Location Privacy in Practice Sonia Ben Mokhtar 26/06/2015 Thanks - - PowerPoint PPT Presentation

▶
location privacy in practice
SMART_READER_LITE
LIVE PREVIEW

Location Privacy in Practice Sonia Ben Mokhtar 26/06/2015 Thanks - - PowerPoint PPT Presentation

May 08, 2023 381 likes •982 views

Location Privacy in Practice Sonia Ben Mokhtar 26/06/2015 Thanks to Vincent Primault Outline 1. Context 2. Location-based services 3. Threats 4. Challenges 5. Anonymization techniques 6. Sum up 2 Who am I? CNRS researcher,

slide-1
SLIDE 1

Location Privacy in Practice

Sonia Ben Mokhtar 26/06/2015

  • Thanks to Vincent Primault…
slide-2
SLIDE 2

Outline

  • 1. Context
  • 2. Location-based services
  • 3. Threats
  • 4. Challenges
  • 5. Anonymization techniques
  • 6. Sum up

2

slide-3
SLIDE 3

Who am I?

  • CNRS researcher, LIRIS lab, DRIM group
  • Research topics:
  • Distributed and/or Mobile systems
  • Fault Tolerance
  • Privacy
  • Coordinator of the Priva’Mov project

funded by the IMU Labex.

3

slide-4
SLIDE 4

CONTEXT: IMU PRIVA’MOV

4

slide-5
SLIDE 5

Crowdsensing—>Smart Cities

  • A novel type of sensor networks using the

sensing capabilities of our handheld devices

  • Personal sensing
  • Health applications
  • Carbon footprint
  • Community sensing
  • Congestion monitoring
  • Air pollution monitoring

5

slide-6
SLIDE 6

Objectives

  • Crowdsensing platform
  • 100 users equipped with

smartphones

  • 3 usecases (social sciences,

mobile systems, transports)

  • Location privacy

6

Crowdsensing platform

slide-7
SLIDE 7

LOCATION-BASED SERVICES (LBS)

Location privacy: A state of the art

7

slide-8
SLIDE 8

Use location to provide services

8

slide-9
SLIDE 9

What’s the weather like?

9

slide-10
SLIDE 10

Find POIs around

10

slide-11
SLIDE 11

Locate nearby friends

11

slide-12
SLIDE 12

Navigate to a destination

12

slide-13
SLIDE 13

Play social games

13

slide-14
SLIDE 14

Location lifecycle

GPS- enabled phone LBS in the cloud GPS satellites

14

Wi-Fi hotspots IP address geocoder Cell towers

  • 1. Location computation
  • 2. LBS request
slide-15
SLIDE 15

Some numbers…

  • Companies (e.g., Apple, TomTom…) have

agreements to share location data with « partners and licensees »

  • Skyhook wireless is resolving 400M user’s

WiFi locations/day

  • 25B copies of applications available on the

AppStore access location data

  • ~50% of all iOS and Android traffic is

available to ad networks

De Montjoye, Y .-A., Hidalgo, C., Verleysen, M. and Blondel, V. Unique in the Crowd: The privacy bounds of human mobility. Scientific reports,Scientific Reports 3, Article number: 1376, 2013.

15

slide-16
SLIDE 16

In practice…

16

slide-17
SLIDE 17

In practice…

17

slide-18
SLIDE 18

WHAT ARE THE THREATS?

Location privacy: A state of the art

18

slide-19
SLIDE 19
slide-20
SLIDE 20

Identifying POIs [1,2,3]

20

[1] Krumm, J. Inference attacks on location tracks. In Pervasive’07. [2] Gambs, S., Killijian, M.-O. and Cortez, M. Show Me How You Move and I Will Tell You Who You Are. Transactions on Data Privacy. [3] Golle, P . and Partridge, K. On the Anonymity of Home/Work Location Pairs. In Pervasive’09.

slide-21
SLIDE 21

Re-identifying mobility traces [1,2]

21

[4] De Montjoye, Y .-A., Hidalgo, C., Verleysen, M. and Blondel, V. Unique in the Crowd: The privacy bounds of human mobility. Scientific reports.

Only 4 (coarse grain) points are sufficient to uniquely identify a majority of users! [4]

slide-22
SLIDE 22

Finding out social relationships

22

slide-23
SLIDE 23

Learning about mobility patterns [2]

23

slide-24
SLIDE 24

Google Now already do this!

24

slide-25
SLIDE 25

WHAT CHALLENGES ARE WE FACING?

Location privacy: A state of the art

25

slide-26
SLIDE 26

How to query LBSs in 
 a privacy-preserving way?

