Defining Perfect Location Privacy Using Anonymization

Transcription

1 Defg Perfect Locato Prvacy Usg Aoymzato Zarr otazer Electrcal a Computer Egeerg Departmet Uversty of assachusetts Amherst, assachusetts Emal: seyeehzar@umass.eu Amr Houmasar College of Iformato a Computer Sceces Uversty of assachusetts Amherst, assachusetts Emal: amr@cs.umass.eu Hosse Pshro-Nk Electrcal a Computer Egeerg Departmet Uversty of assachusetts Amherst, assachusetts Emal: pshro@eg.umass.eu Abstract The popularty of moble evces a locato-base servces LBS) has create great cocers regarg the locato prvacy of users of such evces a servces. Aoymzato s a commo techque that s ofte beg use to protect the locato prvacy of LBS users. I ths paper, we prove a geeral formato theoretc efto for locato prvacy. I partcular, we efe perfect locato prvacy. We show that uer certa cotos, perfect prvacy s acheve f the pseuoyms of users s chage after on r 2 ) observatos by the aversary, where N s the umber of users a r s the umber of sub-regos or locatos. I. INTRODUCTION oble evces capable of commucatg over the Iteret wth hgh-precso localzato capablty have become pervasve the past several years. These commucatg moble evces prove a we rage of servces base o the geographc locato of the user. We refer to such servces that use the geographc locato of ther users as locato-base servces LBS). Whle LBSes prove so may servces to ther users thaks to ther urestrcte access to the locato formato of the users, they also mpose sgfcat prvacy threats to them. Some mechasms have bee propose orer to protect locato prvacy of LBS users, [] [7], geerally referre to as locato prvacy protecto mechasms LPP). Toay s LPPs ca be classfe to two ma categores: etty perturbato LPPs [5] [7] mofy the etty of moble users orer to protect ther locato prvacy e.g., through aoymzato techques), other wors they am at mprovg locato prvacy by cocealg the mappg betwee users a locato observatos. Locato perturbato LPPs are the seco category [] [4], [7], whch a ose to moble users locato coorates. Ths ca potetally mprove locato prvacy by returg accurate locato formato to the LBS applcatos. Some LPPs combe both mechasms to aress ths problem, but ths may egrae the performace of a LBS system. Ufortuately, espte prevous stues o locato prvacy, the esg of LPP systems reles o a-hoc algorthmc heurstcs such as ag ose a shufflg ettes. I ths paper, we propose a fuametal, aalytcal stuy of locato prvacy for locato-base servces. We assume the strogest moel for the aversary,.e., a aversary who has complete statstcal kowlege of the users movemets. The, we efe locato prvacy base o the mutual formato betwee the aversary s observato a actual locato ata. Ths allows us to efe perfect locato prvacy where users have provably prvate locatos. The, we show that for r possble.. locatos, f the aversary obtas less tha on r 2 ) observatos per user, the all users have perfect locato prvacy at all tme. We show that perfect locato prvacy s ee achevable f the LPPs are esge approprately. II. RELATED WORK Exstg work o the esg of LPP mechasms ca be classfe to two ma categores of etty perturbato LPPs [5] [7] a locato perturbato LPPs [] [4], [7]. Locato perturbato LPPs a ose to users locato coorates whle etty perturbato LPPs mofy the ettes of moble users. A commo approach use by etty perturbato LPPs s to obfuscate user ettes wth a group of users, a approach kow as k-aoymty [2], [8]. A seco commo approach to etty perturbato LPPs s to exchage users pseuoyms wth specfc areas calle mx-zoes [9], [0]. Freuger et al. show that combg techques from cryptography wth mx-zoes ca result hgher levels of locato prvacy [5]. Also, ashae et al. use game theoretc approaches to mprove the locato prvacy protecto prove by mx-zoes []. Locato cryptography s aother recto take towars protectg locato formato [2]. ay propose locato perturbato LPPs work by replacg each user s locato formato wth a larger rego, a techque kow as cloakg [2], [3], [3], [4]. Aother recto to locato perturbato s clug ummy locatos the set of possble locatos of users [5], [6]. Several works [4], [7] [20] use fferetal prvacy to protect locato prvacy locato formato atasets. Ths sures that the presece of o sgle user coul sgfcatly chage the outcome of the aggregate locato formato.

