Quality Aware Privacy Protection for Location-based Services

Transcription

1 In Poceedings of the th Intenational Confeence on Database Systems fo Advanced Applications (DASFAA 007), Bangkok, Thailand, Apil 9-, 007. Quality Awae Pivacy Potection fo Location-based Sevices Zhen Xiao,, Xiaofeng Meng,, and Jianliang Xu School of Infomation, Renmin Univesity of China Key Laboatoy of Data Engineeing and Knowledge Engineeing, MOE {xiaozhen, Depatment of Compute Science, Hong Kong Baptist Univesity Abstact. Potection of uses pivacy has been a cental issue fo location-based sevices (LBSs). In this pape, we classify two kinds of pivacy potection equiements in LBS: location anonymity and identifie anonymity. While the location cloaking technique unde the k-anonymity model can povide a good potection of uses pivacy, it educes the esolution of location infomation and, hence, may degade the quality of sevice (QoS). To stike a balance between the location pivacy and QoS, we pesent a quality-awae anonymity model fo potecting location pivacy while meeting use specified QoS equiements. In the model, a mobile use can specify the minimum anonymity level equiement upon location pivacy as well as the maximum cloaking latency and the maximum cloaking egion size equiements upon QoS. In accodance with the model, we develop an efficient diected-gaph based cloaking algoithm to achieve both high-quality location anonymity and identifie anonymity. The pefomance objective is to maximize the cloaking success ate unde the pivacy and QoS constaints. Futhemoe, we intoduce an option of using dummy locations to achieve a 00% cloaking success ate at the cost of communication ovehead. Expeimental esults show the effectiveness of ou cloaking algoithm unde vaious pivacy and QoS equiements. Key wods: Pivacy, Location-based Sevices, QoS Intoduction With the advances in wieless communication and mobile positioning technologies, location-based sevices (LBSs) have become inceasingly popula fo mobile uses. In these applications, mobile uses send thei location infomation to sevice povides and enjoy vaious types of location-based sevices, such as mobile yellow page (e.g., Whee is my neaest estauant ), mobile buddy list (e.g., Whee is my neaest fiend ), taffic navigation (e.g., What is my shotest path to the Summe Palace ), and emegency suppot sevices (e.g., I need help and send me the neaest police ) [, ]. While people get much benefit fom the useful and convenient infomation povided by LBSs, the pivacy theat of evealing a mobile use s pesonal infomation (including the identifie and location) has become a sevee issue [, In this pape, we use mobile use, mobile client, and use intechangeably. 7

2 Z. Xiao, X. Meng and J. Xu ]. A taditional solution to potecting pivacy is the use of pseudonymity []. That is, fo any LBS equest, a tusted middlewae is employed to eplace the eal identifie of the use with a pseudonym befoe fowading the equest to a sevice povide [, ]. Howeve, the location infomation enclosed in the equest may lead to pesonal e-identification. An attacke can link the location to some paticula individual based on extenal knowledge. Fo example, if we know the location exclusively belongs to some owne, the coesponding equest can thus be linked to the location owne [8, 9]. In geneal, thee ae two kinds of pivacy potection equiements in LBS: Location anonymity. This is to potect a use s location fom being disclosed when the location infomation is sensitive (e.g., in a clinic o pub). A common technique is to cloak the use s location by an extended egion. Unde the k-anonymity model [6], the egion is lage enough such that it contains at least k othe uses. Identifie anonymity. This is to hide a use s identifie when the message content is sensitive (e.g., political o financial data). Again location cloaking can be applied to povide identifie anonymity. Unde the k-anonymity model [6], use locations ae cloaked such that a location is coveed by at least