Optimal Sporadic Location Privacy Preserving Systems in Presence of Bandwidth Constraints

Transcription

1 Optimal Spoadic Location Pivacy Peseving Systems in Pesence of Bandwidth Constaints ABSTRACT Michael Hemann KU Leuven ESAT/COSIC, iminds Leuven, Belgium Claudia Diaz KU Leuven ESAT/COSIC, iminds Leuven, Belgium Vaious Location Pivacy-Peseving Mechanisms (LPPMs have been poposed in the liteatue to addess the pivacy isks deived fom the exposue of use locations though the use of Location Based Sevices (LBSs. LPPMs obfuscate the locations disclosed to the LBS povide using a vaiety of stategies, which come at a cost eithe in tems of quality of sevice, o of esouce consumption, o both. Shoki et al. popose an LPPM design famewok that outputs optimal LPPM paametes consideing a stategic advesay that knows the algoithm implemented by the LPPM, and has pio knowledge on the uses mobility pofiles [3]. The famewok allows uses to set a constaint on the toleable loss quality of sevice due to petubations in the locations exposed by the LPPM. We obseve that this constaint does not captue the fact that some LPPMs ely on techniques that augment the level of pivacy by inceasing esouce consumption. In this wok we extend Shoki et al. s famewok to account fo constaints on bandwidth consumption. This allows us to evaluate and compae LPPMs that geneate dummies queies o that decease the pecision of the disclosed locations. We study the tilateal tade-off between pivacy, quality of sevice, and bandwidth, using eal mobility data. Ou esults show that dummy-based LPPMs offe the best potection fo a given combination of quality and bandwidth constaints, and that, as soon as communication ovehead is pemitted, both dummy-based and pecision-based LPPMs outpefom LPPMs that only petub the exposed locations. We also obseve that the imum value of pivacy a use can enjoy can be eached by eithe sufficiently elaxing the quality loss o the bandwidth constaints, o by choosing an adequate combination of both constaints. Ou esults contibute to a bette undestanding of the effectiveness of Pemission to make digital o had copies of all o pat of this wok fo pesonal o classoom use is ganted without fee povided that copies ae not made o distibuted fo pofit o commecial advantage and that copies bea this notice and the full citation on the fist page. Copyights fo components of this wok owned by othes than the autho(s must be honoed. Abstacting with cedit is pemitted. To copy othewise, o epublish, to post on seves o to edistibute to lists, equies pio specific pemission and/o a fee. Request pemissions fom pemissions@acm.og. WPES 3, Novembe 4, 3, Belin, Gemany. Copyight is held by the owne/autho(s. Publication ights licensed to ACM. ACM /3/...$5.. Camela Toncoso Gadiant Vigo, Spain ctoncoso@gadiant.og Bat Peneel KU Leuven ESAT/COSIC, iminds Leuven, Belgium bat.peneel@esat.kuleuven.be location pivacy potection stategies, and to the design of LPPMs with constained esouce consumption. Categoies and Subject Desciptos C.. [Compute-Communication Netwoks]: Geneal Secuity and potection; K.4. [Computes and Society]: Public Policy Issues Pivacy Keywods Design; Secuity; Pivacy. INTRODUCTION Location Based Sevices (LBSs enable uses to, among othes, let thei fiends know whee they ae, find neaby points of inteest, o obtain contextual infomation about thei suoundings. The typical LBS implementation is such that use locations ae by default disclosed to the LBS povide. This aises pivacy concens, as location infomation is known to eveal potentially sensitive pivate infomation (e.g., visiting the mosque, chuch, o temple eveals eligious beliefs. A vaiety of Location Pivacy-Peseving Mechanisms (LPPMs, e.g., [6, 7, 7], have been poposed in pio eseach to mitigate these concens. To do so, these mechanisms obfuscate use locations befoe sending them to the LBS povide. The geat majoity of LPPMs in the liteatue ae designed consideing a non-stategic advesay. This assumes that the advesay is unawae of the LPPM obfuscation algoithm, and that he has no pio knowledge on the uses mobility pofiles. Howeve, both the LPPM s intenal algoithm and the use mobility pattens leak infomation that can be exploited by the advesay to educe he estimation eo when locating uses []. Hence, designs and evaluations that neglect such infomation oveestimate the level of pivacy potection offeed by the LPPM. Shoki et al. [3] poposed a famewok to design LPPM with optimal paametes consideing an advesay that has (and exploits infomation on: i the LPPM algoithm implemented; and ii the mobility pofile of the use. This famewok facilitates the design of LPPMs that imize the location estimation eo of stategic advesaies. Futhemoe, the famewok allows uses to establish a imum toleated quality of sevice loss stemming fom the use

2 of the LPPM. The famewok is suitable to model LBSs in which uses only eveal thei location spoadically, i.e. subsequent location exposues of the same use ae assumed to be sufficiently apat in time that it is not possible to link them as elated to the same individual. Examples of applications in which location evelations ae spoadic include check-in sevices [], o sevices fo finding neaby points of inteest []. The poblem statement in Shoki s famewok [3] does not conside constaints on esouces utilization (e.g., bandwidth, battey consumption. These ae howeve likely to be a concen fo uses in eality, since LBSs ae mostly accessed fom esouce-constained mobile devices. Ou fist contibution is to extend the famewok to account fo esouce limitations. Pio eseach has only applied the famewok to the design of petubation-based mechanisms, i.e., LPPMs that modify the location that is disclosed to the LBS povide. As second contibution, we model two othe popula pivacypeseving stategies in the context of the famewok. Both types of mechanisms incease the advesay s uncetainty on the uses actual position by aising the numbe of locations fom which the use could have issued a quey. In dummy-based mechanisms [4, 6, 6] the LPPM sends fake locations to the LBS seve along with the actual use equests. In pecision-based mechanisms [9,, 5] the LLPM deceases the pecision of the disclosed location sent to the LBS povide, so that thee is a bigge geogaphical egion in which they use might be located. Contay to the petubation-based LPPMs consideed by Shoki et al. [3], dummy-based and pecision-based LPPMs may consume moe esouces (e.g., bandwidth and battey in ode to conceal the uses location. Ou thid contibution is a study of the tilateal tade-off between quality of sevice, bandwidth consumption, and pivacy using these LPPMs as case study. We find that fo the consideed LPPMs both quality loss and bandwidth constaints can be taded fo pivacy. In fact, the imum achievable level of pivacy can be eached eithe when the quality loss constaint is sufficiently