Investigating and Devising Privacy Preserving Approaches for Location-Based Services

As use of location-based services (LBSs) is becoming increasingly prevalent, mobile users are more and more enticed to reveal their locations, which may be exploited by attackers to infer the points of interest (POIs) the users visit and then their privacy information. We propose a novel approach to the protection of a user's location privacy based on unobservability, preventing the attackers from relating any particular POI to the user's current location. We design, implement, and evaluate a privacy-protection system, called the Location Information ScrAmbler (LISA) which protects the user's location privacy by adjusting the location noise and hence, the uncertainty of associating his location with any POI, while conserving resources (especially battery energy) on mobile devices. By protecting location privacy locally on each mobile user's device, LISA eliminates the reliance on the trusted third-party servers required by most existing approaches. Therefore, it not only avoids the vulnerability of a single point of failure, but also facilitates the deployment of LBSs. Our evaluation of LISA using real-world users' traces demonstrates its efficacy and efficiency.

Recent advances in mobile communication and development of sophisticated equipments lead to the wide spread use of Location Based Services (LBS). A major concern for large-scale deployment of LBSs is the potential abuse of their client location data, which may imply sensitive personal information. Protecting location information of the mobile user is challenging because a location itself may reveal user identity. Several schemes have been proposed for location cloaking. In our paper, we propose a generic Enhanced LBS Reference Model (ELRM), which describes the concept, the architecture and the functionalities for location privacy in LBS. As per the architecture, the system ensures location privacy, without trusting anybody including the peers or LBS servers. The system is fully distributed and evaluation shows its efficiency and high level of privacy with QoS.

Nowadays, the location privacy problem has become an important problem for the users who enjoy the location-based services (LBSs). Researchers have focused on the problem of how to protect the location privacy of user efficiently for a long time. On one hand, many achievements adopt the centralized structure in which there is an additional center server. Additionally, some other researchers adopt the distributed structure to overcome the disadvantages brought by the center server in the centralized anonymous system structure. On the other hand, the existing methods of solving the problem are always to protect the individual user’s location privacy in LBSs, without considering the user group’s location privacy. This kind of methods is not very applicable to the status of a number of users who formed a group to complete a LBS task together by collaborative computing. In order to solve the problem of location privacy protection for a user group in the untrusted mobile social networks, a location privacy protection method based on the distributed structure is discussed in this paper. In the scheme, the special homomorphic features of BGN cryptosystem are cleverly used so that it can solve the group’s three classical location service applications simultaneously, namely, group nearest neighbor query, optimal group collection point determination, and group friend’s distance query, by only one security policy. If there are k users who formed the group, it could achieve k-anonymity without exposing the coordinate of each individual user or using any anonymous areas. Furthermore, theoretical and experimental analysis proves that the proposal can efficiently protect each user’s location privacy in the group through taking full advantage of the collaborative computing and communication capabilities of the mobile terminals. It can resist the existing distance interaction attack and collusion attack and can realize the secure and efficient fine-grained controllable location privacy protection for the user group.

Recent mobile devices are mostly equipped with a GPS receiver. This trend has arisen a variety of location based services (LBSs) which enable users to search local information of their current locations. To use LBSs, a user needs to send his/her location information to a service provider. Users' location information is inherently private, since it can reveal the critical information. In this paper, we propose a method to protect the user's location privacy by sending the user's location with dummy locations, which are determined based on the user's current location. We conduct an experiment to evaluate the effectiveness of our proposed method using real users' trajectories on a real map.

The surging deployment of WiFi hotspots in public places drives the blossoming of location-based services (LBSs) available. A recent measurement reveals that a large portion of the reported locations are either forged or superfluous, which calls attention to location authentication. However, existing authentication approaches breach user's location privacy, which is of wide concern of both individuals and governments. In this paper, we propose PriLA, a privacy-preserving location authentication protocol that facilitates location authentication without compromising user's location privacy in WiFi networks. PriLA exploits physical layer information, namely carrier frequency offset (CFO) and multipath profile, from user's frames. In particular, PriLA leverages CFO to secure wireless transmission between the mobile user and the access point (AP), and meanwhile authenticate the reported locations without leaking the exact location information based on the coarse-grained location proximity being extracted from user's multipath profile. Existing privacy preservation techniques on upper layers can be applied on top of PriLA to enable various applications. We have implemented PriLa on GNURadio/USRP platform and off-the-shelf Intel 5300 NIC. The experimental results demonstrate the practicality of CFO injection and accuracy of multipath profile based location authentication in a real-world environment.