k othe equests. In this way, a equest is not identifiable fom the othe k equests. While the k-anonymity model can povide a good potection of uses pivacy, it educes the esolution of the location infomation and, hence, may degade the quality of sevice (QoS). It is often desiable to stike a balance between the location pivacy and QoS equiements. In this pape, we pesent a quality-awae anonymity model fo potecting location pivacy while meeting use specified QoS equiements. In ou model, a mobile use can specify the following equiements in each LBS equest: ) the minimum anonymity level k, indicating the location cloaking should satisfy both k-location-anonymity and k-identifieanonymity; ) the maximum cloaking latency t, epesenting the maximum cloaking delay that the use can toleate; ) the maximum cloaking egion size δ, indicating the maximum toleable eo in location data. While k eflects the use s equiement upon location pivacy, t and δ epesent the use s QoS equiements. Since the pivacy/qos tadeoff fo a use may change ove time unde diffeent cicumstances, we allow these equiements to vay fom one equest to anothe even fo the same use. In accodance with the quality-awae anonymity model, we develop an efficient diected-gaph based cloaking algoithm to pefom anonymization ove LBS equests. The pefomance objective is to maximize the cloaking success ate with pivacy potected and QoS guaanteed. Futhemoe, we intoduce an option of using dummy locations to achieve a 00% cloaking success ate at the cost of communication ovehead. Unde this scenaio, we would like to make use of as few dummies as possible to minimize the communication ovehead. We conduct a seies of expeiments to evaluate the effectiveness of the poposed algoithms. The esults show that ou algoithms ae supeio unde vaious pivacy and QoS equiements. The est of this pape is oganized as follows. We fist eview some elated wok on potecting location pivacy in Section. In Section, we descibe ou quality-awae anonymity model. An efficient cloaking algoithm is poposed in 76

3 Quality Awae Pivacy Potection fo Location-based Sevices Section. Some discussions and impovements ae pesented in Section. Section 6 pesents the implementation and expeimental esults of ou poposed algoithms. Finally, Section 7 concludes the pape. Related Wok Seveal diffeent models have been used fo potecting location pivacy. Kido et al. [] poposed a dummy-based appoach, in which a use sends the actual location with seveal fake locations ( dummies ) to a sevice povide. The sevice povide pocesses and etuns an answe fo each eceived location. The use finally efines the esult based on the actual location. The k-anonymity model was oiginally intoduced fo pivacy potection in conventional database applications [7]. As defined in [6], a elease of data povides k-anonymity potection if the infomation fo each individual contained in the elease cannot be distinguished fom at least k individuals whose infomation also appea in the elease. In the context of LBS, Gutese and Gunwald [] fist adopted the k-anonymity model and poposed a quad-tee based cloaking algoithm. They assume a static anonymity equiement k min fo all uses. To achieve k-anonymity, the algoithm ecusively subdivides the aea aound a use s location into fou quadants until the numbe of uses in the aea falls below k min, and then etuns the pevious quadant as the cloaking egion. This technique does not diffeentiate the pivacy equiements of diffeent uses. Moeove, no estiction is imposed on the cloaking egion size. Thus, a cloaking egion can be vey lage, which may lead to an inaccuate quey esult and a poo sevice quality. Gedik and Liu [] ecently poposed the technique of suppoting pesonalized pivacy equiements, captuing the pivacy and QoS equiements on a pe-use basis. A location cloaking algoithm called CliqueCloak was developed. CliqueCloak constucts an undiected gaph fo all the equests that have not been anonymized yet. Each time the seve eceives a new