26

slide-27
SLIDE 27

Some properties to guarantee

27

Privacy Accuracy Performance Integration

slide-28
SLIDE 28

ANONYMIZATION TECHNIQUES

Location privacy: A state of the art

28

slide-29
SLIDE 29

Anonymization techniques

29

Pseudonymization Spatial cloaking Perturbation Dummies Cryptography Data partitioning

slide-30
SLIDE 30

Anonymization techniques

30

Pseudonymization Spatial cloaking Perturbation Dummies Cryptography Data partitioning

slide-31
SLIDE 31

Spatial cloaking [6]

31

k = 3

[6] Gruteser, M. and Grunwald, D. Anonymous Usage of Location-Based Services Through Spatial and Temporal Cloaking. In MobiSys’03.

slide-32
SLIDE 32

Drawbacks of spatial cloaking

  • Attacks:

– 2 properties to guarantee: query anonymity & location privacy [8]

  • Limitations:

– Number and density of users – The space often needs to be bounded and then discretized – Need of a trusted third party in centralized algorithms

32

[8] Shokri, R., Troncoso, C., & Diaz, C. Unraveling an old cloak: k-anonymity for location privacy. In WPES’10.

slide-33
SLIDE 33

Anonymization techniques

33

Pseudonymization Spatial cloaking Perturbation Dummies Cryptography Data partitioning

slide-34
SLIDE 34

Dummies [12,13]

34

Real location Dummy position Dummy position Dummy position k = 4

[13] Shankar, P ., Ganapathy, V. and Iftode, L. Privately Querying Location-based Services with

  • SybilQuery. In Ubicomp’09.

[12] Kido, H., Yanagisawa, Y . and Satoh, T . Protection of Location Privacy using Dummies for Location- based Services. In ICDE’05 Workshops.

slide-35
SLIDE 35

SybilQuery trips [13]

35

Residential area Residential area Work area Work area Similar length Real trip Sybil trip

slide-36
SLIDE 36

Drawbacks of dummies

  • Attacks:

– Realistic behavior of dummies – Data sent to the LBS contains the real position – Machine learning attacks reidentify real trips from those generated by SybilQuery with a probability of 93 % [14]

  • Limitations:

– The need of external knowledge to generate realistic dummies… – Where to find it? – How to process it with limited resources?

36

[14] Peddinti, S. T ., & Saxena, N. On the limitations of query obfuscation techniques for location

  • privacy. In UbiComp’11.
slide-37
SLIDE 37

Anonymization techniques

37

Pseudonymization Spatial cloaking Perturbation Dummies Cryptography Data partitioning

slide-38
SLIDE 38

Location perturbation

38

Real location Noised position Noised position Noised position

slide-39
SLIDE 39

Geo-indistinguishable locations [16]

39

[16] Andrés, M., Bordenabe, N., Chatzikokolakis, K. and Palamidessi, C. Geo-Indistinguishability: Differential Privacy for Location-Based Systems. In CCS’13.

« The closer two points are the more indistinguishable they should be »

slide-40
SLIDE 40

Geo-indistinguishability in practice

40

Differentially Private Location Privacy in Practice.V. Primault, et . al, MOST[14]

slide-41
SLIDE 41

Drawbacks of location perturbation

  • Attacks:

– Clustering attacks – Privacy guarantees decrease when protecting multiple locations (i.e. a trace)

  • Limitations:

– Applications like navigation are complicated to implement

41

slide-42
SLIDE 42

Anonymization techniques

42

Pseudonymization Spatial cloaking Perturbation Dummies Cryptography Data partitioning

slide-43
SLIDE 43

Pseudonymization

Who Date Latitude Longitude Philippe R. 04/10/13 12:31:45 45.7829609 4.8750313 Jean V . 04/10/13 12:32:54 48.8582285 2.2943877 Anne M. 04/10/13 13:45:07 45.7783975 4.8794162 Anne M. 04/10/13 14:45:13 45.7783975 4.8794162 Jean V . 04/10/13 14:50:56 48.9545237 2.2012417 Lucie E. 04/10/13 15:00:32 45.7671436 4.8329685 Jean V . 04/10/13 15:09:03 48.9545237 2.2012417 Philippe R. 04/10/13 15:10:12 45.7829945 4.8960415 Anne M. 04/10/13 15:37:41 45.7783975 4.8794162 Philippe R. 04/10/13 16:15:13 45.8034791 4.9713056 Jean V . 04/10/13 16:21:21 51.6640214 3.1027893

