1

User-Defined Privacy Grid System forContinuous Location-Based Services

Roman Schlegel, Member, IEEE, Chi-Yin Chow, Member, IEEE, Qiong Huang, Member, IEEE,and Duncan S. Wong, Member, IEEE

Abstract—Location-based services (LBS) require users to continuously report their location to a potentially untrusted server to obtainservices based on their location, which can expose them to privacy risks. Unfortunately, existing privacy-preserving techniques for LBShave several limitations, such as requiring a fully-trusted third party, offering limited privacy guarantees and incurring highcommunication overhead. In this paper, we propose a user-defined privacy grid system called dynamic grid system (DGS); the firstholistic system that fulfills four essential requirements for privacy-preserving snapshot and continuous LBS. (1) The system onlyrequires a semi-trusted third party, responsible for carrying out simple matching operations correctly. This semi-trusted third party doesnot have any information about a user’s location. (2) Secure snapshot and continuous location privacy is guaranteed under our definedadversary models. (3) The communication cost for the user does not depend on the user’s desired privacy level, it only depends on thenumber of relevant points of interest in the vicinity of the user. (4) Although we only focus on range and k-nearest-neighbor queries inthis work, our system can be easily extended to support other spatial queries without changing the algorithms run by the semi-trustedthird party and the database server, provided the required search area of a spatial query can be abstracted into spatial regions.Experimental results show that our DGS is more efficient than the state-of-the-art privacy-preserving technique for continuous LBS.

Index Terms—Dynamic grid systems, location privacy, location-based services, spatio-temporal query processing, cryptography

✦

1 INTRODUCTION

In today’s world of mobility and ever-present Internet connectivity,an increasing number of people use location-based services(LBS)to request information relevant to their current locationsfrom avariety of service providers. This can be the search for nearbypoints of interest (POIs) (e.g., restaurants and hotels), location-aware advertising by companies, traffic information tailored to thehighway and direction a user is traveling and so forth. The use ofLBS, however, can reveal much more about a person to potentiallyuntrustworthy service providers than many people would be will-ing to disclose. By tracking the requests of a person it is possibleto build a movement profile which can reveal information abouta user’s work (office location), medical records (visit to specialistclinics), political views (attending political events), etc.

Nevertheless, LBS can be very valuable and as such usersshould be able to make use of them without having to give uptheir location privacy. A number of approaches have recentlybeen proposed for preserving the user location privacy in LBS.In general, these approaches can be classified into two maincategories. (1)Fully-trusted third party(TTP). The most popularprivacy-preserving techniques require a TTP to be placed betweenthe user and the service provider to hide the user’s locationinformation from the service provider (e.g., [1]–[8]). The maintask of the third party is keeping track of the exact locationof allusers and blurring a querying user’s location into a cloakedarea

• R. Schlegel is with Corporate Research, ABB Switzerland Ltd., Baden-Dattwil, Switzerland.∗C.-Y. Chow and∗D. S. Wong are with the De-partment of Computer Science, City University of Hong Kong,HongKong. ∗Q. Huang is with the College of Informatics, South ChinaAgricultural University, China.∗Authors are ordered alphabetically. E-mail: rs@ione.ch, chiychow@cityu.edu.hk, csqhuang-c@my.cityu.edu.hk,and duncan@cityu.edu.hk

that includesk − 1 other users to achievek-anonymity. This TTPmodel has three drawbacks. (a) All users have to continuouslyreport their exact location to the third party, even though theydo not subscribe to any LBS. (b) As the third party knows theexact location of every user, it becomes an attractive target forattackers. (c) Thek-anonymity-based techniques only achieve lowregional location privacy because cloaking a region to includekusers in practice usually results in small cloaking areas. (2) Privateinformation retrieval (PIR) or oblivious transfer (OT).AlthoughPIR or OT techniques do not require a third party, they incura much higher communication overhead between the user andthe service provider, requiring the transmission of much moreinformation than the user actually needs (e.g., [9]–[11]).

Only a few privacy-preserving techniques have been proposedfor continuousLBS [2], [7]. These techniques rely on a TTPto continuously expand a cloaked area to include the initiallyassignedk users. These techniques not only inherit the drawbacksof the TTP model, but they also have other limitations. (1)In-efficiency.Continuously expanding cloaked areas substantiallyincreases the query processing overhead. (2)Privacy leakage.Since the database server receives a set of consecutive cloakedareas of a user at different timestamps, the correlation among thecloaked areas would provide useful information for inferring theuser’s location. (3)Service termination.A user has to terminatethe service when users initially assigned to her cloaked area leavethe system.