equest, it attempts to identify a clique involving the new equest and some existing equests, and cloak them togethe with the same egion. Howeve, this method has seveal dawbacks. Fist, the effectiveness of this method is limited to uses with small k values (i.e., -). As shown in [], we can hadly find the anonymity set fo equests with lage k values. Second, the cost of seaching a clique in a gaph is costly. Thid, some equests that cannot be anonymized will be dopped when thei lifetimes expie. This will affect the use expeience towads the sevice. Diffeent fom [], ou poposed cloaking algoithm consides the tadeoff between pivacy and QoS equiements to achieve a highe cloaking success ate. A diffeent famewok named Caspe was poposed in []. Caspe employed a gid-based pyamid stuctue to index all use locations. Besides the anonymity level k, a use can specify A min, indicating that the use wants to hide the location infomation within an aea of at least A min. This model has the following concens. Fist, k and A min have a simila functionality. In fact, the highe is the value of k, the lage is the cloaking aea. Second, the cloaking egion may expand abitaily lage if k is set to a lage value and few uses pesent neaby. To addess this poblem, Caspe uses a pivacy-awae quey pocesso to etun a list of candidate quey esults to the anonymizing poxy, who has to locally 77

4 Z. Xiao, X. Meng and J. Xu efine the actual esult fom the candidate list. This appoach incus a high quey pocessing cost, a high communication cost, and a high local computation cost. In contast, to educe such costs, we enfoce some tempoal and spatial QoS equiements when pefoming location cloaking. System Model We conside a LBS system consisting of mobile clients, a tusted anonymizing poxy, and LBS povides [, ]. Upon a use quey, the mobile client fist sends the LBS equest to the anonymizing poxy though an authenticated and encypted connection. The equest consists of the use s identifie id, cuent location l = (l.x, l.y), cuent time t, as well as the sevice elated content such as the quey (denoted by data). Additionally, the mobile client can specify in the equest its pivacy and QoS equiements, which include the desied anonymity level k, the toleable maximum cloaking delay t, and the acceptable maximum cloaking egion size (denoted by a adius of δ). Thus, a equest fom use i is defined as: i = (id, l, k, t, δ, data, t). Based on the equest s pivacy and QoS equiements, the anonymizing poxy expands the location l into a cloaking egion L (to be detailed late in this section). Moeove, the identifie id is eplaced with a pseudonym id (e.g., a secue hash numbe). The oiginal equest is tansfomed into a new anonymized equest, i = (id, L, data), and is fowaded to the LBS povide. Finally, the anonymized equest is pocessed by LBS povide. The quey esult is sent back to the anonymizing poxy, which, afte efining the esult, etuns the final esult to the mobile client. We adopt the k-anonymity model [6] fo potecting location pivacy. Given a set of use equests {,,, n } and thei anonymized equests {,,, n}, the location k-anonymity model is defined as follows: Definition Fo any equest i, the location k-anonymity is satisfied if and only if ) i s cloaking egion i.l coves the locations of at least k othe equests (i.e., {j j.l i.l, j n, j i} k ) and, ) i s location i.l is coveed by the cloaking egions of at least k othe equests (i.e., {j i.l j.l, j n, j i} k ). By this definition, a LBS povide cannot distinguish a use s location i.l fom k othe uses locations since they all pesent in the cloaking egion i.l. Moeove, even knowing the location of a use, a LBS povide cannot tell which equest is made by this use since thee ae k equests all coveing this use s location. As such, both location anonymity and identifie anonymity ae achieved. We efe to the set of uses achieving location anonymity as location anonymity set and the set of uses achieving identifie anonymity as identifie anonymity set. Fo example, Figue shows fou LBS equests fom diffeent uses as well as thei cloaking egions. Since s cloaking egion coves,, and, the location anonymity set of is {,, }. On the othe hand, is coveed by the cloaking egions of though. Thus, the identifie anonymity set of is {,,, }. In summay, fo any equest and its anonymized equest, we specify the pivacy and QoS equiements fom the following thee aspects: 78