loose (as in [3], when sufficient bandwidth is allowed, o when an adequate combination of both is allowed. Ou simulations show that, fo given bandwidth and quality constaints, dummy-based LPPMs offe bette potection than pecision-based LPPMs. This is because dummy-based LPPMs have moe degees of feedom than pecision-based LPPMs in choosing the cove locations, and hence can bette exploit the available esouces. Finally, both dummy-based and pecision-based offe a bette pivacy level than just petubation fo the same quality of sevice, povided that the system can toleate the intoduction of a communication ovehead. The est of this pape is oganized as follows: the next section gives an oveview of the state of the at in location pivacy-peseving systems design. Section 3 descibes the system and advesaial models, as well as the constaints imposed on the design; and Section 4 evisits Shoki et al. s famewok. We descibe the linea pogams to compute diffeent classes of esouce-consuming LPPMs in Section 5, and validate them against eal data in Section 6. Finally, we conclude in Section 7.. RELATED WORK It is widely accepted that the disclosue of location data entails a pivacy isk: Hoh et al. show that ca diving taces enable the infeence of the dives home addesses [3]; this infomation by itself, o togethe with the dives wok place, can be used to e-identify anonymous taces [5, ]. Futhemoe, Feudige et al. point out that a people s mobility pattens ae pesistent and unique [8]. Theefoe, uses ae identifiable by the LBS even if they only shae thei location duing a shot peiod of time. Once location data is identifiable, it may eveal a detailed pictue of the peson s habits, lifestyle, and pefeences [3]. To counte this theat vaious obfuscation-based Location Pivacy Peseving Mechanisms (LPPMs been poposed in the liteatue. These mechanisms obfuscate the evealed locations and thus pevent (o at least limit the possible infeences that could be made fom the data. Following the categoization poposed by Shoki et al. [] we biefly intoduce the existing obfuscation stategies and efe the eade to [] fo a moe detailed eview. Petubation-based LPPMs [, 7] modify a uses epoted location such that at least two uses might be associated to a location. Pseudonymization-based LPPMs egulaly change the identity with which uses identify themselves to the LBS povide, in ode to pevent the linkage of two subsequent use locations, thus peventing the advesay fom econstucting the tajectoies followed by the uses of the system. These LPPMs can be combined with hiding-based LPPMs, which allow uses to sometimes hide thei location [5], futhe deceasing the advesay s capability to link location exposues. Pecision-based LPPMs [4, 9,, 5] educe the ganulaity of the location data evealed to the povide, so that it is not possible to pinpoint the exact location of a use within a geogaphical egion. Finally, dummybased LPPMs [4, 6, 6] automatically geneate queies with fake position data that ae indistinguishable fom the uses eal queies. Hee the advesay is unable to detemine whethe the location associated with a quey coesponds to the uses actual position, o is a decoy. Shoki et al. have poposed methods to quantify and systematically evaluate the level of pivacy povided by obfuscation-based LPPMs [, ]. They fomalize the obfuscation pocess pefomed by the LPPM, as well as the attack stategies that an advesay can use to invet the location tansfomations made by the LPPM. They measue pivacy as the expected eo of a stategic advesay when estimating the actual location of a use. This quantitative appoach is a conestone of thei LPPM design famewok, whee they popose a systematic method to design LPPMs that ae optimal with espect to stategic advesaies, who ae awae of the LPPM s intenal opeation and the uses mobility pofiles [3]. This famewok allows uses to indicate the imum quality loss (deived fom the use of the LPPM that they ae willing to toleate. The design famewok then outputs a set of paametes fo the LPPM that imize the eo of the advesay when attempting to locate uses. Ou wok builds on this famewok and extends it to account fo not only quality loss, but also fo limitations on bandwidth consumption. Finally, we note that thee ae othe appoaches to building location pivacy systems that ae not based on obfuscation stategies and ae thus out of the scope of this pape.

3 This includes cyptogaphic appoaches such as those based on Pivate Infomation Retieval potocols [8]. 3. SYSTEM MODEL In this pape, we extend the famewok by Shoki et al. [3] to account fo bandwidth constaints in Location Pivacy Peseving Mechanisms (LPPMs. Theefoe, we follow the famewok s system model and definitions and augment them when needed to account fo bandwidth constaints. The focus of the famewok is on use-centic mechanisms, in which the configuation of the LPPM is decided on independently by each use, without knowledge about othe uses in the system. Thus, without loss of geneality, we estict ou model and analysis to a single use. We note that cloaking mechanisms, in which the geogaphical egion disclosed is chosen taking into account the positioning of a set of uses [], can also be modeled as use-centic mechanisms because thei pivacy guaantees depend only on the size of the egion [4]. Use model: Similaly to pio wok [3] we conside that the use moves aound in a finite geogaphical aea that is divided into M discete egions R = {,,..., M }. Uses only expose thei location R spoadically to an LBS povide in ode to obtain a sevice. A uses LBS usage patten is descibed by he mobility pofile ψ(, ψ( =, a pobability distibution descibing he likelihood of being at location when queying the LBS. We make no paticula assumption on the uses mobility pattens, i.e., we impose no estictions on the pofiles ψ(. As usage is spoadic, the locations fom which the use accesses the sevice at diffeent time instants ae independent fom each othe. Theefoe, the mobility pofiles only descibe the fequency with which uses visit locations, and does not contain infomation about tansitions between egions. Location pivacy-peseving mechanism: The use uns in he pesonal device an LPPM that tansfoms he eal location R into a pseudo-location R. This tansfomation is made accoding to a pobability distibution f( = P(. The pseudo-location is exposed to the LBS povide instead of he actual location. Shoki et al. [3] conside that R = R. In this wok we extend R to be the poweset of R except the empty set; i.e., R = P(R { }. Hence, i pseudo-locations may o may not contain the eal location ; and ii diffeently fom pio wok [3], in which pseudo-locations ae fomed by one egion in R, hee may be fomed by one o moe egions i in R. Advesay model: We conside that the use wants to potect he eal location towads a passive advesay that has access to the locations exposed to the LBS. This advesay