In this paper, we propose a user-defined privacy grid systemcalleddynamic grid system(DGS) to provide privacy-preservingsnapshotandcontinuousLBS. The main idea is to place asemi-trustedthird party, termedquery server(QS), between the userand the service provider (SP ). QS only needs to be semi-trustedbecause it will not collect/store or even have access to any userlocation information.Semi-trustedin this context means that while

2

QS will try to determine the location of a user, it still correctlycarries out the simple matching operations required in the protocol,i.e., it does not modify or drop messages or create new messages.An untrustedQS would arbitrarily modify and drop messages aswell as inject fake messages, which is why our system dependsona semi-trustedQS.

The main idea of our DGS. In DGS, a querying user firstdetermines aquery area, where the user is comfortable to revealthe fact that she is somewhere within this query area. The queryarea is divided into equal-sized grid cells based on the dynamicgrid structure specified by the user. Then, the user encryptsaquery that includes the information of the query area and thedynamic grid structure, and encrypts the identity of each gridcell intersecting the required search area of the spatial query toproduce a set ofencrypted identifiers. Next, the user sends arequest including (1) the encrypted query and (2) the encryptedidentifiers toQS, which is a semi-trusted party located betweenthe user andSP . QS stores the encrypted identifiers and forwardsthe encrypted query toSP specified by the user.SP decrypts thequery and selects the POIs within the query area from its database.For each selected POI,SP encrypts its information, using thedynamic grid structure specified by the user to find a grid cellcovering the POI, and encrypts the cell identity to produce theencrypted identifier for that POI. The encrypted POIs with theircorresponding encrypted identifiers are returned toQS. QS storesthe set of encrypted POIs and only returns to the user a subsetofencrypted POIs whose corresponding identifiers match any one ofthe encrypted identifiers initially sent by the user. After the userreceives the encrypted POIs, she decrypts them to get their exactlocations and computes a query answer.

Because the user is continuously roaming she might needinformation about POIs located in other grid cells (within thequery area) that have not been requested fromQS before. The usertherefore simply sends the encrypted identifiers of the requiredgrid cells toQS. SinceQS previously stored the POIs withinthe query area together with their encrypted identifiers, itdoesnot need to enlistSP for help.QS simply returns the requiredPOIs whose encrypted identifiers match any one of the newlyrequired encrypted identifiers to the user. After the user receivedthe encrypted POIs fromQS, she can evaluate the query locally.When the user unregisters a query withQS, QS removes thestored encrypted POIs and their encrypted identifiers. In addition,when the required search area of a query intersects the spaceoutside the current query area, the user unregisters the query withQS and re-issues a new query with a new query area.

Contributions. Our DGS has the following key features:(1) No TTP.Our DGS only requires asemi-trustedquery server(QS) (i.e., trusted to correctly run the protocol) located betweenusers and service providers. (2)Secure location privacy.DGSensures thatQS and other users are unable to infer any infor-mation about a querying user’s location, and the service providerSP can only deduce that the user is somewhere within the user-specified query area, as long asQS and SP do not collude.(3) Low communication overhead.The communication cost ofDGS for the user does not depend on the user-specified queryarea size. It only depends on the number of POIs in the grid cellsoverlapping with a query’s required search area. (4)Extensibilityto various spatial queries.DGS is applicable to various types ofspatial queries without changing the algorithms carried out byQSor SP if their answers can be abstracted into spatial regions, e.g.,reverse-NN queries [12] and density queries [13].

1: Encrypted query +Encrypted cell identifiers

4: Encrypted POIsmatching the encrypted

cell identifiers

2: Encrypted query

3: Encrypted POIsMobileUser Query

ServerServiceProvider

Fig. 1. System architecture of our DGS

The rest of this paper is organized as follows. Section2presents the system model of our DGS. Section3 describes thequery processing algorithms designed for DGS. Section4 showsthat DGS is secure and preserves user location privacy. Section 5shows experimental results. Section6 highlights related work.Finally, Section7 concludes the paper.

2 SYSTEM ARCHITECTURE

Fig. 1 depicts the system architecture of our dynamic grid system(DGS) designed to provide privacy-preserving continuous LBS formobile users. Our system consists of three main entities,serviceproviders, query serversand mobile users. We will describe themain entities and their interactions, and then present the twospatial queries, i.e., range andk-nearest-neighbor (NN) queries,supported by our system.Service providers (SP ). Our system supports any number ofindependent service providers. EachSP is a spatial databasemanagement system that stores the location information of aparticular type ofstatic POIs, e.g., restaurants or hotels, or thestore location information of a particular company, e.g., Starbucksor McDonald’s. The spatial database uses an existing spatial index(e.g., R-tree or grid structure) to index POIs and answer rangequeries (i.e., retrieve the POIs located in a certain area).Asdepicted in Fig.1, SP does not communicate with mobile usersdirectly, but it provides services for them indirectly through thequery server (QS).Mobile users.Each mobile user is equipped with a GPS-enableddevice that determines the user’s location in the form(xu, yu).The user can obtain snapshot or continuous LBS from our systemby issuing a spatial query to a particularSP throughQS. Oursystem helps the user select a query area for the spatial query,such that the user is willing to reveal toSP the fact that the useris located in the given area. Then, a grid structure is created andis embedded inside an encrypted query that is forwarded toSP , itwill not reveal any information about the query area toQS itself.In addition, the communication cost for the user in DGS does notdepend on the query area size. This is one of the key featuresthat distinguishes DGS from the existing techniques based on thefully-trusted third party model.

