Geolocation Policy: A Document Format for Expressing Privacy Preferences for Location Information draft-ietf-geopriv-policy-22.txt Draft Authors: H. Schulzrinne, H. Tschofenig, J. Morris, J. Cuellar, J. Polk

Location Obscuring: Design Goal Goal: given the “measured position of the Target” find a circle, the “reported location”, of radius d (uncertainty) that contains the measured position. Measured position Reported location

Location Obscuring: Questions Previous Assumption: For simplification the reported location is in the form of a circle. Question #1: Are we fine with this assumption? Previous Assumption: We do not force algorithm to lie. Question #2: Should we give the Rule Maker the option to control this aspect? Question #3: Shall each run of the protocol render always a different output (with same input)?  see next slide for more details.

Repeated Reports and Movement Not so good! Look at intersection of the last reported locations (& other statistics). The final destination is leaked with high precision. Assume you always produce different outputs. What happens if every evening (week...) you go to the same place? Problem appears even without movement. See also Robert’s Processing examples

Distinguishability Suppose Martin visits Berlin regularly, every Thursday – James conjectures Martin is visiting one of 2 companies – If James obtains Martin's obfuscated locations, and they are always different, clustering algorithms (and the intersection of the provided locations) will eventually disclose which company he visits. We say that the two locations are distinguishable via the algorithm Any algorithm partitions the space into indistinguishability blocks – Two points are in the same block if they are indistinguishable – The smaller these blocks the larger the leakage.

One Algorithm based on “blocks” Construct a grid of points Find octagons around the points hexagons = intersection of octagons squares = areas in only one octagon such that all “blocks” (squares and hexagons) have the same area

Algorithm, cont. If you are in a green square, report the smallest circle that contains the whole octahedrons (the circumcircle of the octahedrons) If you are in a orange hexagon, report the circumcircle of any of the two octahedrons, north or south If you are in a violet hexagon, report the circumcircle of any of the two octahedrons, west or east

Solution Description – Explicitly construct blocks as big as possible make the algorithm depend on the block, not on the point within the block – Generating families of blocks is possible based on map projections and geometric grids – say, latitude, longitude & altitude, or based on countries, cities, landmarks (using Voronoi tessellations), – Necessary to introduce transition blocks between other blocks, in order to diffuse the area when moving from one block to another – What ever method is chosen, it MUST be standardized in detail, because the intersection of the outputs of different algorithms will otherwise provide a high information leakage – One particularly simple version of the algorithm constructing blocks based on a rectangular grid is given in draft-ietf-geopriv-policy-22

Suggestions to the Group Proposal for a refined algorithm in version -22 of the draft. Many other algorithms possible and we don’t need to even stick with one Go with the version in -22 and at a later point decide whether other algorithms are needed. – For example, when deployment of geolocation policy draft starts to begin and new use cases appear.