Citation Context

...ally exposed locations. Other formal approaches to the location privacy problem extend the concept of differential privacy to location privacy, defining a new privacy metric: geo-indistinguishability =-=[2, 5, 6, 20]-=-. The solutions in [2, 5, 20] focus on sporadic locations and are not applied on trajectory privacy. Andrés et al. [2] state that in the case of successive location disclosures, the geo-indistinguish...

Citation Context

...f these metrics alone is incapable of capturing privacy as a whole. The problem of optimizing the tradeoff between privacy and utility has already been discussed in the literature, but notably for differential privacy in the context of statistical databases [11, 25, 26, 28, 36]. Regarding user-centric obfuscation mechanisms, [52] solves the problem of maximizing distortion privacy under a constraint on utility loss. The authors construct the optimal adaptive obfuscation mechanism as the user’s best response to the adversary’s optimal inference in a Bayesian zero-sum game. In the same context, [9] solves the opposite problem, i.e., optimizing utility but for differential privacy. In both papers, the authors construct the optimal solutions using linear programming. Differential and distortion metrics for privacy complement each other. The former is sensitive to the likelihood of observation given data. The latter is sensitive to the joint probability of observation and data. Thus, by guaranteeing both, we encompass all the defense that is theoretically possible. In this paper, we model and solve the optimal obfuscation mechanism that: (i) minimizes utility loss, (ii) satisfies different...

Citation Context

...vacy levels: low, medium, and high. Low privacy corresponds to α = 0.1; medium privacy corresponds to α = 0.05; and high privacy protection corresponds to the most conservative α = 0.01. The procedure depicted in Fig. 14 won’t hide places that the user seldom visits but are sensitive to him. The per-place policies allow the user to set a privacy policy for each visited place, effectively allowing him to control the places he wants revealed to the service providers. Also, LP-Doctor can be extended to support other privacy criteria that try to achieve optimal privacy by perturbing location data [9, 37]. Anonymization Actuator: receives an action to perform from the threat analyzer. If the action is to protect the current location, the actuator computes a fake location by adding Laplacian noise [3] to ensure location indistinguishability. The privacy level determines the amount of noise to be added on top of the current location. One the other hand, if the action is to block, the actuator computes the fake location of < 0,0 >. As specified by Andres et al. [3], repetitive engagement of Laplacian noise mechanism at the same location leaks information about the location. To counter this threa...

Citation Context

...ew of the approach to location privacy developed by our INRIA team Comète. Some of the results presented here have appeared in previous papers of ours specialized in particular aspects of the project =-=[8,10,11]-=-. Road Map. In Section 2 we discuss notions of location privacy from the literature and point out their weaknesses and strengths. In Section 3 we formalize the notion of geoindistinguishability in thr...

Citation Context

...o is that of a single user sending requests to an LBS provider, which is a slightly different case. In order to cope with this difference, the concept of geo-indistinguishability has emerged recently =-=[26,27]-=-. It is a variant of differential privacy for the specific case of LBSs based on the principle that, the closer two locations are, the more indistinguishable they should be. In other words, given two ...