Preventing Denial-of-request Inference Attacks in Location- sharing Services Kazuhiro Minami Institute of Statistical Mathematics ICMU 2014

Location Sharing Services (LSSs) Enable users to share their identifiable location information with others LSS Examples: - Google Latitude, - Glympse - Instamapper Retrieve Location data Mobile Platforms: - iPhone - Android Publish location data GPS signal Compute GPS coordinates Raise significant concern on location privacy

Naïve Access Control in LSS LSS Target user Set of private locations S Requester Define No Examples: hospitals, drinking bars, etc.

Hospital Book store However, just protecting private locations is not enough Assume that Dave knows Bob’s previous traces Bob can figure out that Alice is visiting the hospital here Bob’s path Dave Bob

Location Predictor based on the Markov Model Siebel Center Unihigh DCL Union Siebel Center Unihigh DCL Union Consider locations as states of a user and define a state transition matrix M Probability of moving from l i to l k in n steps: M i,k (n) lili lklk n steps

(M, t)-Access control [MBL2011] Matrix M Ask if M i,k (n) < t LSS Target user Requester Prevent predicting the target user’s visiting a private location with probability higher than a given threshold value t Matrix M Set of private locations S For every private location l k

However, not publishing location data reveals some information Private location A user moves l 1, l 2, and l 3 in sequence A threshold value t = 0.8 ✔ ✔ ✔ Next location is either l 2 or l 4 Only l 2 is not publishable since the user will surely visit l 3 next If we get a sequence (l 1,ε) we learn: 1.The user is currently at l 2, and 2.The user will visit l 3 next ✔

Denial-of-request Inferences If LSS does not publish location data after publishing l i, the requester learns that lili lklk n steps ljlj DENY Private location

Algorithm for converting the original matrix M to compressed M’ If we see (l 2, ε), we know the user’s at l S = {l 6, l 8 } S = {l 2, l 3, l 6, l 8 } If we see (l 1, ε), we know the user’s either at l 2 or l

Hospital Book store Revisiting the previous example with our proposed method Bob’s path

Comparison of the two access-control methods with the Geolife dataset Consider a rectangular region of 39 × 30 kilometers in Beijing, China Use top 10 users in terms of data points Divide the region into 140 × 140 (=19,600) unit regions Q: How many more non-releasable locations when we consider denial-of-request inferences? GPS dataset published by Microsoft Asia 178 users in the period of four years Logged every 1 – 5 seconds

Initial private locations S 0 1.Pick two locations of an restaurant and a hospital, which was actually visited by users China-Japan Friendship Hospital （ N. latitude , E. longitude ） South Beauty Restaurant （ N. latitude , E. longitude ） 2.Randomly choose a given number of locations from the top most frequently visited locations

Dependency on the number of initial private locations #Final private locations #Initial private locations A threshold δ = 0.8. #inference steps = 1.

Dependency on the number of inference attacks #Final private locations #Inference steps A threshold δ = 0.8. #Initial private location = 2

Conclusions Study a new inference problem concerning a denial of service request in LSSs Model an adversary with a compressed state transition matrix Experimental results show a considerable in existing LSSs Future work includes studying inference problems based on the hidden Markov model

Thank you!