2 For stace, Ho et al. [2] propose a fferetally prvate locato patter mg algorthm usg quatree spatal ecomposto. Dewr [22] combe k-aoymty a fferetal prvacy to mprove locato prvacy. Some locato perturbato LPPs are base o eas from fferetal prvacy [4], [23] [26]. For stace, Ares et al. he the exact locato of each user a rego by ag Laplaca strbute ose to acheve a esre level of geo-stgushablty [26]. Several works ame at quatfyg locato prvacy protecto. Shokr et al. [7], [27] efe the expecte estmato error of the aversary as a metrc to evaluate LPP mechasms. O the other ha, a et al. [6] uses ucertaty about users locato formato to quatfy user locato prvacy vehcular etworks. A. Defg Locato Prvacy III. FRAEWORK To vestgate the locato prvacy problem, we frst ee to prove a geerc mathematcal efto for locato prvacy. Coser a etwork cosstg of N users, a suppose that a LPP s use to protect the prvacy of the users. Let A be a aversary who s tereste kowg the locatos of the users as they move. To esure prvacy, we assume the strogest aversary the sese that we assume the aversary has complete statstcal kowlege of the users movemets. That s, through prevous observatos or other sources, the aversary has a complete moel that escrbes the movemet of users as a raom process o the correspog geographc area. Now, startg at tme zero, the users move through the area. I partcular, let X t) be the locato of user at tme t. Aversary A s tereste kowg X t) for =,2,..., N. However, he ca oly observe the aoymze a obfuscate versos of X t) s prouce by the LPP. I partcular, let Y be a collecto of observatos avalable to the aversary. We efe perfect locato prvacy as follows: Defto. User has perfect locato prvacy at tme t wth respect to aversary A, f a oly f lm IX t); Y) = 0, N where I.) shows the mutual formato. The above efto requres that the observatos of the aversary oes ot gve her ay useful formato about the locato of user. It also assumes a large umber of users N ). Ths assumpto s val for almost all applcatos that we coser. I ths paper, to acheve locato prvacy, we use oly aoymzato techques. That s, we perform a raom permutato Π o the set of N users, a the assg the pseuoym Π ) to user. Π : {,2,, N} {,2,, N} Throughout the paper, we assume the permutato Π s chose uformly at raom amog all N! possble permutatos. For smplcty of otatos we sometmes rop the superscrpts, e.g., Π = Π. For =,2,, N let X ) = X ), X 2),, X )) T be a vector whch shows the th user s locatos at tmes,2,,. The aversary observes a permutato of users locato vectors, X ) s, usg the permutato fucto Π. I other wors, the aversary observes where, Y ) = PermX ),X ),,X ) 2 N ; Π ) = X ) Π ),X), Π,X) 2) Π ) = Y ),Y ),,Y ) 2 N ) Y ) Π ) = X) = X ), X 2),, X )) T We trouce two lemmas here that wll be use to prove the ma result through the paper. Lemma. For k =,2,..., let Z k) = Z k), Z k),, Z k) 2 k) ) be a sequece of epeet raom vectors wth sze k) k, such that k) = ak b where a > 0 a 0 < b < are costats. Assume Z k), Z k),, Z k) 2 are epeet screte raom varables wth etcal rage,.e., PZ k) = x) > 0 f a oly f PZ k) j = x) > 0. Further, suppose that ther strbutos F Z k ) coverge to the staar ormal strbuto. I partcular, for each γ > 0, there exsts k 0 N such that f k > k 0, the { } sup F Z k ) x) Φx) : x R, {,2,...,k)} γ Let Y k) be a permute verso of the Z k) uer the raom permutato Π ) : Y k) = PermZ k), Z k) 2,, Z k) ; Π ) ), For > 0 we efe a set A k) as follows: A k) = { y k) : PΠ k) ) = j Y k) = y k) ) < }, The, for ay > 0, we have lm k PYk) A k) ) = Proof. Sketch) Here, the goal s to stuy the cotoal probablty PΠ ) ) = j Y k) = y k) ). I partcular, we wat to stuy the power of a aversary fg the permutate value of,.e., Π k) ), base o the observe ata Y k). To get the ea beh ths lemma, let s assume that Z s have exactly ormal strbuto stea of coserg Z s strbutos covergg to N 0,)). So, all Z s are.. raom varables. If we observe Y k) Z k) N 0,) Y k) = PermZ k), Z k) 2,, Z k) ; Π ) ),

