Location Privacy Protection with a Semi-honest Anonymizer in - - PowerPoint PPT Presentation

▶
location privacy protection with a semi honest anonymizer
SMART_READER_LITE
LIVE PREVIEW

Location Privacy Protection with a Semi-honest Anonymizer in - - PowerPoint PPT Presentation

Mar 21, 2023 220 likes •466 views

Location Privacy Protection with a Semi-honest Anonymizer in Information Centric Networking Kentaro Kita, Yoshiki Kurihara, Yuki Koizumi and Toru Hasegawa Graduate School of Information and Technology, Osaka University, Japan Sep. 23, 2018 1

slide-1
SLIDE 1

Location Privacy Protection with a Semi-honest Anonymizer in Information Centric Networking

Kentaro Kita, Yoshiki Kurihara, Yuki Koizumi and Toru Hasegawa Graduate School of Information and Technology, Osaka University, Japan

1

  • Sep. 23, 2018
slide-2
SLIDE 2

Location-Based Services

  • System model of LBSs
  • Consumers choose locations of their interests (target

locations) from a set of locations where producers

  • ffers its services (service area) and send names of

the locations to the producers

  • Producers return data based on the locations

2

  • Sep. 23, 2018

I need the temperature at Boston /Temperature/Massachusetts/Boston Temperature at Boston Boston Massachusetts Consumer Producer

/Temperature

slide-3
SLIDE 3

Privacy in LBSs

  • Goal : Location Privacy
  • Hiding consumers’ target locations from adversaries

(including producers) in LBSs

  • Privacy Problem in LBSs
  • Consumers’ target locations can easily be linked to

their sensitive information

  • home locations, life styles

3

  • Sep. 23, 2018

I need the temperature at Boston /Temperature/Massachusetts/Boston Temperature at Boston

Is it a consumer who lives in Boston?

Consumer Producer

/Temperature

Adversary

slide-4
SLIDE 4

Existing Approaches

  • Honest anonymizer to achieve location anonymity
  • Hiding each consumer’s target location into other 𝑙 − 1 dummy

locations to achieve 𝑙-anonymity of locations

  • Anonymous location set : a set of 𝑙 locations which includes a

consumer’s target location

  • An anonymizer generates anonymous location sets from

consumers’ requests about their target locations

4

  • Sep. 23, 2018

Boston Boston Anonymizer Consumer Adversary Producer Springfield Oxford Boston Boston Oxford Springfield

slide-5
SLIDE 5

Problems #1 in Existing Approaches

  • 1. The anonymizer can identify consumers’ target locations
  • Hence, the anonymizer must be honest (trusted third party)

5

  • Sep. 23, 2018

Boston Boston Anonymizer Consumer Producer Springfield Oxford I can know that target location is Boston

slide-6
SLIDE 6

Problems #2 in Existing Approaches

  • 1. The anonymizer can identify consumers’ target locations
  • Hence, the anonymizer must be honest (trusted third party)
  • 2. Adversaries can infer target locations from anonymous

location sets by leveraging popularities of locations

6

  • Sep. 23, 2018

Boston Boston Anonymizer Consumer Producer Springfield Oxford I can know that target location is Boston Probably Boston is target location because it is the most popular city among the three

slide-7
SLIDE 7

Problems #2 in Existing Approaches

  • 1. The anonymizer can identify consumers’ target locations
  • Hence, the anonymizer must be honest (trusted third party)
  • 2. Adversaries can narrow target location to a region with a

certain degree of accuracy even if they cannot infer target location

7

  • Sep. 23, 2018

Boston Boston Anonymizer Consumer Producer Cambridge Somerville Boston Boston Somerville Cambridge consumer is interested in eastern side of Massachusetts

slide-8
SLIDE 8

Challenges

  • 1. Semi-honest anonymizer
  • Designing a semi-honest anonymizer in NDN
  • An semi-honest entity follows prescribed protocols but

attempts to gain more information than allowed from the protocols, and does not collude with others to launch attacks

  • 2. Dummy locations selection
  • Rigorously defining location anonymity satisfying the

following two requirements

1. Preventing adversaries from probabilistically inferring target locations 2. Minimizing geographical information of target locations leaked to adversaries

8

slide-9
SLIDE 9

Adversarial Model

  • Two semi-honest adversaries who attempt to infer

target locations from received/eavesdropped packets

  • 𝐵%,' : An adversary on some producers and networks
  • An adversary on producers as well as on routers should be

considered

  • 𝐵(

: An adversary on the anonymizer

  • Unlike existing studies, we assume that the anonymizer is also an

adversary

9

  • Sep. 23, 2018

consumer1 consumer2 anonymizer producer

𝐵( 𝐵%,'

slide-10
SLIDE 10

Location Privacy

  • Is it sufficient to achieve location anonymity to

protect location privacy as in existing approaches?

