Privacy-preserving Social Recommendations in Geosocial Networks

Transcription

1 Privcy-preserving Socil Recommendtions in Geosocil Networks Bisheng Liu nd Urs Hengrtner Cheriton School of Computer Science University of Wterloo {bisheng.liu, uwterloo.c Abstrct Geosocil networks like Foursqure hve enbled people to conveniently shre their wherebouts with their friends online, such s shring check-ins t visited venues. This informtion could be utilized by recommender systems to improve the recommendtion ccurcy, known s socil recommendtions. However, incorporting socil context into recommender systems introduces new privcy threts to users. We design frmework to chieve the benefits of socil recommendtions while preserving the privcy of socil reltions nd considering the business interests of the service provider (SP). Nmely, we propose tht ech user mnges socil reltions loclly nd prticiptes in computing socil recommendtions without reveling socil reltions to the SP nd without the SP reveling proprietry informtion to user. In ddition, we identify two clsses of inference ttcks where the SP my infer the existence of socil reltions by ) observing the rrivl times nd the originting ddresses of messges nd b) monitoring users individul check-in histories. Furthermore, we propose using privte check-ins nd delyed check-ins to defend ginst such ttcks. Finlly, we conduct comprehensive performnce evlution over lrge-scle relworld dtsets. The results suggest tht the proposed privcypreserving frmework is fesible on smrt phone nd only slightly ffects the overll performnce of recommender systems. I. INTRODUCTION Trditionl recommender systems [1] utilize users previous behviors, s well s the informtion gthered from item profiles nd user profiles, to compute recommendtions. Recently, reserchers hve discovered tht recommender systems cn exploit users socil context to improve the recommendtion ccurcy, known s socil recommendtions [21 23, 31]. For exmple, when it comes to the choice of resturnts, user would probbly prefer recommendtions from friends rther thn recommendtions from strngers. Furthermore, the recent explosive growth of socil networking services hs enbled people to conveniently shre informtion with friends online. For exmple, geosocil networks llow users to check in t visited venues t ny given time nd shre the check-in informtion with their friends. Such check-in informtion could be conveniently utilized to provide point-of-interest (POI) recommendtions for users. For instnce, Foursqure [32], one of the most populr geosocil network service providers, now provides users with personlized POI recommendtions bsed on where their friends hve been to. Becuse recommender systems my utilize sensitive informtion from users to produce recommendtions, users might be unwilling to dopt such systems due to concerns over privcy. Privcy for trditionl recommender systems hs been well reserched in the literture [2, 5, 7, 8, 17, 20, 25]. Most of the proposed privcy-preserving pproches im to hide individul user records from the recommender system while still being ble to provide users with ccurte recommendtions. The focus of this pper is the new privcy threts introduced by socil recommendtions. We consider the privcy of socil reltions to be one of the most fundmentl privcy requirements for user. A recent study [14] shows tht mny people hve n interest in hiding their friends set (pproximtely 52.6% of 1.4 million NYC Fcebook users in the study hid their friends set in June 2011). For instnce, certin sensitive friendships might uncover some hidden informtion of user (e.g., friendships tht might expose user s sexul orienttion [19]). In prticulr, privcy of socil reltions is criticl in regions where geosocil network services re operted by unscrupulous service providers or closely monitored by suppressive governments [28]. For the bovementioned resons, we ssume tht user would prefer to keep her socil reltions secret both from strngers nd from the service provider (SP). While designing privcy-preserving recommender system, we should lso keep in mind tht SP might only be willing to dopt or switch to the new system if dopting the new system would not be detrimentl to the SP s business interests. For exmple, the SP would probbly prefer to keep certin key elements of the recommender system hidden from other prties, such s the rtings of ech user t different venues. In this pper, we ddress the following question: in geosocil network, cn we design privcy-preserving recommender system tht provides users with the benefits of socil recommendtions, while ) keeping users socil reltions privte from the SP nd b) preserving the SP s business interests? The contributions of this pper re s follows: ) our work is the first, to our best knowledge, to propose privcypreserving frmework for socil recommendtions in geosocil networks; b) we tke the SP s interests into considertion nd propose tht the SP encrypts ech user s rtings t visited venues with cryptosystems tht support homomorphic properties; c) we identify two types of inference ttcks nd propose using privte check-ins nd delyed check-ins to defend ginst these ttcks; d) we evlute the fesibility of our pproch using lrge-scle dtsets collected from rel-world geosocil network. 1

2 The reminder of this pper is orgnized s follows: In Section II, we present the relted work. In Section III, we introduce some bckground mteril. In Section IV, we present in detil the proposed privcy-preserving frmework. In Section V, we describe inference ttcks nd the defense mechnisms. We present the experimentl results in Section VI. Finlly we conclude our work in Section VII. II. RELATED WORK Recommender systems utilizing the informtion shred in socil networks hve recently ttrcted tremendous ttention from both cdemi [21 23, 31] nd industry [32]. Konsts et l. [21] hve proposed recommendtion lgorithm tht performs Rndom Wlk with Restrts on grph estblished mong users, items nd tgs. M et l. [22, 23] hve incorported users socil friendships into model-bsed collbortive recommender systems. All these pproches im to recommend trditionl items, such s movies; the effectiveness of these pproches in geosocil networks hs not yet been evluted. Ye et l. [31] hve proposed unified POI recommendtion frmework in geosocil networks, which fuses user