3 the, by coserg that Z k) s are.. a usg symmetry, probablty of fg the rght permutato fucto base o ths observato s PΠ ) ) = j Y k) = y k) ) =. I the lemma, as Z s strbutos coverge to N 0,), we are ot able to say ths probablty s exactly, but t s close to t. Ths ca be show usg the cotuty of the probablty strbuto fuctos. I partcular, we ca show < PΠ) ) = j Y ) = y ) ) < + wth hgh probablty. Thus, wth hgh probablty PΠ)) = j Y k) = y k) ) < for ay > 0, a that proves the lemma. Lemma 2. Let Y k) = Y k) be the aversary s observatos as efe above. Let us efe Y as, Y = Y k). k= The, gve Y,Y 2,,Y N, we have that Π a Y N are epeet. Proof. Ths s the mmeate result of the fact that Y,Y 2,,Y N ) = Y s a suffcet statstc for p s. I partcular, f Y Y,Π) = f Y Y ) whch meas that Y a Π are epeet gve the average values Y. B. Locato Prvacy for a Smple Two-State oel To get a better sght about the locato prvacy problem, here we coser a smple scearo. Coser a scearo where there are two locatos, locatos 0 a. At ay tme k {0,,2, }, user has probablty p 0,) to be at locato, epeetly from prevous locatos a epeetly from other users locatos. Therefore, X k) Beroullp ). To keep thgs geeral, we assume that p s are raw epeetly from some cotuous esty f P p) o the 0,) terval. Specfcally, f P p) = 0 for all p 0,) a there are δ 2 > δ > 0 such that δ < f P p) < δ 2 for all p 0,). The values of p s are kow to the aversary. Theorem. For two locatos wth above efto a observato vector Y ) f all the followg hols, ) = cn 2 α, whch c,α > 0 a are costat 2) p 0,) 3) p 2, p 3,, p N ) f p, 0 < δ < f p < δ 2 4) P = p, p 2,, p N ) be kow to the aversary the, we have k N, lm IX k); Y ) ) = 0 N Before provg a formal proof for Theorem, let us prove the tuto beh t. Let us look from the aversary s perspectve. The aversary woul lke to obta X k). The aversary, kows the value of p. To obta X k), t suffces that the aversary obtas Π). Sce X k) Beroullp ), to o so, the aversary ca look at the averages Y Π) = Y Π)) + Y Π) 2) Y Π) ). I fact, we show Lemma 2 that Y Π) s prove a suffcet statstcs for ths problem. Now, tutvely, the aversary s successful recoverg Π) f two cotos hol ) Y Π) p. 2) For all, Y Π) s ot too close to p. Now, ote that by the cetral lmt theorem CLT), Y Π) p p p ) N 0,). That s, loosely speakg, we ca wrte Y Π) N p, p ) p ). Coser a terval I 0,) such that p I a the legth of I, legthi), s equal to L N = c N where c > 0 s a arbtrary costat. Note that for ay,2,, N the probablty that p I s larger tha δl N = cδ N. I other wors, by choosg c large eough, we ca guaratee that a large umber of p s be I. O the other ha, ote that we have VarY Π) ) legthi) = = p p ) c N N on 2 ). Note that here, we wll have a large umber of ormal raom varables Y Π) whose expecte values are terval I wth hgh probablty a ther staar evato s much larger tha the terval legth. Thus, stgushg betwee them wll become mpossble for the aversary. I other wors, the probablty that the aversary wll correctly etfy Πl) goes to zero as N goes to fty. That s, the aversary wll most lkely choose a correct value j for Πl). I ths case, sce the locatos of fferet users are epeet, the aversary wll ot obta ay useful formato by lookg at X j k). Proof of Theorem. We efe X X = X k). k=

