Longitude: a Privacy-Preserving Location Sharing Protocol for Mobile Applications⋆
Total Page:16
File Type:pdf, Size:1020Kb
Longitude: a Privacy-preserving Location Sharing Protocol for Mobile Applications⋆ Changyu Dong, Naranker Dulay Department of Computing Imperial College London {changyu.dong,n.dulay}@imperial.ac.uk Abstract. Location sharing services are becoming increasingly popular. Although many location sharing services allow users to set up privacy policies to control who can access their location, the use made by service providers remains a source of concern. Ideally, location sharing providers and middleware should not be able to access users’ location data without their consent. In this paper, we propose a new location sharing protocol called Longitude that eases privacy concerns by making it possible to share a user’s location data blindly and allowing the user to control who can access her location, when and to what degree of precision. The underlying cryptographic algorithms are designed for GPS-enabled mobile phones. We describe and evaluate our implementation for the Nexus One Android mobile phone. 1 Introduction Location sharing is an increasingly popular function of social-networking services, al- lowing users to share their location with family and friends. Examples include Google Latitude [1], Yahoo Fire Eagle [2], and Loopt [3]. Perhaps the biggest user concern about location sharing services is privacy. Many services allow the users to control who will have access to their location data, over what period of time, and to what degree of precision. However, for many users, the service providers are also a source of concern. Will not the location sharing service use location data to the detriment of the user? Users’ location data is normally saved by the service provider. Unfortunately, this allows providers to track, profile and target users [4,5] as well as aggregrate the data and sell it to others. The typical approach to informing users is to provide a lengthy webpage that states what the service provider may do with the data. The webpage is usually written in a sufficiently obfuscated way to ensure that few users will bother reading it, and often to hide the fact that providerswant to give themselves a high degree of access to the data. A related, but important concern, is that the service provider may be the target of network intrusions and untrustworthy insiders, as well as requests from law-enforcement agencies [6]. This paper describes a protocol called Longitude for location sharing that uses cryp- tography to limit service provider access to location data. It is aimed at providerson the ⋆ This work was supported by UK EPSRC research grant EP/F023294/1 - PRiMMA: Privacy Rights Management for Mobile Applications. Internet or middleware to provide location sharing blindly without the hassle of com- pliance to data protection and location data requests. It ensures that users are able to share their location but are not tracked. Note that the protocol is not a replacement for traditional location-services like Google maps that translate locations into maps. Naively, a user (Alice) could encrypt her location before sending it to the location sharing provider (Luke), effectively protecting it from Luke or other adversaries. Alice would have to securely disseminate the key to her friends (Bob and Carol) and revoke it if she wanted to prevent access to any friend or if the key was disclosed. Rather than a common shared key, Alice could establish pair-wise secret keys with each of her friends or use asymmetric keys, both requiring a great deal more additional storage, computa- tion and communication overheads. A more flexible approach is needed, particularly for resource-constrained mobile devices. Longitude has the following characteristics: 1. Privacy preserving. Longitude enables location-sharing providers or middleware to disseminate user location data blindly. The data is specially encrypted. Alice can control which of her friends can see her location, at what times and to what degree of precision. 2. Simple key management: Alice only needs to keep her own key on her mobile de- vice. She can remove any of her friends at any time without affecting other friends. The revocation process can be done by Alice without requiring any interactions with her friends. 3. Lightweight cryptography.Most of the computationallyintensive cryptographicop- erations in Longitude are done by the service provider, not on the mobile device. Computation and battery life for mobile devices can be optimised further by pre- computing cryptographic material when the mobile device is connected to a power source. 4. Constant communication overhead. Longitude’s communication costs do not in- crease with the number of friends (receivers). No matter how many friends a user has, each piece of location data is encrypted and sent only once. Therefore, the overhead of data communication is minimised. The paper is organised as follows: in Section 2, we summarise the related work; in Section 3, we discuss the system and security model as well as the initial assumptions; in Section 4, we present Longitude, how to fine control user privacy and issues related to user revocation; in Section 5, we explain the underlying cryptographic techniques; in Section 6, we describe and evaluate a prototype implementation of Longitude for Android phones; in Section 7, we conclude the paper and discuss our future plans. 2 Related Work Location sharing services have attracted a lot of attention from industry [1–3], and the development of GPS-enabled mobile phones makes it easy to sense and share user location. According to [7], these services can be categorised into two types: (1) purpose- driven,in which the requesterhas a specific need for the users location, e.g. coordinating meetings, arranging transportation, sending reminders, and (2) social, in which location information is shared simply because it is interesting or fun to do so. However, users are concerned about their privacy and according to [8], existing industry guidelines and implementations do not adequately address these concerns . Previous research on location privacy has focused on anonymisation. For example, in [9], the authors describe a middleware system which delays and reorders messages from users within a mix zone to confuse an observer.In [10],a mechanism called cloak- ing is proposed that conceals a user within a group of k people. To achieve this, the accuracy of the disclosed location is reduced so that a user is indistinguishable from at least k − 1 other users. In [11], k-anonymity is achieved by an ad-hoc network formed by the user and surrounding neighbours, while [12] shows how to achieve k-anonymity in a distributed environment where there are multiple non-colluding servers. Anonymi- sation has a fundamental difference with location sharing. The goal of anonymisation is to prevent others from relating a location to a user; on the other hand, the goal of loca- tion sharing is to let authorised users know where a user is. Therefore, anonymisation is not directly applicable here. Most existing location sharing services do offer the users some form of controls over their privacy. In [8], the authors examine 89 location sharing services and the most widely adopted privacy controls are white list, being invisible, blacklist, group-based permission and providing less detailed location. Several research projects in this area have tried to provide more expressive and effective policy-based privacy controls. For example, Locaccino [13] allows users to specify more fine grained policies based on temporal and spatial restrictions. The pawS system [14] allows a user to use P3P policies to define their location privacy settings and negotiate with the location service provider. The main drawback in all such approaches is that the users must trust the provider, its privileged employees and the security of the infrastructure. The user’s privacy will also be compromised if the service provider is required to disclose the data to a law- enforcement agency. In a location sharing services, the providerusually acts as a broker to disseminate the location information to the authorised receivers. In most of the cases the provider does not need to know the data content in order to provide this service. In [15] a system for sharing user location is described which provides protection from the provider. Users use pairwise symmetric key encryption or asymmetric key encryption to prevent the provider from learning their location. However, the user needs to store multiple keys. Moreover the user has to send multiple copies of the same data, each encrypted under a different key in order to let all her friends be able to get her location. The overheads of key management, computation and communication increase linearly with the number of friends. Some work [16–19] has been done dealing with the problem of preserving privacy in proximity services. Proximity service is a sub-type of location sharing service which notifies and displays a friend’s location if the friend is nearby. While in Longitude we consider the more general location sharing where a user can see a friend’s location no matter the friend is near or far away from the user. 3 Models and Assumptions 3.1 Systems model The Longitude protocol has the following parties: the location-sharing service provider and the set of users registered with the provider. We assume that each user has a GPS- enabled mobile phone that can sense the user’s current location and send it to the provider. The provider stores the location and along with some user configuration data. Users define which other users are authorised to receive their location. Authorised re- ceivers can be removed at any time by the user. Users can also define the precision of the location that will be seen by a particular receiver, e.g. accurate to 1km, 5km, 10km, 100km. 3.2 Security Model We consider the service-provider to be honest-but-curious.