Anonymizing User Location and Profile Information for Privacy-aware Mobile Services Masanori Mano, Yoshiharu Ishikawa Nagoya University 11/2/2010 1

Outline 1.Background & Motivation 2.Related Work 3.System Framework 4.Matching Degree 5.Algorithm 6.Experimental Evaluation 7.Conclusions and Future work 11/2/20102

BACKGROUND & MOTIVATION 11/2/20103

Location-Based Services (LBSs) 11/2/20104 Where is the nearest café? Location- based Services Positioning Technologies Mobile Communication Database Technologies

Profile-Based LBSs LBSs typically utilize user locations and map information –Finding nearby restaurants –Presenting a map around the user –Computing the best route to the destination Use of user profiles (users property) can improve the quality of service –Property- and location-based services –Application areas Mobile shopping Mobile advertisements 11/2/20105

Example: Mobile Advertisements Provides local ads to mobile users –Example: Announcement of time-limited sales of nearby shops Use of user profiles –Properties: age, sex, address, marital status, etc. –Send selected ads to appropriate person Example: {sex: F, age: 28, has_kids: yes} –Cosmetics for women: good –Computers: maybe –Cosmetics for men: bad –Toys for kids: good 11/2/20106 Alice

Example: Mobile Advertisements 11/2/20107 Alice came to a shopping mall Alice Mobile Ads Provider Shopping Mall

Example: Mobile Advertisements 11/2/20108 Alice wanted ads Mobile Ads Provider Alice Shopping Mall

Example: Mobile Advertisements 11/2/20109 Anonymizer construct a cloaked region and send property Mobile Ads Provider Cloaked Region Request with (sex: F, age: 28, …)

Example: Mobile Advertisements 11/2/ Ads provider returns selected ads for Alice Mobile Ads Provider Alice

Example: Mobile Advertisements 11/2/ But, Alice is the only female within the region Cloaked Region Security Camera Mobile Ads Provider

Example: Mobile Advertisements 11/2/ Identify Adversary Get information If an adversary obtains information, he can detect target user Security Camera Mobile Ads Provider

Example 11/2/ In this anonymization, the adversary cant identify the user Cant Identify Security Camera Adversary Mobile Ads Provider

RELATED WORK 11/2/201014

Related Work (1) Techniques for location anonymity are classified into two extreme types [Ling Liu, 2009] –Anonymous location services: Only consider user locations –Identity-driven location services: Also consider user identities Our method lies between the two extremes, but considers user properties –Another dimension 11/2/ AnonymousPartial IdentityIdentity-driven Use of User PropertiesOur Approach No User Properties

Related Work (2) k-anonymity is the most popular approach in the proposals for location anonymity –Users location is indistinguishable from locations of at least other k -1 users Our approach is also based on the concept of k-anonymity –Extended by considering user properties 11/2/201016

Related Work (3) Various approaches to anonymous location services Casper [Mokbel+06]: The anonymizer utilize a grid-based pyramid data structure like quad-tree PrivacyGrid [Bamba+08]: Computes cloaked region by dynamic cell expansion XStar [Wang+09]: Intended for the problem for automobiles on road networks 11/2/201017

SYSTEM FRAMEWORK 11/2/201018

System Architecture (1) There is a service called Matchmaker between users and ads providers Roles of Matchmaker –Maintains user & ad profiles –Matchmaking: Recommend good ads for a given ads request –Anonymization of locations and user properties 11/2/ User Ads Provider Ad Matchmaker

System Architecture (2) Matchmaker is a trusted third-party server Given an ad request, Matchmaker sends anonymized request to ads providers –Use of the users profile/location and ad profiles –Even if some providers are untrusted, the users privacy is protected 11/2/ User Ads provider Matchmaker raw data trusted route anonymized data

User Profile Represents the users properties – k : minimum population A cloaked region should contain at least k users – l : minimum length Minimum length of each side of a cloaked region (square) – s : distance threshold The user wants ads within this distance –Additional attributes (e.g., age and sex) Value ranges are specified ID kls agesex u M-M u F-* k users l s 11/2/201021