4 Sce X k) Beroullp ) EX = p, VarX ) = p p ). As, by applyg Cetral Lmt Theorem, X p p p ) = X p p p ) N 0,) a sce Y Π ) = X, the we ca coclue that Y Π) p p p ) N 0,). Next, we efe a raom set J as a set whch clues ces as follows where J = { : p ɛ < p < p + ɛ} ɛ = N α 3 Remember that α s gve by = cn 2 α. Also ote that J. Let us frst f the strbuto of J whch s the umber of elemets J. Note that for N large eough, ) p +ɛ Pr p ɛ < p < p + ɛ = f P p)p. p ɛ Sce δ < f P p) < δ 2, we coclue that ) 2ɛδ < Pr p ɛ < p < p + ɛ < 2ɛδ 2, So we ca wrte Pr ) p ɛ < p < p + ɛ = 2ɛδ. for some δ > 0. We coclue that J BN,2ɛδ) whe N s large eough. I partcular, for the expecte value a varace of J we get E[ J ] = 2ɛδN = 2 N α 3 V ar J ) = 2Nɛδ 2ɛδ) δn = 2δN α 3 a as N, V ar J ) 2δN α 3. Usg Chebyshev s equalty, P { J E[ J ] } > δn α V ar J ) 3 < δ 2 N 2 α 3 V ar J ) δ 2 N 2 α 3 Thus, J > δn α 3 = 2δN α 3 δ 2 N 2 α 3 0, as N wth hgh probablty. I partcular, J, as N Lemma 3. For all J, the strbuto of ormalze raom varable X coverges to ormal strbuto, X p N 0,) a sce we have Y Π ) = X, Y Π) p Proof. Note that, p p < ɛ = N α 3 N 0,). p p, as N. p p ) By kowg that, p p ) a X p = X p + p p p p ) whch we alreay kow that wrte p p ) = X p p p ) + p p p p ) X p p p ) p p p p ) a as N ɛ = N 0,), so we ca ɛ N α 2 N α 3 Same thg hols for Y sce Y Π ) = X. 0. Next we coser the case where Π J ) whch s Π J ) = {Π ) : J } s kow to the aversary ot the vual Π) s, but the whole set Π J )). I ths case, for the aversary to f Π ), she ees to just look to the set J. We show that eve f the aversary kows the set Π J ), her mutual formato goes to zero. For smplcty, we assume that where = J > δn α 3 J = {,2,,}, a let Y ) = Y Π),Y Π2),,Y Π) ). Now for the aversary to f Π), she ca look to set J wth sze rather tha all the N users. To fsh the proof of Theorem, t suffces to show that as N, HX k) Y ) HX k)). To cotue, we frst prove two lemmas. Lemma 4. Let A be as efe Lemma, partcular, we have lm N PY A ) =.

5 If for all y A, we have HX k) Y = y ) HX k)) as N. The, we have lm HX k) Y ) = HX k)). N Proof. We have HX k) Y ) = HX k) Y = y )PY = y ) y = HX k) Y = y )PY = y ) + y A y A HX k) Y = y )PY = y ). Now ote that the seco sum coverges to zero sce HX k) Y = y ) HX k)) a lm N PY A ) = 0. O the other ha, the frst sum coverges to HX k)) by the assumptos of the lemma. Lemma 4 allows us to coser oly the observatos Y = y for Y A. Lemma 5. Assume P = p, p 2,, p N ) s observe. We efe q N as the probablty that the frst user s state locato) at tme k,.e., X k) =, gve the observato vector Y a the set ΠJ ). q N = PX k) = Y,ΠJ )) Sce Y a ΠJ ) are raom, q N s a raom varable. We have q N p. Proof. Ths lemma s the result of the prevous lemma. We have q N = PX k) = Y = y,πj )). Frst, ote that gve set ΠJ ), we ca gore Y for ΠJ ), so we smply replace N wth to show ths. By applyg the Law of Total Probablty we get j ΠJ ) = PX k) = Π) = j,y ) = y ),ΠJ )) PΠ) = j Y ) = y ),ΠJ )) [y ) j k)=] PΠ) = j Y) = y ) ). j= Wth the same reasog as Lemma 4, t oly suffces to coser Y ) = y ) for y ) A. Also, by Lemma 2 f we efe Y as, Y = Y k). k= the gve Y,Y 2,,Y, we have Π a Y are epeet. Thus, PΠ) = j Y ) = y ) ) = PΠ) = j Y ) = y ) ). But by Lemma 3, Y p N 0,). Ths alog wth Lemma tells us that wth hgh probablty PΠ) = j Y ) = y ) ) +. We obta q N [y j k)=] PΠ) = j Y) = y ) ) so we get j j A ) [y j k)=] q + j A ) [y j k)=] Now, ote that Y j K) are Beroullp Π j) ) a sce we are summg over, by Law of Large Number a p Π j) p the we have [Y j k)=] p, as N j a coserg that we ca wrte )p q N + )p where ca be mae arbtrarly small so that q N p. Thus, X k) = Y = y,πj )) Beroullp ). We alreay kow that X k) Beroullp ). It meas that kowg Y = y,πj ) oes ot chage the strbuto. I other wors the etropy of X k) Y = y,πj )) coverges to HX k)). HX k) Y,ΠJ ))) HX k)) a we kow that cotog oes ot crease etropy, so, HX k) Y,ΠJ ))) HX k)) HX k) Y,ΠJ ))) HX k) Y ) HX k) Y ) HX k)) a sce HX k) Y,ΠJ ))) HX k)) a fally we ca wrte HX k) Y ) HX k)) IX k); Y ) 0, as N whch completes the proof of Theorem.

