Trip planning queries with location privacy in spatial databases

Abstract

Privacy has become a major concern for the users of location-based services (LBSs) and researchers have focused on protecting user privacy for different location-based queries. In this paper, we propose techniques to protect location privacy of users for trip planning (TP) queries, a novel type of query in spatial databases. A TP query enables a user to plan a trip with the minimum travel distance, where the trip starts from a source location, goes through a sequence of points of interest (POIs) (e.g., restaurant, shopping center), and ends at a destination location. Due to privacy concerns, users may not wish to disclose their exact locations to the location-based service provider (LSP). In this paper, we present the first comprehensive solution for processing TP queries without disclosing a user’s actual source and destination locations to the LSP. Our system protects the user’s privacy by sending either a false location or a cloaked location of the user to the LSP but provides exact results of the TP queries. We develop a novel technique to refine the search space as an elliptical region using geometric properties, which is the key idea behind the efficiency of our algorithms. To further reduce the processing overhead while computing a trip from a large POI database, we present an approximation algorithm for privacy preserving TP queries. Extensive experiments show that the proposed algorithms evaluate TP queries in real time with the desired level of location privacy.

Appendices

Appendix A: Detailed algorithm: false location

In this section, we present the detailed algorithm to evaluate a PkTP query based on false location. Algorithm 1, PkTP _false, shows the pseudocode to process a PKTP query that runs on a user’s mobile device. Inputs of the algorithm are k, required types $\{1, 2, \dots , m\}$, a user’s actual source s and destination d, and the obfuscation level o _l . The output is $R_{s}= \{{p_{1}^{1}}, {p_{2}^{1}}, \dots , {p_{m}^{1}}\},\{{p_{1}^{2}}, {p_{2}^{2}}, \dots , {p_{m}^{2}}\},\dots ,\{{p_{1}^{k}}, {p_{2}^{k}}, \dots , {p_{m}^{k}}\}$, k sets of POIs that have the k smallest trip distances from s to d.

The notations that we have used for this algorithm are as follows:

• M i n D[1..k]: An array of k entries, where M i n D[j] represents the j ^th smallest trip distance from s to d via visiting POIs of required types, where 1 ≤ j ≤ k. M i n D[j] is updated with the incremental retrieval of POIs from the LSP. In addition, M i n D[k] represents the length of the major axis of the search region (ellipse).

• r _f : The distance between f and the farthest retrieved POI from f. It also represents the radius of the known region (circle) centering at f.

• IsInsideKnownRegion(s, d, M i n D[k], f, r _f ): A function that checks whether the known region(circle) covers the search region(ellipse) or not and returns yes or no, respectively.

• $P^{\prime }$: A set that stores all POIs retrieved from the LSP, which fall inside the search region.

The first step of our algorithm is the computation of the false location f based on the source s and destination d of a user. Any irreversible technique to compute the false location can be used for this purpose. In our implementation, we have used the following technique to compute the false location. At first an ellipsoid area is calculated with two foci at s and d respectively. The length of the major axis is randomly selected from a range that can vary from the distance between s and d to the maximum distance between two points in the total space, which ensures that four extreme points of the ellipse, remain within the total space. Then a false location is chosen randomly on the boundary of the ellipsoid area. Intuitively, if s, d and f are close then POIs are retrieved in low cost. To reduce query processing cost, the length of the major axis can be also set by the user instead of computing randomly. The output array R _s is initialized with {∅}, the entries of distance array M i n D are initialized with infinity, and r _f is initialized with 0.

Next, a query is sent to the LSP using a function INN with the parameters f, k, m and f l a g. INN incrementally retrieves nearest POIs from f. Any existing nearest neighbor algorithm [17] can be used for the function INN. For the first time f l a g = 0 and INN returns at least k POIs of one type and at least one POI of remaining types, which are sufficient to get k initial POI sets. For rest of the time flag will be 1 and INN returns k POIs, where POIs can be of any of the required types $1,2,\dots ,m$. In Line 8, the retrieved POIs with respect to f are stored in P. Each time P contains the latest POIs retrieved from the LSP. For a dense distribution of POIs, the known region may expand slowly and require a large number of communications between the user and the LSP. To avoid such a scenario, the user may adjust the number of POIs that need to be retrieved incrementally as k + δ instead of k in Function INN, where δ is a positive integer. The parameter r _f is updated as the distance between f and the farthest POI from f in P.

