Moving quey pocessing In moving quey pocessing, [] computes the neaest neighbos fo each possible quey point on a given line segment, wheeas [7] studies how to maintain the use s futue knn upon a change of the use s velocity. Both [] and [7] model the use s movement as a linea function. When the use s futue movement is unknown, the buffeing appoach [3] and the safe egion appoach [33, 1] ae moe appopiate fo efficient moving quey pocessing. In the buffeing appoach [3], the LBS etuns uses the oiginal esult points and some additional esult points to constitute a buffe egion. While moving within the buffe egion, the client s latest esult can be ecomputed locally fom the esult of the pevious quey. Howeve, it is not easy to tune the size of the buffe egion in pactice, and that value actually influences the communication fequency and the numbe of objects sent pe communication. In the safe egion appoach, the LBS epots a safe egion [33, 1, 3] fo the quey esult, such that the esult emains unchanged while the use moves within the safe egion. Unlike the buffeing appoach, this appoach does not equie the client to compute

3 esult locally. This appoach educes both the communication fequency and the computational ovehead fo the use. Finally, note that the solutions in [3,, 7, 1] focus on moving knn queies athe than moving ange queies. The safe egions of moving ange queies wee studied in [33, 3]: ectangula ange queies [33] and cicula ange queies [3]. 3. BASELINE AND FRAMEWORK Following [33, 1, 3], in this pape, we conside a geneic poblem setting in which q is a moving object whose futue locations cannot be pedicted in advance. In a moving quey envionment, the question is when and whee the client should (e-)issue quey in ode to get the most updated quey ange esult asq moves. Baselines fo moving quey authentication A bute-foce method is that the client peiodically issues a quey to the seve fo evey T time units. The coectness of the esults can then be authenticated using an MR-tee. Howeve, thee is no way to guaantee that esult is always up-to-date even when a vey small T is used, endeing this method impactical. To authenticate moving spatial queies, a baseline method uses the buffeing appoach to compute the quey esult and then authenticate the esults by using an MR-tee. Specifically, a client issues a ange quey with a ange lage than the oiginal quey ange. Again, letq last be the last location sent to seve. As long as the cuent location of q moves within the buffe egion (q last, ), the latest quey esult can be deived fom the esult of the last quey because any anges that have cente within (q last, ) and adius ae totally inside (q last, + ). Although simple, the buffeing appoach equies finding the optimal value of. A small leads to moe fequent communication, theeby inceasing the communication cost. A lage, unfotunately, also inceases the communication cost because the size of thevo inceases. Ou safe egion appoach The buffeing appoach is not a tue safe egion appoach because even when staying within the buffe egion the client is still equied to ecompute esult locally. Ou appoach is to etun a safe egion fo the quey esult, such that the esult emains unchanged as long as the use s location q stays within the safe egion. This appoach helps educing the communication fequency between the LBS and the client. Howeve, fo the vaious easons we mentioned in the intoduction, the LBS may etun incoect safe egions, endeing the use s futue esult incoect. Ou goal is thus to devise methods fo the client to veify the coectness of the safe egion etuned by LBS. Famewok fo moving quey authentication Figue illustates the famewok fo answeing moving spatial queies that suppots quey coectness veification. A map povide (e.g., the govenment s land depatment, NAVTEQ and TeleAtlas 3 ) collects points-of-inteests into a spatial dataset. It builds the MR-tee [] of the dataset and signs the digest of the oot node, befoe distibuting/selling it to a sevice povide (i.e., LBS). Initially, a mobile use downloads the oot signatue fom the LBS and the map povide s public key fom a cetificate authoity (e.g., VeiSign). Aftewads, the use sends its location to the LBS, and obtains the quey esult, the safe egion, and the VO. The coectness of the quey esult and the safe egion can be veified at the client by using the eceived VO, the oot signatue and the map povide s public key. The client needs to issue a quey to the LBS again only when it leaves its safe egion. NAVTEQ Maps and Taffic. 