Privacy-Preserving Trajectory Collection Győző Gidófalvi * Uppsala University, Dept. of Information Technology Geomatic ApS Xuegang Huang and Torben Bach Pedersen * Aalborg University, Dept. of Computer Science

November 5th, 2008G. Gidófalvi, X. Huang and T. B. Pedersen2 Problem Setting  Premise: Accurate trajectory patterns necessary for LBSs  Task: Collect exact trajectories of mobile users in a privacy-preserving manner  Objective: Use free, energy-saving, short-range wireless P2P communication (Bluetooth, ZigBee)  Problem: Hardware ID is exposed in P2P communication Data item HIDPrivate trajectory y t x Secret or embarrassing visit / location Need to break the link between public and private information!

November 5th, 2008G. Gidófalvi, X. Huang and T. B. Pedersen3 Location Privacy Definitions Data item : id DEF. k-anonymity : data itemsmoving objects mn≥ ? ? k=5 DEF. α-diversity : x y AREA(MBR)≥α locations (extendable to trajectories) DEF. k-α-anonymity : k-anonymity + α-diversity

November 5th, 2008G. Gidófalvi, X. Huang and T. B. Pedersen4 Merge traj pieces and monitor # of copies After T s +2τ if the majority parity is: odd  discard even  store Data Reporting k-α-anonymity id 1 id k id 2 … id 1 id 2 id k+4 id k+3 id 2 τ if or DB full Anonymity Set k-anonymity Trajectory Repository Data Summarization Trajectory Exchange Get neighbors with at least k resp. neighbors x x Privacy-Preserving Trajectory Collection in Five Stages Server k Registration Queue k = 5 α = 1000m Client Registration k-anonymity Registration request (hid, k, α) … Approval (T s,τ, τ max ) id 1 id k id 2 … id 1 id 2 id k id 2 id k+4 id k+3 id k+2 id 1 id k+1 id 2 exchanged Neighborhood Discovery Trajectory Sampling and Anonymization k-α-anonymity Every λ-period sample real & generate k-1 synthetic, pair-wise α-diverse traj. pieces λ = 60sec id 1 id k id 2 even odd … id 1 Partial data item traj. piece k-α-anonymity id 1 id k id 2 … id 1 id 2 id k+4 id k+3 id 2 Select pdis for exchange exchange id 2 id 1 id k id k+2 id k+1

November 5th, 2008G. Gidófalvi, X. Huang and T. B. Pedersen5 Results  Realistic simulation shows that the method works under reasonable conditions and anonymity settings > 98% of the clients report their collected data > 95% of the data is reported Not reported data is recent and can be corrected for  Method / system that: collects exact trajectories without a loss does not require trusted components and provides strong privacy guarantees