5 Quality Awae Pivacy Potection fo Location-based Sevices. Location Pivacy. This equies to expand the use location l into a cloaking egion L such that the k-anonymity model (Definition ) is satisfied.. Tempoal QoS. This states that the equest must be anonymized befoe the pedefined maximum cloaking delay (i.e., t + t).. Spatial QoS. This specifies that the cloaking egion size should not exceed a theshold, i.e., the cloaking egion must be inside a cicle Ω centeed at l and with a adius of δ (i.e., L Ω(l, δ)). In geneal, a lage t (o δ) povides moe flexibility in location anonymization but esults in an extended quey delay (o a less accuate quey esult). cloaking egion of cloaking egion of cloaking egion of cloaking egion of location point of i, i=,,, Fig.. Illustation of Location Anonymity Set and Identifie Anonymity Set Basic Anonymization Algoithm The anonymization algoithm tuns the use location into a cloaking egion based on the pivacy and QoS constaints. In this section, we discuss the following poblems faced by the anonymization algoithm: ) when to anonymize which equest? and ) given a equest unde the cloaking egion size constaint, how to find othe equests (i.e., the location anonymity set and identifie anonymity set) to satisfy the location k-anonymity model? Beaing in mind that ou objective is to maximize the cloaking success ate, we shall delay the anonymization pocess of a equest until ight befoe its deadline (i.e., t + t ɛ), whee ɛ is a small time offset set to be the wost cloaking time. In this way, not only can moe potential equests join a equest s anonymity set, but also othe equests have a highe chance to include this equest in thei anonymity sets. To tackle the second poblem, the CliqueCloak algoithm poposed in [] constucts an undiected gaph to epesent the coelations of all equests. The gaph is defined as: G u = (V, E u ), whee V is the set of the nodes, each epesenting a equest eceived at the anonymizing poxy, and E u is the set of edges, each epesenting the neighboship between the coesponding nodes (equests). Fo any pai of nodes i, j V, thee exists an edge e ij = ( i, j ) E u if and only if the distance between the two equests i j is not moe than both i.δ and j.δ ( i j i.δ and i j j.δ), which indicates the locations of i and j ae within each othe s pedefined maximum cloaking egion size. Fo any equest i, its location anonymity set and identifie anonymity set ae the same i.u that includes all its neighbos except those have k lage than i.k and those have less than k neighbos in i.u. A clique of at least k equests is identified if they shae the same anonymity set. These equests ae then anonymized with the same cloaking egion (the minimum bounding ectangle (MBR) of thei location points) at the same time. This appoach incus a huge seaching cost fo 79

6 6 Z. Xiao, X. Meng and J. Xu identifying cliques with the wost time complexity of O(N N ), whee N is the numbe of nodes in the subgaph of i.u. Moeove, with a esticted definition of the anonymity set, the cloaking success ate is low. Recall that unde ou location k-anonymity model, each equest can have a diffeent anonymity set and hence a diffeent cloaking egion. Thus, in contast to [], we build a diected gaph athe than an undiected gaph. In the diected gaph G d = (V, E d ), fo any pai of nodes i, j V, thee exists an edge e ij = ( i, j ) E d fom i to j, if and only if the distance between the two equests is not moe than i.δ ( i j i.