3 TeleAtlas Digital Mapping. The spatial dataset is expected to have infequent updates (e.g., monthly map updates). In case the use equies fesh esults (i.e., obtained fom the latest datasets), the map povide could follow [1] to include a timestamp in the oot signatue of the tee. Ou advesay model is the same as in []. Except the data owne s pivate key, advesaies ae assumed to know all othe infomation, e.g., the data owne s public key, the secue-hash function, the Mekle R-tee, its oot signatue, and ou authentication algoithms. The secuity is guaanteed by the Mekle R-tee []. Sevice povide Root signatue Mekle R-tee distibute Root signatue Root signatue [once] location update esult, safe egion, VO when cossing safe egion Mekle R-tee Mobile client Map povide build Spatial Dataset Cetificate authoity Public key [once] Figue : Moving quey authentication. PROPOSED SOLUTION Thee ae two main types of ange quey, ectangula ange quey [5, ] and cicula ange quey [, ]. The fome specifies the quey ange as a ectangle wheeas the latte specifies the quey ange as a cicle. In this pape, we focus on the authentication of moving cicula ange queies. Heeinafte, we use the tem ange quey to denote cicula ange quey. A summay of notation used in this pape is given in Table 1. In the following, we fist intoduce some basic definitions fo ou poblem. Then, we pesent ou Ac-Based () method fo constucting VO fo moving ange quey authentication (Section.). As we will elaboate late, the safe egion fo a moving ange quey is constituted by a set of acs. Hence, ou method exploits this popety to constuct a compact VO. Futhemoe, we can pove that ou method is VO-optimal, i.e., it puts the minimum data points and MR-tee enties into the VO (Section.3). Aftewads, we analyze the size of thevo constucted by this method (Section.). At the end, we pesent a method to futhe educe the communication fequency (Section.5) by eusing the VO when the client cosses a safe egion..1 Peliminay and Definitions A (cicula) ange quey is a cicle (q,), whee q is a quey point and is a adius (in Euclidean distance). A data point p is in the esult set S if its distance fom q is less than o equal to, i.e., dist(q,p). In contast, a data point p is not in the esult S if its distance fom q is geate than, i.e., dist(q,p) >. In Figue 3(a), the bold cicle (q,) is a cicula ange quey with cente q and adius. Data points g 1, g, g 3, and p 1 ae inside (q,), so they ae esult points and in S. Since g is outside (q,),g is a not a esult point and not ins. When a client moves, its ange quey esult may change. In ode to get the updated esult, basically it has to submit a new quey to the LBS using its updated location q. To minimize the communication fequency and the communication cost, we adopt the safe egion appoach. When the seve eceives a ange quey, it etuns the client a safe egionsr in addition to the quey esults.

4 Table 1: Summay of Fequently Used Symbols Symbol Meaning D the dataset adius ac (c,) cicula egion with centecand adius S ange quey esult SR(S,D) safe egion g i a guad object gi ac a bode of safe egion contibuted byg i A 1 end,a end two ending points ofgi ac G a set of guad object (c,) a secto with centecand adius RVR quey esult veification egion GOVR gi guad object veification egion GOEPC gi guad object end point cicle GOSD gi guad object secto diffeence cicumfeence of g i G GOVRg i SRVR ange safe egion veification egion Π veification egion Theefoe, the client does not need to issue a new quey to the LBS as long as it moves within SR. The safe egion fo moving ange queies [] is stated below. Definition 1. Safe Region of Range Quey (Ref. []) The safe egionsr(s,d) of a cicula ange quey is defined as: SR(S,D) = (p i,) (p j,) p i S p j D S whee S is the set of esult points of ange quey (q,) and D is the dataset. In Figue 3(a), the light gey egion is the safe egion SR(S,D) fo the ange quey esult S = {g 1,g,g 3,p 1}. It is fomed by (g 1,) (g,) (g 3,) (p 1,), excluding (g,). Note that the safe egion SR(S,D) is enclosed by fou acs: ab, bd, dc, and ca, which ae oiginated fom cicles (g 1,), (g,), (g,), and (g 3,), espectively. In othe wods, (p 1,) does not contibute to the final safe egion SR(S,D) (in factsr(s,d) is completely inside (p 1,)). So, [] distinguishes the set of data points G that ae necessay fo epesenting the safe egion, which ae called guad objects, fom the othes. Definition. Guad Object (Ref. []) Given a point g i, g i is a guad object if pat of (g i,), which is an ac gi ac, can contibute to the final safe egionsr(s,d). In Figue 3(a), pointsg 1,g,g, andg 3 ae guad objects because thei coesponding acs ab, bd, dc, and ca fom the safe egion. In contast, pointp 1 is not a guad object. The challenges of veifying the coectness of the safe egion SR can be explained using Figue 3(a). Assume that the LBS needs to evaluate a ange quey (q,) and its safe egion (i.e., the light gey egion). By Definition, the LBS can epesent the safe egion using fou guad objects g 1, g, g 3, and g. Having these guad objects, the client is able to constuct the safe egion. Suppose that the LBS intentionally omits guad object g and only sends guad objects g 1, g, and g 3 to the client. In this case, the client will get an incoect (lage) safe egion, which is the union of the light gey egion and the dak gey egion. The challenge hee is that the client cannot notice that one guad object (g ) is missing. Note that