could be the LBS povide, an eavesdoppe of the use-povide communication, o othe LBS subscibes with which exposed locations ae shaed. We assume that the advesay knows the uses pofiles ψ(, which can be infeed, fo instance, using existing leaning techniques []. Following pio wok [3] we model the advesay s stategy as a pobability distibution h(ˆ = P(ˆ. This distibution descibes the pobability that, given an exposed location, the estimated location ˆ coesponds to the uses eal position. We measue the pivacy loss as the advesay s expected eo in this estimation ˆ given that the eal location is. We model the advesaial eo as a function d p(ˆ, that depends on both the uses pivacy citeia and on the semantics of the location [3]; as well as on the tansfomation function f( implemented by the LPPM. (We povide examples of functions d p( that ae adequate fo paticula LPPMs in Section 5. Quality of sevice: Uses expect to obtain elevant infomation fom thei queies to the LBS. Because the esponse of the LBS to a quey depends on the obseved location, and not on the eal location, the infomation contained in the esponse may be of less utility to the use than that contained in a esponse to a quey in which is exposed. Given an LPPM f(, the expected quality loss suffeed by the use can be computed as: E[Q loss (ψ, f, d q] =, ψ(f( d q(,. ( In this fomula ψ( epesents the pio pobability of the use accessing the LBS fom location (i.e., accoding to he mobility pofile; f( epesents the pobability of exposing given that the use is at ; and the function d q(, epesents the quality loss esulting fom exposing instead of to the LBS povide. (We povide examples of d q( functions adequate fo paticula LPPMs in Section 5. In layman wods, E[Q loss (ψ, f, d q] eflects the aveage discontent expeienced by uses when utilizing an LPPM. We assume that the use imposes a imum toleable sevice quality loss Q loss. The LPPM output must satisfy the constaint E[Q loss (ψ, f, d q] < Q loss. Bandwidth constaints: The fact that Shoki et al. conside R = R implies that the LPPM neve incus in communication ovehead when sending instead of. Since we have set R = P(R { }, sending may equie moe bandwidth than sending (e.g., if is composed by seveal egions in R. LBSs ae mostly accessed fom mobile devices which in geneal have esticted connectivity and limited esouces, and hence uses may want to limit the ovehead intoduced by the LPPM. We extend the existing model [3] to account fo this fact by defining the expected bandwidth ovehead incued by LPPM f( as: B cost(ψ, f, d b =, ψ(f( d b (,, ( In this fomula ψ( and f( have the same ole as in Eq. (. The function d b (, epesents the additional cost in tems of bandwidth deived fom exposing instead of. (We povide examples of d b ( functions adequate fo paticula LPPMs in Section 5. We assume that the use imposes a imum toleable bandwidth B cost. As with quality loss constaints, the LPPM must satisfy B cost < B cost. We note that, although we only conside limitations on communication ovehead, the function d b ( can model othe constaints elated to esouce consumption esulting fom exposed pseudo-locations that may be fomed by seveal egions, e.g., the incease in battey consumption needed to send moe packets, o to pocess moe esponses. Pivacy: The level of pivacy enjoyed by uses depends on the attack stategy deployed by the advesay. Following the definition by Shoki et al. [, 3] we measue the expected pivacy of the use as: Pivacy(ψ, f, h, d p = ψ(f( h(ˆ d p(ˆ,. (3,,ˆ

4 Real location Use Mobility pofile ( Quality constaint Q loss Bandwidth constaint Attack h( f( B loss Pseudo location Pseudo location Advesay Mobility pofile ( Quality constaint Q loss Bandwidth constaint LPPM f( h( B loss Estimated location a Real location b Petubation Figue : System model. Each summand in this equation epesents the pobability that the use obtains a pivacy level d p(ˆ,, when she accesses the LBS fom location location, exposes pseudolocation, and the advesay estimates ˆ given the obsevation. Figue illustates the elationships between the diffeent elements of this model. Note that we conside that the defense (esp., the attack takes into account the attack (esp., the defense implemented by the advesay (esp., the use, as well as the uses mobility pofile and he constaints in tems of bandwidth and quality of sevice. 4. A GAME THEORETIC APPROACH TO LOCATION PRIVACY In this section we evisit the design methodology poposed by Shoki et al. in pio wok [3]. This method allows the use to choose optimal paametes fo the LPPM f(, given an advesay that implements the optimal attack h( against this defense. Given a use mobility pofile ψ( and quality of sevice constaint Q loss, the method models the design of the optimal LPPM as an instance of a zeo-sum Bayesian Stackelbeg game. The Stackelbeg competition in the context of location pivacy is stated as follows: a leade (the use, commits fist to an LPPM f( that satisfies the quality constaint Q loss. Fo this pupose the LPPM takes the uses actual location as input, and outputs a pseudo-location. Upon obseving the exposed location, a followe (the advesay, estimates the eal location though the attack h(, taking into account both the uses pofile ψ( and the LPPM f( chosen by the use. The advesay pays an amount d p(ˆ, to the use that epesents the estimation eo fom the advesay s pespective, and the location pivacy gain fom the uses pespective. Both playes aim at imizing thei payoffs: the advesay ties to minimize the amount to pay (i.e., minimize he estimation eo, while the use ties to imize this amount (i.e., imize he location pivacy. The game is zeo-sum, as the advesay s infomation gain equals the pivacy lost by the use, and vice-vesa. It is also a Bayesian game since the advesay only has access to pobabilistic data about the uses eal location; i.e., he infomation on the use is incomplete. 4. Petubation-based LPPM Shoki et al. validate thei famewok by applying it to the design of petubation-based stategies. In this scenaio R = R, and hence the pseudo-locations output by the c Dummies d Pecision eduction Figue : Toy example (R = {,..., 9}: a Real use location; b Petubation-based LPPM R = R; c Dummybased LPPM; d Reducing pecision-based LPPM. LPPM ae fomed by one egion i R, which may o may not be equal to the eal location. Let us conside the toy example in Fig. a, in which the aea R is fomed by 9 egions, and whee the use queies the LBS povide fom location 5. Two possible pseudo-locations ae shown in Fig. b, depicted in black and gay. Note that the black coincides with the eal use location = 5, while the gey pseudo-location = 7 does not. Solution: We now pesent the linea pogams developed in pio wok [3] to compute the optimal petubation and attack stategies f( and h(. These linea pogams compute the theoetic equilibium of the game descibed above. The use uns the following linea pogam to find the optimal paametes fo he petubation-based LPPM: Choose f(, x,, that imize x (4 subject to x ψ(f( d p(ˆ,, ˆ, (5 ψ( f( d q(, Q loss (6 f( =, (7 f(,, (8 The decision vaiable f( epesents the LPPM algoithm, while x epesents the expected pivacy of the use (see Appendix A. The inequalities defined by Eq. (5 expess the pivacy constaint, ensuing that f( is chosen to imize x ; while the inequalities defined by Eq. (6 expess the quality constaint, ensuing that the expected quality of sevice loss is at most Q loss. Finally Eq. (7 and (8 ensue that f( is a pope pobability distibution. On the othe hand, the advesay uns the following linea pogam to obtain the optimal attack function h(ˆ, which

