Hide in Plain Sight: Enabling Mobile Applications and Data ... · • δ-location set differential...

Hide in Plain Sight: Enabling Mobile

Applications and Data Analytics with

Local Differential Privacy

Li Xiong

Department of Computer Science

Department of Biomedical Informatics

Emory University

IEEE International Conference on Mobile Data Management

Workshops/PhD Forum, 06/10/2019

* Work supported by National Science Foundation and Google Research Award

2Location data collected from individual devices

(Source: New York Times 12/2018)

Over 235 million locations captured from more than 1.2

million unique devices during a three-day period in 2017

(Source: New York Times 12/2018)

Who Knows What About Me? A Survey of Behind the Scenes Personal Data Sharing to Third Parties by Mobile Apps,

2015-10-30 https://techscience.org/a/2015103001/

33%/47% of Android/

iOS apps shared GPS

coordinates with third

parties

Location data sharing by iOS apps (left) to domains (right)

The Mobile Data Economy

Enabling Data Analytics with Centralized

Differential Privacy

Enable Mobile Apps and Analytics with Local

Enabling Mobile Apps and Analytics with Local

• Background

• Local differential privacy

• Geo-indistinguishability (local d-privacy)

• Extended privacy notions

• Protecting dynamic locations (CCS15, VLDB17 demo)

• Protecting spatiotemporal events (ICDE19)

• New mobile applications

• Spatial crowdsourcing with geo-indistinguishability

(ICDE18)

• New mechanisms

• Supporting both analytics and mobile applications

(CNS19)

• Privacy definition

• Any two locations produce “similar”

distributions (bounded by 𝜖)

• Mechanism

• Randomized response (with

encoding)

• Applications

• Simple analytics (e.g. frequency

estimation)

• Google, Apple, Microsoft

• Limitations

• Output not useful for mobile apps

Local Differential Privacy

• Privacy Definition

• Any two locations at distance at

most 𝑟 produce “similar”

distributions proportional to the

distance (bounded by 𝜖 𝑟)

• Mechanism:

• Planar Laplace mechanism

• Applications

• Mobile apps/location sharing

• Limitations:

• Temporal correlations of dynamic

locations not considered

• Not optimal for analytics

Geo-Indistinguishability (Local d-privacy)

e 𝜖 d(x1,x2)

• Generating random point z (from actual point

x ∈ X) according to planar Laplace distribution

Geo-Indistinguishability: Planar Laplace Mechanism

𝝐= log 6𝑟=1 km

Better privacy: 𝝐= log 2𝑟=1 km

• Background

(ICDE18)

• New mechanisms

(CNS19)

Location Privacy: Temporal Correlations

• Temporal correlations (adversary knowledge): moving patterns and

previously released perturbed locations

Differential Privacy with δ-location set

• δ-location set differential privacy

• Any two locations in the probable location set produce “similar”

distributions proportional to the distance (bounded by 𝜖)

• Probable location set determined by hidden Markov Model

Y. Xiao, L. Xiong. Protecting Locations with Differential Privacy under Temporal Correlations. CCS 2015

Y. Xiao, L. Xiong, S. Zhang, Y. Cao. LocLok: Location Cloaking with Differential

Privacy via Hidden Markov Model. VLDB demo, 2017

· · ·z1 z2 z3 ztobservable:

x1 x3unobservable: x2 x t· · ·

Optimal perturbation mechanism

• Minimize expected distance between perturbed location z and true

location x

• While satisfying constraint of differential privacy – any pair of

locations x1 and x2 are indistinguishable

• Exponential mechanism and Laplace

mechanism are not optimal

Planar Isotropic Mechanism

• Based on sensitivity hull K of δ-location set which

determines the lower bound error

• An improved K-norm mechanism based on Isotropic

transformation

• Achieves optimality while achieving differential privacy

Results: Perturbed Trace Illustration

Results: k-Nearest Neighbor Queries

From Location Privacy to Spatiotemporal

Privacy

• Location privacy mechanisms protect location at a time

• May not protect spatiotemporal activities?

• Staying in hospital for 2 hours

• From home to office every morning

• Need formal notions and mechanisms

Yang Cao, Yonghui Xiao, Li Xiong, Liquan Bai. PriSTE: From Location Privacy to

Spatiotemporal Event Privacy (short paper). ICDE 2019

Spatiotemporal events

• Boolean expression for spatiotemporal event

• Location at a time point (ut = si)

From Location Privacy to Spatiotemporal Event

Privacy

• Location privacy

• Two locations produce “similar” distributions/observations

• Spatiotemporal event privacy

• A true event and a negative event produce “similar”

location traces

Spatiotemporal Privacy Framework

• LPPM: Existing location privacy mechanism, e.g. Planar Laplace

Mechanism for geo-indistinguishibility

• PrivacyCheck: check spatiotemporal event privacy and calibrate

privacy budget

Results

• Strong LPPM may satisfy spatiotemporal privacy already

• Weak LPPM need to reduce privacy budget significantly (less utility) to

achieve same level of spatiotemporal privacy

• Stronger spatiotemporal privacy, less utility of the locations

• Background

(ICDE18)

• New mechanisms

(CNS19)

ONLINE TASK ASSIGNMENT IN SPATIAL

CROWDSOURCING

Privacy preserving online task assignment in

spatial crowdsourcing

• Both requester and worker locations are perturbed using geo-

indistinguishability

• Three-stage framework for task assignment using uncertain locations

Hien To, Cyrus Shahabi, Li Xiong. Privacy-Preserving Online Task

Assignment in Spatial Crowdsourcing with Untrusted Server. ICDE 2018

• Background

(ICDE18)