preferences for POI with socil influence nd geogrphicl influence. Our work dopts similr unified POI collbortive recommender system. Some of the erliest privcy-preserving pproches for recommender systems come from Cnny [7, 8], who hs proposed using homomorphic encryption nd peer-to-peer protocol to provide privcy for severl model-bsed collbortive recommender systems. Similr ides hve been explored [17, 25]. Polt nd Du [27] hve proposed tht customers use rndomized perturbtion technique to disturb their privte dt before sending the dt to the SP. Similr ides hve lso been explored [5, 20]. Aïmeur et l. [2] hve proposed using semitrusted third prty to distill encoded sensitive customer informtion. Previous work ims to keep individul user records hidden from the SP or other users. Our reserch differs from these pproches becuse our reserch ims to keep users socil reltions secret from the SP, while still providing users with the benefits of socil recommendtions. Mchnvjjhl et l. [24] hve studied socil recommendtions solely bsed on socil grph. Their results suggest ccurte recommendtions inevitbly lek informtion bout the existence of edges between certin nodes. Our work differs from theirs becuse ) we re trying to hide the socil reltions from the SP nd b) socil recommendtions in our frmework re integrted with other recommender systems. The closest references to our reserch cn be found in the literture of privcy for socil reltions in socil networks. Anderson et l. [3] hve proposed n rchitecture for socil networking tht protects users socil informtion from both the opertor nd other network users. Domingo-Ferrer et l. [15] hve proposed scheme to prevent the resource owner in socil networks from lerning the reltionships nd trust levels between the users who collborte in the resource ccess. Tootoonchin et l. [30] hve proposed cryptogrphic frmework, Lockr, to seprte socil networking content from ll other online socil network functions. Bckes et l. [4] hve proposed similr pproch to chieve ccess control while keeping socil reltions hidden from the SP. We exploit similr ide s reltion uthentiction [4] to implement ccess control. Egle et l. [16] hve explored the possibility of inferring friendships between users by nlyzing high resolution user trces collected from mobile phones. Crndll et l. [10] hve used dtsets collected from the Flickr website to investigte the extent to which socil reltions between people cn be inferred from co-occurrences in time nd spce. Crnshw et l. [11] hve proposed novel set of loction-bsed fetures nd dopted supervised mchine lerning frmework to predict the friendship between two users by nlyzing their loction trils. A similr ide hs been explored by Scellto et l. [29]. In our reserch, the SP does not hve the ground truth informtion bout friendships. Therefore, the SP is unble to exploit the supervised mchine lerning method to detect friendships. III. A. Socil Recommender Systems BACKGROUND Most proposed socil recommender systems include two components: socil influences, which define how much influence ech friend hs on user; recommendtion lgorithms, which define how to compute recommendtions with friends socil influences nd their rtings of ech item/poi s inputs. The definition of socil influence vries in different systems. In this pper, we dopt the definition proposed by Ye et l. [31], which is bsed on the frction of common friends nd the frction of common venues between user nd ech friend. Let SI i,k be the socil influence of user k on user i, where user k is friend of user i. Let F i nd L i denote the friends set nd the visited venue set of user i, respectively. Let F k nd L k denote the friends set nd the visited venue set of user k, respectively. The socil influence of user k on user i is defined s follows [31]: Fi Fk Li Lk SIi, k = η + (1 η) F F L L i k i k where η denotes tuning prmeter with the vlue between 0 nd 1. The socil context is typiclly incorported into other recommender systems. Ye et l. [31] propose liner fusion frmework to integrte the results from multiple recommender systems, including socil recommendtions. We dopt their pproch s the bsis for our reserch, becuse their pproch hs been proved to be effective for POI recommendtions in geosocil networks. Assuming tht user i hs never visited venue before, the socil recommendtion lgorithm by Ye et l. proposes estimting the rting of user i t venue (defined s the socil rting of user i t venue, SR i, ) s follows: SR i, = k Fi SI k Fi R i, k k, where F i denotes the friends set of user i, SI i,k denotes the socil influence of friend k on user i nd R k, denotes the rting of user SI i, k (1) (2) 2

3 k t venue. If we merge the denomintor of (2) into SI i,k in the numertor, then (2) cn be rewritten s follows: SR = SI R (3) ' i, i, k k, k Fi where SI i,k in (3) represents the normlized socil influence with the vlue between 0 nd 1. Finlly, for given user i, her score t venue is defined s normlized vlue of SR i, : S SR f i, i, = (4) mx { SRi, } where mx {SR i, } is normliztion term tht represents the highest socil rting for user i t ll venues. The unified fusion frmework [31], which integrtes the results from multiple recommender systems, is represented s follows: S n n k i, αksi, αk k = 1 k = 1 (5) =, where = 1 where S i, denotes the finl score of user i t venue, S k i, denotes the score of user i t venue computed by recommender system k, nd the weighting prmeter α k denotes the reltive importnce of recommender system k compred to other recommender systems. The frmework returns the top-n highest rnked venues for ech user s recommendtions. B. Homomorphic Encryption Homomorphic encryption is form of encryption where performing certin lgebric opertion on the plintext is equivlent to performing certin (possibly other) lgebric opertions on the ciphertext. We describe the ddition opertion of n dditive cryptosystem. Let Enc() denote the encryption function. We cn compute the encrypted vlue of the sum of two plintext messges m nd n s follows: Enc( m + n) = Enc( m) Enc( n) (6) We cn compute the encrypted vlue of the product m nd k (where k is positive integer) s the modulr exponentition of the cipertext of m with the plin text vlue of k s the exponent, which cn be denoted s follows: Enc( m k) = ( Enc( m)) k (7) As we will show in Section IV-D, in our