6 C. Exteso to r States locatos) Here we exte the results to a scearo whch we have r 2 locatos or regos, locatos 0,,,r. At ay tme k {0,,2, }, user has probablty p j 0,) to be at locato j, epeetly from prevous locatos a epeetly from other users locatos. We assume that p j s for j = 0,,,r 2) are raw epeetly from some r mesoal cotuous esty f P p) o the 0,) r. Specfcally, f P p) = 0 for all p 0,) r a there are δ 2 > δ > 0 such that δ < f P p) < δ 2 for all p {p 0, p,, p r 2 ) 0,) r : p 0 +p + +p r 2 }. The values of p j s are fxe a o ot chage as tme goes o. We the ca state the followg theorem. Theorem 2. For r locatos wth above efto a observato vector Y ) f all the followg hols, ) = cn r 2 α, whch c,α > 0 a are costat 2) p 0,) 3) p 2, p 3,, p N ) f p, 0 < δ < f p < δ 2 4) P = p, p 2,, p N ) be kow to the aversary the, we have k N, lm IX k); Y ) ) = 0 N Theorem 2 ca be prove usg smlar eas trouce the proof of Theorem. We omt the proof ue to space lmtato. IV. CONCLUSION I ths paper, we efe perfect locato prvacy base o the mutual formato betwee the aversary s observato formato a the actual user s locato ata. The we smplfe the problem to two-state locatos wth N umber of users a umber of aversary s observatos. We erve the relato betwee a N. We showe that perfect locato prvacy s achevable f cn 2 α. We the extee our moel to r-state locatos a obtae cn r 2 α to have perfect locato prvacy. REFERENCES [] R. Shokr, G. Theoorakopoulos, C. Trocoso, J.-P. Hubaux, a J.- Y. Le Bouec, Protectg locato prvacy: optmal strategy agast localzato attacks, Proceegs of the 202 AC coferece o Computer a commucatos securty. AC, 202, pp [2]. Gruteser a D. Gruwal, Aoymous usage of locato-base servces through spatal a temporal cloakg, Proceegs of the st teratoal coferece o oble systems, applcatos a servces. AC, 2003, pp [3] B. Hoh,. Gruteser, H. Xog, a A. Alrabay, Preservg prvacy gps traces va ucertaty-aware path cloakg, Proceegs of the 4th AC coferece o Computer a commucatos securty. AC, 2007, pp [4] N. E. Boreabe, K. Chatzkokolaks, a C. Palamess, Optmal geostgushable mechasms for locato prvacy, Proceegs of the 204 AC SIGSAC Coferece o Computer a Commucatos Securty. AC, 204, pp [5] J. Freuger,. Raya,. Félegyház, P. Papamtratos, a J.-P. Hubaux, x-zoes for locato prvacy vehcular etworks, [6] Z. a, F. Kargl, a. Weber, A locato prvacy metrc for v2x commucato systems, Saroff Symposum, SARNOFF 09. IEEE. IEEE, 2009, pp. 6. [7] R. Shokr, G. Theoorakopoulos, J.-Y. Le Bouec, a J.-P. Hubaux, Quatfyg locato prvacy, Securty a Prvacy SP), 20 IEEE Symposum o. IEEE, 20, pp [8] L. Sweeey, k-aoymty: A moel for protectg prvacy, Iteratoal Joural of Ucertaty, Fuzzess a Kowlege-Base Systems, vol. 0, o. 05, pp , [9] A. R. Beresfor a F. Stajao, Locato prvacy pervasve computg, IEEE Pervasve computg, o., pp , [0] J. Freuger, R. Shokr, a J.