5 minimizes pivacy when the use implements a petubationbased LPPM f( : Choose h(ˆ, y,,, ˆ, andz q [, that minimize subject to ψ( y + z qq loss (9 y ˆ h(ˆ d p(ˆ, + z qd q(,,, ( h(ˆ =, ( ˆ h(ˆ,, ˆ ( z q (3 The decision vaiable h(ˆ epesents the advesay s attack stategy on the LPPM algoithm, and y the expected pivacy of the use (see Appendix A. The vaiable z q acts as shadow pice fo the quality. It expesses the loss (gain in pivacy when the imum toleated expected quality loss Q loss deceases (inceases by one unit. We efe the eade to Shoki s pio wok fo moe details on the meaning of this vaiable [3]. The inequalities defined by Eq. ( epesent constaints on pivacy, ensuing that h(ˆ is chosen to minimize pivacy given the quality constaints; and Eqs ( and ( ensue that h( is a pope pobability distibution. Finally Eq. (3 ensues that the tade-off between quality and pivacy expessed by z q is non-negative. Quality, Bandwidth, and pivacy constaints: Petubation-based LPPMs output one-sized egions R = R. This detemines the functions used to model the constaints imposed by the use. Since pseudo-locations and eal locations have the same size, thee is no communication ovehead in the model. Theefoe, the bandwidth constaint B cost does not affect the optimization and does not appea in the linea pogams. Futhemoe, in this setting both the quality and the pivacy constaints can be expessed in tems of the distance between the exposed location (esp., the infeed location ˆ and the actual use location [3]. Fo the sake of simplicity, in ou expeiments fo petubation-based LPPMs we model both d q(, and d p(ˆ, as the Manhattan distance between the two locations (e.g., d p(ˆ, = ˆ. 5. BANDWIDTH-CONSUMING LOCATION PRIVACY PRESERVING MECHANISMS In this section we model two popula families of Location Pivacy-Peseving Mechanisms (LPPMs in the liteatue that consume exta bandwidth to incease uses pivacy: dummy-based LPPMs, and pecision-based LPPMs. To model these stategies we extend the game-theoetic appoach outlined in the pevious section to also account fo bandwidth constaints. We descibe two linea pogams that output the uses optimal LPPM f( and the advesay s optimal attack h(, while especting the quality and bandwidth constaints. 5. Dummy-based LPPM Dummy-based LPPMs automatically geneate dummy queies that ae sent to the LBS povide along with the uses eal queies [4, 6, 6]. The dummy queies contain fake locations and thei goal is to incease the advesay s estimation eo on the uses eal location, since fo the advesay all eceived locations ae equally likely to coespond to the uses actual position. A dummy-based LPPM f( outputs pseudo-locations fom R = P(R { } fomed by one o moe noncontiguous egions i R, which may o may not contain the eal location. In the toy example shown in Fig. c we can see two possible outputs when the use sends one dummy quey fomed by two egions. The black pseudolocation = {, 5} contains the eal location = 5, while the gey pseudolocation = { 3, 8} does not. In the latte case the LPPM no only geneates decoy locations, but also petubs the uses position. Solution: The linea pogam to compute the optimal dummy-based LPPM is simila to the petubation-based case, with one impotant diffeence: it includes a set of inequalities to ensue that the expected communication ovehead associated to the use of dummies does not exceed the imum expected bandwidth consumption B cost : Choose f(, x,, that imize x (4 subject to x ψ(f( d p(ˆ,, ˆ, (5 ψ( f( d q(, Q loss (6 ψ( f( d b (, B cost (7 f( =, (8 f(,, (9 The new inequality (7 adds the bandwidth constaint, so that the expected bandwidth consumption does not exceed B cost. Fom the advesay s point of view, the linea pogam used to compute the optimal attack h(ˆ diffes fom the petubation-based case in that we intoduce a new shadow pice z b in Eq. (5. This new vaiable models the elation between pivacy and bandwidth in the same manne as z q models the elation between pivacy and quality. We obtain: Choose h(ˆ, y,,, ˆ, z q [,, z b [, to minimize subject to y ˆ ψ( y + z qq loss + z b B cost ( h(ˆ d p(ˆ, + z qd q(, + z b d b (,,, ( h(ˆ =, ( ˆ h(ˆ,, ˆ (3 z q (4 z b (5

6 Quality, bandwidth, and pivacy constaints: As the dummy-based LPPM tansmits dummy locations to the LBS povide, the functions d q(, and d b (,, which expess the constaints on quality and bandwidth, need to take into account that pseudo-locations can be composed by seveal egions. With espect to the quality of sevice function d q(, we distinguish two cases. If the actual location is among the egions contained in the pseudo-location, then the quality loss is zeo, as the use eceives a esponse coesponding to he eal location. Fomally, d q(, =, :. If on the othe hand the eal location is not within the exposed pseudo-location, we assume that the esponse fo the neaest location will povide the most useful esponse to the use, and thus measue the quality loss as the minimum of the distances between the eal location and each of the locations i contained in. Fo instance, consideing the Manhattan distance, d q(, = min i i, : /. The bandwidth function d b (, takes into account that the system sends and eceives moe taffic when dummies ae implemented. This exta bandwidth consumption may be due to an incease in the length of the quey if all dummies ae sent in one equest; o to an incease in the numbe of queies if dummies ae sent in sepaate equests. In this pape we conside that each dummy inceases the bandwidth ovehead by units: one unit fo uploading and one unit fo downloading. Fomally: d b (, = ( i. As in the petubation-based case, the pivacy function d p(ˆ, consides the locations ˆ, R and hence this function does not need to be modified. 