  • Location Privacy

= location anonymity + session anonymity

  • Session anonymity ensures indistinguishability of

consumers

  • Adversaries cannot gain information about consumers
  • Who is the consumers
  • Whether two requests are from the same consumer or not

10

  • Sep. 23, 2018
slide-11
SLIDE 11

Necessity to Achieve Session Anonymity

  • Auxiliary information about consumers breaks 𝑙-anonymity
  • Adversaries can Infer target location based on the possibility that

the consumer chooses each location as target location

11

  • Adversaries can Infer target location based on the past

anonymous location sets of the consumer

Boston

𝐵%,'

Boston can be target location because the consumer requests from a location near Boston Springfield Oxford

𝐵%,'

Boston can be target location of the third request because it can be assumed that the consumer make requests along a certain road Boston first second third

slide-12
SLIDE 12

Design Rationale of Architecture

  • Solution to achieve location anonymity
  • Each consumer makes request specifying an anonymous

location set to the anonymizer instead of target location

  • The anonymizer generates a map of anonymous

location sets for all the locations and distribute it to consumers

  • Solution to achieve session anonymity
  • We leverage lack of source/destination addresses on

packets in NDN (against 𝐵()

  • Interest and Data packets do not convey any information about

consumer.

  • The anonymizer also works as a mix-router (against 𝐵%,')

12

  • Sep. 23, 2018
slide-13
SLIDE 13

Anonymizer as a mix-router

13

  • Sep. 23, 2018
  • Session anonymity against 𝐵%,'
  • The Anonymizer acts as a Chum’s mix router to prevent 𝐵%,'

from link incoming and outgoing packets at the anonymizer

  • Encryption/decryption at the anonymizer
  • Batching 𝑂 incoming packets
  • Sometimes make dummy requests

𝐵(

𝐵%,'

anonymous location set locations which is included in the anonymous location set Encrypted Not encrypted I cannot link incoming and

  • utgoing packets
slide-14
SLIDE 14

Requirements to Location Anonymity

  • 1. Preventing adversaries from probabilistically

inferring target locations

  • Location 𝑙-anonymity
  • Adversaries cannot infer a consumer’s target location 𝑚+ from

her/his anonymous location set ℒ 𝑄 𝑚+ = 𝑚/ ℒ] = 𝑄 𝑚+ = 𝑚2 ℒ] (∀𝑚/, 𝑚2 ∈ ℒ)

  • 2. Minimizing geographical information of target

locations leaked to adversaries

  • Location 𝑢-closeness
  • Each anonymous location set ℒ is scattered uniformly

throughout the service area 𝑇 𝐸 ℒ, 𝑇 ≤ 𝑢 ,where 𝐸[:,:] is the difference between two geographical distributions

14

  • Sep. 23, 2018
slide-15
SLIDE 15

Requirement #1 to Location Anonymity

  • Location 𝑙-anonymity
  • Adversaries cannot infer a consumer’s target location

𝑚+ from her/his anonymous location set ℒ 𝑄 𝑚+ = 𝑚/ ℒ] = 𝑄 𝑚+ = 𝑚2 ℒ] (∀𝑚/, 𝑚2 ∈ ℒ)

  • 𝑄 𝑚 ℒ] = 𝑄 ℒ 𝑚]𝑄 𝑚 /𝑄[ℒ] (Bayes’ theorem)

15

  • Sep. 23, 2018

The probability that ℒ is used under the condition that target location is 𝑚 the probability that 𝑚 is selected as a target location (popularity)

  • We should take these two factors into account to

generate anonymous location sets

slide-16
SLIDE 16

Solution #1 to Location Anonymity

  • Making disjoint anonymous location set
  • If we divide the service area into disjoint anonymous

location sets, the anonymous location set for each target location is deterministically determined

  • ∀𝑚 ∈ ℒ, 𝑄 ℒ 𝑚 = 1 and ∀𝑚 ∉ ℒ, 𝑄 ℒ 𝑚 = 0

→ 𝑄 𝑚 ℒ] = 𝑄 ℒ 𝑚]𝑄 𝑚 /𝑄[ℒ] = 𝑄 𝑚 /𝑄[ℒ]

  • Maximizing entropy of popularities of locations
  • 𝐼ℒ = − ∑

𝑞A,ℒ ∗ logF 𝑞A,ℒ

  • A∈ℒ
  • where 𝑞A,ℒ = 𝑄 𝑚 / ∑

𝑄[𝑚/]

  • AH∈ℒ

(normalized popularity)