Advertisement Profile Represents properties of each advertisement An advertisement that satisfies the following conditions should be sent –The ad area overlaps with the users requesting area –Other properties (age and sex) match (overlap) the users properties IDad areaagesex a1(100, 200, 400, 500)[20, 29]M a2(500, 500, 700, 700) [60, ] * Ad1 Ad2 s 11/2/201022

MATCHING DEGREE 11/2/201023

Motivation: Bad Anonymization The cloaked region contains aged/young and male/female users –The properties of the region is vague The ads provider has a cosmetic ad for female The ads provider may have a question: Is it valuable to send the ad? 11/2/ Ads provider ? Age: young to aged Sex: * (all)

Motivating Example: Good Anonymization Good anonymization would be that the users in the cloaked region have similar properties to the target user –Matching degree is introduced as a similarity 11/2/ Bad AnonymizationGood Anonymization different sexdifferent agesimilar sex and age

Matching Degree A matching degree is computed as the overlapped area of attribute values –Range: [0, 1] –Treated as if it were a probability value 11/2/ Attribute Values of Target User Overlapped Area Attribute Values of Other User Matching Degree for Spatial Attributes Matching Degree for Interval Attributes

Matching Degree 11/2/ nameage Alice21-30 Bob21-25 Dave61-80 Target user is Bob Compared user is Alice match = 1.0 Target user is Alice Compared user is Bob match = 0.5 Target user is Dave Compared user is Alice match = 0.0 Attribute of target user

ANONYMIZATION ALGORITHM 11/2/201028

Anonymity Conditions The cloaked region contains the target user The region contains at least k – 1 other users The length of each side of the region is longer than l The matching degrees between the target user and k - 1 users are more than a certain threshold value 11/2/ target user l k-1 users

Anonymization Process 1.Consider a rectangular region centered target user 2.Randomly select one user as a seed from the users within the region 3.Compute a rectangle around the seed 4.If the rectangle contains at least k users with good matching degrees, anonymization is completed Q A B C D E F 11/2/201030

Anonymization Example 11/2/ Alice Alice required ad –k = 3 –Threshold for matching degree = 0.5 Joe Kent Dave Mary Mike

Anonymization Example 11/2/ Alice Alice is young woman –match = 1.0 Mary is also young woman –match = 1.0 Kent is young man –match = 0.5 Joe is aged man –match = 0.0 Dave and Mike are middle age men – match = Joe Dave Kent Mary Mike

Anonymization Example 11/2/ Alice A region centered Alice contains Kent and Mike We assume that Kent is selected as the seed user 1.0 Joe Dave Kent Mary Mike

Anonymization Example 11/2/ Alice Compute region around Kent Check whether anonymization is appropriate 1.0 Joe Dave Kent Mary Mike

Anonymization Example 11/2/ Alice Cloaked region contains three users with good matching degrees We cant detect target user –Alice, Kent and Mary are young person It is good anonymization target user is young person 1.0 Joe Dave Kent Mary Mike

EXPERIMENTAL EVALUATION 11/2/201036

Experimental Evaluation CPU 2.8GHz RAM 512MB Linux Evaluation on synthetic data Experimental Settings 11/2/ PropertyValue Target area[(0.0, 0.0), (100.0, 100.0)] No. User1000 k[5, 10] l[2.0, 10.0] s[0.1, 5.0] No. of Profile Attributes 2 Attribute Value[0, 1], [0, 2], [0, 3], [0, 4], [1, 2], [1, 3], [1, 4], [2, 3], [2, 4], [3, 4] (randomly)

Threshold Values and Success Rates Matchmaker specifies a threshold value of matching degree –Find out an appropriate threshold Success rate is sensitive to population –Need to change threshold flexibly 11/2/ Containing more than or equal to k users with good matching degree (i.e. threshold) is successful anonymization

Computation Time We compare computation times of two approaches –Compute matching degrees –Does not compute matching degrees Only consider the number of users Computing of matching degrees takes more than twice times –Well try to improve algorithms of computing matching degrees 11/2/201039

CONCLUSIONS & FUTURE WORK 11/2/201040

Conclusions and Future work Conclusions –Proposed an approach to anonymization for LBSs –Utilizing user profiles to specify users properties and anonymization preferences –Property-aware anonymization using matching degrees Future work –More experimental evaluation –Improving algorithm 11/2/201041

Thank you 11/2/201042