5. Pecision-based LPPM Pecision-based LPPMs educe the pecision of the location exposed by disclosing a lage egion [9,, 5]. This makes it had fo the advesay to pinpoint the exact location of the use. As in the pevious case, the LPPM f( outputs pseudo-locations fom R = P(R { }, but in this case is fomed by a set of one o moe contiguous egions i R that may o may not contain the eal location. The locations contained in fom the egion that is sent to the LBS povide. In the toy example shown in Fig. d, we can see two possible outputs when the pecision is halved by exposing two egions. The black pseudo-location = { 5} { 6} contains the eal location = 5, while the gey pseudo-location = { 7} { 8} does not. In the latte case the LPPM no only exposes decoy locations, but also petubs the uses position. Solution: The bandwidth consumed by a pecision-based LPPM stongly depends on the type of infomation equied by the LBS. Let us conside an LBS that etuns neaby points of inteest. When the use issues a equest fo a lage pseudo-location (i.e., with educed pecision, the esponse contains moe points than when the pseudo-location is small, equiing moe bandwidth. This is simila to the dummy-based case but has diffeent quality loss and communication ovehead, as explained below. Hence, the optimal defense can be computed using the appopiate functions d q( and d b ( in the linea pogam (Eqs (4-(9. We efe to this type of systems as neaby pecision-based LPPMs. Now conside an LBS in which the povide etuns the value of inteest (e.g., taffic congestion fo a epesentative location within. In this case the LBS esponse contains just one value independently of the size of the egion, and hence diminishing the pecision does not incease the bandwidth consumption. This is simila to the petubationbased case, whee thee LPPM does not incu in a communication ovehead, but has diffeent quality loss as explained below. The optimal LPPM paametes can be computed using the appopiate function d q( in the linea pogam (Eqs (4-(8. We denote these systems as aggegated pecisionbased LPPMs. Quality, Bandwidth, and pivacy constaints: The quality loss intoduced by pecision-based LPPMs depends on the type of system. Fo neaby pecision-based LPPMs thee is no quality loss when the uses actual location is included in, because the esponse includes the points of inteest neaest to this location, and thus d q(, =, :. Othewise, we measue the quality loss as the minimum distance between the use location and the locations contained in (d q(, = min i i, : /. Fo aggegated pecision-based LPPMs, in which the esponse is one epesentative value, lage egions educe the expected quality of sevice. In ou expeiments we measue the quality loss as the aveage distance fom the use location to the egions i R in, i.e., d q(, = i i /N, being N the numbe of egions in. The bandwidth consumption only inceases fo neaby pecision-based LPPMs. We define the function d b (, that descibes the communication cost, as d b (, = ( i, and add one unit of bandwidth fo each exta egion i included in. The estimation of the advesay is a location ˆ R, and thus the pivacy constaint does not need to be modified. 6. EVALUATION The linea pogams pesented in the pevious section output optimal LPPM paametes. In this section we evaluate the tade-off between location pivacy, sevice quality, and communication ovehead in diffeent types of LPPMs. Fo this pupose we measue the expected Pivacy(ψ, f, h, d p offeed by an LPPM fo a given mobility pofile ψ(, using diffeent combinations of imum toleable expected quality loss Q loss and expected bandwidth consumption B cost. These constaints ae modeled depending on the stategy followed by the LPPMs as descibed in Sections 4., 5., and 5.. Fo pecision-based LPPMs we distinguish between neaby pecision-based LPPMs, which incu in communication ovehead but no quality loss; and aggegated pecisionbased LPPMs, which do not consume exta bandwidth but educe the quality of sevice. Existing Dummy-based LPPMs [4, 6, 6]: In these schemes the LPPM algoithm selects a fixed numbe of equests b u containing dummy locations. These dummy locations, which ae sent to the LBS povide along with the eal equest, ae chosen depending on the uses mobility pofile. The eal location may be petubed o not. We model existing dummy-based LPPMs as follows: the use sets a value fo the bandwidth consumption b u that establishes the allowed communication ovehead. Then is chosen accoding to the uses mobility pofile fom all possible pseudo-locations that contain b u dummies. We note that, in some poposed systems, dummies ae chosen also depending on pevious exposues in ode to esemble ealistic movements. Howeve, since we limit ou analysis to spoadic LBSs, in which the locations fom which the use makes subsequent equests

7 ae not coelated, we do not conside past exposues when selecting dummy locations. Existing Pecision-based LPPMs [9,, 5]: In these schemes the use sets a paamete that defines the pecision of the exposed location. The eal location may be petubed o not. We model existing pecision-based LPPMs as follows: Given that the use chooses a imal pecision eduction s u, the LPPM selects fom all pseudo-locations containing s u contiguous egions i R, such that the following condition holds: i : i s u, consideing the Manhattan distance as quality loss function. Existing attacks: Similaly to pio wok [3] we evaluate LPPMs with espect to Bayesian infeence attacks []. This attack invets the algoithm implemented by the LPPM using the posteio pobability distibution ove all locations given the uses pofile. Optimal attacks: We also evaluate the diffeent LPPMs against optimal attacks. We test the pefomance of the optimal LPPM towads the optimal attack output by the famewok; and the pefomance of existing defenses against the optimal attack against descibed in pio wok which we epeat hee fo convenience [3]: Minimize subject to ˆ ψ(f( h(ˆ d p(ˆ, (6 ˆ,, h(ˆ =,, and h(ˆ, ˆ, (7 6. Expeimental setup We use eal mobility pofiles obtained fom the CRAW- DAD dataset epfl/mobility [9] to evaluate the LPPMs pefomance. This dataset contains GPS coodinates of appoximately 5 taxis collected ove 3 days in the San Fancisco Bay Aea. The level of pivacy offeed by the LPPMs depends on the size of the aea of inteest, as well as on the numbe of egions M in which the aea is divided. These paametes define the size of the egions i, and hence influence the accuacy with which the advesay estimates the use location. When the choice of paametes esults in small egions i, the advesay can locate the use with moe pecision than when egions ae big (e.g., a lage egion of inteest divided in few egions. In the following we justify ou choices fo the size of the aea of inteest and the numbe of egions used in ou expeiments. Numbe of egions. The numbe of egions has a stong impact on the unning time of the optimization because the numbe of possible eal locations, pseudo-locations, and estimated locations define the numbe of inequalities involved in the linea pogams. In ou evaluation we need to un a lage numbe of linea pogams to test a significant sample of quality/bandwidth constaint combinations. Hence, we need to choose an appopiate numbe of egions in the aea of inteest to be able to un ou expeiments in easonable