When specifying the query area for a query, the user willtypically consider several factors. (1) The user specifies amini-mum privacy level, e.g., city level. For a snapshot spatial query,the query area would be the minimum bounding rectangle of thecity in which the user is located. If better privacy is required,the user can choose the state level as the minimum privacy level(or even larger, if desired). The size of the query area has noperformance implications whatsoever on the user, and a usercanfreely choose the query area to suit her own privacy requirements.For continuous spatial queries, the user again first choosesa queryarea representing the minimum privacy level required, but alsotakes into account possible movement within the time periodt for

3

the query (e.g., 30 minutes). If movement at the maximum legalspeed could lead the user outside of the minimum privacy levelquery area within the query timet, the user enlarges the queryarea correspondingly. This enlargement can be made generously,as a larger query area does not make the query more expensivefor the user, neither in terms of communication nor computationalcost. (2) The user can also generate a query area using a desiredk-anonymity level as a guideline. Using a table with populationdensities for different areas, a user can look-up the populationdensity of the current area, and use this to calculate the queryarea size such that the expected number of users within the queryarea correlates with the desiredk-anonymity level. Consideringthat this is an approximation for the correspondingk-anonymity,the resulting query area can be taken as a lower-bound and thefinal query area size calculated as the lower-bound times a safetymargin factor. The idea of using such density maps has been usedfor LBS [14] and health data [15]. (3) Alternatively, the user canspecify a query area based on how far she wants to travel, e.g., ifthe user wants to find restaurants within the downtown area, shesets the downtown area as the query area.

A larger query area does have an impact onQS andSP interms of workload and communication cost, but the bottleneckis considered to be between the user andQS, and the load onthis link and on the user does not depend on the query area size.A system parameter can be defined to limit the maximum queryarea size or number of objects returned to a user, in order to notoverload the client-side application.Query servers (QS). QS is a semi-trusted party placed betweenthe mobile user andSP . Similar to the most popular infrastructurein existing privacy-preserving techniques for LBS,QS can bemaintained by a telecom operator [16]. The control/data flows ofour DGS are as follows (Fig.1):

1) The mobile user sends a request that includes (a) the iden-tity of a user-specifiedSP , (b) anencrypted query(whichincludes information about the user-defined dynamic gridstructure), and (c) a set ofencrypted identifiers(whichare calculated based on the user-defined dynamic gridstructure) toQS.

2) QS stores the encrypted identifiers and forwards theencrypted query to the user-specifiedSP .

3) SP decrypts the query and finds a proper set of POIsfrom its database. It then encrypts the POIs and their cor-responding identifiers based on the dynamic grid structurespecified by the user and sends them toQS.

4) QS returns to the user every encrypted POI whoseencrypted identifier matches one of the encrypted iden-tifiers initially sent by the user. The user decrypts thereceived POIs to construct a candidate answer set, andthen performs a simple filtering process to prune falsepositives to compute an exact query answer.

We assume that there is a secure channel between the user andQS. This assumption is necessary asSP might be able to learn theuser’s location if it can eavesdrop on the communication betweenthe user andQS. The secure channel can easily be establishedusing standard techniques such as identity-based encryption [17],key exchange protocols (e.g. MQV [18]) or SSL/WTLS. We alsonote that the data privacy ofSP is protected with regards toQS,asQS only receives encrypted information about the POIs, andonly the client can decrypt the POIs.QS hence does not learn anyinformation about the POIs (e.g., name, address, ratings, etc.).

We additionally note that the work-load of theQS depends tosome extent on the query area chosen by a user, i.e., a large queryarea would lead to theSP sending a comparatively larger amountof data to theQS. If this is an issue, aQS could provide differenttiers of services, some of which could be paid, that would allow fordifferent privacy requirements of users (i.e., different maximumquery area sizes). Basic economical principles could be applied tomake this worthwhile both for users andQS service providers.Supported spatial queries.DGS supports the two most popularspatial queries, i.e., range andk-NN queries, while preserving theuser’s location privacy. The mobile user registers a continuousrange query with our system to keep track of the POIs withina user-specified distance,Range, of the user’s current location(xu, yu) for a certain time period, e.g., “Continuously send me therestaurants within one mile of my current location for the next onehour”. The mobile user can also issue a continuousk-NN query tofind thek-nearest POIs to the user’s current location(xu, yu) fora specific time period, e.g., “Continuously send me the five nearestrestaurants to my current location for the next 30 minutes”.

