Spatial cloaking is a privacy mechanism that is used to satisfy specific privacy requirements by blurring users' exact locations into cloaked regions. This technique is usually integrated into applications in various environments to minimize the disclosure of private information when users request location-based service. Since the database server does not receive the accurate location information, a set including the satisfying solution would be sent back to the user. General privacy requirements include K-anonymity, maximum area, and minimum area.
Background With the emergence and popularity of location-based services, people are getting more personalized services, such as getting the names and locations of nearby restaurants and gas stations. Receiving these services requires users to send their positions either directly or indirectly to the service provider. A user's location information could be shared more than 5000 times in two weeks. Therefore, this convenience also exposes users' privacy to certain risks, since the attackers may illegally identify the users' locations and even further exploit their personal information. Continuously tracking users' location has not only been identified as a technical issue, but also a privacy concern as well. It has been realized that Quasi-identifiers, which refer to a set of information attributes, can be used to re-identify the user when linked with some external information. For example, the social security number could be used to identify a specific user by adversaries, and the combined disclosure of birth date, zip code, and gender can uniquely identify a user. Thus, multiple solutions have been proposed to preserve and enhance users' privacy when using location-based services. Among all the proposed mechanisms, spatial cloaking is one of those which has been widely accepted and revised, thus having been integrated into many practical applications.
Location privacy Location privacy is usually considered falling into the category of information privacy, though there is little consensus on the definition of location privacy. There are often three aspects of location information: identity, location (spatial information), and time (temporal information). Identity usually refers to a user's name, email address, or any characteristic which makes a user distinguishable. For example, Pokémon Go requires a consistent user identity, since users are required to log in. Spatial information is considered as the main approach to determine a location. Temporal information can be separated into real-time and non-real time and is usually described as a time stamp with a place. If a link is established between them, then the location privacy is considered violated. Accessing personal location data has been raised as a severe privacy concern, even with personal permission. Therefore, privacy-aware management of location information has been identified as an essential challenge, which is designed to provide privacy protection against abuse of location information. The overall idea of preserving location privacy is to introduce enough noise and quantization to reduce the chances of successful attacks.
Spatial crowdsourcing uses devices that has GPS (global positioning system) and collects information. Data retrieved includes location data that can be used to analyze maps and local spatial characteristics. In recent years, researchers have been making a connection between social aspects and technological aspects regarding location information. For example, if co-location information is considered as the data which potential attackers would get and take into consideration, the location privacy is decreased by more than 60%. Also, by a constant report of a user's location information, a movement profile could be constructed for this specific user based on statistical analysis, and a large amount of information could be exploited and generated from this profile such as user's office location, medical records, financial status, and political views. Therefore, more and more researchers have taken account of the social influence in their algorithms, since this socially networked information is accessible to the public and might be used by potential attackers.
History In order to meet user's requirements for location privacy in the process of data transportation, researchers have been exploring and investigating models to address the disclosure of private information.
The secure-multi-party model is constructed based on the idea of sharing accurate information among n parties. Each party has access to a particular segment of the precise information and at the same time being prevented from acquiring the other shares of the data. However, the computation problem is introduced in the process, since a large amount of data processing is required to satisfy the requirement.
The minimal information sharing model is introduced to use cryptographic techniques to perform join and intersection operations. However, the inflexibility of this model to fit into other queries makes it hard to be satisfying to most practical applications.
The untrusted third-party model is adopted in peer-to-peer environments.
The most popular model right now is the trusted third-party model. Some of the practical applications have already adopted the idea of a trusted third party into their services to preserve privacy. For example, Anonymizer is integrated into various websites, which could give anonymous surfing service to its users. Also, when purchasing through PayPal, users are not required to provide their credit card information. Therefore, by introducing a trusted-third-party, users' private information is not directly exposed to the service providers.