The ubiquity of mobile devices with global positioning functionality (e.g., GPS and Assisted GPS) and Internet connectivity (e.g., 3G and Wi-Fi) has resulted in widespread development of location-based services (LBS). Typical examples of LBS include local business search, e-marketing, social networking, and automotive traffic monitoring. Although LBS provide valuable services for mobile users, revealing their private locations to potentially untrusted LBS service providers pose privacy concerns. In general, there are two types of LBS, namely, snapshot and continuous LBS. For snapshot LBS, a mobile user only needs to report its current location to a service provider once to get its desired information. On the other hand, a mobile user has to report its location to a service provider in a periodic or on-demand manner to obtain its desired continuous LBS. Protecting user location privacy for continuous LBS is more challenging than snapshot LBS because adversaries may use the spatial and temporal correlations in the user's a sequence of location samples to infer the user's location information with a higher degree of certainty. Such user spatial trajectories are also very important for many applications, e.g., business analysis, city planning, and intelligent transportation. However, publishing original spatial trajectories to the public or a third party for data analysis could pose serious privacy concerns. Privacy protection in continuous LBS and trajectory data publication has increasingly drawn attention from the research community and industry. In this chapter, we describe the state-of-the-art privacy-preserving techniques for continuous LBS and trajectory publication.

The widespread usage of location based services (LBS); where obtaining any informational service is entirely based upon the user's current location, have raised a significant concern about location privacy of the user. For the queries like ‘where is my closest ATM?’, ‘where is my nearest hospital’, or any route assistance in general, it is essential to submit the user's actual location to avail the demanded services. Similar communication holds true for a location based vehicular transportation system. Cloaking and ob-fuscation are the two generalized approaches to deal with location privacy preservation in LBS. These approaches are mainly based on a trusted third party (TTP) and exploits the well established K-anonymity principle in order to make the query issuer indistinguishable with other K − 1 more users. In such approaches all the data (mainly location coordinates and queries) becomes available at the central server, thus complete knowledge of the query (including user id) exists at central node. This is the major limitation of TTP based architecture and makes such frameworks susceptible to different privacy attacks. This paper is a research attempt to extend the realm of collaborative communication among peers belonging to a mobile user group in a decentralized or trusted third party free architecture. We propose a collaborative P2P communication model; called CAST, that employs the series of trust among peers and peers use their cached mobile data to collaborate with each other in order to get the results locally. The scheme provides results locally with low latency and works efficiently when the peers share common inclinations (or data value). The proposed algorithm preserves user's privacy and performs effectively under pull-based sporadic query scenario.

With the pervasive use of smartphones that sense, collect, and process valuable information about the environment, ensuring location privacy has become one of the most important concerns in the modern age. A few recent research studies discuss the feasibility of processing data gathered by a smartphone to locate the phone's owner, even when the user does not intend to share his location information, e.g., when the Global Positioning System (GPS) is off. Previous research efforts rely on at least one of the two following fundamental requirements, which significantly limit the ability of the adversary: (i) the attacker must accurately know either the user's initial location or the set of routes through which the user travels and/or (ii) the attacker must measure a set of features, e.g., the device's acceleration, for potential routes in advance and construct a training dataset. In this paper, we demonstrate that neither of the above-mentioned requirements is essential for compromising the user's location privacy. We describe PinMe, a novel user-location mechanism that exploits non-sensory/sensory data stored on the smartphone, e.g., the environment's air pressure, along with publicly-available auxiliary information, e.g., elevation maps, to estimate the user's location when all location services, e.g., GPS, are turned off.

The continued growth in online services that provide users with content based on location presents a unique privacy concern for the user. Since the user cannot control the use of the data included in his network transactions once they leave the device, nor can he control the response from the location-based system (LBS), he must assume that information is available to an unknown observer who could use the information to estimate the user's location. This paper presents a cloaking system that preserves a user's location privacy by submitting multiple requests from disparate false locations to the LBS in rapid succession in order to confuse the observer and meet the user's pre-determined location privacy threshold.

