A cryptographic approach to location privacy
Loading...
Files
Full Text E-thesis
Date
2023
Authors
Eshun, Samuel N.
Journal Title
Journal ISSN
Volume Title
Publisher
University College Cork
Published Version
Abstract
The rapid expansion of location-based services (LBS) has driven an escalating demand for personalised and context-aware applications, enriching user experiences across health, weather, and navigation sectors. These services offer valuable insights into various applications using large-scale datasets of individual mobility traces. However, alongside the benefits come considerable privacy concerns, as the data could inadvertently reveal sensitive information about users' movements and behaviours. This thesis delves into multiple facets of privacy within LBS, concentrating on the de-anonymisation of mobility data and the subsequent privacy risks it poses. In response to these concerns, the thesis presents privacy-preserving indoor localisation techniques, later improved with an efficient cryptographic protocol to protect users and service providers against privacy breaches.
The first part of this thesis focuses on de-anonymisation attacks on mobility data. We propose a novel de-anonymisation model that employs hidden Markov models (HMM) to create user mobility profiles based on spatiotemporal trajectories. The performance of this model is assessed using real-world mobility datasets from two different cities, Shanghai and Rome. Our attack techniques significantly improve over existing de-anonymisation techniques, successfully re-identifying up to 85% and 90% of anonymised users in the respective datasets. However, despite the model's effectiveness, limitations exist, such as the model's dependence on the availability of a training dataset. Future work could explore unsupervised machine learning algorithms to address these limitations or utilise more sophisticated techniques like recurrent neural networks (RNNs) to model the evolution of user mobility behaviour over time.
The second part of the thesis addresses privacy concerns in indoor Wi-Fi localisation. We propose a privacy-preserving protocol that uses partial homomorphic encryption (Paillier's cryptosystem) to guarantee user location privacy while allowing computation in the encrypted domain. This approach ensures that most of the computational overhead on the user side is delegated to the server while hiding the user's exact location. By leveraging the Spatial Bloom filter {data structure}, complemented by homomorphic encryption, the service provider can learn about the user's presence in predefined areas without revealing the user's exact location or these predefined areas to the user.
The third part of the thesis introduces an efficient and privacy-preserving cryptographic protocol that incorporates a more realistic security assumption in the form of a malicious adversary, one of the most important improvements to guarantee privacy for both the service provider and the user, unlike the semi-honest adversary in the previous protocol. Our protocol employs additive homomorphic encryption (DGK encryption) to preserve the privacy of the user's location fingerprint while allowing the service provider to compute over the encrypted fingerprint. In addition, garbled circuits protect the service provider's reference database against malicious users while delivering location output to the user. Finally, spatial Bloom filters further enhance the protocol by allowing the service provider to learn the user's vicinity in predefined areas of interest without revealing the exact location to the user or these predefined areas.
Compared to similar protocols, our proposed solution demonstrates a significant reduction in computational costs on the user side and a 99.99% reduction in online communication costs, making it more efficient and practicable in the Internet of Things environments. Furthermore, our protocol is the first to provide security against malicious users, whereas other protocols are limited to honest-but-curious adversaries.
For future work, we recommend strengthening the protection against actively corrupt service providers or cloud services by implementing additional cryptographic techniques, such as the ABY framework, for efficient mixed-protocol multiparty computation. Moreover, exploring other protocols or cryptographic primitives that improve efficiency, security, and privacy is encouraged, possibly through the combination of different techniques to optimise the protocol's current efficiency or reduce the size of the garbled circuit.
By examining the challenges posed by de-anonymisation attacks and developing innovative solutions, this thesis offers a comprehensive approach to enhancing privacy and security in location-based services. By investigating privacy-preserving indoor localisation techniques and developing efficient protocols, we strive to protect the interests of both users and service providers. As the demand for personalised and context-aware applications continues to grow, this research contributes significantly to the ongoing conversation surrounding privacy and data protection in the digital age.
The importance of addressing privacy concerns in location-based services cannot be overstated. As technological advancements progress and LBS permeate various aspects of our lives, ensuring the confidentiality of user data becomes paramount. The solutions presented in this thesis, including privacy-preserving indoor localisation techniques and efficient cryptographic protocols, are crucial steps towards achieving a balance between the benefits offered by these services and the privacy requirements of users and service providers.
As location-based services evolve, new challenges and privacy risks will undoubtedly emerge. Therefore, the work presented in this thesis should be considered part of an ongoing effort to develop and refine techniques that preserve user privacy while maintaining the functionality and efficiency of LBS. The exploration of alternative cryptographic primitives, the improvement of existing protocols, and the development of new privacy-preserving methods will be essential to ensuring the continued growth and success of location-based services in a secure and privacy-conscious manner.
In conclusion, this thesis comprehensively examines privacy concerns in LBS, focusing on de-anonymising mobility data and developing privacy-preserving indoor localisation techniques. The efficient cryptographic protocols proposed to offer robust protection for both users and service providers, paving the way for a more secure and privacy-oriented future for LBS.
Description
Keywords
Location privacy , Location-based services (LBS) , Secure multi-party computation (SMC) , Wi-Fi fingerprinting , Homomorphic encryption , Bloom filter , Garbled circuit , Oblivious transfer , Hidden Markov models , DBSCAN clustering , De-anonymization
Citation
Eshun, S. N. 2023. A cryptographic approach to location privacy. PhD Thesis, University College Cork.