all guad objectsg 1,g, andg 3 ae oiginated fom the dataset D (thus they pass the data coectness checking). Howeve, the client cannot detemine whethe the set of guad objects povided by the LBS is complete. Similaly, the LBS may also epot a smalle safe egion by etuning fake objects as guad objects. Again such case is easy to be detected by checking the oot signatues. By Definition 1, SR(S,D) is constucted by all data points in D. So, a bute-foce solution is to etun the whole dataset D to the client so that the client is guaanteed to compute SR(S,D) coectly. Ou goal is to design efficient methods to constuct veification objects VO fo veifying the coectness of the safe egion, yet the size ofvo should be as small as possible. RVR c p 1 a q g 1 d g 3 g b g SR(S,D) (a) safe egion and RVR Figue 3: Illustation of egions p 1 g 3 a q ac g3 b f e GOSDg3 GOEPCg3 GOVRg3 (b)govr,goepc, and GOSD. Ac-Based Method Ou Ac-Based method constucts a compact VO fo authenticating a moving ange quey. Its idea is to exploit the acs of a safe egion to constuct a VO with minimal size. The method consists of a seve algoithm and a client algoithm. At the seve side, eveything that is necessay fo veifying the ange quey esult and the safe egion is put into VO and sent to the client. At the client side, the coectness of the quey esult and the safe egion is veified based on the data stoed in thevo. Algoithm 1 Ac-Based Method (Seve) Receive fom client: (Quey pointq, Intege) Using MR-teeT D (on datasetd) 1: S := compute the esult points ofq fom the teet D : computesr(s,d) fom the tee T D (using the method of []) 3: RVR:= (q,) : G := set of guad objectsg i 5: GOVR gi :=( (g i,) (g i,)) (p 1 e,) (p e,) : SRVR:= g i G GOVRg i 7: Π :=RVR SRVR : VO := DepthFistRangeSeach(T D.oot,Π) 9: sendvo to the client..1 Seve Algoithm Algoithm 1 is the pseudo-code of the seve algoithm. Upon eceiving the use location q and the adius, the seve computes the esult points fom an MR-tee T D (Line 1). Then, it computes the safe egion by using safe egion computation method in [] efficiently (Line ). Next, it defines a veification egion Π so as to identify data points that ae useful fo veifying the ange quey esult and the safe egion and put them into VO. Moe specifically, the veification egion Π is defined as the union of (i) the ange quey esult veification egion (RV R) and (ii) the ange quey safe egion veification egion (SRVR). Definition 3. Range quey esult veification egion (RV R). The ange quey esult veification egion (RV R) is defined as the cicula egion (q,) at the cuent quey location q with adius.

5 In Figue 3(a), the bold cicle (q,) is RVR. The definition of the ange quey safe egion veification egion SRV R is quite complicated. Theefoe, we fist state some peliminay definitions. Definition. Guad object end points cicles (GOEPC gi ) Given a guad object g i, the guad object end points cicles of g i (GOEPC gi ) is the union of (A 1 end,) and (A end,), whee A 1 end and A end ae two end points of gi ac, an ac that contibutes to the final safe egionsr(s,d). Definition 5. Guad object secto diffeence (GOSD gi ) Given a guad object g i, the guad object secto diffeence of g i (GOSD gi ) is the diffeence between a secto (g i,) with cente g i and adius, and a secto (g i,) with the same cente g i but with adius. The angle subtended by the sectos ae detemined by the end pointsa 1 end anda end descibed in Definition. In Figue 3(b), given a guad object g 3, and assume that g3 ac is the ac that contibutes to the final safe egion SR(S,D). The two end points of g3 ac ae a and b. So, the guad object end points cicles of g 3, i.e., GOEPC g3, is the union of cicles (a,) and (b,). Note thatgosd g3 is the dak gey egionabef. With the definitions of guad object end points cicles and guad object secto diffeence, we now define the veification egion of a guad object as follows. Definition. Guad object veification egion (GOVR gi ) GOVR gi = GOEPC gi GOSD gi Figue 3(b) shows the veification egion of guad object g 3, which is the union of the light gey egion and the dak gey egion. Now, we define ange quey safe egion veification egion (SRVR) as follows. Definition 7. Range quey safe egion veification egion (SRV R) The ange quey safe egion veification egion (SRV R) is defined as the union of the GOVR gi of each guad object g i in G, except its cicumfeence : SRVR = GOVR gi g i G whee G is the set of guad objects and is the cicumfeence of g i G GOVRg, i.e., = {z i R location l on gi ac, dist(l,z) =, locationsl ongi ac,dist(l,z) } Finally, the veification egion Π fo authenticating (moving) ange quey is defined as the union of the ange quey esult veification egion (RVR) and the ange quey safe egion veification egion (SRVR). Definition. Veification egionπ Π = RVR SRVR With the veification egion Π fo a moving ange quey clealy defined, thevo can be constucted by a depth-fist tavesal of the MR-tee (Line in Algoithm 1). Points insideπae put in thevo and the