Modeling privacy approaches for location based services

Abstract

Locationbased services (LBS) use geospatial data of mobile device to provide information in real time. A key concern in using these services is the need to reveal the user’s exact location, which may allow an adversary to infer private information about the user. To address the privacy concerns of LBS users, a number of security approaches have been proposed based on the concept of k-anonymity. The central idea in location k-anonymity is to find a set of k-1 users close to the actual user, such that the locations of these k users are indistinguishable from one another, thus protecting the identity of the user. A number of performance parameters like success rate, amount of privacy achieved are used to measure the performance of the k-anonymity approaches. However, there is no formal model to compare the different k-anonymity approaches. Moreover, these proposals also make the implicit, unrealistic assumption that the k−1 users are readily available. Thus they ignore the turnaround time to process a user request, which is crucial for a real-time application like LBS. In this work, we model the k-anonymity approaches using queuing theory to compute the average sojourn time of users and queue length of the system. To demonstrate that queuing theory can be used to model all k-anonymity approaches, we quantitatively compare three different k-anonymity approaches with varying degree of complexity - top-up, bottom-down and bulk processing. The proposed analytical model is further validated with experimental results.

Introduction

With the wide availability of location-aware devices and advancement of positioning technologies like Global Positioning Systems (GPS) to determine exact locations of users and objects of interest, a new class of applications called locationbased services (LBS) have become highly popular. These applications can vary from utility applications like finding points of interest, friends currently present in ones vicinity to serious applications like sending alarm messages during emergency etc. One of the main concern in using these services, is that they require revealing ones location which may allow an adversary to infer sensitive information about the user. To address the privacy concerns of LBS, a number of approaches have been proposed, popular among them are those approaches that implement the concept of k-anonymity. In this approach, the key idea is to find a set of k users confined in a given geographical area such that they are indistinguishable from one another, thus protecting the identity of the user.

Central to the idea of k-anonymity in LBS is a trusted third party (TTP) which is delegated with the task of anonymization. When a LBS query arrives at the TTP, it finds $k-1$ other users in the vicinity of the user and sends the obfuscation area to the LBS server. This is known as cloaking or position obfuscation. The different LBS privacy approaches using k-anonymity basically differ in the way how the $k-1$ other users are selected. These approaches make an unrealistic, implicit assumption that the $k-1$ other users are readily available. However, in practice queries for anonymization will arrive at unpredictable times and when they arrive other users may not be available. For example in Clique–Cloak [1] approach, whenever a query arrives it is checked if the location point of the user forms a clique with $k-1$ other users. In such a case, the first $k-1$ users will always have to wait. Thus the natural question that arise is how long a LBS query may have to wait before it can be served, for how long will the TTP be busy in computation and so on. The existing k-anonymity approaches consider different performance parameters like success rate, amount of privacy level achieved, etc. but do not consider parameters like average response time of a query which is very important as the queries are fired in real time and users want fast response.

Although the idea of k-anonymity has been well established [1], [2] and effectively deployed to solve the upcoming challenges of location privacy [3], [4], no mathematical model are available to evaluate them. The contribution of our work can be summarized as follows:

• Modeling of k-anonymity privacy approaches: Our first aim is to develop a mathematical framework that can be used to evaluate k-anonymity privacy approaches in terms of request-to-response time of a query, the number of queries present in the TTP, length of a busy period and length of an idle period. Next we adapt this framework to model specific privacy approaches available in literature.

• Experimental validation of the model: The second goal of our work is to experimentally compute the performance parameters estimated using our mathematical model and compare the results.

• Comparative analysis: The last objective is to compare the various k-anonymity approaches available in literature based on our proposed model. The result of our analysis show that the bottom-up privacy approach clearly outperforms the top-down approach. Bulk processing privacy approaches have the nice proper of generating cloaking area with high spatial resolutions, however, they have higher turnaround time and low anonymization probability rate.

In this work, we use the concept of single service systems and bulk service systems of Queueing theory to model the k-anonymity LBS privacy approaches that uses a TTP. In order to demonstrate our approach, we apply the concept to some well-known k-anonymity LBS privacy approaches [1], [5], [6], [7]. Results show that our mathematical model as compared to experimental results has a high accuracy with an error percentage of about 2.5%.

The remainder of our work is organized as follows. Section 2 reviews state-of-the-art in location services, privacy threats and defense mechanisms. The background of our work is presented in Section 3. In Section 4, we describe how queuing theory can be used to model the k-anonymity privacy approaches. The proposed queuing model is given in Section 5. Experimental results are given in Section 6 and finally the concluding remarks are given in Section 7.