δ), which indicates j s location is within i s pedefined maximum cloaking egion size. Similaly, thee exists an edge e ji = ( j, i ) E d fom j to i, if and only if i s location is within j s pedefined maximum cloaking egion size. The location anonymity set of a equest i, is fomed by all its outgoing neighbos i.u out, i.e., i.u out = { i } { j ( i, j ) G d (V, E d )}, and the identifie anonymity set, is fomed by all its incoming neighbos i.u in, i.e., i.u in = { i } { j ( j, i ) G d (V, E d )}. Fo each equest i, we maintain a flag to identify its status, i.e., flag = unanonymized means i has not been anonymized, and flag = fowaded means i has been anonymized successfully and fowaded to the sevice povide but not yet deleted in the gaph. A equest i can be anonymized immediately if thee ae at least k othe anonymized equests in i.u out (i.e., {j j i.u out, j.flag = fowaded, j i} k ) and k othe anonymized equests in i.u in (i.e., {j j i.u in, j.flag = fowaded, j i} k ). The cloaking egion of i is then epesented by the MBR of the location points of the equests in the location anonymity set (denoted by MBR( i.u out )). 0 0 k= k= (a) CliqueCloak (b) Ou Cloaking Fig.. An Example: the diffeences between CliqueCloak and ou poposed cloaking We use an example to illustate the diffeences between CliqueCloak(Figue (a)) and ou poposed cloaking algoithm (Figue (b)). The same set of use equests with coesponding k values ae shown in the figue, whee they ae numbeed in the ascending ode of thei deadlines. We assume 0 has been anonymized successfully ( 0.flag = fowaded in ou cloaking). With CliqueCloak,,, and fom a clique and ae cloaked with the same egion (thei MBR, epesented by the shaded aea in Figue (a)). Then they will be deleted fom the gaph. Initially, no equests ae flagged as fowaded. We employ CliqueCloak to anonymize equests in the wam-up peiod; ou poposed cloaking algoithm follows afte the wam-up peiod. 80

7 Quality Awae Pivacy Potection fo Location-based Sevices 7 Next, and will be dopped because they cannot find enough neighbos. With ou poposed cloaking algoithm, the neighboships between the equests ae diffeent and some new edges ae added in the diected gaph. Fist, is pocessed with U out = U in = { 0,,, }. Because 0.flag = fowaded, satisfying.k =, we can anonymize with cloaking egion MBR( 0,,, ). Then, is pocessed with U out = { 0,,, } and U in = {,,, }. Because 0 and have been anonymized successfully, satisfying.k =, we can also cloak it with MBR( 0,,, ). Similaly, all the othe equests will be successfully anonymized with.l = MBR(,,,, ),.L = MBR(, ),.L = MBR(,,, ). Obviously, by allowing diffeent cloaking egions fo diffeent equests, ou poposed cloaking algoithm gets a highe success ate than CliqueCloak. Moeove, as shown in Figue (b), the cloaking egions of,, and cove some moe equests in addition to,, and, theeby poviding a highe pivacy level than CliqueCloak. In the following, we descibe the detailed data stuctues and elated algoithms fo anonymizing use equests.. Data Stuctues As mentioned, we employ a dynamic in-memoy diected gaph fo all use equests. To facilitate the constuction and maintenance of the gaph, we build a spatial index (i.e., R-tee) ove the location points ( i.l s) of all equests. Thus, we can use a window quey to quickly find the neighbos of a equest. Additionally, we maintain a min-heap to ode the equests accoding to thei cloaking deadlines (i.e., the key is i.t + i. t).. Algoithms Algoithm : Maintenance ( i = {id, x, y, t, t, k, δ, data}) inset i into the spatial index and the heap; ceate a new node fo i in the gaph; i.n 0; i.u in { i}; i.u out { i}; C a ange quey Q on the spatial index, Q = ((x δ max, y δ max), (x + δ max, y + δ max)); foall j C, j i do if i j i.δ o i j j.δ then if i j i.δ then ceate an edge ( i, j) in the gaph; i.u out i.u out {j}; j.u in j.u in {i}; if i j j.δ then ceate an edge ( j, i) in the gaph; i.u in i.u in {j}; j.u out j.u out {i}; i.n i.n + ; j.n j.n + ; end end Maintenance: Algoithm details the maintenance of the data stuctues. Given a new incoming equest i, we fist update the spatial index and the heap. Next we update the gaph. We stat by seaching the spatial index using a ange quey with i.l as the cental point and δ max as the adius, whee δ max is the 8