est ae put in thevo as some non-leaf enties. We now pove that any point p outside the veification egion Π cannot alte the ange quey esult S and its coesponding safe egionsr(s,d) and thus it is safe to exclude them in thevo. THEOREM 1. [Pointsp outsideπcannot alte the quey esult and the safe egionsr(s,d)] PROOF: To pove the theoem, we pove that (i) any pointp outside RVR cannot be ange quey esult (Lemma 1), and (ii) any point p outside SRVR cannot alte the safe egion (Lemma ). Since the veification egionπis the union ofrvrandsrvr, the theoem is poved if Lemma 1 and Lemma hold. LEMMA 1. [Points outside RVR ae not ange quey esult] We have p outside RVR, p / S, whee S is the ange quey esult set. Poof: Ifp is outsidervr, thenp is not inside the quey ange. Thus,p / S. LEMMA. [Points outside SRV R cannot alte safe egion SR(S,D)] If p is outside SRVR, then SR(S,D) = SR(S,D\{p }). Poof: Recall that the safe egion SR(S,D) is enclosed by a set of acs gi ac. Theefoe, if p is outside GOVR gi fo all g i G, Lemma 3 fom [] implies that (p,) does not intesect any ac gi ac and thus (p,) does not ovelap the safe egionsr(s,d). With that, Lemma is poven. LEMMA 3. If p is outside GOVR gi, then (p,) does not intesect acg ac i. (Ref. []) p 1 β g 3 α a b p ac g3 f ee GOSDg3 p GOEPCg3 Figue : Example fo Lemma 3 Now, with Lemma 1 and Lemma, Theoem 1 is poven. The shape of veification egionπhee is iegula (not a simple shape like cicle). Fo efficient implementation, the seve actually does not ende the complex shape of the veification egion Π. Instead, we can check whethe the following condition holds duing the tee tavesal (Line in Algoithm 1), and if it does not, we add e into thevo: A end gac i (mindist(e,q) ) A 1 end gac i ( mindist(e,a end ) < ) ( mindist(e,a 1 end ) < ) g i G ovelap(gosd gi,e) The fist tem of Equation 1 checks whethe the minimum distance fom non-leaf enty e to q is smalle than o equal to. If the distance is smalle than o equal to, e ovelaps o touches RVR. The second and thid tems check whethe the minimum distance fom e to evey end points A 1 end and A end of ac gi ac is smalle than. If the distance is smalle than, e ovelaps with GOEPC gi. The last tem checks whethe e ovelaps any GOSD gi. (1)

6 .. Client Algoithm Algoithm is the pseudo-code of the client algoithm. Upon eceiving the VO, the client fist econstucts the oot digest fom the VO (Line 1) and veifies it against the MR-tee oot signatue signed by the data owne (Line ). If the veification is successful, thevo is guaanteed to contain only enties fom the oiginal MRtee (Line 3). Afte that, it poceeds to veify the coectness of esult points and the safe egion povided by the VO. It extacts fom thevo (i) a setd of data points, and (ii) a setr of non-leaf enties, (Line -5) and then computes the esult point set S fom D (Line ). S is coect if evey non-leaf enty of R does not intesect RVR (Lines 7 ). If the esult points ae coect, the client can poceed to check the safe egion. The client next computes the safe egion SR(S,D ) fom D (Line 9). The client can ensue that SR(S,D ) is coect if evey non-leaf enty does not intesect Π (Lines 1 1). If so, the client can teat the esult points and the safe egion as coect (Line 15). Algoithm Ac-Based Method (Client) Receive fom seve: (Veification ObjectVO) 1: h oot := econstuct the oot digest fomvo : veify h oot against the MR-tee oot signatue 3: if h oot is coect then : D := the set of data points extacted fomvo 5: R := the set of non-leaf enties extacted fomvo : S := compute the esult points ofq fomd 7: RVR:= (q,) : if e R, e RVR = then authenticate quey esult 9: V:=computeSR(S,D ) authenticate safe egion 1: G := set of guad objectsg i 11: GOVR gi := ( (g i,) (g i,)) (A 1 end,) 1: (A end,) SRVR:= g i G GOVRg i 13: Π :=RVR SRVR 1: if e R,e Π = then 15: etun ange quey esult S and safe egionsr 1: etun authentication failed Up to now, we have intoduced the seve algoithm and the client algoithm of the Ac-Based () method. Now, we pove that the client can veify the ange quey esult and the safe egion by using thevo constucted by this method. LEMMA. [Client can veify the coectness of ange esult] Poof: Diect esults fom []. LEMMA 5. [Client can veify the coectness of safe egion] Following the Ac-Based () method, a client can veify that the constucted safe egion SR(S,D ) equals to the coect safe egion SR(S,D), i.e.,sr(s,d ) = SR(S,D). Poof: Fist, fom Lemma, we knows = S. ( ) Next, line 1 and line of Algoithm ensue that all data points p D and all non-leaf enties e R in the VO ae oiginated fom the data owne []. Then, the client algoithm checks whethe any non-leaf enty e R intesect SRVR, and if no, it egads the safe egion SR(S,D ) as coect, i.e., SR(S,D ) = SR(S,D). We pove its coectness by contadiction. Assume the client egads SR(S,D ) = SR(S,D) even when a non-leaf enty e R in VO intesects SRVR. When e intesectssrvr, it is possible that p e insidesrvr. Let P be the set of p e that is inside SRVR