frmework, users need to compute (7) when k is floting point number. To perform rel rithmetic over finite field, we represent floting point numbers s fixed point numbers by multiplying them by fixed bse. C. System Model A legitimte user in our model cn crete new venues in the system. Venues in our system cn be either privte (such s Alice s home) or public (such s locl club). The verifiction of the identity of the user s the venue owner cn be performed offline. We ssume tht the informtion of privte venue (e.g., GPS coordintes, venue nme) is only vilble to the venue owner, the owner s friends nd the SP. Friends in our system re defined s users who hve reched mutul consent to form friendship; tht is, the friendship in our system is bidirectionl. When user visits venue, she cn choose to check in t tht venue by publishing the check-in informtion to the system. The check-in includes the identity of the user, the time when the check-in tkes plce, the venue informtion, nd possibly some other dt. Users my perform the check-in using mobile device (e.g., smrt phone or lptop). We ssume tht only user s friends re llowed to ccess her check-ins. We lso ssume tht the SP lerns ll checkin informtion (for resons explined in Section III-D), but does not lern ech user s friends set. A strnger to given user is defined s collection of non-registered visitors nd registered users of the system who re not the user s friends. The service provider (SP) in our system mintins user dtbse mnging user identities nd user profiles, venue dtbse mnging venue profiles, check-in dtbse keeping ll users check-ins, nd n Access Control List (ACL) for ech user. The SP lso mnges user-venue rting mtrix. Ech entry in the mtrix represents the rting of given user t given venue, which is computed by the SP. Entries in the user-venue rting mtrix re empty if the corresponding user hs never checked in t the corresponding venue. For given user, the SP ims t computing the scores t those venues with empty entries using (5) nd rnking those venues ccordingly. Competitors of the SP re defined s other geosocil network SPs who provide similr check-in services nd POI recommendtion services s the SP. We overview the recommendtion process in our system s follows: for ech check-in, the SP is responsible for computing nd updting the rting of the user t the venue using certin proprietry lgorithm with possibly the user s check-in frequencies, explicit feedbcks nd/or some other observtions over long period s inputs; periodiclly, ech user loclly computes socil recommendtions without lerning friends rtings t venues nd without reveling the socil reltions to the SP, nd then submits the results to the SP (more detils in Section IV); upon receiving POI recommendtion request, the SP runs multiple recommender systems nd integrtes the results including the socil recommendtions, nd returns the top-n highest rnked venues to the requesting user. D. Thret Model In our thret model, we consider the friendship between users in geosocil network to be sensitive, nd thereby the friendship between two users should be kept privte from the SP nd strngers. We consider the SP to be honest but curious; tht is, the SP follows our protocol, but is curious bout lerning the friends set of user. We consider this ssumption to be resonble in Online Socil Networks. The SP hs vluble reputtion to mintin nd ny suspicion of mlicious behviors could potentilly led to significnt loss of users [12]. The business interests of geosocil network SP usully lie in those collected check-ins. It would be very unlikely for the SP to dopt or switch to privcy-preserving recommender 3

4 system if the new system could hrm the SP s business interests. Therefore, in order to motivte the SP, we choose not to hide the contents of check-ins from the SP (except privte check-ins, which we will further describe in detil in Section V). In ddition, we ssume tht the SP knows the rel identity of ech user in the system (e.g., Foursqure explicitly declres in the Terms of Use tht users must provide Foursqure with ccurte, truthful, nd complete registrtion informtion). We do cknowledge tht nonymity is n importnt privcy requirement for users on the Internet. However, loction dt gthered from check-ins could llow the SP to re-identify user [6]. In our model, users cn choose to use pseudonyms in order to keep nonymity from strngers. However, we do not consider user identities to be privte from the SP. In our model, we ssume user hs the option of hiding the friends set from her friends. In cse tht user decides to hide the friends set from her friend, we consider the friend to be honest (with tht user) but lso curious; tht is, the friend follows our protocol when intercting with the user but is curious bout lerning the friends set of the user s well. Furthermore, we consider it is possible for the SP to infer the friendship between two users, if the SP discovers tht the two users shre number of common friends. We ssume tht users dopt mix network (e.g., Mixmster [26]) to send messges to the SP so tht the SP cnnot link multiple messges to the sme sender. We lso ssume tht the communiction between users nd the SP is secure so tht other prties cnnot lern nything by evesdropping. In ddition, s previously mentioned in the system model, the informtion of privte venue is only vilble to the SP, the venue owner nd the owner s friends. Therefore, strngers to legitimte user might be interested to lern such informtion. Lst but not lest, from the SP s perspective, competing SP might be interested in lerning some key informtion of the system dopted by the SP, such s the rtings (computed by the SP) of users t ech venue. A competing SP my try to lern such informtion either by colluding with users or by becoming user himself. IV. PRIVACY-PRESERVING RECOMMENDATIONS In this section, we first give n overview of our frmework. Then, we describe the components of the frmework in detil. A. Overview The core ide behind our frmework is tht we keep the sensitive socil networking dt hidden from the SP without ffecting the performnce of POI recommendtions by the SP. We now briefly describe the components comprising the frmework. We ssume tht Bob nd Alice re both legitimte users in the system. Without loss of generlity, we describe the frmework from the perspective of