A formal model of obfuscation and negotiation for location privacy

Transcription

1 A formal model of obfuscation and negotiation for location privacy Matt Duckham and Lars Kulik University of Melbourne Victoria 3010, Australia Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 1/18

2 Location privacy Overview Motivational example Location privacy protection Regulation: data protection and fair information practices Privacy policies: trust mechanisms to prescribe acceptable use Anonymity: dissociation of information about an individual from the individual s actual identity Obfuscation: deliberately degrading the quality of location information to protect the privacy of the person to whom that location information refers (related to spatial cloaking [Gruteser and Grunwald, 2003]) Obfuscation is complementary to existing approaches Negotiation: balancing the quality of service and level of privacy for a location-based service Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 2/18

3 Motivational example Overview Motivational example Ichiban Remote locationbased information service provider Sushi Ten Yo! Sushi A: "Yo! Sushi" City Center Park Pedestrian Q: "I am in City Center Park. What is the closest sushi restaurant?" Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 3/18

4 Quality and obfuscation Quality Scenario Inaccuracy: lack of correctness in information I am located at the corner of Flinders Street and Spring Street (I am actually located at the corner of Flinders and Elizabeth) Imprecision: lack of detail in information I am located on Flinders Street (accurate, but no detail about where on Flinders Street) Vagueness: existence of borderline cases (e.g., tall, near) I am located near Flinders Street Station ( near is vague: there exist places which are neither near nor not near Flinders Street) Any type of imperfection can be used in obfuscation; here we concentrate on imprecision Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 4/18

5 Scenario Quality Scenario Positioning system Location-based service provider Location-aware system Proximity queries: Where is the closest hospital? Where is the next fare waiting for a taxi? Subscribe me to locationbased content... Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 5/18

6 Obfuscation model Obfuscation model Negotiation Efficient computation a b c d n m l k e j f i g h o z p y q r s t x w v u Example obfuscation set O = {a, c, h, m, n, o, w} Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 6/18

7 Negotiation Obfuscation model Negotiation Efficient computation Aims to maximize quality of service (highest confidence in result) Location-based service provider Aims to maximize level of privacy (largest obfuscation set) Location-based service user Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 7/18

8 Negotiation Weighted graph, POI set, Obfuscation set (O) Obfuscation model Negotiation Efficient computation Define δ where oδp means o, p O have the same POI as their most proximal. O O/δ No Yes Return most proximal POI for arbitrary o O, with QoS Client reveals [l] O/δ No Client reveals O O No Yes Yes Return most proximal POI for arbitrary o [l], with QoS Reiterate with O in place of O Return estimate of most proximal POI, with QoS Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 8/18

9 Case 1: O O/δ Obfuscation model Negotiation Efficient computation o 1 q 1 q 5 o 5 o 2 o 4 o 3 q 4 o 6 q 2 q 3 O/δ = {{o 1, o 2, o 3, o 4, o 5, o 6 }} Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 9/18

10 Negotiation Weighted graph, POI set, Obfuscation set (O) Obfuscation model Negotiation Efficient computation Define δ where oδp means o, p O have the same POI as their most proximal. O O/δ No Yes Return most proximal POI for arbitrary o O, with QoS Client reveals [l] O/δ No Client reveals O O No Yes Yes Return most proximal POI for arbitrary o [l], with QoS Reiterate with O in place of O Return estimate of most proximal POI, with QoS Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 10/18

11 Case 2: Client identifies [l] O/δ Obfuscation model Negotiation Efficient computation q 1 o 1 q 5 o 5 o 2 o 4 o 3 q 4 o 6 q 2 q 3 l = o 1 O/δ = {{o 1, o 2, o 5 }, {o 3 }, {o 4, o 6 }} [l] = {o 1, o 2, o 5 } Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 11/18

12 Negotiation Weighted graph, POI set, Obfuscation set (O) Obfuscation model Negotiation Efficient computation Define δ where oδp means o, p O have the same POI as their most proximal. O O/δ No Yes Return most proximal POI for arbitrary o O, with QoS Client reveals [l] O/δ No Client reveals O O No Yes Yes Return most proximal POI for arbitrary o [l], with QoS Reiterate with O in place of O Return estimate of most proximal POI, with QoS Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 12/18

13 Case 3: Client identifies O O Obfuscation model Negotiation Efficient computation q 1 o 1 q 5 o 5 o 2 o 4 o 3 q 4 o 6 q 2 q 3 O = {o 1, o 3, o 4, o 5, o 6 } Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 13/18

14 Efficient computation Obfuscation model Negotiation Efficient computation q 1 o 1 q 5 o 5 o 2 o 4 o 53 q 4 o 6 q 2 q 3 (s,q 1 ) (s,q 2 ) s (s,q 3 ) (s,q 4 ) (s,q 5 ) Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 14/18

15 Summary Summary Current work Provides mechanism for balancing level of privacy against quality of service Lower levels of privacy generally lead to higher quality of service Compatible with need-to-know principle Robust computation with imperfect location information Computationally comparable with conventional shortest path algorithm Communication is bounded (negotiation must terminate) Current work: Selection and configuration of O has determining effect Assumes stateless model of LBS Proximity queries relatively simple (as opposed to route queries) Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 15/18

16 Simulations Summary Current work See [Duckham and Kulik, 2005] Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 16/18

17 Navigation and routes Summary Current work See [Duckham et al., 2003] Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 17/18

18 Hostile agents Summary Current work Tracking over time provides a basis for invasive inferences, e.g., Maximum speed of agent Minimum speed of agent Goal directed movement (e.g., agent is taking shortest path) Tracking granularity Direction of agent... Stronger assumptions lead to greater inferences that can be made Approach is to develop an algebra of inference operators, which can be combined in a predictable way Pervasive 2005: Matt Duckham and Lars Kulik May 10, p. 18/18

19 [Duckham and Kulik, 2005] Duckham, M. and Kulik, L. (2005). Simulation of obfuscation and negotiation for location privacy. Submitted to COSIT [Duckham et al., 2003] Duckham, M., Kulik, L., and Worboys, M. F. (2003). Imprecise navigation. Geoinformatica, 7(2): [Gruteser and Grunwald, 2003] Gruteser, M. and Grunwald, D. (2003). Anonymous usage of location-based services through spatial and temporal cloaking. In Proc. MobiSys 03, pages