and P be the set of p e that is outside SRVR. By Lemma, p P may (o may not) alte the safe egion. Since e coves points in P P, a point p in e may (o may not) alte the safe egion, i.e., it is possible thatsr(s,d\{p P }) SR(S,D). ( ) In ou -method, the client computes the safe egion fom D (the set of data points in VO), as points in P P ae epesented by a non-leaf enty e, they ae not in D, theefoe, we have D = D\{P P }. And hence, we have SR(S,D ) = SR(S,D\{P P }). By ( ), we get SR(S,D ) = SR(S,D\{P P }) = SR(S,D\(P P ). Combining this with ( ), we obtain that SR(S,D ) may not equal to SR(S,D), i.e., it possible that SR(S,D ) SR(S,D), which contadicts with the assumption..3 VO-optimality In this section, we pove that the Ac-Based () method is VO-optimal, i.e., it puts the minimum data points and MR-tee enties into thevo. THEOREM. [The method isvo-optimal] PROOF: To pove the theoem, we need to pove that (i) Points inside Π ae sufficient fo the client to veify the coectness of the quey esult and the safe egion (Lemma ). (ii) Points inside Π ae necessay fo the client to veify the coectness of the quey esult and the safe egion (Lemma 7). Since the establishment of (i) shows that all points in Π ae sufficient and the establishment of (ii) shows that all points in Π ae necessay, the VO contains the minimum data points. Futhemoe, since the MR-tee is being visited fom the oot node, and tavesed until we find a non-leaf enty e that does not intesect Π, so the numbe of non-leaf enties that put intovo is also minimum. LEMMA. [Points p inside Π ae sufficient fo client to veify the coectness of ange quey esult and its safe egion] Poof: Lemma implies that points p inside RVR ae sufficient fo the client to veify the coectness of the quey esult. Lemma 5 implies that points p inside SRVR ae sufficient fo the client to veify the coectness of the safe egion. Since Π is the union of RVR and SRVR, points p inside Π ae sufficient fo client to veify the coectness of the ange quey esult and the safe egion. LEMMA 7. [PointspinsideΠae necessay fo client to veify the coectness of ange quey esult and its safe egion] Poof: Fist, we pove that all points inside RVR ae necessay fo the client to veify the coectness of quey esult. ( ) Since all points inside RVR ae the quey esult, they must be etuned to the client. Hence all points inside RV R ae necessay. Next, we pove that all points p inside SRV R RV R ae necessay fo the client to veify the coectness of the safe egion. ( ) We pove this by contadiction. Suppose thee exists nonesult point p inside SRVR RVR such that SR(S,D ) = SR(S,D \{p }). By definition of SRVR (Definition 7), we know that thee exists a location l inside SR(S,D \{p }) such thatdist(p,l). Theefoe, we have By this, we can conclude that: SR(S,D \{p }) (p,)

7 SR(S,D \{p }) (p,) SR(S,D \{p }) () By the definition of safe egion (Definition 1), we know example illustates how the client is able to efesh the safe egion without issuing a new quey to the seve. By using this technique, the client needs to send a new quey to the seve only when the new veification egionπ now intesects some non-leaf enty invo last. SR(S,D \{p }) (p,) = SR(S,D ) (3) Π last Π now SR({g 1, g, g 3, g },D ) Combining () and (3), we can conclude that SR(S,D ) = SR(S,D \{p }) (p,) SR(S,D \{p }). This leads to a contadiction. Finally, since RVR (SRVR RVR) = RVR SRVR, and Π is the union of RVR and SRVR, by ( ) and ( ), all points p inside Π ae necessay fo client to veify the coectness of the quey esult and the safe egion. a c qlast g 1 e d g 3 SR({g 1, g, g 3 },D ) g b qnow e 1 g p 7 p e 3 g 1 qlast e d g 3 g e 1 b qnow f g p 7 p e 3. VO Size Analysis Next, we povide a theoetical analysis on the size of the VO constucted by ou -method. Given a egion, the size of thevo can be estimated by the cost fomula in []. So, hee we focus on estimating the size of the veification egionπ. Fo simplicity, we assume that data points ae unifomly distibuted. Let d max be the maximum distance between quey point q and any point in the safe egion. Hence, the cicula egion (q,d max) can completely cove the safe egion. If a cicula egion with adius and cente outside (q, + d max), it cannot ovelap with (q,d max) and thus it cannot ovelap with the safe egion. Theefoe, (q, + d max) is a valid veification egion. Since Π is VO-optimal and (q, +d max) is a valid veification egion, Π is completely coveed by (q, + d max). In [], the uppe bound of the expected distance m up that a point can move staightly within a safe egion is estimated as.33, whee n is the n numbe of data points in D. Hee, we use m up to appoximate d max. Theefoe, the size of the VO is estimated by substituting the aeaπ( +.33 n ) into the MR-teeVO size analysis in []..5 Communication Optimization Ou Ac-Based method computes safe egions in ode to minimize the communication fequency between the mobile client and the seve. In this section, we discuss how the client can euse the