time. Let us conside that the aea of inteest is divided with a gid of M = α β egions, with no paticula estiction on the egions shape o size. In the stategies consideed in this pape, the numbe of eal and estimated locations ( and ˆ is the same, and equal to the cadinality of R, i.e., M = cad(r = α β. Howeve, the numbe of possible pseudo-locations depends on the stategy im- Table : Pefomance times fo diffeent gid sizes Petubation-based Gid size Mean Std % finished x.s (. h.6s. 3x3.8s (. h.36s. 4x4.39s (. h.34s. 5x5.3s (. h.64s. 6x6 6.s (. h 5.s. 7x7.4s (.6 h 8.48s. 8x s (.9 h s. 9x s (.95 h 45.49s. x s (3.67 h 666.s. Dummy-based Gid size Mean Std % finished x.s (.h.8s. 3x3.8s (.h.33s. 4x4 67.9s (.86h s 78.8 Pecision-based Gid size Mean Std % finished x.9s (. h.s. 3x3.6s (. h.8s. 4x4.84s (. h.35s. 5x5 6.47s (. h.6s. 6x6 68.5s (. h 39.74s. 7x s (.3 h 9.8s x8 77.8s (.49 h 546.9s x s (.96 h 57.97s 68. x 63.4s (7.8 h 68.76s plemented by the LPPM. The petubation-based LPPM tansfoms eal locations into one-egion pseudo-locations, hence cad(r = cad(r. The dummy-based stategy allows pseudo-locations to contain any combination of noncontiguous locations, and we can compute the numbe of possibilities fo as cad(r = M ( M i= i. Finally, in the pecision-based mechanisms pseudo-locations contain combinations of contiguous locations. Fo simplicity in ou expeiments fo pecision-based LPPMs we limit R to ectangula pseudo-locations (this would make the pseudo-location = { 4} { 7} { 8} in Figue ineligible. Theefoe, the numbe of pseudo-locations is cad(r = α i= β j= (α i(β j. We un the linea pogams on an HP PoLiant DL98 G7 seve with 5 GB RAM and 8 pocessos Intel E7 86 with coes each (total 8 coes using MATLAB s linpog( function, and MATLAB s paallel computing capabilities. Table shows the amount of time needed to compute an LPPM function f( fo diffeent gid sizes αxβ, aveaged ove combinations of quality and bandwidth estictions. As expected, the linea pogam unning time gows slowe fo petubation-based LPPMs than fo pecision-based LPPMs, and dummy-based LPPMs quickly become intactable (in fact, we could not compute any LPPM fo a 5x5 gid. While unning the expeiments we also noticed that when the size of the gid inceases MATLAB s linea pogam solve could not find a solution fo some of the optimization poblems. The pecentage of successful optimizations fo each scenaio is shown in the thid column of Table. We note that othe linea pogam solves could impove

8 5 Pivacy(ψ, f, h, d p Pivacy E[Q loss (ψ, f, d q E[Q loss (ψ, f, d q Figue 5: Petubation-based LPPM: pivacy level against the optimal attack; and aveage expected quality loss. Figue 3: Consideed aea in San Fancisco. Figue 4: Use pofile. The dake the egion the highe the pobability that the use accesses the LBS fom this location. this pecentage, as well as educe the unning time of the optimization. Fo pefomance easons, in ou expeiments we choose a gid size of 8x6 fo petubation-based and pecision-based LPPMs, and 4x3 fo dummy-based LPPMs. Howeve, we must stess that a use only needs to un the linea pogam optimization once to compute he optimal potection stategy, and that the mobile device can outsouce this opeation to a tusted seve via a adequately secued connection. Theefoe, in eality a lage numbe of egions can be consideed. Aea of inteest size. Given a numbe of egions, the size of the aea of inteest defines the advesay s infeence accuacy. Conside an aea of Km divided by a x catesian gid. The advesay can naow his estimation of the uses location to at most Km. If on the othe hand the aea is only Km the the advesay can tighten his estimation to. Km. In ode to make ou expeiments meaningful we select an aea of 8 6 Km = 48 Km in Downtown San Fancisco which we show in Fig. 3. We divide the aea in egions using a catesian gid of 8x6 o 4x3, depending on the expeiment. These gid sizes allow the advesay to infe (with moe o less accuacy the neighbohoods visited by the use. We note that in San Fancisco fequent visits to a neighbohood may eveal sensitive infomation, such as sexual oientation (Casto distict, financial status (Financial distict, and cultual pefeences (Haight-Ashbuy. In [3] Shoki et al. demonstate that the tade-offs between pivacy and quality constaints have the same tendency fo diffeent uses, and that the imum level of pivacy achievable by the LPPM depends on the uses mobility pofile. We have un expeiments fo many individuals in the dataset and confimed these esults. Theefoe, without loss of geneality, we only show esults fo one use. We choose as taget use the one fo which moe data is avail- able in the dataset, to have a good estimation of the uses mobility pofile. The taget uses mobility pofile, computed using location exposues inside Downtown San Fancisco, is shown in Figue Results We sepaate ou evaluation in thee steps. Fist, we show that the optimal dummy-based and pecision-based LPPMs designed using the famewok ae supeio to state of the at LPPMs. Second, we evaluate the impact of quality loss and bandwidth ovehead constaints on the pivacy povided by optimal LPPMs. Finally, we compae the optimal dummy LPPM with the neaby pecision based LPPM in tems of pivacy, bandwidth consumption and quality loss. We note that few points ae missing in the figues. This is because MATLAB s optimization algoithm was not able to find the solution fo these paticula combinations of constaints. 6.. Petubation-based LPPM Fo the sake of completeness we make a pefomance analysis of the petubation-based LPPM used in pio wok using ou dataset [3]. The esults ae shown in Fig. 5, whee we compae the pivacy offeed by the optimal petubationbased LPPM towads the optimal attack output by the linea pogam, fo diffeent expected quality loss constaints. Confiming pevious esults [3], we obseve that when the sevice quality constaint is loosened sufficiently the level of pivacy povided by the LPPM es out. This is because these loose constaints allow the LPPM to choose pseudolocations that do not leak infomation that is useful fo the attack. Theefoe the best estimation of the advesay is only dependent on his pio knowledge, i.e., the uses mobility pofile. Once quality constaints ae sufficiently loosened, the linea pogam does can output paametes that do not fulfill tightly the quality constaint. As a consequence the aveage expected quality loss gows slowly and stabilizes aound an optimal value that can be much smalle than the imum toleated expected quality loss Q loss. 6.. Bandwith-consuming Optimal LPPMs vs. Existing LPPMs Let us conside a case in which the quality loss allows the LPPMs to petub the eal location; i.e., Q loss >, and thus does not necessaily contain. Given the consideed gid sizes, we obseve that as soon as some communication ovehead is allowed both optimal and existing LPPMs each the imum level of pivacy achievable.

