Elastic distinguishability metrics for Location Privacy Marco - - PowerPoint PPT Presentation
Elastic distinguishability metrics for Location Privacy Marco Stronati marco@stronati.org joint work with K. Chatzikokolakis and C. Palamidessi 1 / 14 Privacy for LBS Goal: limit semantic inference (not anonymity) Reasonable utility for
Marco Stronati marco@stronati.org joint work with
1 / 14
Goal: limit semantic inference (not anonymity) Reasonable utility for LBS
2 / 14
Mechanism
x − → M − → z
[Chatzikokolakis et. al: Broadening the Scope of Differential Privacy Using Metrics. PETS’13]
3 / 14
Mechanism
x − → M − → z
[Chatzikokolakis et. al: Broadening the Scope of Differential Privacy Using Metrics. PETS’13]
3 / 14
Mechanism
x − → M − → z
[Chatzikokolakis et. al: Broadening the Scope of Differential Privacy Using Metrics. PETS’13]
3 / 14
Mechanism
x − → M − → z
[Chatzikokolakis et. al: Broadening the Scope of Differential Privacy Using Metrics. PETS’13]
3 / 14
Mechanism
x − → M − → z
dX-privacy
dP(M(x), M(x′)) ≤ dX(x, x′) ∀x, x′ Distinguishability Metric on your set
Apply noise according to the metric
[Chatzikokolakis et. al: Broadening the Scope of Differential Privacy Using Metrics. PETS’13]
3 / 14
dX(x, x′) = ǫ dE(x, x′) Space is privacy ǫ tunes how much
Requirement
I want to be indistinguishable from a certain amount of space.
[Andr´ es et al: Geo-indistinguishability: differential privacy for location-based systems. CCS’13]
4 / 14
dX(x, x′) = ǫ dE(x, x′) Space is privacy ǫ tunes how much
Requirement
I want to be indistinguishable from a certain amount of space.
[Andr´ es et al: Geo-indistinguishability: differential privacy for location-based systems. CCS’13]
4 / 14
5 / 14
6 / 14
6 / 14
I want to be indistinguishable from a certain amount of privacy mass. req(l) = mass
7 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Graph-based algo: start with a disconnetted graph interate over all nodes
◮ compute mass ◮ add an edge with l = req−1(mass)
we stop at l⊤ dX(x, x′) = shortest-path(x, x′)
8 / 14
Elastic Mechanism = Elastic Metric + Exponential Mechanism
9 / 14
9 / 14
9 / 14
9 / 14
EM vs PL City (Paris) vs Subsurb (Nanterre) Fixed Utility as Expected Error Compare Privacy as Adversarial Error Gowalla and Brightkite datasets
[Shokri, Theodorakopoulos, Boudec, Hubaux. Quantifying location privacy. S&P’11]
10 / 14
1000 2000 3000 4000 5000 6000 7000 8000 EM city EM suburb
Expected Error (m)
PL 0.6 0.65 0.7 0.75 0.8 0.85 0.9 0.95 1 EM city PL city EM suburb PL suburb
AdvError
11 / 14
Geoind is simple and efficient (Location Guard) Too rigid! Contributions: Elastic metric with privacy mass requirement Scalable algorithm Future Work: Include in privacy mass ideas from k-anonymity Lightweight version for Location Guard
12 / 14
Don’t miss Location Guard tomorrow
13 / 14
linear growth of epsilon fences for recurrent places achieve “better privacy” consuming less ǫ dF(x, x′) = dX(x, x′) x, x′ / ∈ F x, x′ ∈ F ∞
14 / 14