peviously eceived veification object VO in ode to futhe educe the communication fequency between the seve and the client even when the client leaves the safe egion. Let us conside the example in Figue 5. In Figue 5a, a client is located at q now and its pevious location was at q last. At q last, the ange quey esult set was {g 1,g,g 3} and its safe egion SR({g 1,g,g 3},D ) was the egion abdc. The veification egion Π last was the light gey egion. Since Π last intesected the nonleaf entiese 1,e, thei leaf nodes wee visited and thei data points wee inseted into the veification object VO last. Π last did not intesecte 3 soe 3 was inseted intovo last, and the subtee ofe 3 was not visited. Thus,VO last = {g 1,g,g 3,g,e 3}. Late on, the client moves to a new location q now, which is outside the safe egion. Befoe sending a new quey to the seve, the client can un Algoithm again using the pevious VO last and its cuent client location q now as inputs. Fist, the client finds the quey esult set of q now fom VO last and the esults ae {g 1,g,g 3,g }. Then, the coesponding safe egion SR({g 1,g,g 3,g },D ) is computed as the egion bdf and the coesponding veification egion Π now is computed as the dak gey egion shown in Figue 5b. Obseve that Π now does not intesect any non-leaf enties in VO last (e.g., e 3), the client actually can compute the esults and the safe egion without any data points fome 3. Theefoe, it does not issue a new quey to the seve. This (a) veification egionπ last foq last (b) veification egion Π now foq now Figue 5: ReusingVO fo moving ange quey authentication 5. EXPERIMENTAL STUDY We evaluate ou methods using both synthetic and eal datasets. We implemented all methods in C++ with the cyptogaphic functions in the Cypto++ libay. All expeiments wee un on a.5 GHz Intel PC unning Ubuntu with GB of RAM. The page size of MR-tees is set to Kbytes. Datasets and quey tajectoies The eal datasets ae NA (Noth Ameica, 175K points), ARG (Agentina, 5K points), CHINA (China, 3K points) 5. These datasets have also been used in [1, 3] to model points-of-inteests in diffeent counties. We also geneated UNI (synthetic unifom) and GAU (synthetic Gaussian) datasets fo the scalability expeiments. We followed [, 3, ] to geneate each GAU dataset such that it contains 1 Gaussian bells of equal size and evey Gaussian bell has a standad deviation as.5% of the domain space length. The quey wokload contains tajectoies of 5 moving objects geneated by tajectoy geneato in [1]. Each tajectoy simulates an object unning in Euclidean space (diectional movement) and has a location ecod at evey timestamp; thee ae 1, timestamps in total and the time between adjacent timestamps is 1 second. Theefoe, each object s jouney is about 1, seconds (i.e., about.7 hous). We ty to simulate the scenaio of a ca (default speed 5km/h) moving at the county level (i.e., on CHINA, ARG, and NA datasets). Table shows the building time of MR-tees on the eal datasets and synthetic datasets (5K data points to 1K data points). The time of building MR-tees scales well with the data size. Table : MR-Tee building time Dataset Building Time (seconds) MR-tee CHINA 1.75 ARG.71 NA 1.5 5, UNI/GAU 3.11 / 35. 1, UNI/GAU 3.11 / 7.7, UNI/GAU 1. / , UNI/GAU 33.3 / 39. 1,, UNI/GAU 73.9 / 5.7 Pefomance measue Following [1], we measue the cumulative total cost fo each object s tajectoy. In ou expeiments, we Cypto++ libay: 5 Downloaded fom and challenge9/download.shtml We have epeated the whole expeimental study using MR*-tee. The expeimental esults ae simila and not descibed hee.

8 Communication Fequency Communication Fequency Communication Fequency speed (km/h) speed (km/h) Seve Time (sec) speed (km/h) speed (km/h) (a) comm. fequency [CHINA] (b) comm. cost (kbytes) [CHINA] (c) seve CPU time (sec) [CHINA] (d) client CPU time (sec) [CHINA] speed (km/h) speed (km/h) Seve Time (sec) speed (km/h) speed (km/h) (a) comm. fequency [ARG] (b) comm. cost (kbytes) [ARG] (c) seve CPU time (sec) [ARG] (d) client CPU time (sec) [ARG] speed (km/h) speed (km/h) Seve Time (sec) speed (km/h) speed (km/h) (a) comm. fequency [NA] (b) comm. cost (kbytes) [NA] (c) seve CPU time (sec) [NA] (d) client CPU time (sec) [NA] Figue : Effect of quey speed (on vaious eal datasets) epot the communication cost (in kilobytes) as the total size of VO pe object. This is the most impotant measue in this pape and we hope to minimize it. We also epot the communication fequency, which is the numbe of clients queies eceived by the seve, pe object. In addition, we epot the seve and client CPU time (in seconds), pe object jouney. Competitos We now epot the expeimental esults of moving ange queies. The default quey ange is 5 km fo a moving client (i.e., on CHINA, NA, and ARG datasets). We compae ou method with the baseline buffeing method (BASE) mentioned in Section 3. Again, BASE s pefomance depends on the value, which in tuns depends on vaious factos such as the quey ange, quey speed, data size, and data distibution. The optimal fo a paticula setting cannot be found unless we exhaustively ty evey possible value. Howeve, fo compaison pupose, we also caied out such a manual tuning pocess fo BASE in all ou expeiments. We use to denote the best pefomance of BASE that uses the optimal value. We use to epesent the aveage pefomance of BASE ove evey value. 