9 Pivacy(ψ, f, h, d p Existing, Bayesian Optimal, Bayesian Existing, Optimal Optimal, Optimal B cost (a Dummy-based LPPMs (4x3 gid. Q loss = ; no petubation. 5 B cost (b Neaby pecision-based LPPMs (8x6 gid. Q loss = ; no petubation..5.5 Q loss (c Aggegated pecision-based LPPMs (8x6 gid. B cost = ; no communication ovehead. Figue 6: Compaison of Optimal and existing LPPMs and attacks. Hence, ou analysis focuses on the case whee the quality constaint does not allow fo petubation, i.e., Q loss =. In ode to faily compae optimal and existing algoithms fo evey possible use constaint b u (esp., s u, we constuct an existing dummy-based LPPM (esp., pecision-based as descibed above, and evaluate its quality loss and bandwidth ovehead. These values ae used as constaints in the linea pogams descibed in Section 5, which output optimal LPPM paametes that meet the same equiements than thei coesponding existing countepats. Figue 6 shows the esults of the compaison depending on the bandwidth constaint B cost. We obseve that both the optimal defense and attack pefom bette than thei existing countepats. Like with quality loss, if the bandwidth constaint is sufficiently loosened the level of pivacy es out. Note that due to the unning time of the algoithms the dummy-based stategy is tested on a smalle gid, and hence the imum pivacy achievable, given by the mobility pofile, is lowe than in the pecision-based case. Finally, the aggegate pecision-based LPPM does not impose any bandwidth ovehead (see Section 5 and theefoe the evaluation in in Fig. 6c consides diffeent values fo the quality constaint Q loss Tilateal pivacy, quality, bandwidth tade-off We now study the tade-off between pivacy, quality, and bandwidth consumption fo dummy- and neaby pecisionbased LPPMs. We note that the aggegate pecision-based LPPM does not impose a bandwidth ovehead, and hence its pefomance is simila to that of the petubation-based mechanism shown in Figue 5, with a slight diffeence in the expected quality of sevice loss. Figues 7a and 8a show the impact of quality loss and bandwidth constaints on pivacy fo the optimal dummyand neaby pecision-based LPPMs. As expected, when no exta bandwidth consumption is allowed (B cost = pivacy inceases with the amount of petubation allowed by the quality constaint. Fo a given toleable expected quality loss Q loss, elaxing the bandwidth constaint inceases the level of pivacy achievable until it es out. Similaly, loosening the quality constaint inceases the level of pivacy fo a given communication ovehead. Next we examine the tade-off between the expected quality loss E[Q loss ] and expected bandwidth ovehead E[B cost] fo given combinations of Q loss and B cost. Recall that when pivacy es out, futhe loosening the quality constaint slows the gowth of the aveage expected quality loss. Similaly, the moe bandwidth is allowed the less expected quality loss needs to be taded-off fo pivacy (see Figues 7b and 8b; and the moe quality loss is allowed, the less bandwidth needs to be used on aveage (see Figues 7c and 8c Dummy vs. Neaby Pecision LPPMs Finally, we compae dummy-based and neaby pecisionbased LPPMs in a 4x3 gid. Figue 9a shows the pivacy level obtained by both algoithms fo diffeent quality and bandwidth constaints (the fome showed in the legend, and the latte inceased one unit at a time until pivacy es out. Unsupisingly, in Fig. 9a we see that fo the same combination on constaints, the dummy LPPM pefoms bette in tems of its achieved level of pivacy. This is because the optimal neaby pecision-based LPPM is esticted to choose R that contain contiguous egions, while the optimal dummy-based LPPM has no such contiguity estiction and can make the most of the allowed bandwidth consumption. With espect to bandwidth ovehead, we can see in Fig. 9b that the expected bandwidth consumption E[B cost] of both algoithms is the same until E[Q loss ] stabilizes (i.e., when pivacy es out. Once pivacy has ed out, the expected bandwidth consumption stabilizes fo the neaby pecisionbased LPPM, but continues gowing fo the dummy-based LPPM. This is because we conside ectangula contiguous pseudo-locations in the pecision-based case and theefoe thee ae less eligible egions than in the dummy-based case, whee thee is no such estiction. Fo instance, in a 3x3 gid pecision-based pseudo-locations can only be fomed by,, 4, 6, and 9 contiguous egions in R, while dummy-based LPPMs can output pseudo-locations containing any combination of to 9 egions. Hence, even if the bandwidth constaint is loosened, the pecision-based LPPM has fewe lage pseudo-locations to choose fom, and thus consumes less bandwidth than the dummy-based stategy, which can select moe expensive altenatives. In tems of quality loss, the dummy-based LPPM suffes moe quality degadation than the pecision-based LPPM (see Fig. 9c. This is due to the feedom of the dummybased stategy to select any combination of locations. This

10 Pivacy(ψ, f, h, d p Q loss = Q loss =.5 Q loss =.5 Q loss = E[Q loss ] 4 3 B cost =.5 B cost = B cost = 4 B cost = E[B cost ] 5 5 B cost =.5 B cost = B cost = 4 B cost = 3 4 B cost (a Pivacy 3 4 Q loss (b Expected quality loss 3 4 Q loss (c Expected bandwidth Figue 7: Dummy-based LPPM. (4x3 gid Pivacy(ψ, f, h, d p Q loss = Q loss = Q loss = Q loss =.5 E[Q loss ] B = cost B cost = 3 B cost = 5 B cost = E[B cost ] 5 5 B cost = B cost = 5 B cost = B cost = 5 5 B cost 4 6 Q loss 4 6 Q loss (a Pivacy. (b Expected quality loss. (c Expected bandwidth. Figue 8: Pecision-based LPPM. (8x6 gid Pecision Pivacy Q loss = Q loss =. Q loss =.5 Pecision E[B cost ] Q loss = Q loss =. Q loss =.5 Pecision [Q loss ].5.5 B cost = B cost = B avg = Dummies Pivacy (a Pivacy Dummies E[B cost ] (b Bandwidth..5.5 Dummies [Q ] loss (c Quality of sevice loss. Figue 9: Compaison of optimal dummy-pased LPPM vs. neaby pecision-based LPPM.

