1. “Location Privacy Protection for Smartphone Users”
By Kassem Fawaz and Kang G. Shin
University of Michigan, Ann Arbor
Presented by Xiaopeng Li
CSE at University of South Carolina

2. Overview The motivation of studying location privacy protection
The threat model
Design of the components of LP-Guardian
The architecture and implementation of LP-Guardian
Evaluate LP-Guardian
Conclusion and future work

3. Motivation Location-based services
LBS use real-time geo-data from a mobile device to provide information, entertainment or security.
--- such as restaurant locators, roadside assistance
LBS also use a smartphone’s GPS technology to track a person’s location.

4. Motivation Location-based services
LBS can range from Google Maps to Foursquare. Most popular apps now include the feature.
More smartphone users are using location-based services, according to a recent study by Pew Research.
--- Almost 74% of smartphone users enable LBS to get real-time information
But how much do users care about location privacy?

5. Motivation Users’ perceptions of location privacy
78% of the surveyed people believe that apps accessing their location can pose privacy threats.
85% of them reported that they care about who access their location.
Traditional research proposals
Suffer several shortcomings in terms of effectiveness, efficiency and practicality.
Due to the shortcomings, the authors implement LP-Guardian.

6. Motivation Related work
Most theoretical approaches address the tracking threat in that they hide the users’ raw location while still revealing the users’ mobility.
One practical solution makes the app never receive location updates rendering it unusable.
Other proposed systems require changes to the existing mobile ecosystem to provide the privacy guarantees.

7. Threat Model Three types of threats
Assume a passive adversary who is interested in inferring more information about the user from collected location information.
Three types of threats
1. Tracking Threat
--- locate users in real time
2. Identification Threat
--- identify users from frequently visited places
3. Profiling Threat
--- profile users according to some health clinics or religious places

8. Design High-Level Overview Anonymization:
1. Coarsening without loss of service (weather apps)
--- Location is automatically coarsened to the city-level;
2. Monitoring the users’ mobility (fitness app)
--- Feed the app a synthetic route that preserves some features of the users’ actual route;
3. Requires location with high granularity (geo-search app)
--- Apply a novel mechanism to control release of the location to prevent any possible identification;

9. Design Identification Protection
The set of city blocks is Bl = {bl1, bl2, bl3, …}, Every resident has a probability distribution of visiting the blocks as pi = P( bli ).
Higher pmin , lower privacy guarantee; a lower pmin will indicate a stricter privacy guarantee.
Idea: hiding the user among a theoretical set of people who have to satisfy a minimum probability constraint of visiting the places that the user visits.

10. Design Profiling Protection
Profiling threat when visiting a particular church or a health clinic.
LP-Guardian addresses the threat by putting the user in control.
Idea: If the user opts to hide his place, LP-Guardian adds noise to the actual location, making the reported location indistinguishable from the actual location.

11. Architecture and Implementation
Interceptor; Rule manager; Place/City detector; Location anonymizer

12. Architecture and Implementation
Core Implementation
Intercept and then modify the location object before reaching the app.

13. Architecture and Implementation
User Interface
Bootstrapping
Set the initial probabilities of user’s top N visited places
Set the rule for every app
Per-place/session controls
1. Control the profiling protection level
--- Whenever an app attempts to access the user’s location from a new place, LP-Guardian will prompt the user to ask for his decision.

14. Architecture and Implementation
User Interface
Properties of the prompts
Frugality and visibility
--- LP-Guardian prompts the user only in the event of a location request and while running in the foreground.
2. Safety
--- Balance between the frequency of prompts and privacy guarantees.
--- Only the first location access from every newly visited place is proceeded by a prompt to allow the user to make a choice.

15. Evaluation
Performance

16. Evaluation
Privacy
Identification Protection

17. Evaluation Privacy Tracking
Most apps can’t track the user for more than 8 minutes a day.

18. Evaluation User Study Geo-search (Yelp)
--- 57% of the participants indicated a comfortable level.
2. Social Networking (Facebook)
--- 82% of the participants answered that they have no problem with sharing a city-level location instead of the actual home or work locations.
3, 4, 5… Please find more in the paper.

19. Conclusion & Future Work
The authors proposed LP-Guardian, a novel location privacy protection framework for Android smartphone users that is practical, effective and efficient
In the future, the authors plan to pursue the deployment challenges related to location privacy protection.

20. Thank you! Question?