8 8 Z. Xiao, X. Meng and J. Xu maximum cloaking egion size equiement of all the equests. The equests in the seach esult C ae the candidates fo being i s neighbos in the gaph. Each j in C is filteed based on whethe the distance between j and i is within i.δ o j.δ. In the fome case, we constuct an edge fom i to j. In the latte case, we constuct an edge fom j to i. In both cases, they ae added to each othe s outgoing neighbo set U out and incoming neighbo set U in. In the algoithm, i.n is used to epesent the cadinality of U in Uout. Algoithm : Cloaking get the top equest in the heap; if t + t t now < ε then foall.u out do if.flag = fowaded then k o + +; foall.u in do if.flag = fowaded then k i + +; if k o k and k i k then send out R = (pid, MBR(.U out),.data) fo ;.flag = fowaded; foall.u out.uin, do.n.n ; if.n = 0 and.flag = fowaded then delete fom the gaph; end if.n = 0 then delete fom the gaph; else delete fom the gaph; delete fom the spatial index and the heap; end Cloaking Algoithm: Algoithm descibes the cloaking algoithm. The input equest is the fist equest appoaching its deadline. We fist compae s cloaking time constaint.t+. t with cuent time t now. If.t+. t t now ε, whee ε is a small time offset set to be the wost cloaking time, we cloak immediately. Othewise, we delay the anonymization of to the time.t+. t ε. In the cloaking algoithm, we compute the numbe of s neighbos that have been anonymized successfully in the outgoing neighbo set and the incoming neighbo set, denoted by k o and k i espectively. If both k o and k i satisfy s minimum anonymity level (k o.k and k i.k ), can be cloaked as = (pid, MBR(.U out ),.data) and its flag is set as fowaded, whee pid is the pseudonym that eplaces.id. Othewise, the cloaking fails and the equest is deleted fom the gaph. This algoithm has a time complexity O(n), whee n is the numbe of s neighbos. Afte is successfully cloaked, we delay the emoval of in the gaph until all its neighbos have been pocessed. This is because othewise the neighboships between and its neighbos will disappea. And when we anonymize s neighbos late, they cannot include in thei anonymity sets and, hence, educe the pivacy level and the cloaking success ate. Thus, we then decease the unpocessed neighbos (n) of each s neighbo j in.u out.uin. If j has been anonymized aleady befoe and is the last neighbo of j to be pocessed, we can emove j fom the gaph. If all neighbos of have been anonymized befoe it, we can emove fom the gaph. No matte whethe the cloaking succeeds 8

9 Quality Awae Pivacy Potection fo Location-based Sevices 9 o fails, finally the equest should be emoved fom the spatial index and the heap. Impovement with Dummy Requests This section discusses an impovement by using dummy equests in case of a cloaking failue. With dummies intoduced, we can guaantee a successful cloaking fo evey equest and a 00% success ate. Theefoe, we only need to maintain fo each node the numbe of incoming neighbos.k i and the numbe of outgoing neighbos.k o (.flag is no longe maintained). If both.k i and.k o satisfy the equied pivacy level.k, the cloaking can poceed with success. Othewise, we use Algoithm to geneate enough dummies such that the dummies and the eal neighbos togethe fom s anonymity set. The time complexity of this cloaking algoithm is O(). We geneate dummies fo a equest based on the following equiements. Fist, dummies should be within both the location anonymity set and the identifie anonymity set such that the pivacy level will be highe. Second, dummies must be indistinguishable fom actual equests. Thid, dummies should satisfy the spatial QoS equiement of. Thus, to avoid expanding the existing cloaking egion, the location of each dummy distibutes andomly within MBR(.U out ). The cloaking egion of each dummy equest, d, which