11 allows dummy-based LPPMs to squeeze the quality constaint moe efficiently than the pecision-based stategy, which is limited to choosing contiguous locations. The clustes at the end of the lines in the figue eflect that the values E[Q loss ] and E[B cost] fluctuate slightly once they have stabilized (Fig. 9b. 7. CONCLUSIONS Location Pivacy-Peseving Mechanisms (LPPMs mitigate pivacy isks deived fom the disclosue of location data when using Location Based Sevices (LBSs. Shoki et al. poposed in pio wok a famewok to design optimal LPPMs towads stategic advesaies, awae of the LPPM algoithm and the uses mobility pattens [3], fo applications in which uses only eveal thei location spoadically. The poposed famewok allows uses to set a limit on the imum toleated quality loss incued by the LPPM, but it fails to captue constaints on the esouce consumption (e.g., bandwidth intoduced by some LPPM stategies, such as sending dummies, o deceasing the pecision of exposed locations. In this wok we have extended Shoki et al. s famewok to allow the use to specify a bandwidth constaint. Futhemoe, we have modeled two popula stategies to tade-off bandwidth fo pivacy: a scheme based on sending dummy locations to the LBS, and a scheme based on educing the pecision of the location sent to the LBS. We have evaluated the pefomance of LPPMs that consume bandwidth using the CRAWDAD taxi dataset. Ou esults show that the optimal dummy- and pecision- based LPPMs povide moe pivacy than thei espective naive countepats. Futhemoe, both LPPMs pefom bette than petubation-based stategies if communication ovehead is allowed by the use, with dummy-based LPPMs being the the best choice fo a given combination of quality and bandwidth constaints. Futhemoe, the esults of ou simulations show that uses can achieve the imum pivacy allowed by thei mobility pofiles by eithe pemitting a sufficiently lage quality of sevice loss, o bandwidth consumption, o an adequate combination of both. Acknowledgments. We thank Reza Shoki fo shaing his optimization code. This eseach was suppoted in pat by the Euopean Union unde poject LIFTGATE (Gant Ageement Numbe 859 and the Euopean Regional Development Fund (ERDF; and by the pojects: IWT SBO SPION, FWO G.36.N, FWO G.686.N, and GOA TENSE (GOA//7. 8. REFERENCES [] Fousquae. [] Google maps. [3] Zeit online: Betayed by ou own data. 3/data-potection-malte-spitz. [4] M. E. Andés, N. E. Bodenabe, K. Chatzikokolakis, and C. Palamidessi. Geo-indistinguishability: Diffeential pivacy fo location-based systems. CoRR, abs/.984,. [5] A. Beesfod and F. Stajano. Mix zones: use pivacy in location-awae sevices. In Pevasive Computing and Communications Wokshops, 4. Poceedings of the Second IEEE Annual Confeence on, pages 7 3, 4. [6] A. R. Beesfod and F. Stajano. Location pivacy in pevasive computing. IEEE Pevasive Computing, (:46 55, Jan. 3. [7] J. Feudige, R. Shoki, and J.-P. Hubaux. On the optimal placement of mix zones. In I. Goldbeg and M. J. Atallah, editos, 9th Pivacy Enhancing Technologies Symposium, volume 567 of LNCS, pages Spinge, 9. [8] J. Feudige, R. Shoki, and J.-P. Hubaux. Evaluating the pivacy isk of location-based sevices. In G. Danezis, edito, Financial Cyptogaphy and Data Secuity, volume 735 of LNCS, pages Spinge Belin Heidelbeg,. [9] B. Gedik and L. Liu. Location pivacy in mobile systems: A pesonalized anonymization model. In Distibuted Computing Systems, 5. ICDCS 5. Poceedings. 5th IEEE Intenational Confeence on, pages 6 69, 5. [] P. Golle and K. Patidge. On the anonymity of home/wok location pais. In H. Tokuda, M. Beigl, A. Fiday, A. J. B. Bush, and Y. Tobe, editos, 7th Intenational Confeence on Pevasive Computing, volume 5538 of LNCS, pages Spinge, 9. [] M. Gutese and D. Gunwald. Anonymous usage of location-based sevices though spatial and tempoal cloaking. In Poceedings of the st intenational confeence on Mobile systems, applications and sevices, MobiSys 3, pages 3 4, New Yok, NY, USA, 3. ACM. [] B. Hoh and M. Gutese. Potecting location pivacy though path confusion. In Secuity and Pivacy fo Emeging Aeas in Communications Netwoks, 5. SecueComm 5. Fist Intenational Confeence on, pages 94 5, 5. [3] B. Hoh, M. Gutese, H. Xiong, and A. Alabady. Enhancing secuity and pivacy in taffic-monitoing systems. Pevasive Computing, IEEE, 5(4:38 46, 6. [4] H. Kido, Y. Yanagisawa, and T. Satoh. An anonymous communication technique using dummies fo location-based sevices. In Pevasive Sevices, 5. ICPS 5. Poceedings. Intenational Confeence on, pages 88 97, 5. [5] J. Kumm. Infeence attacks on location tacks. In A. LaMaca, M. Langheinich, and K. Tuong, editos, Pevasive Computing, volume 448 of LNCS, pages Spinge Belin Heidelbeg, 7. [6] H. Lu, C. S. Jensen, and M. L. Yiu. Pad: pivacy-aea awae, dummy-based location pivacy in mobile sevices. In Poceedings of the Seventh ACM Intenational Wokshop on Data Engineeing fo Wieless and Mobile Access, MobiDE 8, pages 6 3, New Yok, NY, USA, 8. ACM. [7] J. T. Meyeowitz and R. R. Choudhuy. Hiding stas with fiewoks: location pivacy though camouflage. In K. G. Shin, Y. Zhang, R. Bagodia, and R. Govindan, editos, 5th Annual Intenational Confeence on Mobile Computing and Netwoking (MOBICOM, pages ACM, 9.