Protection of location privacy for moving kNN queries in social networks

Location-based services are increasingly used in our daily activities. In current services, users however have to give up their location privacy in order to acquire the service.The literature features a large number of contributions which aim at enhancing user privacy in location-based services. Most of these contributions obfuscate the locations of users using spatial and/or temporal cloaking in order to provide k-anonymity. Although such schemes can indeed strengthen the location privacy of users, they often decrease the service quality and do not necessarily prevent the possible tracking of user movements (i.e., direction, trajectory, velocity). With the rise of Geofencing applications, tracking of movements becomes more evident since, in these settings, the service provider is not only requesting a single location of the user, but requires the movement vectors of users to determine whether the user has entered/exited a Geofence of interest.In this paper, we propose a novel solution, PrivLoc, which enables the privacy-preserving outsourcing of Geofencing and location-based services to the cloud without leaking any meaningful information about the location, trajectory, and velocity of the users. Notably, PrivLoc enables an efficient and privacy-preserving intersection of movement vectors with any polygon of interest, leveraging functionality from existing Geofencing services or spatial databases. We analyze the security and privacy provisions of PrivLoc and we evaluate the performance of our scheme by means of implementation. Our results show that the performance overhead introduced by PrivLoc can be largely tolerated in realistic deployment settings.KeywordsPrivacyGeofencinglocation trackinglocation-based services

The ubiquity of modern mobile devices with GPS modules and Internet connectivity such as 3G/4G techniques have resulted in rapid development of Location-Based Services (LBSs). However, users enjoy the convenience provided by the untrusted LBS server at the cost of their privacy. To protect user's sensitive information against adversaries with side information, we design a personalized spatial cloaking scheme, termed TTcloak, which provides k-anonymity for user's location privacy, 1-diversity for query privacy and desired size of cloaking region for mobile users in LBSs, simultaneously. TTcloak uses Dummy Query Determining (DQD) algorithm and Dummy Location Determining (DLD) algorithm to find out a set of realistic cells as candidates, and employs a CR-reflnement Module (CRM) to guarantee that dummy users are assigned into the cloaking region with desired size. Finally, thorough security analysis and empirical evaluation results verify our proposed TTcloak.

Trilateration is one of the well-known threat models to the user's location privacy in location-based apps, especially those contain highly sensitive information such as dating apps. The threat model mainly bases on the publicly shown distance from a targeted victim to the adversary to pinpoint the victim's location. As a countermeasure, most of location-based apps have already implemented the 'hide distance' function, or added noise to the publicly shown distance in order to protect their user's location privacy. The effectiveness of such approaches however is still questionable.

Trilateration is one of the well-known threat models to the user's location privacy in location-based apps; especially those contain highly sensitive information such as dating apps. The threat model mainly bases on the publicly shown distance from a targeted victim to the adversary to pinpoint the victim's location. As a countermeasure, most of location-based apps have already implemented the “hide distance” function, or added noise to the publicly shown distance in order to protect their user's location privacy. The effectiveness of such approaches however is still questionable. Therefore, in this paper, we investigate how the popular location-based dating apps are currently protecting their user's privacy by testing three popular GLBT-focused apps: Grindr, Jack'd, and Hornet. We found that Jack'd has the most privacy issues among the three apps. As one of our findings, we also show how the adversary can still figure out the location of a targeted victim even when the “show distance” function is disabled in Grindr. Without using sophisticated hacking techniques, our proposed model (called colluding-trilateration) is still very effective and efficient at locating the targeted victim, and of course in a so-called “legal” manner, because we only utilize the information that can be obtained just as same as any other ordinary user. In case of Hornet, although it has adopted location obfuscation in its system, we were not only able to discover its noise-adding pattern by conducting empirical analysis, but also able to apply the colluding trilateration used in Grindr to locate the targeted victim regardless of the location obfuscation. Our study thus raises an urgent alarm to the users of those location-based apps in general and GLBT-focused dating apps in particular about their privacy. Finally, the paper concludes by suggesting some possible solutions from the viewpoints of both the LBS provider and the user considering the implementation cost and the trade-off of utility.

Location-based services are becoming popular for mobile users. The mobile users' location plays a key role to provide the service from one side, but it can be considered as a dimension of their privacy and so necessary to keep it anonymous to the other parties. Since one important issue is to achieve an accurate service, it is important to use the mobile's accurate location. Using the location accurately raises some concerns on behalf of the user's privacy. One solution for meeting this requirement is using tickets by the means of a third party. The tickets should have some properties for not letting a mobile user to cheat and use the ticket more than one time. This paper proposes a protocol to preserve Preserve Privacy in Location based services, in short 2PLoc, aimed to provide anonymity of location, for location based services, based on onetime tickets regardless of the existence of any trusted third party. The protocol satisfies the requirement of accurate location use, as well as the ability of revoking anonymity on the ticket double spending. The user, location-based service provider, and the ticket issuer are the three untrusted parties in 2PLoc. 2PLoc is based on a special designed ticket that disconnects the relation between the location of the mobile user and its identity. The ticket is designed based on the blind signature and the concept of elliptic curves discrete logarithm.