Privacy-Preserving Location Tracking of Lost or Stolen Devices: Cryptographic Techniques and Replacing Trusted Third Parties with DHTs Thomas Ristenpart∗ Gabriel Maganis† Arvind Krishnamurthy† Tadayoshi Kohno† ∗University of California, San Diego †University of Washington
[email protected] {gym,arvind,yoshi}@cs.washington.edu Abstract recover the device itself. The number of companies of- We tackle the problem of building privacy-preserving fering such services, e.g., [1, 9, 21, 29, 34, 37, 38], attests device-tracking systems — or private methods to assist in to the large and growing market for device tracking. the recovery of lost or stolen Internet-connected mobile Unfortunately, these systems are incompatible with devices. The main goals of such systems are seemingly the oft-cited goal of location privacy [17, 22, 23] since contradictory: to hide the device’s legitimately-visited the device-tracking services can always monitor the lo- locations from third-party services and other parties (lo- cation of an Internet-enabled device — even while the cation privacy) while simultaneously using those same device is in its owner’s possession. This presents a signif- services to help recover the device’s location(s) after it icant barrier to the psychological acceptability of track- goes missing (device-tracking). We propose a system, ing services. To paraphrase one industry representative: named Adeona, that nevertheless meets both goals. It companies will deploy these systems in order to track provides strong guarantees of location privacy while pre- their devices, but they won’t like it. The current situation serving the ability to efficiently track missing devices. leaves users of mobile devices in the awkward position of We build a version of Adeona that uses OpenDHT as the either using tracking services or protecting their location third party service, resulting in an immediately deploy- privacy.