After retrieving POIs from the LSP, Function IsInsideSearchRegion checks and prunes the newly retrieved POI in P, if any POI falls outside the overlapping region of the known region and the search region. For the first time, no POI is pruned as the search region has not been yet computed, i.e., M i n D[k] is $\infty$.

Then the algorithm computes S, all possible new eligible candidate sets of POIs computed with POIs in P and $P^{\prime }$ using the function GenerateSet. Note that P and $P^{\prime }$ store all POIs retrieved from the LSP in the current iteration and previous iterations, respectively, which fall inside the search region. In addition to computing S, the function GenerateSet also updates $P^{\prime }$ by adding POIs in P to $P^{\prime }$. The pseudocode for GenerateSet is shown in Algorithm 2 (please see Section Appendix A.1).

For each set $S^{\prime } \in S$, the algorithm computes the trip distance $Tdist(s,d,S^{\prime })$ and updates R _s and M i n D, if $Tdist(s,d,S^{\prime })< MinD[k]$. At this stage, IsInsideSearchRegion function again prunes the POIs of $P^{\prime }$ because M i n D[k] may have been reduced, which means the area of the search region may have been reduced. A POI that was previously inside the search region may now go outside of the search region. At the end, the IsInsideKnownRegion function checks whether the known region(circle) covers the search region(ellipse) or not. If yes, the loop terminates, otherwise the loop continues and repeats the process by retrieving more POIs from the LSP. When the known region covers the search region, the k optimal POI sets have been found and stored in R _s .

After that the algorithm checks whether the privacy level achieved so far is greater than or equal to o _l using the function CompObLev. The incremental retrieval of POIs from the LSP continues until the user specified privacy level o _l is achieved by expanding the known region. To compute the obfuscation level, CompObLev needs to check whether a source destination pair within the known region satisfies the terminating condition of the search and CompObLev needs to repeat the test for all possible source destination pairs within the known region, which is computationally very expensive. Thus, to make the process faster, in our proposed approach, a user approximates her obfuscation level with monte carlo simulation. For this, we randomly generate 1 million source destination pairs within the known region and compute the percentage of source destination pairs that satisfy the termination condition, and thereby approximate the area of known region that can be considered by adversaries as a refined location of a user. Finally, we compute the obfuscation level as the percentage of the area considered as the user’s refined location with respect to the total space.

1.1 A.1 GenerateSet

The GenerateSet function takes the parameters m, P, $P^{\prime }$, M i n D[k] and flag and returns all possible eligible candidate sets of POIs from the retrieved dataset. Note that for sequenced kTP queries, the algorithm considers the sequence while generating the sets and if the sequence is not fixed, the algorithm considers all possible sequences of visiting POIs while generating the sets. Algorithm 2 describes the detailed steps of the function.

For the first time f l a g = 0 and $P^{\prime }$ is empty. Thus, sets are generated using the POIs in P with the function GetSet, stored in S and P is copied in $P^{\prime }$.

For subsequent call of the algorithm, f l a g = 1 and P contains the latest POIs retrieved from the LSP and $P^{\prime }$ contains the previously retrieved POIs. For each POI p∈P, all possible sets are generated with p and other POIs in $P^{\prime }$ with the function GetSet, sets are added in S, and p is added in $P^{\prime }$.

After generating the sets, OneSetDist calculates the distance for each set of POIs. For example, if a set is {p ₁, p ₂, p ₃}, the distance is computed as d i s t(p ₁, p ₂) + d i s t(p ₂, p ₃) The distances of eligible sets are also stored to avoid recomputation for future trip distance computation (not shown in Algorithm 2).