• New mechanisms

(CNS19)

Supporting both range queries and frequency

estimation

• Existing

• Local differential privacy with randomized response –

frequency estimation

• Geo-indistinguishability (local d-privacy) with planar

Laplace mechanism – range queries

• Goal

• Optimize for both frequency estimation and range

queries while ensuring local d-privacy

• Basic idea

• Assign different perturbation probabilities for different

input/output pairs in a way related to the distance

X. Gu, M. Li, Y. Cao and L. Xiong, Privacy-Preserving Range Queries and Frequency

Estimation with Geo-indistinguishability. IEEE Conference on Communications and

Network Security (CNS), 2019

Results: Comparison

RR: Randomized Response

OU: Optimized with Unary Encoding

PL: Planar Laplace mechanism

EM: Exponential mechanism

LE: Linear equation mechanism

Gowalla dataset

(ICDE18)

• New mechanisms

(CNS19)

• Open challenges

• Privacy/utility tradeoff

• User empowerment

Assured Information Management and Sharing

(AIMS)

Assured Information Management and Sharing

(AIMS)

http://www.cs.emory.edu/site/aims

Hide in Plain Sight: Enabling Mobile Applications and Data ... · • δ-location set differential...

Documents

Transcript of Hide in Plain Sight: Enabling Mobile Applications and Data ... · • δ-location set differential...

Veriﬁcation of Random Behavioursdelab.csd.auth.gr/~bci1/SEEFM03/seefm03_07.pdfPrAC5 we obtain (a t 1 2 δ) + (a t 1 2 δ) = ((a + a) t 1 2 (a + δ)) t 1 2 ((a + δ) t 1 2 (δ + δ)).

Αδελφοί Καραμαζόφ - Δ | Φιοντόρ Ντοστογιέφσκι

SEE THROUGH THE NEGATIVE - Pioneer Human Services...Glen & Charlene Gunderson Δ Kim Gunning Δ Priya Gupta Δ Rachel Gutierrez Δ Evy Haan Δ Leslie Habig Δ Derek Habowski Δ Roger

End 2 - Uni Stuttgart · h uc m larger family algebras SB(n,r,δ)δ∈k, sp ecialising to the symplectic and orthogonal case for δ= −n δ= n,. respely ectiv rom F the pt oin of

Filter design from Σ - Δ ADC to incremental Σ - Δ ADC

SMALL SINGLE LOW FREQUENCY TRANSISTOR AMPLIFIERSThe partial derivatives are taken keeping the collector voltage or base current constant. The Δ v B, Δ v C, Δ i B, Δ i C represent

Topic 1 Rate of Reaction. Introduction M concentration massg mLL volume (s) (g) (aq) UnitAmountState of Reactant Δ means change Δ in Time Δ in Amount.

Determination of the δ N and δ C of Total Nitrogen and ...

Single-spinasymmetries with 2 hadron fragmentation: The ... · 0.5 0.55 0.6 0.65 0.7 0.75 0.8 0.85 0.9 0.95 1 Mhh [GeV] sin δ 0 sin δ p sin(δ 0-δ p) Fit data with: À Á Â Ã

Unit 1 Kinetics. Introduction M concentration massg mLL volume (s) (g) (aq) UnitAmountState of Reactant Δ means change Δ in Time Δ in Amount of Reactant.

Dubai Wind Code22 · 2017-11-23 · For the city of Dubai, the topography coefficient will be taken as Ct =1+0.001 Δ (3.4) where Δ is the height of the location in meters from the

Polar Bonds and Molecules - Ms Keefe's Classroom€¦ · 0.4–1.0 Moderately polar covalent δ+ δ– H—Cl (0.9) 1.0–2.0 Very polar covalent δ+ δ– H—F (1.9) >2.0 Ionic

Setting Guide · STEP 5: Setting location service Follow the onscreen instructions to set location service. * When Google account is set, the setting screen for the location service

TheShort-CutMetropolisMethod · 2018-11-02 · drawn from some distribution not depending on x, with density function f(δ), which must be symmetrical around zero (ie, f(δ) = f(−δ)).

1.List of data, formulae and relationships Level... · Rate of thermal energy transfer by conduction =kA T x Δ Δ (Thermal conductivity k; temperature gradient Δ Δ T x) Kinetic

Determination of K, Δ G ˚ , Δ H ˚ , and Δ S ˚

X-ray photoelectron spectroscopy - An introduction mena3100_march_2014.pdfΔ. E) Δ. E = (Δ. E. n 2 + Δ. E. p 2 ... From Heisenberg’s uncertainty principle, the finite ... Zn .

+Dissociation- H H Oδ-δ-δ+δ+ H H Oδ-δ-δ+δ+ A. When an _____ compound made of ____ dissolves in water, the ____ ________ from one another. This is called.

ɺ ͋ͭ· Δ・ ॴ ɻ - jrwd.co.jp

APPLICATION FIELDS - Authentification · 2016 Δ PLENARY SESSIONS Δ ORAL SESSIONS Δ ABSTRACT SUBMISSIONINTENSIVE ORAL SESSIONS Δ POSTER SESSIONS Δ WORKSHOPS Δ SHORT COURSES Δ

+Dissociation- H H Oδ-δ-δ+δ+ H H Oδ-δ-δ+δ+ A. When an _ compound made of dissolves in water, the ____ from one another. This is called.