5.1 Effect of Quey Speed We study the effect of moving quey speed on the pefomance of ou -method,, and. Figue shows (a) the total communication fequency, (b) the total communication cost, (c) the total seve CPU time, and (d) the total client CPU time, of each moving object, with espect to diffeent quey speeds, in its.7-hou jouney, on the thee datasets. In Figue a, the communication fequency of is annotated with the coesponding optimal value (in km) found by ou manual tuning pocess. When the quey speed inceases, a client using the baseline methods leaves its buffe egion easie, so its communication fequency inceases. The communication fequency of ou -method ises slowly because ou method euses the VO wheneve applicable. Togethe with the fact that ou VOoptimal method constucts vey compact VO, this explains why the communication cost of ou -method is much smalle than that of the baseline methods in Figue b. The seve computation ovehead of ou -method is vey small (Figue c). That is because the communication fequency of -method is small and also computing safe egions fo moving ange queies is not expensive. The client CPU times of all methods ae shown in Figue d. We can see that all methods incu almost negligible computational ovehead on the client side, which is less than.1 CPU seconds fo a.7-hou jouney. 5. Effect of the Quey Range Figue 7 shows the effect of the quey ange. In Figue 7a, we can see that the communication fequencies of the baseline methods ae quite stable when inceases. That is because the optimal values fo the baseline methods do not vay when inceases, so all buffeing egions have the same size. Since the speed of the client is constant in this expeiment, with constant size buffeing egions, the communication fequencies of the baseline methods emain unchanged. The communication fequency of ou method inceases slowly when inceases. That is because the numbe of esult points inceases when inceases. As the safe egion of moving ange quey is defined as the intesection of esult points excluding the union of non-esult points, the incease of esult points esults in a smalle safe egion. This explains the incease of communication fequency with. Howeve, the communication cost of ou -method is much lowe than the baseline methods (Figue 7b) because ou method is VO-optimal and thus is able to constuct vey compactvo. When inceases, the quey

9 Communication Fequency Seve Time (sec) Communication Fequency Communication Fequency adius (km) adius (km) adius (km) adius (km) (a) comm. fequency [CHINA] (b) comm. cost (kbytes) [CHINA] (c) seve CPU time (sec) [CHINA] (d) client CPU time (sec) [CHINA] adius (km) adius (km) Seve Time (sec) adius (km) adius (km) (a) comm. fequency [ARG] (b) comm. cost (kbytes) [ARG] (c) seve CPU time (sec) [ARG] (d) client CPU time (sec) [ARG] adius (km) adius (km) Seve Time (sec) adius (km) adius (km) (a) comm. fequency [NA] (b) comm. cost (kbytes) [NA] (c) seve CPU time (sec) [NA] (d) client CPU time (sec) [NA] Figue 7: Effect of (on vaious eal datasets) Communication Fequency Seve Time (sec) data size (x 1 points) data size (x 1 points) data size (x 1 points) data size (x 1 points) (a) comm. fequency (b) comm. cost (kbytes) (c) seve CPU time (sec) (d) client CPU time (sec) Communication Fequency Figue : Effect of data size (UNIFORM) Seve Time (sec) data size (x 1 points) data size (x 1 points) data size (x 1 points) data size (x 1 points) (a) comm. fequency (b) comm. cost (kbytes) (c) seve CPU time (sec) (d) client CPU time (sec) Figue 9: Effect of data size (GAUSSIAN) esults ae lage and thus the VOs ae lage. Theefoe, the computation ovehead of ou -method on both the seve side and the client side incease but still stays low (Figue 7c and d). 5.3 Effect of Data Size We poceed to study the scalability of ou methods, by using synthetic data of diffeent sizes. Figue shows the pefomance of the methods unde unifom datasets of diffeent sizes. When the data size inceases, the data density ises. Theefoe, the quey esults as well as the VO-size geneally would incease, leading to a highe communication cost. Nonetheless, we emak that the communication cost of ou -method inceases mildly because of the compact VO constucted as well as the euse of the VO. Simila obsevations could be found on the Gaussian datasets (see Figue 9). 5. Validation ofvo Size Analysis Finally, we validate the theoetical analysis about the size of VO