For better understanding, Table 3 epresents a simulation of function GenerateSet with an example scenario for k = 1 and m = 2. The table is divided into two parts based on values of flag (0 or 1). First time when GenerateSet is called, M i n D[k] is $\infty$ and flag is 0. The first part of the table assumes $P=\{p_{1},p_{2},p_{2}^{\prime }\}$. After execution of GetSet, S includes sets $\{(p_{1},p_{2}),(p_{1},p_{2}^{\prime })\}$ (as shown in Line 3 of Table 2). Then $P^{\prime }$ keeps a copy of P for future use. In Line 12.(a), for set {(p ₁, p ₂)}, calculated distance from OneSetDist is less than M i n D[k] because M i n D[k] is infinity. Thus, the condition of Line 13.(a) is False. Same for Lines 12.(b) and 13.(b). Hence no set will not be removed from S and it contains $\{(p_{1},p_{2}),(p_{1},p_{2}^{\prime })\}$.

Table 3 GenerateSet: simulation with example

We assume that the trip distance via (p ₁, p ₂) and $(p_{1},p_{2}^{\prime })$ are 10 and 20, respectively. Thus, the next time when GenerateSet is called M i n D[k] is 20 and flag is 1. The second part of the table assumes $P=\{p_{1}^{\prime },p_{2}^{\prime \prime }\}$. In Line 7.(a), for $p=p_{1}^{\prime }$, two sets $\{(p_{1}^{\prime },p_{2}),(p_{1}^{\prime },p_{2}^{\prime \prime })\}$ are generated and stored in S. After that $p_{1}{\prime }$ is added to the $P^{\prime }$ which stores all the retrieved POIs. Following the same procedure for $p_{2}^{\prime \prime }$, S contains sets $\{(p_{1}^{\prime },p_{2}),(p_{1}^{\prime },p_{2}^{\prime \prime }), (p_{1},p_{2}^{\prime \prime }),(p_{1}^{\prime },p_{2}^{\prime \prime })\}$ and all the POIs are added to $P^{\prime }$. Assume that for set $\{(p_{1}^{\prime },p_{2})\}$ in 13.(a), OneSetDist distance, say 30, is greater then M i n D[k]. Thus, the condition is true and this set will be removed from S. Present S contains $\{(p_{1}^{\prime },p_{2}^{\prime \prime }), (p_{1},p_{2}^{\prime \prime }),(p_{1}^{\prime },p_{2}^{\prime \prime })\}$ in Line 14.(a). Similar process continues for each remaining sets in S. After pruning all the unnecessary sets, finally S contains $\{(p_{1},p_{2}^{\prime \prime })\}$.

Appendix B: Detailed algorithm: cloaked location

In this section, we present our algorithm to evaluate a PkTP query based on the cloaked location of the user. Algorithm 3, PkTP _cloaked_User, shows the pseudocode to process a PKTP query that runs on a user’s mobile device. Similar to Algorithm 1, inputs of the algorithm are k, required types $\{1, 2, \dots , m\}$, a user’s actual source s and destination d, and the obfuscation level o _l . The output is $R_{s}= \{{p_{1}^{1}}, {p_{2}^{1}}, \dots , {p_{m}^{1}}\},\{{p_{1}^{2}}, {p_{2}^{2}}, \dots , {p_{m}^{2}}\},\dots ,\{{p_{1}^{k}}, {p_{2}^{k}}, \dots , {p_{m}^{k}}\}$, k sets of POIs that have the k smallest trip distances from s to d.

In the first step of the algorithm, the function GenerateRectangle generates the source and destination rectangle s _r and d _r based on the user defined obfuscation level o _l . We use the algorithm proposed in [13, 14] to randomly compute the rectangles according to the privacy requirements. Then the algorithm retrieves a candidate answer set that includes optimal answers for all possible source-destination pairs in s _r and d _r , respectively, using the function PkTP _cloaked_LSP (discussed in detail in the later part of this section). The candidate POIs are stored in P.