Since a snapshot query is just the initial answer of the contin-uous one, DGS also supports snapshot range andk-NN queries.Although we only focus on range andk-NN queries in this work,DGS is applicable to other continuous spatial queries if thequeryanswer can be abstracted into spatial regions. For example,oursystem can be extended to support reverse-NN queries [12] anddensity queries [13] because recent research efforts have shownthat the answer of these queries can be maintained by monitoringa region.

2.1 Adversarial Models

We now discuss adversarial models regardingQS andSP , andthen present the formal security proof of our DGS in Section4. AmaliciousQS orSP will try to break a user’s privacy by workingwith the data available to them within the described protocol. Wedo not considerQS orSP with access to external information notdirectly related to the protocol.

2.1.1 User Anonymity

As described above, bothQS andSP will try to de-anonymize auser by using the information contained in the protocol (althoughthey still faithfully follow the protocol itself). WhileQS does nothave any information about a user that would allow it to narrowdown the list of users that would fit a specific query,SP has accessto the plaintext query of a user. This query, however, only containsthe query region and the grid parameters, and with the informationavailable,QS can therefore do no better than establish that theuser is somewhere within the query region (see also Section4).

One other concern regarding the de-anonymization of users isthat if for example the services ofSP are paid services, thenSPmight for example be able to link a query with a billing recordandat least establish the presence of a user in a query area. While inthis paper we consider it acceptable that a user can be located to bewithin a query region byQS (after all, the user can freely choosethe query area and hence choose it such that her personal privacyrequirements are met), there is other research which would allowto prevent the linking of a query area to a specific user throughbilling records, for example the work by Yau and An [19]. Soeven if theSP requires the authentication of users to provide a(paid) service, the service can be provided while protecting theanonymity of the user. However, no matter in which way theSP

4

provides the service, the privacy guarantees will always bebetterthan TTP, as a TTP always knows the exact location of the users,while in our system neitherQS nor SP know the exact locationof a user. Regarding paid services andQS, in such a caseQS doesnot have any information to narrow down the geographic locationof a user, even if it is being used as a paid service and can linkqueries to billing records.

Regarding the de-anonymization of users, we also note thatthe type of POI in a query sent toSP or the density of POIs percell in the query area, do not provideQS with any meaningfulinformation that could be used to reduce the anonymity set ofa user. Specifically, there is no correlation between the densityof POIs in a cell and the actual location of a user, as the userlaunches a query without a-priori knowledge of the density ofPOIs, and hence the density of POIs in a cell cannot be used tomake deductions about the possible location of a user in the queryarea.

A natural choice for the role ofQS is the network serviceprovider of a user. Even though the network service providercantypically locate a user down to an individual cellular network cellalready, taking on the role ofQS does not provide it with anyadditional information about the user, such as the actual queryarea. There is also no requirement for the queries of a user tocorrespond to the user’s actual location, and the network serviceprovider does not have any information available that wouldallowit to infer either case. To summarize, a network service provideralready knows the location of its users, and serving as aQS doesnot provide it with any additional information about its users.Alternatively,QS services could also be provided by volunteers(e.g., like many of the nodes in the Tor network), by ad-supportedservices, or even by services that charge a modest fee.

2.1.2 Other AttacksIn this subsection we discuss a few other attacks and explainhowthey relate to our proposed system.IP localization. One possible attack involvesQS trying to de-termine the position of a user through IP localization (i.e., usinga database which can map IP addresses to locations). Becauseof how mobile phone networks are setup (considering that oursystem is aimed at mobile users using mobile phone networks),however, mobile phones cannot be located with useful accuracy,as shown by Balakrishnan et al. [20]. Even so, if IP localization is aconcern, solutions at the network level can hide the originating IP,for example by using an anonymizing software such as Tor [21].Timing attacks. Another set of attacks might use timing infor-mation ifQS can observe the traffic close to the originating user.However, ifQS can observe such traffic, the location privacy ofthe user is very likely already compromised, even without timingattacks. Furthermore, we consider this to be out of the scopeofour work.Query server as client.QS might try to also act as a client in anattempt to gain some information which could help to localize auser.QS has no information to launch such an attack, however, noteven an approximate location of the user. Also, the number ofPOIsreturned to a client does not allowQS to make any inferences,because it knows neither the query area nor the grid parameters. Alarge number of POIs could either mean a dense region or a largequery area, depending on the grid parameters, which are unknownto QS.Network traffic fingerprinting. An attack as described by Bissiaset al. [22] which makes inferences based on the statistics of

(xb,yb)

0

0

1

1

2

2

3

3

(xu,yu)

(xt,yt)

Range

x

y

(a) Dynamic grid structure

(xb,yb)

0

0

1

1

2

2

3

3

(xu,yu)

(xt,yt)

p1p2

p4 p6

p7

x

y

(b) Answer computation

Fig. 2. Example of range query processing in DGS

encrypted network connections is not applicable to our system.The attack as described in the paper is equivalent to determiningwhich QS a user is using. This information does not need tobe secret and communication withQS is highly uniform acrossdifferent query servers (unlike website traffic), very likely makingthem for all practical purposes indistinguishable.Commuter problem. Another attack that can identify the homeand the office location of a user through location traces is de-scribed by Golle et al. [23]. This attack is not applicable to oursystem, because no plaintext locations are ever transmitted in oursystem and no inferences can be made.

