1. Privacy-Preserving Optimal Meeting Location Determination on Mobile Devices Igor Bilogrevic, Member, IEEE, Murtuza Jadliwala, Member, IEEE, Vishal Joneja, Kübra Kalkan, Jean-Pierre Hubaux, Fellow, IEEE, and Imad Aad

2. Outline Introduction & Problem Definition Problem Formulation & System Architecture Proposed Solution Privacy Requirements & Definitions Privacy & Complexity Analysis Experimental Evaluation

3. Outline Introduction & Problem Definition Problem Formulation & System Architecture Proposed Solution Privacy Requirements & Definitions Privacy & Complexity Analysis Experimental Evaluation

4. Introduction Two popular feature of LBS : Location check-ins and location sharing Near 88% of 35 participants were not comfortable sharing their location information

5. Fair Rendez-Vous Point Problem To determine a location among the such that the maximum distance between this location and all other users’ locations is minimized

6. Fair Rendez-Vous Point Problem To determine a location among the such that the maximum distance between this location and all other users’ locations is minimized

7. k-center Problem To determine k locations from N candidate places for placing facilities such that the maximum distance from any place to its closest facility is minimized.

8. k-center Problem To determine k locations from N candidate places for placing facilities such that the maximum distance from any place to its closest facility is minimized.

9. Outline Introduction & Problem Definition Problem Formulation & System Architecture Proposed Solution Privacy Requirements & Definitions Privacy & Complexity Analysis Experimental Evaluation

10. System Architecture

11. C.-H. O. Chen et al., “GAnGS: Gather, authenticate’n group securely,”in Proc. 14th ACM Int. Conf. Mobile Computing Networking, 2008,pp. 92–103. Y.-H. Lin et al., “SPATE: Small-group PKI-less authenticated trust establishment,” in Proc. 7th Int. Conf. MobiSys, 2009, pp. 1–14.

12. System Architecture Privacy-Preserving Fair Rendez-Vous Point (PPFRVP) algorithm A InputOutput {E(L 1 )||E(L 2 )||…||E(L N )}E(L fair )=g(E(L 1 )||E(L 2 )||…||E(L N ))

13. System Architecture Privacy-Preserving Fair Rendez-Vous Point (PPFRVP) algorithm A InputOutput {E(L 1 )||E(L 2 )||…||E(L N )}E(L fair )=g(E(L 1 )||E(L 2 )||…||E(L N ))

14. System Architecture Privacy-Preserving Fair Rendez-Vous Point (PPFRVP) algorithm A InputOutput {E(L 1 )||E(L 2 )||…||E(L N )}E(L fair )=g(E(L 1 )||E(L 2 )||…||E(L N ))

15. Outline Introduction & Problem Definition Problem Formulation & System Architecture Proposed Solution Privacy Requirements & Definitions Privacy & Complexity Analysis Experimental Evaluation

16. Transformation Function f Boneh-Goh-Nissim (BGN) cryptosystems ElGamal and Paillier cryptosystems

17. About BGN-based Cryptosystem The cryptosystem devised by Boneh, Goh, and Nissim was the first to allow both additions and multiplications with a constant-size ciphertext. However, only one multiplication is permitted. One of the key ideas in the BGN system is to use elliptic curve groups whose order is a composite number n that is hard to factor. Homomorphic Encryption and the BGN Cryptosystem David Mandell Freeman November 18, 2011

18. Fairness Function g A. Distance Computation B. MAX Computation C. ARGMIN MAX Computation

19. Fairness Function g A. Distance Computation B. MAX Computation C. ARGMIN MAX Computation

20. Distance Computation(BGN) T is the modulus of the plaintext domain.

21. Distance Computation(BGN)

22. Distance Computation(E-P)

23. n is the modulus of the Pailliar cryptosystem.

24. Distance Computation(E-P)

25. Fairness Function g Distance Computation B. MAX Computation C. ARGMIN MAX Computation

26. MAX Computation For each index i, the LDS generates two random values (r i & s i ) to scale and shift the encrypted square distance between Li and other location preferences)

27. MAX Computation For each index i, the LDS generates two random values (r i & s i ) to scale and shift the encrypted square distance between Li and other location preferences)

28. ARGMIN MAX Computation For each index i, the LDS generates two random values (r i & s i ) to scale and shift the encrypted square distance between Li and other location preferences)

29. Finally… In Step C.3, each user knows which identifier corresponds to himself And the user whose preferred location has the minimum distance sends to all other users the fair rendezvous location in an anonymous way. After the last step, each user receives the final fair rendezvous location, but no other information regarding non-fair locations or distances is leaked

30. Outline Introduction & Problem Definition Problem Formulation & System Architecture Proposed Solution Privacy Requirements & Definitions Privacy & Complexity Analysis Experimental Evaluation

31. Privacy Requirements & Definitions

32. Challenge-Response Games

33. (weak) Identifiability Guess : u a chooses a value k’ ∈ {1,..., N} and sends it back to the challenger.

34. Distance-Linkability Guess : u a responds with a value s ∗ ∈ {0, 1}. u a wins the game if s ∗ = 0 and d j,k ≥ s, or if s ∗ = 1 and d j,k < s.

35. Coordinate-Linkability Guess : u a responds with a value r ∈ {0, 1} u a wins the game if r = 0 and b j ≤ b k, or if r = 1 and b j > b k.

36. Outline Introduction & Problem Definition Problem Formulation & System Architecture Proposed Solution Privacy Requirements & Definitions Privacy & Complexity Analysis Experimental Evaluation

37. Privacy Analysis Probability advantages under passive attack are 0s

38. Privacy Analysis(Active Attack) Collusion ( between the LDS and a participant) Fake Users Generated by the LDS Generated by a legitimate participant Unfair RV(Malicious modification or untruthful reporting of the maximum masked values)

39. Unfair RV even if a user falsely reports one of his values to be the maximum, this would cause the algorithm to select a non-fair rendez-vous location if and only if no other user selected a smaller value as the maximum distance.

40. Complexity Analysis

44. Outline Introduction & Problem Definition Problem Formulation & System Architecture Proposed Solution Privacy Requirements & Definitions Privacy & Complexity Analysis Experimental Evaluation

45. Complexity Analysis (LDS implementation is running on a standard Linux PC) (2 GHz CPU, 3 GB RAM, Ubuntu Linux). Dist ARGMIN MAX

46. Complexity Analysis (client application is implemented on Nokia N810) (ARM 400 MHz CPU, 256 MB RAM, Linux Maemo OS) Dist all MAX+ARGMIN

47. END