Bob, who will be performing the following tsks: Mnging friendship: Upon receiving Alice s friend request, Bob cn choose to ccept/reject the request. Once Bob nd Alice hve mutully greed to form friendship, they exchnge the proof of the existence of the friendship, which we will discuss more in Section IV-B. Checking in t venues: When visiting venue, Bob cn perform check-in nd publish the check-in to the system. Only Bob s friends re llowed to ccess the check-in. We denote the check-in record s check_in(bob, (, L ), t), where L represents the GPS coordintes of venue nd t denotes the time when Bob performs the check-in. Accessing friends check-ins: If Bob is interested to lern his friend Alice s wherebouts, Bob cn nonymously request Alice s recent check-ins from the SP. Bob proves the existence of the friendship with Alice to the SP by presenting the proof of the friendship without reveling his identity, which we will elborte more in Section IV-C. Computing recommendtions: Bob prticiptes in the computtion of socil recommendtions for himself, by nonymously requesting his friends rtings t venues from the SP, intercting with friends nd computing the socil influence (s defined in (1)) of ech friend, clculting the socil rting t ech venue using (3) with the help of homomorphic encryption, nd finlly submitting the socil recommendtions to the SP. Finlly, the SP integrtes the results from multiple recommender systems using (5) nd returns the recommendtions to Bob. B. Mnging Friendship We ssume tht when new user registers in the system, she genertes pir of public nd privte keys nd sends copy of the public key to the SP. We now describe the process of forming the friendship between Alice nd Bob. First, Alice nd Bob rech mutul consent to form friendship by exchnging request messges encrypted with ech other s public key using n independent contct chnnel tht does not involve the SP, such s third prty emil ccount. Then, Bob sends Alice secret friendship key Fkey bob, which is shred only mong Bob nd his friends. Upon receiving Fkey bob, Alice computes H(Fkey bob ) where H is the SHA-256 hsh function, nd stores the result s the proof of the friendship with Bob, denoted s FriendshipTg bob. Bob lso computes FriendshipTg bob nd sends it to the SP for future uthentiction. Alice performs the sme procedure to set up the friendship with Bob. We will describe the usge of Fkey bob in Section V. We now briefly describe the process of ending the friendship between Alice nd Bob. Bob deletes Alice from his friends set. In ddition, Bob chooses new friendship key nd brodcsts it to ll remining friends. Then, Bob computes the new corresponding FriendshipTg bob nd sends it to the SP. Becuse Alice does not know the new friendship key, she is unble to compute the new FriendshipTg bob. Agin, Alice performs the sme procedure. C. Accessing Friends Check-ins In our system, only user s friends re llowed to ccess her check-ins. The SP mintins n Access Control List (ACL) for ech user, which defines who is llowed to ccess the user s check-ins. We exploit similr ide from Bckes et l. [4] to implement friendship-bsed ACL. 4

5 We briefly describe the uthentiction process. Upon setting up the friendship with Bob, Alice cn prove to the SP tht she is indeed friend of Bob by presenting FriendshipTg bob to the SP. The SP ccepts/rejects Alice s clim by checking FriendshipTg bob with the copy received from Bob. Notice tht, FriendshipTg bob does not contin the identity of Alice nd therefore Alice cn use the tg to nonymously request Bob s check-ins from the SP. We ssume secure nonymous chnnel (such s mix network [26]) where ech user cn nonymously communicte with the SP, so tht outside ttckers cnnot lunch impersontion, phishing, interception, or reply ttcks. This pproch slightly differs from the pproch proposed by Bckes et l. [4], where the uthors propose tht user signs the (non-secret) friendship tg before sending it to his/her friends nd uses the signture s the proof of the friendship. A friend of the user uses zero-knowledge proofs to prove knowledge of the signture without providing the signture to the SP. They rgue tht the SP might store the signture of the friendship tg nd lter reuse it in other scenrios. This pproch could be used to uthenticte the friendship in our frmework; however, in our system, we ssume the SP to be honest but curious, which implies the SP will not impersonte the user with other SPs. Therefore, we rgue tht it is unnecessry for user to sign the friendship tg or to hide the signture from the SP in our ppliction scenrio. In ddition, zero-knowledge proofs introduce extr computtion nd communiction overhed. D. Computing Recommendtions As previously described in the system model, the SP mintins user-venue rting mtrix M. The entry in the i-th row nd the -th column of M represents user i s rting computed by the SP t venue. We describe how to compute socil rtings for user i using (3) without reveling the socil reltions to the SP. We require tht user i loclly mintins tble tble_friends i. Ech row/record in tble_friends i corresponds to friend of user i. Let user k be friend of user i. The record in tble_friends i corresponding to user k consists of the public key of user k, the socil influence of user k on user i, list of venues tht user k hs previously visited nd the rting of user k t ech visited venue. Note tht, the rtings of user k t visited venues re computed by the SP using certin proprietry lgorithm. We believe tht the SP prefers to keep the rtings privte from other prties, especilly from competing service providers, becuse the performnce of the whole recommender system highly depends on whether or not these rtings truly reflect users preferences nd interests. For given user i, we divide the computtion of recommendtions for the user into four steps. 