We exclude side-channel attacks in general from the securityanalysis as being out of the scope of this paper. Many of theside-channel attacks mentioned above are fundamental to networkcommunications, and as such neither limited to nor a consequenceof the design of our proposed protocol.

3 DYNAMIC GRID SYSTEM (DGS)In this section, we will describe how our DGS supports privacy-preserving continuous range andk-NN queries. This section isorganized as follows: Section3.1 describes the details of ourDGS for processing continuous range queries and incrementallymaintaining their answers, and Section3.2extends DGS to supportk-NN queries.

3.1 Range Queries

Our DGS has two main phases for privacy-preserving continuousrange query processing. The first phase finds an initial (or asnapshot) answer for a range query (Section3.1.1), and the secondphase incrementally maintains the query answer based on theuser’s location updates (Section3.1.2).

3.1.1 Range Query ProcessingAs described in Section2, a continuous range query is defined askeeping track of the POIs within a user-specified distanceRangeof the user’s current location(xu, yu) for a certain time period.In general, the privacy-preserving range query processingprotocolhas six main steps.Step 1. Dynamic grid structure (by the user).The idea of thisstep is to construct a dynamic grid structure specified by theuser.A querying user first specifies a query area, where the user iscomfortable to reveal the fact that she is located somewherewithinthat query area. The query area is assumed to be a rectangulararea,represented by the coordinates of its bottom-left vertex(xb, yb)and top-right vertex(xt, yt). Notice that the user is not necessarily

5

required to be at the center of the query area. Instead, its locationcan be anywhere in the area. However, our system can also supportirregular spatial regions, e.g., the boundary of a city or a county,by using a minimum bounding rectangle to model the irregularspatial region as a rectangular area. The query area is dividedinto m × m equal-sized grid cells to construct a dynamic gridstructure, wherem is a user-specified parameter. Each grid cellis identified by(c, r), wherec is the column index from left toright andr is the row index from bottom to top, respectively, with0 ≤ c, r < m. Given the coordinates of the bottom-left vertexof a grid cell,(xc, yc), the grid cell identity can be computed by

(c, r) =(⌊

xc−xb

(xt−xb)/m

⌋

,⌊

yc−yb

(yt−yb)/m

⌋)

. Fig. 2 gives a runningexample for privacy-preserving range query processing, where thequerying user is located in the cell(2, 1), m = 4, and the circlewith a radius of the range distanceRange specified by the userconstitutes the query region of the range query.Step 2. Request generation (by the user).In this step, thequerying user generates a request that includes (1) a query fora SP specified by the querying user and (2) a set of encryptedidentifiers,Se, for a QS. The user first selects a random keyKand derives three distinct keys:

(HK,EK,MK)← KDF(K) (1)

whereKDF(·) is a key derivation function ( [24]). Then, the usersets query andSe as follows:

(1) Query generation.An encrypted query for a specificSPis prepared as:

query← IBE.EncSP (POI-type,K,m, (xb, yb), (xt, yt)) (2)

where IBE.EncSP (·) is Identity-Based Encryption (IBE) underthe identity ofSP (details of IBE are in [17]). In the encryptedquery, POI-type specifies the type of POIs,K is the random keyselected by the user, and the personalized dynamic grid structureis specified bym, (xb, yb), and(xt, yt).

(2) Encrypted identifier generation.Given the query regionof the range query, the user selects a set of grid cellsSc in thedynamic grid structure that intersect the query region, i.e., a circlecentered at the user’s current location(xu, yu) with a radius ofRange. For each selected grid celli in Sc, its identity(ci, ri) isencrypted to generate an encrypted identifier:

hi ← H(ci, ri) (3)

Ci ← SE.EncHK(hi) (4)

where H(·) is a collision-resistant hash function andSE.Enckey(·) a symmetric encryption algorithm (for exampleAES-based) under keykey. After encrypting all the grid cellsin Sc, the user generates a set of encrypted identifiersSe. It isimportant to note that the user will make sure that the identifiersin Se are ordered randomly. Finally, the user produces a requestas below and sends it toQS:

request← 〈SP, query, Se〉 (5)

