Private Queries in LocationBased Services: Anonymizers are Not Necessary

1
Private Queries in Location-Based
ServicesAnonymizers are Not Necessary
2
Outline

• LBS Privacy Overview
• Spatial Cloaking Techniques
• Proposed PIR Technique
• Approximate and Exact Queries
• Performance Optimization
• Experimental Evaluation

3
Outline

• LBS Privacy Overview
• Spatial Cloaking Techniques
• Proposed PIR Technique
• Approximate and Exact Queries
• Performance Optimization
• Experimental Evaluation

4
Location-Based Services (LBS)
Problem Statement How to preserve anonymity of
query source?

• LBS users
• Mobile devices with GPS capabilities
• Spatial Queries
• E.g., NN Queries
• Location server is
• NOT trusted

Find closest hospital to my present location
5
Outline

• LBS Privacy Overview
• Spatial Cloaking Techniques
• Proposed PIR Technique
• Approximate and Exact Queries
• Performance Optimization
• Experimental Evaluation

6
Spatial K-Anonymity

• Query issuer hides among other K-1 users
• Probability of identifying query source 1/K
• Idea anonymizing spatial regions (ASR)

7
CasperMok06

• Quad-tree based
• Fails to preserve anonymity for outliers
• Unnecessarily large ASR size

u2

• Let K3

A1
u1
u3

• If any of u1, u2, u3 queries, ASR is A1

u4

• If u4 queries, ASR is A2

A2

• u4s identity is disclosed

Mok06 Mokbel et al, The New Casper Query
Processing for Location Services without
Compromising Privacy, VLDB 2006
8
Reciprocity
KGMP07 Kalnis P., Ghinita G., Mouratidis K.,
Papadias D., "Preventing Location-Based Identity
Inference in Anonymous Spatial Queries", IEEE
TKDE 2007.
9
Hilbert Cloak (HC)
u3
u6
u1
u5
u4
u2
B1
B2
10
Continuous QueriesCM07

• Problems
• ASRs grows large
• Query dropped if some user disconnects

CM07 C.-Y. Chow and M. Mokbel Enabling Private
Continuous Queries For Revealed User Locations.
In Proc. of SSTD 2007
11
Space EncryptionKS07

• Drawbacks
• answers are approximate
• makes use of tamper-resistant devices
• may be vulnerable if some POI are known

Hilbert Mapping
Server
P2
P4
P1
NN(15)P2
P3
Q
15
KS07 A. Khoshgozaran, C. Shahabi. Blind
Evaluation of Nearest Neighbor Queries Using
Space Transformation to Preserve Location Privacy
, In Proc. Of SSTD 2007
12
Motivation

• Limitations of existing solutions
• No privacy guarantees
• especially for continuous queries
• Considerable overhead for sporadic benefits
• maintenance of user locations
• Assumption of trusted entities
• anonymizer and trusted, non-colluding users

13
Outline

• LBS Privacy Overview
• Spatial Cloaking Techniques
• Proposed PIR Technique
• Approximate and Exact Queries
• Performance Optimization
• Experimental Evaluation

14
Private Information Retrieval (PIR)

• Computationally hard to find i from q(i)
• Bob can easily find Xi from r (trap-door)

15
PIR Theoretical Foundations

• Let N q1q2, q1 and q2 large primes
• Quadratic Residuosity Assumption (QRA)
• QR/QNR decision computationally hard (in )
• Essential properties
• QR QR QR
• QR QNR QNR

16
PIR Protocol for Binary Data
X10
4 16 17 33
27 3 27 16
z4 z3 z2 z1
Get X10
QNR
a2, b3, N35 QNR3,12,13,17,27,33 QR1,4,9,11
,16,29
z2QNR gt X101 z2QR gt X100
KO97 E. Kushilevitz and R. Ostrovsky.
Replication is NOT needed Single database,
computationally-private information retrieval. In
IEEE Symposium on Foundations of Computer
Science, pages 364373, 1997.
17
Outline

• LBS Privacy Overview
• Spatial Cloaking Techniques
• Proposed PIR Technique
• Approximate and Exact Queries
• Performance Optimization
• Experimental Evaluation

18
Approximate Nearest Neighbor

• Data organized as a square matrix
• Each column corresponds to index leaf
• An entire leaf is retrieved the closest to the
  user

19
Exact Nearest Neighbor
A3 p1, p2, p3 A4 p1, --, --
Z4 Z3 Z2 Z1
Only z2 needed
p2
Y1 Y2 Y3 Y4
QNR
20
Outline

• LBS Privacy Overview
• Spatial Cloaking Techniques
• Proposed PIR Technique
• Approximate and Exact Queries
• Performance Optimization
• Experimental Evaluation

21
Avoiding Redundant Computations

• Data mining
• Identify frequent partial products

22
Parallelize Computation

• Values of z can be computed in parallel
• Master-slave paradigm
• Offline phase master scatters PIR matrix
• Online phase
• Master broadcasts y
• Each worker computes z values for its strip
• Master collects z results

23
Outline

• LBS Privacy Overview
• Spatial Cloaking Techniques
• Proposed PIR Technique
• Approximate and Exact Queries
• Performance Optimization
• Experimental Evaluation

24
Experimental Settings

• Datasets
• Sequoia dataset 62K POI
• Synthetic sets 10K - 100K POI
• Modulus up to 1280 bits
• P4, 2.8GHz CPU

25
Parallel Execution
26
Re-using Partial Products
27
Disclosed POI
28
Conclusions

• PIR-based LBS privacy
• No need to trust third-party
• Secure against any location-based attack
• Future work
• Further reduce PIR overhead
• Support more complex queries
• Include more POI information in the reply