1) Step one: obtining friends rtings. User i nonymously requests her friends rtings from the SP using the sme method s requesting the friends check-ins, s described in Section IV-C. Notice tht, if user i requests the rtings of multiple friends using single messge, the SP cn infer tht these users requested by user i shre common friend. As described in the thret model, users who shre number of common friends my very well be friends with ech other. To prevent such correltions, we require tht user i uses seprte messges to request the rtings of ech friend. As described in our thret model, we ssume tht the user dopts mix network to send messges to the SP so tht the SP cnnot link two seprte messges originting from the sme user. Prior to sending the rtings to the requesting user, the SP encrypts the rtings using homomorphic dditive encryption scheme with his public key to protect the business interests. Upon receiving the encrypted rtings, the user updtes the corresponding records for ech friend in tble_friends i. 2) Step two: computing socil influences. We first describe how to compute the socil influence of ech friend using (1) if user i chooses to hide the friends set from her friends. Let user k be friend of user i. In order to compute the crdinlity of the intersection set between F i nd F k (F i nd F k denote the friends set of user i nd user k, respectively) while keeping F i hidden from user k, user i initites Privte Set Intersection Crdinlity (PSI-CA) protocol [13], which cn determine the crdinlity of the intersection set without reveling the ctul set. Upon the completion of the protocol, user i lerns the vlue of F k, F i F k nd thereby the vlue of F i F k, while user k only lerns the vlue of F i. On the other hnd, if user i is comfortble with shring the friends set with her friend k, user i cn directly exchnge the whole friends set with user k nd then clculte the vlue of F k, F i F k nd F i F k. Assuming user s friend is honest with the user, user i cn just send the computed F i F k nd F i F k to user k so user k does not need to repet the computtion. In ddition, user i cn loclly compute the intersection nd the union of L i nd L k (L i nd L k denote the visited venue set of user i nd user k, respectively), becuse user i hs lredy stored the list of venues visited by user k fter completing Step one. Finlly, user i stores/updtes the socil influence of user k in tble_friends i. 3) Step three: computing nd updting socil rtings. Upon completing Steps one nd two, user i cn compute the socil rtings using (3). Even though the rtings of friends t venues re encrypted with the SP s public key, user i cn compute the ciphertext of the socil rtings encrypted with the SP s public key with the help of homomorphic encryption. User i clcultes the ciphertext of the socil rting t venue j using the following eqution, which is derived from (3) using (6) nd (7): SI, (, ) ( (, )) i k i Enc Rk k Fi Enc SR = Becuse the normlized socil influence of friend k on user i SI i,k is floting point number with the vlue between 0 nd 1, we represent SI i,k s fixed point number by multiplying it by fixed bse. User i sends the encrypted socil rtings bck to the SP. Finlly, the SP decrypts the socil rtings using his privte key, clcultes the scores using (4), nd updtes the records corresponding to user i for future usge. Note tht, there is no motivtion for user i to report flsified socil rtings becuse it would only ffect the socil recommendtion ccurcy for herself. (8) 5

6 4) Step four: generting POI recommendtions. Upon receiving the POI recommendtion request, the SP runs multiple recommender systems simultneously, integrtes the results from ech recommender system including the results from the socil recommender system, nd returns the top-n highest rnked venues bsed on the finl scores. Note tht, Steps one, two nd three cn be crried out by user i periodiclly, regrdless of when Step four ctully tkes plce. We believe tht the overll socil recommendtions from the friends re reltively stble over period of time. Therefore, in order to reduce the computtion nd communiction overhed, user i cn set the frequency of performing Steps one, two nd three to be reltively low, e.g., once every week. V. INFERENCE ATTACKS AND DEFENSE MECHANISMS Using our proposed frmework, user is ble to nonymously ccess friends check-ins, thereby preventing the SP from lerning the existence of friendship from single request messge. However, the SP might be ble to infer the friendship by observing nd correlting multiple messges or check-ins. In this section, we introduce two types of inference ttcks: check-in-inference ttcks where the SP infers the friendship by observing users check-in histories; messgeinference ttcks where the SP infers the friendship by observing the rrivl times nd the originting ddresses of messges sent by users. Furthermore, we propose severl mechnisms to mitigte the thret of inference ttcks. A. Check-in Inference Attcks Assuming tht Alice nd Bob re friends with ech other, we identify three types of check-in-inference ttcks where the SP might be ble to infer the friendship between Alice nd Bob solely bsed on their check-in histories. ) Privte-venue relted ttcks. Bob checks in t privte venues owned by Alice, such s Alice s home. The privte property of the venue implies tht users who check in t the venue re most likely to be friends with the venue owner. Therefore, the SP could infer tht Bob is friend of Alice. To defend ginst such ttcks, we first propose specil type of check-ins, privte check-ins, where the user encrypts the venue informtion contined in the check-ins using her friendship key, which is shred only mong the user nd her friends (see Section IV-B). Therefore, only the friends of the user re ble to decrypt the venue informtion. We denote the privte check-in record of Bob t venue s check_in(bob, E((, L ), Fkey bob ), t), where E((, L ), Fkey bob ) represents the encryption of the informtion of venue using n uthenticted symmetric-key encryption function with Bob s friendship key Fkey bob. In ddition, we require tht E() is probbilistic encryption scheme so tht the SP is unble to correlte multiple privte check-ins tht tke plce t the sme venue. Now we demonstrte how to use privte check-ins to defend ginst the bovementioned ttck. We propose tht Bob lwys performs privte check-ins t privte venues. Let the check-in record be check_in(bob, E(( Alice s home, L lice ), Fkey bob ), t), where L lice represents the GPS coordintes of Alice s home. Consequently, the checked-in venue is hidden from the SP nd therefore Alice s identity is hidden from the SP; Bob s friends cn still decrypt the venue informtion becuse they know Fkey bob. However, now user who is friend of Bob but is not friend of Alice cn lern the GPS coordintes of Alice s