Approaches for preserving location information The promising approach of preserving location privacy is to report data on users' behavior and at the same time protect identity and location privacy. Several methods have been investigated to enhance the performances of location-preserving techniques, such as location perturbation and the report of landmark objects.
Location perturbation The idea of location perturbation is to replace the exact location information with a coarser grained spatial range, and thus uncertainty would be introduced when the adversaries try to match the user to either a known location identity or external observation of location identity. Location perturbation is usually satisfied by using spatial cloaking, temporal cloaking, or location obfuscation. Spatial and temporal cloaking refers to the wrong or imprecise location and time reported to the service providers, instead of the exact information. For example, location privacy could be enhanced by increasing the time between location reports, since higher report frequencies makes reidentification more possible to happen through data mining. There are other cases when the report of location information is delayed until the visit of K users is identified in that region.
However, this approach could affect the service reported by the service providers since the data they received are not accurate. The accuracy and timelessness issues are usually discussed in this approach. Also, some attacks have been recognized based on the idea of cloaking and break user privacy.
Landmark objects Based on the idea of landmark objects, a particular landmark or a significant object is reported to the service provider, instead of a region.
Avoid location tracking In order to avoid location tracking, usually less or no location information would be reported to the service provider. For example, when requesting weather, a zip code instead of a tracked location would be accurate enough for the quality of the service received.
Environment
Centralized scheme A centralized scheme is constructed based on a central location anonymizer (anonymizing server) and is considered as an intermediate between the user and the service provider. Generally, the responsibilities of a location anonymizer include tracking users' exact location, blurring user specific location information into cloaked areas and communicate with the service provider. For example, one of the methods to achieve this is by replacing the correct network addresses with fake-IDs before the information are forward to the service provider. Sometimes user identity is hidden, while still allowing the service provider to authenticate the user and possibly charge the user for the service. These steps are usually achieved through spatial cloaking or path confusion. Except in some cases where the correct location information are sent for high service quality, the exact location information or temporal information are usually modified to preserve user privacy.
Serving as an intermediate between the user and location-based server, location anonymizer generally conducts the following activities: Receiving users' exact location information and private profile Blurring the location into cloaked areas based on the specific privacy requirements In most of the times, removing user identities from the location information Reporting the cloaked area to the service provider and receiving a list of solutions, which is referred to as a candidate list, from the service provider which satisfies user's requests Deciding the most appropriate solution based on the user's exact location and returning the accurate solution information back to the user ( Some location anonymizer may not adopt this step)
The location anonymizer could also be considered as a trusted-third party since it is trusted by the user with the accurate location information and private profile stored in the location anonymizer. However, this could also expose users' privacy into great risks at the same time. First, since the anonymizer keeps tracking users' information and has access to the users' exact location and profile information, it is usually the target of most attackers and thus under higher risks. Second, the extent to which users trust the location anonymizers could be essential. If a fully trusted third party is integrated into the algorithm, user location information would be reported continuously to the location anonymizer, which may cause privacy issues if the anonymizer is compromised. Third, the location anonymizer may lead to a performance bottleneck when a large number of requests are presented and required to be cloaked. This is because the location anonymizer is responsible for maintaining the number of users in a region in order to provide an acceptable level of service quality.
Distributed scheme (decentralized scheme) In a distributed environment, users anonymize their location information through fixed communication infrastructures, such as base stations. Usually, a certification server is introduced in a distributed scheme where users are registered. Before participating in this system, users are required to obtain a certificate which means that they are trusted. Therefore, every time after user request a location-based service and before the exact location information is forward to the server, the auxiliary users registered in this system collaborate to hide the precise location of the user. The number of assistant users involved in cloaking this region is based on K-anonymity, which is usually set by the specific user. In the cases where there are not enough users nearby, S-proximity is generally adopted to generate a high number of paired user identities and location information for the actual user to be indistinguishable in the specific area. The other profiles and location information sent to the service provider are sometimes also referred to as dummies.