  • Selecting 𝑙 locations so that their popularities 𝑄 𝑚 are

as close as possible

  • We evaluate later

16

  • Sep. 23, 2018
slide-17
SLIDE 17

Requirement #2 to Location Anonymity

  • Location 𝑢-closeness
  • Each anonymous location set ℒ is scattered uniformly

throughout the service area 𝑇 𝐸 ℒ, 𝑇 ≤ 𝑢 where 𝐸[:,:] is the difference between two distributions

  • Motivation to achieve location t-closeness
  • If all the locations in an anonymous location set is close,

adversaries can narrow target location to a region with a certain degree of accuracy even if they cannot infer target location

17

  • Sep. 23, 2018

𝑇

  • Solution
  • Combining sufficiently scattered locations to generate

anonymous location sets

slide-18
SLIDE 18

Anonymous Location Sets Generation

  • Overview of our algorithm to generate

anonymous location sets

  • 1. Dividing the service area into 𝑙 segments
  • 𝑙 is degree of 𝑙-anonymity
  • Each segment consists of neighboring locations
  • 2. Selecting a location from each segment according to

the popularities and combine those 𝑙 locations

  • Locations with similar popularities that are located far enough

can be combined.

  • Anonymous location sets become disjoint

18

  • Sep. 23, 2018
slide-19
SLIDE 19

Evaluation of Anonymous Location Sets

  • Measurements
  • Entropy of popularities of locations in each anonymous

location set

  • Ratio of size of the range covered by each anonymous

location set with respect to that of a service area

  • Conditions
  • An LBS which collect speed of vehicles in each location
  • Use SUMO simulator to obtain vehicle movements
  • The service area is approximately 60 𝑙𝑛F and is

divided into 1024 locations

  • anonymity degree 𝑙 = 15

19

slide-20
SLIDE 20

Generated Anonymous Location Sets

  • Examples of anonymous location sets
  • A set of locations painted with the same color is one

anonymous location set.

20

  • 1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1
  • 1 -1
  • 1
  • 1
  • 1 -1
  • 1
  • 1 -1
  • 1
  • 1 -1
  • 1
  • 1
  • 1 -1
  • 1
  • 1 -1
  • 1 -1
  • 1
  • 1 -1 -1 -1 -1
  • 1 -1
  • 1
  • 1 -1 -1 -1 -1 -1 -1
  • 1
  • 1
  • 1 -1 -1 -1 -1 -1 -1
  • 1 -1
  • 1 -1 -1 -1
  • 1 -1 -1 -1
  • 1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1
  • 1 -1
  • 1 -1 -1 -1 -1
  • 1 -1
  • 1
  • 1 -1 -1 -1
  • 1 -1 -1 -1 -1
  • 1 -1 -1
  • 1 -1 -1
  • 1 -1 -1 -1 -1 -1
  • 1 -1 -1
  • 1
  • 1 -1 -1 -1 -1 -1
  • 1 -1
  • 1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1
  • 1
  • 1 -1
  • 1 -1 -1 -1 -1 -1
  • 1
  • 1
  • 1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1
  • 1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1
  • 1 -1 -1
  • 1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1 -1
  • 1 -1 -1 -1 -1 -1 -1 -1

Service are Anonymous location sets

slide-21
SLIDE 21

Result #1

  • Location k-anonymity : Location Entropy of the

popularities of locations

  • The larger the entropy, the smaller the differences in

popularities of locations and adversaries cannot infer target locations.

  • optimal value is 𝐼ℒ = − logF

K L =3.91

  • Observation
  • Our algorithm generates good anonymous location sets

because the entropy is sufficiently close to the optimal value

21

4 8 12 16 20 24

Time of Day

1 2 3 4

Entropy

Entropy (max) Entropy (median) Entropy (min)

slide-22
SLIDE 22

Result #2

  • Location t-closeness : Ratio of size of the range

covered by each anonymous location set with respect to that of the service area

  • The greater the ratio is, the more adversaries cannot

gain geographical information of target locations

  • Observation
  • Even the worst anonymous location set covers a sufficiently

large area of the service area.

22

4 8 12 16 20 24

Time of Day

0.2 0.4 0.6 0.8 1

Ratio

Max Mean Min

slide-23
SLIDE 23

Conclusions

  • Conclusions
  • We define location privacy as a combination of location

anonymity and session anonymity

  • We propose an architecture to achieve session anonymity

under the adversarial model that none of the anonymizer, producers, and networks are honest

  • We propose an anonymous location sets generation algorithm

to achieve location anonymity which is defined using 𝑙- anonymity and 𝑢-closeness

23

  • Sep. 23, 2018