home, which violtes the privcy requirement of the privte venue tht only the SP, the venue owner nd her friends re ble to lern the venue informtion (s described in Section III-C). We propose tht Bob first encrypts the venue informtion using Alice s friendship key Fkey lice nd then further encrypts it using his own friendship key Fkey bob. The finl check-in record is check_in(bob, E(E(( Alice s home, L lice ), Fkey lice ), Fkey bob ), t). Now only common friend of Alice nd Bob cn lern the informtion bout Alice s home nd the fct tht Bob checked in t Alice s home t time t. b) Attcks bsed on co-occurrences. Alice nd Bob hng out together lot; therefore they checked in t quite few venues together. By monitoring the number of co-occurrences between Alice nd Bob s check-ins over long period of time, the SP might be ble to infer the friendship between them. We ssume tht the SP considers two users to be friends if the totl number of co-occurrences between them exceeds certin detection threshold. To mitigte the thret of such ttcks, Bob cn dely publishing the check-ins till Alice hs left. Delyed check-ins my cuse problem for populr commercil pplictions such s rel-time coupons for users in stores. Alterntively, we propose tht prior to checking in, Bob first checks if Alice hs lredy checked in t the sme venue erlier by nonymously requesting Alice s ltest check-ins from the SP. If Alice hs lredy checked in nd the number of cooccurrences would exceed the detection threshold if Bob submits norml check-in, Bob performs privte check-in. If Bob does not know the exct vlue of the detection threshold set by the SP, Bob cn ply conservtively by ssuming the threshold to be vlue tht he is confident to be lower thn the ctul threshold chosen by the SP. c) Attcks bsed on fetures of shred venues. Alice nd Bob shre number of comon venues (even if they did not visit those venues together). The SP might be ble to infer the friendship by exploiting certin fetures of the shred venues. Similr techniques hve been exploited to design link prediction system for online loction-bsed socil networks [11, 29]. Scellto et l. [29] use supervised mchine lerning method to predict new friendships bsed on plce fetures, such s the frction of common plces between two users. In our frmework, becuse the SP does not hve the ground truth informtion bout friendships, the SP cn insted turn to threshold bsed lgorithm to detect the friendship using the sme plce fetures. Among those plce fetures proposed by Scellto et l., the minimum loction entropy cross ll shred venues nd the similrity between users check-in behviors re reported to be two of the most importnt indictors of potentil friendship. We briefly describe these two fetures for the convenience of future discussion. Let U denote the user set nd V denote the venue set. Let C be the totl number of check-ins of ll users t venue nd let P i, be the check-in probbility of user i t venue, which is 6

7 defined s C i, /C where C i, represents the number of check-ins of user i t venue. The loction entropy of venue, H(), is defined s follows [11, 29]: H ( ) = P log( P ) (9) i, i, i U The results suggest tht two users re more likely to become friends if they re observed together t loctions of low entropy thn t loctions of high entropy such s shopping mll [11, 29]. We require tht the SP periodiclly computes nd publishes the loction entropy for ech venue. We lso ssume tht the SP would not lie bout the vlue of the loction entropy, since we ssume the SP to be honest-but-curious. In this pper, we dopt cosine similrity to mesure the similrity between users check-ins. The check-in similrity between users i nd j, denoted s Sim i,j, is computed s follows: Sim i, j = V V C C C i, j, C 2 2 i, j, V (10) To defend ginst such ttcks, Bob constntly monitors those bovementioned fetures between Alice nd him. If the vlue is pproching the detection threshold, Bob cn perform privte check-ins t venues which Alice hs previously visited. Similrly, if Bob does not know the exct vlue of the threshold, Bob could conservtively ssume the threshold to be lower vlue. The impct of privte check-ins. Privte check-ins cn ffect the performnce of collbortive recommender systems, becuse the SP is unble to correlte the encrypted venue to ny other venues stored in the system. However, considering the huge mount of check-ins stored in the SP s dtbse, we believe tht reltively smll number of privte check-ins would not ffect the overll performnce of the system significntly. We evlute in detil the impct in Section VI-C. B. Messge Inference Attcks Depending on the informtion leked to the SP, messges sent by users cn be grouped into three generl clsses: ) identity-bsed messges from which the SP cn lern the identity of the sender of the messge, e.g., check-in messges; b) friendship-bsed messges from which the SP cn lern tht the sender of the messge is friend of certin user, e.g., messges requesting to ccess friends check-ins; c) messges tht do not revel ny informtion to the SP, e.g., messges requesting to ccess contents tht re public to ll users. The SP cn lunch messge-inference ttcks by ) linking one identity-bsed messge nd one friendship-bsed messge to the sme sender, e.g., check-in messge sent by Alice erlier nd request messge for ccessing user s check-ins originting from the sme IP ddress s the first messge (which indictes tht Alice nd the user being requested re friends with ech other); b) linking two friendship-bsed messges to the sme sender, e.g., two seprte messges originting from the sme IP ddress request ccessing two users check-ins (which indictes tht the two users being requested shre common friend). The SP cn lunch such ttcks by observing nd nlyzing the rrivl times nd the originting ddresses of the received messges. In order to mitigte such threts, we propose tht users dopt mix network (e.g., Mixmster [26]) to send messges to the SP so tht the SP cnnot link multiple messges to the sme sender. VI. EVALUATION In this section, we conduct the following experiments to evlute the fesibility of our proposed frmework: ) the cryptogrphic overhed on smrt phone; b) the thret of check-ininference ttcks; c) the impct of privte check-ins. A. Dtsets We choose Gowll s the dt source for our experiments. Gowll ws geosocil networking website where users shred their