Quantifying location privacy

Transcription

1 Sébastien Gambs Quantifying location privacy 1 Quantifying location privacy Sébastien Gambs Université de Rennes 1 - INRIA sgambs@irisa.fr 10 September 2013

2 Sébastien Gambs Quantifying location privacy 2

3 Sébastien Gambs Quantifying location privacy 3

4 Geolocation and privacy Geolocation associate a geographical location to an object such as a cell phone, a computer or a GPS-equipped vehicle. These objects are often personal and link to a particular individual (or a group of individuals such as a family). If disclose to unauthorized entities, these information can lead to a privacy breach in the same manner that the history of purchase of an individuals or his personal queries. Main goal: reconcile geolocation and privacy for applications which rely on the spatio-temporal data of individual. Sébastien Gambs Quantifying location privacy 4

5 1 AlsoSébastien sometimes Gambs called locational privacy. Quantifying location privacy 5 Geo-privacy Geo-privacy 1 seeks to prevent an unauthorized entity from learning the past, current and future location of an individual (Beresford et Stajano 03). Remark : the personal spatio-temporal data of an individual can play the role of quasi-identifiers. From the geolocated data of an individual, it is possible to infer : his home and place of work, his identity, his center of interests, his habits or a deviation from his usual behaviour. Privacy breach

6 Sébastien Gambs Quantifying location privacy 6 Geolocation, a new type of personal data (INRIA Alumni)

7 Sébastien Gambs Quantifying location privacy 7 Geolocated query

8 Sébastien Gambs Quantifying location privacy 8 Collaborative traffic monitoring

9 Sébastien Gambs Quantifying location privacy 9 Geosocial network

10 Sébastien Gambs Quantifying location privacy 10 Dimensions to take into account when designing a location privacy metric 1. Periodicity of location data : Continuous (the user regularly releases his position) or Sporadic (irregular samples of the user position). 2. Type of location data : GPS traces, Call data records, Contact traces. 3. Imprecision versus inaccuracy. 4. Geosanitization mechanisms Example: differential privacy for location data (cf. two previous talks).

11 Properties of a good location privacy model 1. The model should be realistic. It should capture realistic threats against location privacy. 2. The model should be quantifiable. It should be equipped with a privacy metric that can tell between two different situations, which one is the most harmful to privacy. 3. The model should be intuitive and comprehensible. It should help to reason on location privacy and how to achieve it. 4. The model should be testable/falsifiable. It should be possible to verify/disprove/test the limits of the guarantees provided by the model. Sébastien Gambs Quantifying location privacy 11

12 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 12

13 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 13 Limit of pseudonymity Replacing the name of a person by a pseudonym preservation of the privacy of this individual (Extract from an article from the New York Times, 6 August 2006) The same phenomenon is true for geolocated data. Example: if the granularity is too small, the pair home-work becomes unique for a large fraction of the population (Colle and Kartridge 09).

14 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 14 Inference attack Inference attack : the adversary takes as input a geolocated dataset (and possibly some background knowledge) and tries to infer some personal information regarding individuals contained in the dataset. Main challenge : to be able to give some privacy guarantees even against an adversary having some auxiliary knowledge. We may not even be able to model this a priori knowledge. Remark: maybe my data is private today but it may not be so in the future due to the public release of some other data.

15 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 15 Objective of inference attack Identification of important places, called Point of Interests (POI), characterizing the interests of an individual. Example: home, place of work, gymnasium, political headquarters, medical center,... Prediction of the movement patterns of an individual, such as his past, present and future locations. Linking the records of the same individual contained in the same dataset or in different datasets (either anonymized or under different pseudonyms). The linking disclosure risk measures the success probability of this attack. Discover social relations between individuals. Example: people that are in the vicinity of each other on a frequent basis.

16 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 16 Auxiliary knowledge The adversary can have auxiliary knowledge that may help him in conducting a privacy breach. Examples of auxiliary knowledge : presence of an individual within an anonymized dataset, partial knowledge of its attributes (such as home address or place of work), a model of his habits, knowledge of his social network, knowledge of the distribution of the attributes within the population, geographical knowledge of roads and relief,...

17 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 17 Identification of POIs through clustering algorithm Main idea : search for gaps in the mobility traces. Inference attack : 1. Delete all mobility traces in which the person is in movement. 2. Find gaps in the traces (significative stop periods that have last at least 10 or 20 minutes). 3. Keep the mobility trace just before and after the gap. 4. Run a clustering algorithm on the remaining traces in order to discover significant clusters. 5. Return as POI the median of each cluster. Validation issue : how to evaluate the quality of the POIs returned if we do not have access to a ground truth?

18 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 18 Identification of the house of a taxi (view from GEPETO, AINA 09)

19 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 19 Identification of the house of a taxi (view from GoogleMaps and StreetView)

20 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 20 Mobility Markov chain (TDP 11) Objective : to represent in a compact way the mobility behaviour of an individual. The states of the chain are POIs and a transitions represents the probability from moving from one POI to another. Construction : Remove all moving traces. From the resulting traces, extract the POIs by running a clustering algorithm. Label each trace with the corresponding POI and compute the transitions probabilities. Temporal variant of the model (DYNAM 11): decompose the time into slices, the label of a stage corresponds to POI/time slice.

21 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 21 Example of mobility Markov chain

22 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 22 Predicting the next location of an individual (MPM 12) Prediction technique : from the actual location, choose te transition leaving from this POI that has the highest probability and predicts the corresponding POI. Evaluation method : splitting of the mobility traces betweena training set and a testing set (50%-50%). The mobility Markov chain is learnt from the training set and his prediction rate is evaluated in the testing set. Variant of the method : to remember the n last visited states (instead of simply the current one). Example : a user has visited work and then supermarket, which POI is the one where the user will go?