10 in moving ange quey authentication. Ou analysis has made cetain simplifying assumptions like unifom data distibution. Thus, the following validation is conducted on unifom data only. Figue 1 shows the actual numbe of points coveed by the veification egion Π and the estimated numbe based on the equations in Section. duing moving ange quey authentication. The esults show that ou theoetical analysis is quite obust as it well captues the tend and the eo is below.1 on unifom datasets. Numbe of data points Estimated No. of Point Actual No. of Point 1 data size (x 1) Figue 1: VO analysis (UNIFORM). CONCLUSION In this pape, we pesented a famewok with efficient methods to authenticate moving ange queies. We poved that ou methods ae VO-optimal, i.e., the size of the veification object (VO) equied to cay out authentication is minimal in size. We also pesented optimization techniques that can futhe educe the communication fequency between a moving client and the sevice povide. Expeimental esults show that ou methods efficiently authenticate moving ange queies using a small communication cost and computational ovehead. As fo futue wok, we plan to extend ou methods to use othe othogonal ADS (e.g., PMKd-tee [13]) and establish the coespondingvo-optimality. 7. REFERENCES [1] N. Beckmann, H.-P. Kiegel, R. Schneide, and B. Seege. The R*-tee: An Efficient and Robust Access Method fo Points and Rectangles. In SIGMOD, 199. [] N. Buno, S. Chaudhui, and L. Gavano. Stholes: A multidimensional wokload-awae histogam. In SIGMOD, 1. [3] M. A. Cheema, L. Bankovic, X. Lin, W. Zhang, and W. Wang. Continuous monitoing of distance based ange queies. TKDE, 1. [] M. A. Cheema, L. Bankovic, X. Lin, W. Zhang, and W. Wang. Multi-Guaded Safe Zone: An Effective Technique to Monito Moving Cicula Range Queies. In ICDE, 1. [5] D. Gunopulos, G. Kollios, V.J.Tsotas, and C.Domeniconi. Selectivity estimatos fo multidimensional ange queies ove eal attibutes. VLDB J, 3. [] L. Hu, W.-S. Ku, S. Bakias, and C. Shahabi. Veifying spatial queies using voonoi neighbos. In GIS, 1. [7] G. S. Iweks, H. Samet, and K. P. Smith. Maintenance of K-nn and Spatial Join Queies on Continuously Moving Points. ACM TODS, 31():5 53,. [] A. Kundu and E. Betino. Stuctual Signatues fo Tee Data Stuctues. PVLDB, 1(1):13 15,. [9] A. Kundu and E. Betino. How to Authenticate Gaphs without Leaking. In EDBT, 1. [1] F. Li, M. Hadjieleftheiou, G. Kollios, and L. Reyzin. Dynamic Authenticated Index Stuctues fo Outsouced Databases. In SIGMOD,. [11] F. Li, K. Yi, M. Hadjieleftheiou, and G. Kollios. Poof-Infused Steams: Enabling Authentication of Sliding Window Queies On Steams. In VLDB, 7. [1] R. C. Mekle. A Cetified Digital Signatue. In CRYPTO, 199. [13] K. Mouatidis, D. Sachaidis, and H. Pang. Patially mateialized digest scheme: An efficient veification method fo outsouced databases. VLDB J, 1(1):33 31, 9. [1] S. Nutanong, R. Zhang, E. Tanin, and L. Kulik. The V*-Diagam: A Quey-dependent Appoach to Moving KNN Queies. PVLDB, 1(1):195 11,. [15] H. Pang, A. Jain, K. Ramamitham, and K.-L. Tan. Veifying Completeness of Relational Quey Results in Data Publishing. In SIGMOD, 5. [1] H. Pang and K. Mouatidis. Authenticating the Quey Results of Text Seach Engines. PVLDB, 1(1):1 137,. [17] H. Pang, J. Zhang, and K. Mouatidis. Scalable Veification fo Outsouced Dynamic Databases. PVLDB, (1): 13, 9. [1] D. Papadias, J. Zhang, N. Mamoulis, and Y. Tao. Quey pocessing in spatial netwok databases. In VLDB, 3. [19] S. Papadopoulos, Y. Yang, S. Bakias, and D. Papadias. Continuous Spatial Authentication. In SSTD, 9. [] S. Papadopoulos, Y. Yang, and D. Papadias. CADS: Continuous Authentication on Data Steams. In VLDB, 7. [1] R. L. Rivest, A. Shami, and L. Adleman. A Method fo Obtaining Digital Signatues and Public-key Cyptosystems. Commun. ACM, 1():1 1, 197. [] R. Sion. Quey execution assuance fo outsouced databases. In VLDB, 5. [3] Z. Song and N. Roussopoulos. K-Neaest Neighbo Seach fo Moving Quey Point. In SSTD, 1. [] Y. Tao, D. Papadias, and Q. Shen. Continuous Neaest Neighbo Seach. In VLDB,. [5] L. Wang, S. Noel, and S. Jajodia. Minimum-Cost Netwok Hadening using Attack Gaphs. Compute Communications, 9(1):31 3,. [] X. Xiong, M. F. Mokbel, and W. G. Aef. Lugid: Update-toleant gid-based indexing fo moving objects. In MDM,. [7] Y. Yang, D. Papadias, S. Papadopoulos, and P. Kalnis. Authenticated Join Pocessing in Outsouced Databases. In SIGMOD, 9. [] Y. Yang, S. Papadopoulos, D. Papadias, and G. Kollios. Authenticated Indexing fo Outsouced Spatial Databases. VLDB J., 1(3):31, 9. [9] K. Yi, F. Li, G. Comode, M. Hadjieleftheiou, G. Kollios, and D. Sivastava. Small Synopses fo Goup-by Quey Veification on Outsouced Data Steams. ACM TODS, 3(3), 9. [3] M. L. Yiu, Y. Lin, and K. Mouatidis. Efficient Veification of Shotest Path Seach via Authenticated Hints. In ICDE, 1. [31] M. L. Yiu, E. Lo, and D. Yung. Authentication of Moving knn Queies. In ICDE, 11. [3] M. L. Yiu and N. Mamoulis. Clusteing objects on a spatial netwok. In SIGMOD,. [33] J. Zhang, M. Zhu, D. Papadias, Y. Tao, and D. L. Lee. Location-based Spatial Queies. In SIGMOD, 3.