loctions by checking in t venues (Gowll ws cquired by Fcebook in December 2011). The friendship in Gowll ws bidirectionl; tht is, both prties needed to ccept ech other s friend request to form the friendship. The dtsets used in our experiments were collected by Cho et l. [9]. We use three months of dtsets between My 2010 nd July 2010, which consist of the friendship network of Gowll users nd the time nd loction informtion of ll check-ins mde by users during the three month period. The whole dtsets contin totl of 57,071 ctive users nd 616,429 venues. The totl number of check-ins is 1,818,714. We define the rting of user t given venue s the totl mount of check-ins the user hs performed t the venue. We obtin the user-venue rting mtrix fter summrizing the totl check-ins, which hs density of (which is consistent with dtsets crwled from other lrge-scle geosocil networks, e.g., for Foursqure dtsets nd for Whrrl dtsets [31]). Ech user hs n verge of 9.67 friends nd ech user hs checked in t venues on verge. B. Cryptogrphic Overhed In the frmework, the most computtion-intensive cryptogrphic opertions re Privte Set Intersection Crdinlity to clculte socil influences (only required if user chooses to hide the friends set from the friends) nd homomorphic encryption to compute socil recommendtions. We conduct the following experiments on Google Nexus One phone feturing 1-GHz Snpdrgon CPU nd 512 MB of RAM. For ech experiment, we crry out 5,000 runs nd verge the results. We dopt the cryptogrphic protocol proposed by De Cristofro et l. [13] for Privte Set Intersection Crdinlity. The computtion complexity is liner in the sizes of the two sets. Let Alice hve v friends nd Bob hve w friends. Assuming tht it is Alice who requests computing the set intersection crdinlity from Bob, Alice needs to compute 2(v+1) exponentitions with short exponents nd v modulr multiplictions while Bob needs to compute (v + w) modulr exponentitions with short exponents nd w modulr multiplictions. Under the prcticl setting recommended in [13], the length of the exponent is 224 7

8 Figure 1. Vrying modulus length Figure 2. Vrying exponent length Figure 3. Co-occurrences Figure 4. Delyed time T Figure 5. Privte check-ins. Figure 6. Neighborhood-bsed CF (precision) Figure 7. Neighborhood-bsed CF (recll). Figure 8. United CF system bits. Furthermore, ssuming user s friend is honest with the user, Alice cn just send the computed set intersection crdinlity to Bob so Bob does not need to repet the computtion. We dopt the Pillier cryptosystem s the homomorphic encryption scheme becuse of its dditive homomorphic property. Assuming tht the sum of the number of venues visited by user s friends is N v, the user needs to compute N v modulr exponentitions nd less thn N v modulr multiplictions. In ddition, in order to perform rel rithmetic over finite field, we represent floting point numbers s fixed point numbers by multiplying them by fixed bse, denoted s bse. Therefore, the exponent used in (8) is the product of SI i,k nd bse, denoted s expo. For evlution purposes, we fix the vlue of SI i,k to be 0.5 (recll tht SI i,k represents the normlized socil influence with the vlue between 0 nd 1) nd fix the bse to be Therefore, the length of expo is shorter thn 19 bits. In the first experiment, we vry the modulus length nd evlute the computtion time of single modulr multipliction nd single modulr exponentition on the smrt phone. We first set the length of expo to be 224 bits (in ccordnce with the cse of computing socil influences) nd then run the sme experiment with the length of expo s 19 bits (in ccordnce with the cse of computing socil recommendtions). The results re presented in Fig. 1. In the second experiment, we fix the modulus length to be 2048 bits, vry the length of expo, nd evlute the computtion time of single modulr exponentition. The results re presented in Fig. 2. Fig. 1 shows tht on smrt phone, with 2048-bit modulus, it tkes pproximtely 0.54 ms to compute modulr multipliction, 7.54 ms to compute modulr exponentition with the length of expo being 19 bits, nd ms to compute modulr exponentition with the length of expo being 224 bits. Fig. 2 shows tht the computtion time of modulr exponentition increses s the length of expo grows. For n verge user in the tested dtsets, it tkes pproximtely s to compute socil influences of ll friends (if the user wnts to hide the friends set from her friends) nd 1.71 s to compute socil rtings t ll venues visited by friends. Note tht, users re only required to perform such cryptogrphic opertions t low frequencies (e.g., only once week), s mentioned in Section IV-D. Therefore, it is computtionlly fesible to perform the required cryptogrphic opertions on smrt phone. C. Check-in-inference Attcks Bsed on Co-occurrences Thret of the ttck. We evlute the thret of check-ininference ttcks bsed on co-occurrences, s described in Section V-b. The SP considers two users to be friends if the totl number of co-occurrences between them exceeds certin threshold. We compre the results with ground truth dt. We use two metrics to study the thret of the ttcks: ) precision: the frction of identified friendships tht re correct; b) recll: the frction of rel friendships tht re correctly identified. We consider two check-ins to be co-occurrence if the venues contined in the check-ins re the sme nd the time difference between two check-ins is smller thn T. In this experiment, we choose T to be 3 hours. We vry the threshold of cooccurrences from 1 to 5 nd evlute the precision nd recll of the ttcks. The results depicted in Fig. 3 indicte tht s the threshold increses, the precision of the ttck increses, while the recll decreses. The empiricl results suggest two cooccurrences to be prcticl choice of the threshold; the precision is over 40% nd the recll is pproximtely 3.67%. While the recll is reltively low, the detection lgorithm chieves reltively high precision, which suggests tht if two friends hve checked in t more thn two venues together, the SP cn infer the friendship between them t rther high probbility. Delyed check-ins. If user lerns tht his/her friend hs just checked in t the sme venue, the user cn choose to dely performing the check-in by period of T. If the friendship ws detectble by the SP, to gurntee tht the friendship is still detectble, the SP hs to extend the observtion window from T to T + T ccordingly. We fix the threshold to be two cooccurrences, vry the vlue of T, nd evlute the performnce of the ttcks. The results re depicted in Fig. 4. As expected, the precision of the ttck drops s we increse the vlue of T. However, the results indicte tht the precision of the ttcks remins over 13% even when T is 24 hours, suggesting tht delyed check-ins could only mitigte the thret, s the SP 8

