(Mobile Phones, On-Board Navigation Systems) Location Based
Total Page:16
File Type:pdf, Size:1020Kb
2010 IEEE 6th Intemational Conference on Wireless and Mobile Computing, Networking and Communications Mobile Systems Location Privacy: "MobiPriv" A Robust K Anonymous System. Leon Stenneth Phillip S. Yu Ouri Wolfson Dept. of Computer Science Dept. of Computer Science Dept. of Computer Science University ofIliinois, Chicago University of Illinois, Chicago University ofIllinois, Chicago Chicago, USA Chicago, USA Chicago, USA [email protected] [email protected] [email protected] ABSTRACT unwanted advertisements sent to your mobile device. Wi th the rapid advancement of positioning and tracking There are several architectures that are considered for capabilities (mobile phones, on-board navigation systems) privacy aware location based services. These architectures location based services are rapidly increasing. Privacy in are client-server, trusted third party,and peer based. location based systems is addressed in many papers. Our Inthe strict client server architecture clients communicate work is focused on the trusted third party privacy directly with the LBS by submitting a request, the LBS framework that utilizes the concept of k-anonymity with or then returns a response directly to the client [11,12,1 3,14]. without I-diversity. In previous anonymization models k Inthe peer based model clients communicate directly with may be defined as a personalization parameter of the each other [21]. The intention of the clients is to cloak with mobile user or as uniform system parameter for all mobile each other in order to satisfy the k-anonymous principle. users . Clearly, k other users may not be available at the The trusted third party model utilizes the concept of a time of request in these systems. These requests are middle-ware between the mobile user and the LBS. We discarded because the qualityof service (QoS) they require sometimes refer to the middle-ware as anonymization cannot be satisfied. In this paper we introduce a novel server or AS. Mobile requests are first sent to the middle suite of algorithms called MobiPriv that guarantees a ware,the request is then cloaked into a region with the 100% success rate of processing a mobile request using k spatial and temporal tolerance, we refer to this as a region anonymity with diversity considerations. We evaluated our request. The request is then cloaked with other users region suite of algorithms experimentally against previously request in close proximity, we refer to it as an aggregate proposed anonymization algorithms using real world region request. These anonymization (middle-ware) traffic volume data, real world road network and mobile systems are already deployed publicly [25]. Our work is users generated realistically by a mobile object generator. focused on the trusted third party architecture. Location privacy in location based system is to prevent adversaries from learning a mobile user past or current Keywords - Location Based Services; k-anonymity; 1- Diversity; Privacy; Mobility locations and the time the locations where visited. We used the concept of cloaking for location protection. We also define request linking protection as preventing an 1. INTRODUCTION adversary from knowing the mobile user that submitted a Location based services (LBS) are applications that take request. We used the concept of k-anonymity [9,8] and 1- the geographic location into consideration. LBS is diversity [7,26] to prevent request linking. enhanced by the rapid improvement of the mobile phone Mobile users in these frameworks are considered k capabilities such as GPS and multimedia. Example of anonymous if a mobile user cannot be distinguished from location based services are TransitGenie [20], NextBus at least k-l other mobile users in the same region request. [22],Google Latitude [5]. The concept of I-diversity ensures that the queries in In general a user submit a request to some database or region request are not homogenous. Recall that a region location based server and receives a response. A typical request consist of a cloaked area containing multiple request from a user include some location criteria and may mobile requests sent from the middle-ware to the LBS. be in the the form of <id,time, location(x,y),query> The remainder of the paper is organized as follows. Example: "What is the fastest path from my current Section 2 ad dresses the preliminaries of our framework. location (latitude,longitude) to NavyPier Chicago, Illinois Section 3 presents an overview of Mobi Priv and Section 4 (latitude,longitude}". highlights the experimental evaluations. Finally, section 5 With untrusted servers the privacy and security of an and section 6 discusses the related work and the conclusion individual may be leaked to adversaries. Several reports respectively. are available where GPS devices were used to stalk user locations [2 3,24]. A knowledge of location may reveal a person's political, religious or medical affiliations. A 2. PRELIMINARIES knowledge of location may also lead to tracking or In this section we discuss our motivation, architecture, U.S. Govemment work not protected by U.S. copyright 54 attack model and main concepts. users submit a request incorporating positioning information such as current location (latitude,longitude ) as 2.1 Motivation a parameter of the request to the AS. Inthis paper we tackle privacy in location based services We assume that adversaries loiter between the by preventing adversaries from being aware of the current anonymization server and the LBS or adversaries directly or past mobile user location as well as linking a specific aims for the LBS. We also assume that adversaries know request or response to a mobile user. the exact location of some mobile users along with the Current k-anonymous techniques that uses the AS concept time they submitted the request. This assumption is [7,8,15,19] will under-perform if k-l other users are not realistic as adversaries may have background knowledge available at the time of request. These AS systems allow of the victim in real life. Adversaries are also aware of the the user to define their own personal level of privacy by hashed identification of all the mobile users in a region specifying the k in k-anonymity. request. The anonymization engine has two options if at the time of The first level of protection we provide is securely hashing request k-l users are not present: (1) Wait until k-l other the user identification and message identification before requests are made in the same region [8]. (2) Expand the submitting the region request. We refer to this as weak region in search for k-l other requests [19,15] or continue anonymizationsince it is not enough to deter adversaries. to divide a large region until the region contains at most k- Even if a user does not disclose their identity at a location, 1 other users [15]. an adversary may still learn this information through If after waiting for k-l other users or region expansion to spatial and temporal inferences. fmd k-l other requests, if the AS still cannot satisfy k then Consider a transit itinerary system such as TransitGenie the request is culminated. [20] or NextBus [22] where a user may queryfor current Clearly dropping user request because k-l other users are buses in their vicinity. By sending this request a user not around will appraise the system as unreliable. Also, location is revealed to the LBS. Knowing a sender's some LBS systems cannot tolerate temporal delay and location may lead to spam advertisements send to your region expansion compromises the accuracy of the device also, religious affiliations and hotel visits may be response. revealed. Furthermore, if continuous queries are sent a user may be tracked. Location privacy is the prevention of adversaries from 2.2 Architecture knowing a user's current or past locations. To protect Our work is focused on the trusted third party architecture location privacy we perturb a point request submitted by and is the first work to consider realistic diverse dummy the user into a region request. In this way an adversary generation on this type of architecture. cannot know where exactly in the region the sender of the The users first send the requests to AS, the AS then remove request is located. or pseudo-generate the identification field and also cloak Clearly, if the sender is the only person in the perturbed the client location point into a region containing k-l other region the adversary may infer with high confidence that users. One novelty about our approach is if k-l other the request belongs to the sender. We called this a request mobile user request cannot be found we generate realistic linking attack. Inorder to prevent linking a request to the diverse dummies instead of dropping the query. The AS user the concept of aggregating k-l other users is the same then forwards the aggregate region request to the LBS. region is used. We refer to this as location k-anonymity The LBS processes the query and send a response. This [10]. response is generic and should be filtered to get precise Observe also that if all the k users in the region submit results. Filtering can be done on the AS or by the mobile request to the same symbolic address such as the same client. A diagram depicting our architecture is shown movie theater, k-anonymity fails because the adversary below in Figure 1. may infer that some persons are interested in that symbolic address. This kind of attack is referred to as the homogeneity attack. For this reason the concept of 1- diversity is considered [26]. L diversity adds another dimension to the privacy level and ensures that our query location and querycontents are diversified. For example, request should span across different postal ad dresses or different buildings.