43

slide-44
SLIDE 44

Pseudonymization

Who Date Latitude Longitude A 04/10/13 12:31:45 45.7829609 4.8750313 B 04/10/13 12:32:54 48.8582285 2.2943877 C 04/10/13 13:45:07 45.7783975 4.8794162 C 04/10/13 14:45:13 45.7783975 4.8794162 B 04/10/13 14:50:56 48.9545237 2.2012417 D 04/10/13 15:00:32 45.7671436 4.8329685 B 04/10/13 15:09:03 48.9545237 2.2012417 A 04/10/13 15:10:12 45.7829945 4.8960415 C 04/10/13 15:37:41 45.7783975 4.8794162 A 04/10/13 16:15:13 45.8034791 4.9713056 B 04/10/13 16:21:21 51.6640214 3.1027893

44

slide-45
SLIDE 45

Mix-zones [5]

45

Mix-zone Zone 1 Zone 3 Zone 2 t1 t4 t6 1 A 2 B 3 C 1 B 2 C 3 A A B C t2 t3 t5 3 1 2

[5] Beresford, A. and Stajano, F . Location Privacy in pervasive computing. Pervasive Computing, IEEE.

slide-46
SLIDE 46

Drawbacks of mix-zones

  • Attacks:

– Re-identification by using physical/logical laws

  • Limitations:

– Number and density of users – k is hard to enforce in practical use – Need of a central pseudonym server – Placement of mix-zones

46

slide-47
SLIDE 47

Anonymization techniques

47

Pseudonymization Spatial cloaking Perturbation Dummies Cryptography Data partitioning

slide-48
SLIDE 48

Cryptographic protocols

48

B ε(B) A ε(A) ε(A+B) A ε(A)

Symmetric and asymmetric encryption Homomorphic encryption

A

slide-49
SLIDE 49

Drawbacks of cryptographic protocols

  • Attacks:

– Security depends on the underlying cryptographic techniques used

  • Limitations:

– Each is designed for a unique use case – Don’t scale well

49

slide-50
SLIDE 50

Anonymization techniques

50

Pseudonymization Spatial cloaking Perturbation Dummies Cryptography Data partitioning

slide-51
SLIDE 51

Data partitioning

51

Server 1

  • Objects

Server 2

  • Locations

Communication protocol

slide-52
SLIDE 52

Koi architecture [23]

52

Matcher Combiner Koi component 3rd party application

Client location Registers items/ triggers Callback Registers items/triggers Matches Matching protocol Location updates

[23] Guha, S., Jain, M., & Padmanabhan, V. Koi: A Location-Privacy Platform for Smartphone Apps. In NSDI’12. Mobile user

slide-53
SLIDE 53

Drawbacks of data partitioning

  • Attacks:

– Sensibility to traffic analysis – Link location updates together and re-identity user

  • Limitations:

– Non-colluding servers – Needs to rebuild a database of POIs

53

slide-54
SLIDE 54

SUM UP

Location privacy: A state of the art

54

slide-55
SLIDE 55

Conclusions and Future Directions

  • Location data is sensitive!
  • Existing solutions:
  • Are vulnerable to re-identification attacks
  • Spatial obfuscation alters location

information

  • —> New protection mechanism for data

publishing, that minimally distorts location —> Towards temporal obfuscation

55

slide-56
SLIDE 56

Future Directions: Speed smoothing

56

10:05 10h08 10:05 10:08 10:07 10:06 epsilon 10:06 10:07 Point of interest

Time Distortion Anonymization for the Publication of Mobility Data with High

  • Utility. V. Primault, et. al, Proc. IEEE TrustCom’15.
slide-57
SLIDE 57

Future Directions: Path confusion

57

Have paths been "exchanged"? Meeting zone Meeting zone

Attacker

slide-58
SLIDE 58

More Details

http://liris.cnrs.fr/privamov

  • Time Distortion Anonymization for the Publication of Mobility Data with

High Utility. V. Primault, S. Ben Mokhtar, C. Lauradoux, L. Brunie. In the 14th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (IEEE TrustCom'15). 2015.

  • Privacy-preserving Publication of Mobility Data with High Utility. V.

Primault, S. Ben Mokhtar & L. Brunie (2015). In the 35th International Conference on Distributed Computed Systems (short)(IEEE ICDCS’15). 2015.

  • Differentially Private Location Privacy in Practice. V. Primault, S. Ben

Mokhtar, C. Lauradoux, L. Brunie. In Mobile Security Technologies Workshop, co-located with 35th IEEE Security and Privacy Symposium. 2014.

58

slide-59
SLIDE 59

Questions?

59