9 is still ble to detect the friendship t reltively lower precision. Impct of the privte check-in. For ech check-in in the dtsets, we exmine whether or not it needs to be encrypted to void exceeding the detection threshold for inference ttcks bsed on co-occurrences. We clculte the frction of privte check-ins mong ll check-ins under different thresholds. Fig. 5 shows tht there is only smll frction of privte check-ins mong ll check-ins. In prticulr, totl of 1.60% check-ins re required to be encrypted with the threshold being two. In the following experiments, we investigte the impct of privte check-ins on the performnce of collbortive recommender systems. For simplicity's ske, we dopt clssic neighborhood-bsed collbortive recommender system [18, 31]. We dopt methods nd metrics similr to Ye et l. [31] to evlute the performnce of the recommender system. For ech individul user in the dtsets, we rndomly mrk off x% (x = 10, 30 (defult vlue), 50) of ll venues visited by the user. The im of the recommender system is to recover the mrked off user-venue pirs for ech trgeted user. The recommender system computes rnking score for ech venue nd returns the top-n (N = 5 (defult vlue), 10, 20) highest rnked venues for ech user s recommendtions. For given user, if recommended venue hppens to be previously mrked off venue for the user, we consider the venue to be recovered venue. We use two metrics to evlute the performnce of the recommender system: ) precision: the rtio of recovered venues to the N recommended venues; b) recll: the rtio of recovered venues to the set of mrked off venues. We tret the performnce of the recommender system when there re no privte check-ins s our bseline. We compre the bseline with the performnce of the recommender system when there re privte check-ins under different thresholds of co-occurrences. For ech experiment, we conduct 10 runs nd verge the results. We conduct the sme experiments when N = 5, 10, 20. The results re presented in Fig. 6 (precision) nd Fig. 7 (recll). We omit plotting the error br becuse the stndrd devition is below one thousndth. The performnce of the recommender system is consistent with the reported results in [31] (the reported precision in [31] is below 0.03 for the Foursqure dtsets with density of user-venue rting mtrix). Note tht, the effectiveness of recommender systems for sprse dtsets is typiclly rther low due to limited informtion contined in the dtsets, which is expected to increse s more user check-ins re logged in the system. In our experiments, we focus on observing the reltive performnce difference of the recommender system with nd without privte check-ins insted of their bsolute performnce mesures. Fig. 6 nd Fig. 7 indicte tht the introduction of privte check-ins does not hve significnt impct on the performnce of the recommender system. There is n verge of 0.35% loss in precision nd 0.26% loss in recll when the detection threshold is two. In ddition, s the number of totl check-ins continues to grow, we expect the impct of privte check-ins to be even less, becuse the remining unencrypted check-ins re most likely enough to chrcterize user similrities. We lso conduct the sme experiments by vrying the percentge of mrked off venues, which exhibits similr results (figures omitted). () Minimum loction entropy (b) Check-in similrity Figure 9. Attck bsed on fetures of shred venues. In ddition, we evlute the performnce of the unified collbortive frmework using (5), which integrtes the results of the neighborhood-bsed collbortive recommender system nd the socil recommender system (using the optiml setting recommended in [31]). We compre the performnce of the unified collbortive frmework (denoted s CF-UF) with the neighborhood-bsed collbortive recommender system (denoted s CF-U) under different thresholds of co-occurrences. Fig. 8 shows tht incorporting socil context indeed improves the performnce nd privte check-ins do not ffect the overll performnce of the recommender system significntly. D. Check-in-inference Attcks Bsed on Fetures of Shred Venues We evlute the thret of check-in-inference ttcks bsed on monitoring the minimum loction entropy cross ll shred venues by two users nd the similrity of user check-in behviors. We use the sme metrics, precision nd recll, to evlute the performnce of the ttcks. In the first experiment, we ssume tht the SP considers two users to be friends if the minimum loction entropy cross their shred venues is smller thn certin detection threshold. We then compre the results with ground truth dt. Fig. 9() depicts the performnce of the ttcks s we increse the threshold of loction entropy. The overll precision nd recll re much lower thn those from the ttcks bsed on cooccurrences. Notice tht, there is steep drop in precision nd increse in recll when the threshold of entropy is one bit. One possible explntion is tht there re totl of 13.91% venues tht hve one bit of entropy nd hve been visited by only two users in the dtsets. In the second experiment, we ssume tht the SP considers two users to be friends if the cosine similrity of two users check-in behviors exceeds certin threshold. Similrly, we vry the threshold of similrity weight nd evlute the performnce of the ttcks. We only consider users hving t lest five check-ins, becuse the similrity weights derived from users with too few check-ins my be misleding. The results re depicted in Fig. 9(b). When the threshold of similrity weight is 0.4, the chieved precision is pproximtely 41.46%, which is close to the performnce of the detection lgorithm bsed on co-occurrences when the threshold of co-occurrences is two. However, the corresponding recll is only 1.44%, which is pproximtely 40% of the recll chieved by the detection lgorithm bsed on co-occurrences. Notice tht, s we increse the threshold from 0.8 to 0.9, the precision of the lgorithm 9