also cove the location point of, is a andom spatial egion between MBR({, d}) and MBR(.U out ). As such, the dummies and become both incoming neighbos and outgoing neighbos, and the sevice povide will have difficulty in identifying dummies. Algoithm : Dummy (x, y, k d, M) 6 7 compute the MBR of M, L = ((x min, y min), (x max, y max)); fo i = to k d do x andom(x min, x); x andom(x, x max); y andom(y min, y); y andom(y, y max); L i ((x, y), (x, y )); send out the ith cloaked dummy equest, R i (pid, L i, data); end Algoithm shows the detailed dummy geneation pocess. The inputs of the pocedue ae: location (l.x, l.y) of equest to be cloaked, the numbe of dummies to be geneated, and s outgoing neighbo set as M. The pseudonym and sevice elated content ae also andomly geneated. Finally, we send the cloaked dummy equests out to the sevice povide. 6 Expeiments In this section, we expeimentally compae the effectiveness of ou cloaking algoithm against CliqueCloak [] unde vaious location pivacy and QoS settings. In all the expeiments, we use Thomas Binkhoff Netwok-based Geneato of Moving Objects [] to geneate a set of moving objects. The input to the geneato is the oad map of Oldenbug County (with an aea of about 00km ). We simulate 0,000 moving objects that ae unifomly distibuted in the spatial 8

10 0 Z. Xiao, X. Meng and J. Xu Poposed(No Dummy) CliqueCloak Poposed(No Dummy) CliqueCloak success ate success ate oveall k value (a) vaying k % % % % maximum cloaking egion size (b) vaying δ Poposed(No Dummy) CliqueCloak 0.8 success ate % % % % maximum cloaking latency (c) vaying t Fig.. Pefomance of Cloaking Success Rate unde Diffeent Settings space at the initial time and aftewads continuously move on the oad netwok. These moving objects issue LBS equests with thei cuent locations at a quey inteval of 0,000 s. In each equest, t, k, and δ ae assigned unifomly between the ange [.0.]% of the update inteval (i.e.,,000-,000), [ ] uses, and [.0-0.0]% of the space (i.e., -0), espectively. We set the wost cloaking time offset ε as 0 s. Recall that the goal of ou cloaking algoithm is to maximize the numbe of equests anonymized successfully in accodance with thei pivacy and QoS equiements. We fist evaluate the cloaking success ate with vaious pivacy and QoS equiements. Figues (a), (b), and (c) show the effect of vaying k, δ, and t on the success ate, espectively. In all cases tested, ou method without using dummies always outpefoms CliqueCloak, by -% in tems of cloaking success ate. By using dummy equests, we can even achieve a 00% success ate. In Figues (a), both CliqueCloak and ou method show that the equests with lage k values ae moe difficult to anonymize, thus getting a lowe success ate. Howeve, the pefomance degadation of ou method is less significant than that of CliqueCloak. This indicates that ou method is moe obust fo lage k values. Figues (b) and (c) show that a lage δ o t impoves the flexibility in location anonymization and thus getting a highe success ate. We then measue the efficiency of ou location-anonymity model in tems of uses pivacy equiements. The elative location anonymity level is measued by k /k, whee k is the numbe of uses actually included in the cloaking egion while k is the use equied numbe. In Figue, we compae the elative anonymity level of ou method against CliqueCloak unde diffeent k values. In ou method, by using dummies, the elative anonymity level can be up to 9 fo k =, meaning that the equests ae actually anonymized with k 8 on 8