In Line 5, the function ComputeSet is called to generate all possible sets with POIs in P and the sets are stored in S. After that for each set $s^{\prime }$ in S, the algorithm computes the trip distance with respect to s to d. If the trip distance is less than M i n D[k] then the answer set R _s and the distance array M i n D are updated. Since M i n D[k] may have been updated, the algorithm checks whether it is possible to prune some sets from S to reduce the computational overhead using the function PruneSet. The function PruneSet removes a set $\{{p^{1}_{1}}, {p^{2}_{2}},...,{p^{i}_{m}}\}$ from S if ${\sum }_{i=1}^{m-1}{dist(p_{i}, p_{i+1})}$ is already greater than M i n D[k]. Finally R _s contains k sets of POIs that minimize trip distances from s to d.

Algorithm 4, PkTP _cloaked_LSP shows the details steps for LSP side algorithm. A set $P^{\prime }$, initialized with ∅, stores the POIs that provide k smallest trip distances with respect to all possible source-destination pairs in s _r and d _r , respectively. The input to the algorithm are $s_{r},d_{r},k,\{1, 2, \dots , m\}$ and the output is $P^{\prime }$.

The notations that we have used for this algorithm are summarized below:

• s _c (d _c ): The center of the source (destination) rectangle, s _r (d _r ) and one of the foci of the search region (ellipse).

• m _p : The mid point of s _c and d _c . It is also the center point of the known region (circle).

• d ₁(d ₂): The Euclidean distance from s _c to the corner point of the s _r

• M i n D[1..k]: An array of k entries, where M i n D[j] represents the j ^th smallest trip distance from s _c to d _c via visiting POIs of required types, where 1 ≤ j ≤ k.

• $d^{\prime }$: The sum of d ₁, d ₂ and M i n D[k]. It also represents the length of the major axis of the search region (ellipse).

• $r_{m_{p}}$: The radius of the known region centering at m _p .

• IsInsideKnownRegion($s_{c},d_{c},d^{\prime },m_{p},r_{m_{p}}$): A function that checks whether the known region(circle) covers the search region(ellipse) or not and return yes or no, respectively.

Similar to Algorithm 1, this algorithm uses a function INN with parameters f, k, m _p and flag to incrementally retrieve nearest POIs with respect to m _p . For the first time f l a g = 0 and INN returns at least k POIs of one type and at least one POI of remaining types, which are sufficient to get k initial POI sets. For rest of the time flag is 1 and INN returns k POIs, where POIs can be of any of the required types $1,2,\dots ,m$. The retrieved POIs with respect to m _p are stored in P. Each time P contains the latest POIs retrieved by INN. Note that with every call of INN, the length of the radius of the known region $r_{m_{p}}$ increases. Function IsInsideSearchRegion in Line 8 prunes a POI in P if it falls outside the overlapping region of the known region and the search region. Note that initially M i n D[k] is $\infty$ and thus, no POI from P is pruned in the first iteration.

Algorithm 4 also uses the function GenerateSet (described in Section A.1) to generate possible candidate sets and stores them in S. For each set $s^{\prime }$ in S, the algorithm calculates the trip distance $Tdist(s_{c},d_{c},S^{\prime })$ for source destination pair s _c and d _c . If $Tdist(s_{c},d_{c},S^{\prime })< MinD[k]$, the array M i n D is updated. In Line 15, the algorithm updates the length of the major axis $d^{\prime }$ of the search region and uses IsInsideSearchRegion function to prune the POIs from $P^{\prime }$ that are not included in the overlapping region of computed known and search regions.

Finally, the algorithm checks whether the current known region covers the search region using the function IsInsideKnownRegion. If yes, the algorithm returns $P^{\prime }$ to PkTP _cloaked_User. Otherwise, the algorithm repeats the process to identify the candidate answer set that includes POIs for k smallest trip distances with respect to all possible source-destination pairs in s _r and d _r , respectively.