[Paper Review] Eat the Cake and Have It Too: Privacy Preserving Location Aggregates in Geosocial Networks

Bogdan Cărbunar, Mahmudur Rahman+2 more|arXiv (Cornell University)|Apr 12, 2013

Privacy-Preserving Technologies in Data29 references4 citations

TL;DR

This paper proposes ProfilR, a privacy-preserving framework for constructing location-centric profiles (LCPs) in geosocial networks using homomorphic encryption and zero-knowledge proofs, enabling venues to compute aggregate user statistics without accessing individual data. The system ensures user privacy and correctness with end-to-end overhead of 2.5 seconds on smartphones, even under strong security guarantees.

ABSTRACT

Geosocial networks are online social networks centered on the locations of subscribers and businesses. Providing input to targeted advertising, profiling social network users becomes an important source of revenue. Its natural reliance on personal information introduces a trade-off between user privacy and incentives of participation for businesses and geosocial network providers. In this paper we introduce location centric profiles (LCPs), aggregates built over the profiles of users present at a given location. We introduce PROFILR, a suite of mechanisms that construct LCPs in a private and correct manner. We introduce iSafe, a novel, context aware public safety application built on PROFILR . Our Android and browser plugin implementations show that PROFILR is efficient: the end-to-end overhead is small even under strong correctness assurances.

Motivation & Objective

• To resolve the conflict between user privacy and business incentives in geosocial networks by enabling aggregate user profiling without exposing individual data.
• To ensure that venues and providers cannot learn individual user information, even through anonymized location traces.
• To enforce correctness by preventing users from falsely contributing to LCPs or manipulating aggregates.
• To design a scalable, efficient system suitable for deployment on resource-constrained mobile devices.
• To demonstrate practical utility through iSafe, a context-aware public safety application built on ProfilR.

Proposed method

• ProfilR uses the Benaloh homomorphic cryptosystem to enable encrypted computation of LCPs on user profiles without decryption.
• Zero-knowledge proofs (ZK-CTR) are employed to verify the correctness of user contributions without revealing private data.
• LCPs are computed either at venues via a venue-centric model or in real time via ad hoc device-to-device communication for snapshot LCPs.
• The system enforces location correctness by binding contributions to physical presence verified through venue-deployed devices.
• iSafe leverages ProfilR to compute safety-aware LCPs using Yelp review data, enabling privacy-preserving safety awareness.
• The framework ensures k-anonymity by requiring at least k users to be present before any profile is revealed.

Experimental results

Research questions

• RQ1 How can location-centric profiles be computed in a way that preserves user privacy while ensuring correctness?
• RQ2 Can a system be designed to allow venues to collect aggregate user statistics without accessing individual profiles?
• RQ3 What is the performance overhead of enforcing privacy and correctness in real-time mobile applications?
• RQ4 How can user location spoofing and fake check-ins be mitigated in a decentralized, privacy-preserving manner?
• RQ5 Can a practical, efficient system be built for real-world deployment on smartphones and web browsers?

Key findings

• The end-to-end overhead for an LCP update operation on a smartphone is 2.5 seconds, even with a client cheating probability of 1 in a million.
• Communication overhead in ZK-CTR rounds is under 17KB for 20 sub-ranges and 1024-bit key size, with storage overhead at 5KB for a single dimension.
• The iSafe browser plugin introduces less than 1 second of overhead for processing 500 Yelp reviews.
• The system achieves strong privacy guarantees by ensuring that no entity can learn individual user profiles, even with access to all system interactions.
• Snapshot LCPs enable real-time, decentralized computation of aggregates among co-located users via ad hoc wireless connections.
• The framework is resilient to Sybil attacks under the assumption that adversaries cannot control a large number of fake accounts, which can be mitigated using existing Sybil detection techniques.