11 Quality Awae Pivacy Potection fo Location-based Sevices aveage elative anonymity level Poposed(Dummy) Poposed(No Dummy) CliqueCloak potion 00% 80% 60% 0% 0% Dummies 0 k value oveall k value Fig.. Relative Anonymity Level Fig.. Potion of Dummy Requests aveage cloaking time(millisec) Poposed(Dummy) Poposed(No Dummy) CliqueCloak 0 k value Fig. 6. Cloaking Efficiency aveage. Without using dummies, the elative anonymity level is fom. fo k = to. fo k =, meaning that the equests ae actually anonymized with k 0 on aveage. CliqueCloak povides a lowe level fom. fo k = to.0 fo k =. This esult also demonstates that even without dummies ou method can suppot lage k values up to 0 while CliqueCloak is limited to smalle k values. In Figue, we measue the potion of dummy equests geneated in the total equests unde vaying k values. Requests with lage k equie moe neighbos and hence a highe pecent of dummies. On aveage, we can achieve a 00% success ate with about 0% dummies (and thus 0% of communication ovehead), which we think is acceptable. Finally, Figue 6 shows the effect of k on the cloaking efficiency. In all cases tested, ou method shows a much shote cloaking time than CliqueCloak. When k inceases, (moe neighbos ae fomed), the aveage cloaking time lengths as a esult of inceasing cost of seaching anonymity sets. Howeve, the pefomance degadation of ou method is much less smalle than that of CliqueCloak. 7 Conclusion In this pape, we have discussed the poblem of quality-awae pivacy potection in location-based sevices. We classified the pivacy equiements into location anonymity and identifie anonymity. To potect both of these two anonymities, we have pesented a quality-awae k-anonymity model that allows a mobile use to specify in each LBS equest the location pivacy equiement as well as the tempoal and spatial QoS equiements. We have developed an efficient diectedgaph based cloaking algoithm to achieve a high cloaking success ate while 8

12 Z. Xiao, X. Meng and J. Xu satisfying the pivacy and QoS equiements. Moeove, we have intoduced the use of dummy equests to achieve a 00% cloaking success ate at the cost of communication ovehead. Expeimental evaluation have veified the effectiveness of ou model and the poposed cloaking algoithms unde vaious pivacy and QoS equiements. Acknowledgments This eseach was patially suppoted by the gants fom the Natual Science Foundation of China unde gant numbe 60709, 60708; Pogam fo New Centuy Excellent Talents in Univesity(NCET). Jianliang Xu s wok was suppoted by gants fom the Reseach Gants Council, Hong Kong SAR, China (Poject Nos. HKBU /0E and HKBU /06E). Refeences. R. José, N. Davies. Scalable and Flexible Location-Based Sevices fo Ubiquitous Infomation Access. In Poceedings of Fist Intenational Symposium on Handheld and Ubiquitous Computing, J. Schille and A. Voisad, editos. Location-Based Sevices. Mogan Kaufmann Publishes, 00.. L. Bakhuus and A. K. Dey. Location-Based Sevices fo Mobile Telephony: a Study of Uses Pivacy Concens. In INTERACT, 00.. A. R. Beesfod and F. Stajano. Location Pivacy in Pevasive Computing. IEEE Pevasive Computing, ():6-, 00.. A. Pfitzmann and M. Hansen. Anonymity, Unlinkability, Unobsevability, Pseudonymity, and Identity management - A Consolidated Poposal fo Teminology, L. Sweeney. K-anonymity: A model fo potecting pivacy. Intenational Jounal on Uncetainty, Fuzziness and Knowledge-based Systems, 0():7C70, P. Samaati and L. Sweeney. Potecting pivacy when disclosing infomation: k- anonymity and its enfocement though genealization and suppession. Technical Repot SRI-CSL- 98-0, SRI Intenational, M. Gutese and B. Hoh. On the Anonymity of Peiodic Location Samples. In SPC, A. Machanavajjhala, J. Gehke, and D. Kife. l-divesity: Pivacy Beyond k- Anonymity. In ICDE, M. J. Atallah and Keith B. Fikken.Pivacy-Peseving Location-Dependent Quey Pocessing. In ICPS, 00.. M. Gutese and D. Gunwald. Anonymous usage of location based sevices though spatial and tempoal cloaking. In ACM/USENIX MobiSys, 00.. B. Gedik and L. Liu. Location Pivacy in Mobile Systems: A Pesonalized Anonymization Model. In ICDCS, 00.. H. Kido, Y. Yanagisawa, and T. Satoh. Potection of Location Pivacy using Dummies fo Location-based Sevices. In ICPS, 00.. M. F. Mokbel, C. Chow and W. G. Aef. The New Caspe: Quey Pocessing fo Location Sevices without Compomising Pivacy. In VLDB, T. Binkhoff. A Famewok fo Geneating Netwok-Based Moving Objects. GeoInfomatica, 6():C80,