In the running example (Fig.2a), the range query region, whichis represented by a circle, intersects six grid cells, i.e.,(1, 0),(2, 0), (1, 1), (2, 1), (1, 2), and (2, 2) (represented by shadedcells), which make up the set of grid cellsSc, and thus, the userhas to encrypt each identity of these grid cells and produce sixencrypted identifiers inSe.Step 3. Request processing (byQS). WhenQS receives therequest from the user, it simply stores the set of encrypted

identifiersSe and forwards the encrypted query toSP specifiedby the user.Step 4. Query processing (bySP ). SP decrypts the request toretrieve the POI-type, the random keyK selected by the user inthe request generation step (Step 2), and the query area definedby m, (xb, yb), and (xt, yt). SP then selects a set ofnp POIsthat match the required POI-type within the user specified queryarea from its database. For each selected POIj with a location(xj , yj)) (1 ≤ j ≤ np), SP computes the identity of the gridcell in the user specified dynamic grid structure coveringj by(cj , rj) =

(⌊

xj−xb

(xt−xb)/m

⌋

,⌊

yj−yb

(yt−yb)/m

⌋)

.

Then,SP generates(HK,EK,MK) ← KDF(K) and com-putes the following:

hj ← H(cj , rj) (6)

Cj ← SE.EncHK(hj) (7)

lj ← SE.EncEK(xj , yj) (8)

σj = MACMK(Cj , lj) (9)

whereMACkey(·) is a message authentication code under keykey. TheCj is the corresponding encrypted identifier of a POI,the lj contains the exact location of a POI in encrypted form,and theσj is included to prevent certain attacks byQS (such astampering with the encrypted POIs).

Finally, SP sends the set of selected POIs back toQS in thefollowing form:

〈POIj = (Cj , lj , σj)〉, wherej = 1, . . . , np. (10)

Step 5. Encrypted identifier matching (byQS). Upon receivingnp triples,QS determines the set of matching POIs by comparingthe encrypted identifiersCj (1 ≤ j ≤ np) of the received POIwith the set of encrypted identifiersSe previously received fromthe user. A match between aCj and someCi in the setSe

indicates that the POIj is in one of the grid cells required by theuser. Thus,QS forwards every matching POI〈lj , σj〉 to the user.If the query is a snapshot query,QS then deletes the receivedPOIs and their encrypted identifiers. However, if the query is acontinuous one,QS keeps the received POIs along with theirencrypted identifiers until the user unregisters the query.Step 6. Answer computation (by the user).Suppose that thereare µ matched POIs received by the user. For each of thesematched POIs, say〈lj , σj〉, the user decryptslj usingEK andgets access to the exact location(xj , yj) of the POI. From(xj , yj)andlj, the user verifiesσj by re-calculating theMAC value andcompares it againstσj . If they match, the user finds the answer thatincludes the POI whose location is within a distance ofRangeof the user’s current position(xu, yu). In the running example(Fig. 2b), the user receives five POIs fromQS, where the rangequery answer includes two POIs, i.e.,p4 andp6.

3.1.2 Incremental Range Query Answer Maintenance

After the user gets the initial response for a range query fromQS, she can find the initial (or snapshot) query answer locally.Then, incremental answer updates can be performed to maintainthe answer when the user’s location changes. This phase has fourmain steps.Step 1. Cache region (by the user).The user keeps track of thegrid cells previously requested and caches the POIs returned byQS for those cells. These cells define acache region. The useris able to find a query answer from the cached POIs as long as

6

(xb,yb)

0

0

1

1

2

2

3

3

(xu,yu)

(xt,yt)

Cache Region

p1p2

p4 p6

p7

x

y

(a) Cache region

(xb,yb)

0

0

1

1

2

2

3

3

(xu,yu)

(xt,yt)

p1p2

p4 p6

p7

p8

p10

x

y

(b) Answer refinement

Fig. 3. Example of incremental range query maintenance

the query region (i.e., a circular area centered at the user’s currentlocation(xu, yu) with a radius of range distanceRange specifiedby the user) is contained within the cache region. However, whenthe query region intersects some grid cells (within the query area)outside the cache region, the user executes the following steps(Steps 2 to 4) to enlistQS for help to find a query answer.

Fig. 3 depicts a running example for the incremental rangequery answer maintenance phase, where the user has requested thePOIs within six grid cells, as illustrated in Fig.2. The combinedarea of these six grid cells constitutes the cache region, representedby a bold rectangle. As shown in Fig.3a, the query region of therange query intersects two grid cells outside the cache region, i.e.,(3, 1) and(3, 2) (represented by shaded cells), so the user has toexecute Steps 2 to 4 to get the POIs within these two grid cellsfrom QS.Step 2. Incremental request generation (by the user).Thisstep is similar to the request generation step (Step 2) in therangequery processing phase (Section3.1.1), except that the user onlygenerates encrypted identifiers for the set of grid cellsSc thatintersect the query region but are outside of the cache region,i.e., that have not been requested by the user before. For eachgrid cell in Sc, its identity is encrypted to generate an encryptedidentifier Ci using Equations3 and 4. Then, an answer updaterequest including the set of encrypted identifiersSe is sent toQS. In the running example (Fig.3a), the user has to get thePOIs within the two grid cells(3, 1) and (3, 2) to evaluate therange query, so she encrypts their cell identities to generate twoencrypted identifiers inSe, and sends an update request along withSe to QS.