-P. Hubaux, O the optmal placemet of mx zoes, Prvacy ehacg techologes. Sprger, 2009, pp []. H. ashae, Q. Zhu, T. Alpca, T. Bacşar, a J.-P. Hubaux, Game theory meets etwork securty a prvacy, AC Computg Surveys CSUR), vol. 45, o. 3, p. 25, 203. [2] G. Ghta, P. Kals, A. Khoshgozara, C. Shahab, a K.-L. Ta, Prvate queres locato base servces: aoymzers are ot ecessary, Proceegs of the 2008 AC SIGOD teratoal coferece o aagemet of ata. AC, 2008, pp [3]. Werke, P. Skvortsov, F. Dürr, a K. Rothermel, A classfcato of locato prvacy attacks a approaches, Persoal a Ubqutous Computg, vol. 8, o., pp , 204. [4] Y. Ca a G. Xu, Cloakg wth footprts to prove locato prvacy protecto locato-base servces, Ja. 205, us Patet App. 4/472,462. [Ole]. Avalable: US [5] H. Ko, Y. Yaagsawa, a T. Satoh, A aoymous commucato techque usg ummes for locato-base servces, Pervasve Servces, ICPS 05. Proceegs. Iteratoal Coferece o. IEEE, 2005, pp [6] H. Lu, C. S. Jese, a. L. Yu, Pa: prvacy-area aware, ummybase locato prvacy moble servces, Proceegs of the Seveth AC Iteratoal Workshop o Data Egeerg for Wreless a oble Access. AC, 2008, pp [7] J. Lee a C. Clfto, Dfferetal etfablty, Proceegs of the 8th AC SIGKDD teratoal coferece o Kowlege scovery a ata mg. AC, 202, pp [8] K. Chatzkokolaks, C. Palamess, a. Stroat, Geostgushablty: A prcple approach to locato prvacy, Dstrbute Computg a Iteret Techology. Sprger, 205, pp [9] H. H. Nguye, J. Km, a Y. Km, Dfferetal prvacy practce, Joural of Computg Scece a Egeerg, vol. 7, o. 3, pp , 203. [20] A. achaavajjhala, D. Kfer, J. Abow, J. Gehrke, a L. Vlhuber, Prvacy: Theory meets practce o the map, Data Egeerg, ICDE IEEE 24th Iteratoal Coferece o. IEEE, 2008, pp [2] S.-S. Ho a S. Rua, Dfferetal prvacy for locato patter mg, Proceegs of the 4th AC SIGSPATIAL Iteratoal Workshop o Securty a Prvacy GIS a LBS. AC, 20, pp [22] R. Dewr, Local fferetal perturbatos: Locato prvacy uer approxmate kowlege attackers, oble Computg, IEEE Trasactos o, vol. 2, o. 2, pp , 203. [23] K. Chatzkokolaks,. E. Arés, N. E. Boreabe, a C. Palamess, Broaeg the scope of fferetal prvacy usg metrcs. Prvacy Ehacg Techologes. Sprger, 203, pp [24] R. Shokr, Optmal user-cetrc ata obfuscato, arxv preprt arxv: , 204. [25] K. Chatzkokolaks, C. Palamess, a. Stroat, Locato prvacy va geo-stgushablty, AC SIGLOG News, vol. 2, o. 3, pp , 205. [26]. E. Arés, N. E. Boreabe, K. Chatzkokolaks, a C. Palamess, Geo-stgushablty: Dfferetal prvacy for locato-base systems, Proceegs of the 203 AC SIGSAC coferece o Computer & commucatos securty. AC, 203, pp [27] R. Shokr, G. Theoorakopoulos, G. Daezs, J.-P. Hubaux, a J.-Y. Le Bouec, Quatfyg locato prvacy: the case of sporac locato exposure, Prvacy Ehacg Techologes Sprger, 20, pp.