Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Time-Efficient Locally Relevant Geo-Location Privacy Protection

Chenxi Qiu, Ruiyao Liu, Primal Pappachan, Anna Squicciarini, Xinpeng Xie

TL;DR

This work tackles the scalability challenge of LP-based geo-obfuscation for location privacy in LBS by introducing Locally Relevant Geo-Obfuscation (LR-Geo), which confines optimization to locally relevant locations for each user and offloads coefficient computation to a server. It combines an exponential mechanism to enforce Geo-Ind across users with a Benders decomposition framework to exploit a ladder-structured constraint matrix, achieving substantial improvements in computation time and data utility while preserving privacy. The authors provide theoretical guarantees for Geo-Ind with high probability, derive cost bounds, and demonstrate empirical gains on Rome road-network data, showing LR-Geo can handle up to 1500 locations within about 100 seconds and outperform multiple baselines. The approach offers a practical path to deploying privacy-preserving geo-obfuscation at city-scale or larger, balancing privacy, utility, and scalability in real-world LBS deployments.

Abstract

Geo-obfuscation serves as a location privacy protection mechanism (LPPM), enabling mobile users to share obfuscated locations with servers, rather than their exact locations. This method can protect users' location privacy when data breaches occur on the server side since the obfuscation process is irreversible. To reduce the utility loss caused by data obfuscation, linear programming (LP) is widely employed, which, however, might suffer from a polynomial explosion of decision variables, rendering it impractical in largescale geo-obfuscation applications. In this paper, we propose a new LPPM, called Locally Relevant Geo-obfuscation (LR-Geo), to optimize geo-obfuscation using LP in a time-efficient manner. This is achieved by confining the geo-obfuscation calculation for each user exclusively to the locally relevant (LR) locations to the user's actual location. Given the potential risk of LR locations disclosing a user's actual whereabouts, we enable users to compute the LP coefficients locally and upload them only to the server, rather than the LR locations. The server then solves the LP problem based on the received coefficients. Furthermore, we refine the LP framework by incorporating an exponential obfuscation mechanism to guarantee the indistinguishability of obfuscation distribution across multiple users. Based on the constraint structure of the LP formulation, we apply Benders' decomposition to further enhance computational efficiency. Our theoretical analysis confirms that, despite the geo-obfuscation being calculated independently for each user, it still meets geo-indistinguishability constraints across multiple users with high probability. Finally, the experimental results based on a real-world dataset demonstrate that LR-Geo outperforms existing geo-obfuscation methods in computational time, data utility, and privacy preservation.

Time-Efficient Locally Relevant Geo-Location Privacy Protection

TL;DR

This work tackles the scalability challenge of LP-based geo-obfuscation for location privacy in LBS by introducing Locally Relevant Geo-Obfuscation (LR-Geo), which confines optimization to locally relevant locations for each user and offloads coefficient computation to a server. It combines an exponential mechanism to enforce Geo-Ind across users with a Benders decomposition framework to exploit a ladder-structured constraint matrix, achieving substantial improvements in computation time and data utility while preserving privacy. The authors provide theoretical guarantees for Geo-Ind with high probability, derive cost bounds, and demonstrate empirical gains on Rome road-network data, showing LR-Geo can handle up to 1500 locations within about 100 seconds and outperform multiple baselines. The approach offers a practical path to deploying privacy-preserving geo-obfuscation at city-scale or larger, balancing privacy, utility, and scalability in real-world LBS deployments.

Abstract

Geo-obfuscation serves as a location privacy protection mechanism (LPPM), enabling mobile users to share obfuscated locations with servers, rather than their exact locations. This method can protect users' location privacy when data breaches occur on the server side since the obfuscation process is irreversible. To reduce the utility loss caused by data obfuscation, linear programming (LP) is widely employed, which, however, might suffer from a polynomial explosion of decision variables, rendering it impractical in largescale geo-obfuscation applications. In this paper, we propose a new LPPM, called Locally Relevant Geo-obfuscation (LR-Geo), to optimize geo-obfuscation using LP in a time-efficient manner. This is achieved by confining the geo-obfuscation calculation for each user exclusively to the locally relevant (LR) locations to the user's actual location. Given the potential risk of LR locations disclosing a user's actual whereabouts, we enable users to compute the LP coefficients locally and upload them only to the server, rather than the LR locations. The server then solves the LP problem based on the received coefficients. Furthermore, we refine the LP framework by incorporating an exponential obfuscation mechanism to guarantee the indistinguishability of obfuscation distribution across multiple users. Based on the constraint structure of the LP formulation, we apply Benders' decomposition to further enhance computational efficiency. Our theoretical analysis confirms that, despite the geo-obfuscation being calculated independently for each user, it still meets geo-indistinguishability constraints across multiple users with high probability. Finally, the experimental results based on a real-world dataset demonstrate that LR-Geo outperforms existing geo-obfuscation methods in computational time, data utility, and privacy preservation.
Paper Structure (50 sections, 8 theorems, 29 equations, 13 figures, 4 tables)

This paper contains 50 sections, 8 theorems, 29 equations, 13 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Preliminary
  3. Geo-Obfuscation in LBS
  4. Geo-Indistinguishability
  5. LP Problem Formulation
  6. Motivations and Observations
  7. Methodology
  8. Locally Relevant Geo-Obfuscation
  9. LR Location Set Searching
  10. Obfuscation Range
  11. Problem Formulation
  12. Computation Framework
  13. Exponential Mechanism Integration
  14. Benders' Decomposition to Enhance Computation Efficiency
  15. Problem reformulation of CLR-Geo
  16. ...and 35 more sections

Key Result

Theorem 3.1

Consider two locations $v_i$ and $v_j$ are connected through at least one path in the Geo-Ind graph $\mathcal{G}$. Let the path distance$D_{v_i,v_j}$ represent the sum of weights of the edges forming the shortest path between $v_i$ and $v_j$. Their probabilities of selecting location $v_k$ as the ob

Figures (13)

  • Figure 1: Directly/indirectly linked obfuscation vectors.
  • Figure 2: Strongly & weakly linked decision vectors.
  • Figure 3: Generate a submatrix instead of the whole matrix.
  • Figure 4: Obfuscation matrix calculation.
  • Figure 5: Block ladder structure of the CLR-Geo problem.
  • ...and 8 more figures

Theorems & Definitions (11)

  • Definition 2.1
  • Definition 3.1
  • Theorem 3.1
  • Definition 4.1
  • Proposition 4.1
  • Proposition 4.2
  • Proposition 4.3
  • Theorem 4.4
  • Proposition 4.5
  • Theorem 4.6
  • ...and 1 more