There is the possibility that a small amount of informationabout the movement of a user is leaked if the user only requeststhe cells outside the cache region. For example, if a user requestssix cells in an initial request, and then two cells in an answerupdate request a short while later, an adversary (e.g.,QS) mightbe able to infer information about the movements of the user.If this is a concern, a user can pad the number of encryptedidentifiers in an answer update request to obtain the same numberof encrypted identifiers as in the initial request by generatingencrypted identifiers for additional grid cells, which havenot beenrequested by the user before and are around the grid cells inSc.In this way, the adversary cannot distinguish between the “actual”encrypted identifiers and the “additional” encrypted identifiers.Step 3. Request processing (byQS). BecauseQS alreadycached the POIs along with their encrypted identifiers within theuser-specified query area from the initial request, it does not need

to contactSP to deal with the answer update request. Instead,similar to the encrypted identifier matching step (Step 5) intherange query processing phase,QS simply returns the POIs whoseencrypted identifier matches one of the encrypted identifiers inSe

in the answer update request sent by the user.Step 4. Answer computation (by the user).This step is similar tothe answer computation step (Step 6) in the range query processingphase, except that the user evaluates the query based on boththe POIs newly returned byQS and the previously cached POIs.Fig. 3b depicts that the user gets two new POIs,p8 andp10, fromQS, and the new query answer includes POIsp6 andp8.

3.2 K-Nearest-Neighbor Queries

Similar to continuous range queries, the privacy-preserving queryprocessing for continuousk-NN queries has two main phases. Thefirst phase finds an initial (or snapshot) answer (Section3.2.1),while the second phase maintains the correct answer when theusermoves by using incremental updates (Section3.2.2). However,unlike range queries, the required search area of ak-NN query isunknown to a user until the user finds at leastk POIs to computea required search area, i.e., a circular area centered at theuser’slocation with a radius from the user to thek-th nearest POI. Thus,the privacy-preserving query processing protocol ofk-NN queriesis slightly different.

3.2.1 K-Nearest-Neighbor Query ProcessingA continuousk-NN query is defined as keeping track of thek-nearest POIs to a user’s current location(xu, yu) for a certaintime period, as presented in Section2. In general, the privacy-preservingk-NN query processing has six major steps to findan initial (or snapshot) query answer. Fig.4 depicts a runningexample of the privacy-preserving query processing of ak-NNquery, wherek = 3.Step 1. Dynamic grid structure (by the user).This step is thesame as the dynamic grid structure step (Step 1) in the rangequery processing phase (Section3.1.1). It takes a user-specifiedquery area with a left-bottom vertex(xb, yb) and a right-top vertex(xt, yt) and divides the query area intom×m equal-sized cells,as illustrated in Fig.4a (m = 6).Step 2. Request generation (by the user).The required searcharea of thek-NN query is initially unknown to the user. Theuser first finds at leastk POIs to compute the required searcharea as a circular area centered at the user’s location with aradius of a distance from the user to thek-th nearest known POI.The user therefore first attempts to get the nearby POIs from aspecificSP . In this step, the user requests the POIs in the cellcontaining the user and its neighboring cells fromSP . Giventhe user’s current location(xu, yu) and a query area specifiedby the user in Step 1, she wants to get the POIs within a setof grid cells Sc that includes the cell containing herself, i.e.,(cu, ru) =

(⌊

xu−xb

(xt−xb)/m

⌋

,⌊

yu−yb

(yt−yb)/m

⌋)

, and its at most eight

neighboring cells(cu− 1, ru− 1), (cu, ru− 1), (cu+1, ru− 1),(cu − 1, ru), (cu + 1, ru), (cu − 1, ru + 1), (cu, ru + 1), and(cu + 1, ru + 1). For each celli in Sc, the user generates anencrypted identifierCi using Equations3 and4, as in the requestgeneration step (Step 2) in the range query processing phase. Theuser also creates a query to be sent toSP based on Equation2.Finally, the user sends a request, which includes the identity ofSP , the query, and the set of encrypted identifiers (in randomorder)Se, as given in Equation5, toQS.