23 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 23 Experimental results The prediction method was tested on 3 mobility datasets (synthetic, Phonetic, Geolife) with n varying between 1 and 3 (best prediction rate obtained for n = 2). Results : success rate of the prediction between 70 and 95%.

24 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 24 De-anonymization attack via MMC (TrustCom 13) Objective : find an individual in an anonymous geolocated database. Assumption : the adversary has been able to observe in the past the mobility of the some individuals present in the dataset. Main idea : to compute a distance metric between 2 MMCs quantifying the difference between two mobility behaviours.

25 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC Sébastien Gambs Quantifying location privacy 25 De-anonymization attack via MMC Design of different distance metrics (geometrical, topological, logical) between MMCs and different way to combine the predictors. Best de-anonymization rate : 45% (obtained by combining 2 predictors).

26 Inference attack Identification of POIs through clustering algorithm Understanding and predicting the mobility of an individual De-anonymization attack via MMC A generic framework for inference attack on location data Figure: Shokri, Theodorakopoulos, Le Boudec and Hubaux 11. Sébastien Gambs Quantifying location privacy 26

27 Sébastien Gambs Quantifying location privacy 27 Spatial cloacking l-diversity and t-closeness Unlinkability

28 Sébastien Gambs Quantifying location privacy 28 Sanitization Spatial cloacking l-diversity and t-closeness Unlinkability Sanitization : process increasing the uncertainty in the data in order to preserve privacy. Inherent trade-off between the desired level of privacy and the utility of the sanitized data. Typical application : public release of data. Examples drawn from the sanitization entry on Wikipedia

29 Sébastien Gambs Quantifying location privacy 29 k-anonymity Spatial cloacking l-diversity and t-closeness Unlinkability Often, finding the optimal way of sanitizing the data is a NP-hard problem. Example of sanitization method with guarantees : k-anonymity (Sweeney 02). Main idea : protect the privacy of an individual by blending him into the crowd. k-anonymisation : process which constructs a database processus (by suppression and generalization) in which each record is indistinguishable from at least k 1 other records. Guarantee : no individual can be targeted with a probability 1 over k 1, even for an adversary having auxiliary knowledge.

30 Sébastien Gambs Quantifying location privacy 30 Spatial cloacking l-diversity and t-closeness Unlinkability Spatial cloacking Spatial cloacking (Gruteser and Grunwald 03) : extension of the concept of k-anonymity to spatio-temporal data. Main idea : ensure that at each time step, each individual is located within an area that is shared by at least k 1 other individuals. Possible method : recursively split the space in areas of different sizes such that each area respects the property of k-anonymity.

31 Sébastien Gambs Quantifying location privacy 31 Illustration of spatial cloacking Spatial cloacking l-diversity and t-closeness Unlinkability Illustration of spatial cloacking for k = 3 (extrait de Gruteser et Grunwald 03).

32 Sébastien Gambs Quantifying location privacy 32 Spatial cloacking l-diversity and t-closeness Unlinkability Limits of geographical masks and spatial cloacking If the adversary has some geographical knowledge about the sanitized area, he can discard some hypothesies that are not really realistic. Example : if after a random perturbation the returned location is situated within an area difficult to reach such as river or a mountain the adversary can easily discard this hypothesis by considering instead the closes accessible area. Linkability risk : even if it is impossible to identify exactly an individual, it is sometimes possible to link the actions of a group of individuals. Example of inference : at each time step, I am able to follow the movement of one group from one area to another.

33 Sébastien Gambs Quantifying location privacy 33 Spatial cloacking l-diversity and t-closeness Unlinkability l-diversity and t-closeness (Location) l-diversity: guarantee than for each spatial area revealed, there is enough diversity in terms of semantics of the possible locations. Can be instantiated by an entropic measure. (Location) t-closeness: provides a stronger guarantee by requiring that the distribution of possible locations is close to the distribution of the whole population. Can be instantiated by a divergence on distributions such as Kullback-Leibler divergence (relative entropy). Complementary to the guarantee provided by k-anonymity.

34 Spatial cloacking l-diversity and t-closeness Unlinkability Mix-zone (Beresford and Stajano 03) Inspired from the Mix-nets of Chaum which are used for the anonymous communication of messages. Mix-zone : area of space where no observation are produced and such that a new pseudonym will be generated when a person leaves the area which is different from the one that this person had when entering. Main goal : make it more difficult to link the actions of an individual. Example : the laboratory can be a mix-zone where no measurement are performed while we are here. When we leave it, we will receive a different pseudonym from the one we had before entering. Privacy metric : probability of success of an adversary in reconstructing the path of an individual. Sébastien Gambs Quantifying location privacy 34

35 Illustration of mix-zone Spatial cloacking l-diversity and t-closeness Unlinkability Measures are taken in the application zone contrary to the mix zone (Beresford and Stajano 03). Alternative to provide unlinkability : anonymity + path confusion. Sébastien Gambs Quantifying location privacy 35

36 Sébastien Gambs Quantifying location privacy 36

37 Sébastien Gambs Quantifying location privacy 37 Towards a generic location privacy model Should be able to resist to most of the state of the art inference attacks. Should be equipped with a privacy parameter that can be changed to tune the privacy model. Should work despite strong adversary knowledge. Example: mobility model, social network. Possible direction: geo-indistinguishability + l diversity for semantics of location + unlinkability + evaluation of the privacy level through inference attacks.

38 Sébastien Gambs Quantifying location privacy 38 This is the end! Thanks for your attention. Questions?