7

(xb,yb)

(xu,yu)

(xt,yt)

0

0

1

1

2

2

3

3

4

4

5

5x

y

(a) Dynamic grid structure

(xb,yb)

(xu,yu)

(xt,yt)

p1

p2

0

0

1

1

2

2

3

3

4

4

5

5x

y

(b) Incremental search

(xb,yb)

(xu,yu)

(xt,yt)

p1

p2

p3

0

0

1

1

2

2

3

3

4

4

5

5x

y

(c) Required search area

(xb,yb)

(xu,yu)

(xt,yt)

p1

p2

p3

p4

0

0

1

1

2

2

3

3

4

4

5

5x

y

(d) Answer refinement

Fig. 4. Example of k-nearest-neighbor query processing in DGS

In the running example (Fig.4a), the user located in the gridcell (3, 3) and therefore requests the POIs in the cells(3, 3) andits neighboring grid cells, i.e.,(2, 2), (3, 2), (4, 2), (2, 3), (4, 3),(2, 4), (3, 4), and(4, 4), (represented by shaded cells) fromSPthroughQS.Step 3. Request processing (byQS). This step is identical toStep 3 for range queries in the query processing phase (Sec-tion 3.1.1).Step 4. Query processing (bySP ). This step is identical to Step 4for range queries in the query processing phase (Section3.1.1).Thanks to this query abstraction feature, our DGS can be easilyextended to support other continuous spatial query types, e.g.,reverse NN queries and density queries.Step 5. Required search area (by the user andQS). This step issimilar to the encrypted identifier matching step (Step 5) for rangequeries in the query processing phase (Section3.1.1), with thedifference that this step may involve several rounds of interactionbetween the user andQS.QS matches the encrypted identifiers ofthe encrypted POIs returned bySP with the encrypted identifiersin Se sent by the user in Step 2, and sends the matching encryptedPOIs to the user.

If at leastk encrypted POIs are returned to the user, she candecrypt them to compute a required search area for thek-NNquery in the form of a circle centered at the user’s location with aradius of the distance between the user and thek-th nearest POI.On the other hand, if less thank POIs are returned, the user startsthe next iteration by requesting the grid cells fromQS one hopfurther away from the position of the user, i.e., the neighboringcells of the grid cells that have already been requested by theuser. This incremental search process is repeated (i.e., requestingmore cells moving steadily outward from the user’s position) untilthe user has obtained at leastk POIs fromQS. After the userdetermines the required search area, there are two possibilities:

1) The user has already requested all the cells which in-tersect the required search area. In this case, the userproceeds to the next step.

2) The required search area intersects some cells which havenot yet been requested fromQS. The (at least)k POIsfound so far may in that case not be an exact answer, andthe user requests those cells fromQS which intersectthe required search area but have not been requested yet(in Fig. 4c these would be the shaded cells outside thebold rectangle). After receiving all encrypted POIs in thenewly requested cells fromQS, the user proceeds to thenext step.

In the running example, Fig.4b depicts that the grid cells initiallyrequested by the user (within the bold rectangle) contains less thanthree POIs. The user therefore requests the neighboring grid cells(the grid cells adjacent to the bold rectangle) fromQS. This willresult in discovering three POIs in total, i.e.,p1, p2, andp3. Theuser then computes the required search area represented by acircle(Fig. 4c). As the required search area intersects eight cells whichthe user has not yet requested fromQS (i.e., they are outside thebold rectangle), the user will launch another request for the gridcells(0, 1), (0, 2), (0, 3), (0, 4), (1, 0), (2, 0), (3, 0), and(4, 0).Step 6. Answer refinement (by the user).Having received all thePOIs within all the grid cells intersecting the required search area,the user can decrypt them to get their exact locations, as in theanswer computation step (Step 6) for range queries in the queryprocessing phase (Section3.1.1), and determine the exact answerby selecting thek nearest POIs. The previous steps ensure thatthesek POIs are indeed the closest ones. In the running example(Fig. 4d), the user can find the exact answer for the3-NN query,which includes three POIsp1, p2, andp4.

3.2.2 Incremental k-NN Query Answer Maintenance

After the user computes an initial (or snapshot)k-NN queryanswer, the incremental answer update phase allows to maintainthe answer as the user moves around. Similar to range queries,the incremental answer maintenance phase has four steps. Thefirst two steps are the same as the cache region step and theincremental request generation step as in Section3.1.2. In thethird step (i.e., request processing) performed by theQS, sinceQS has already cached the encrypted POIs, together with theircorresponding encrypted identifiers calculated bySP in Step 4of the query processing phase, it does not need to contactSP .It can simply forward the encrypted POIs matching one of theencrypted identifiers inSe to the user. In the last step (i.e., answerrefinement) performed by the user, she decrypts the receivedPOIs and sorts the ones located within the required search areaaccording to their distance to the user in ascending order. Thek-nearest POIs to the user constitute the new query answer.

4 SECURITY ANALYSIS

In this section, we define several security models which formalizethe location privacy of our DGS, and show that the proposedschemes in Section3 are secure. In our schemes, the query server(QS) sees a user’s encrypted queries and POIs from a serviceprovider (SP ). Since the user query and returned POI locationsare encrypted,QS could only learn the user’s location from

8

the number of returned POIs rather than the encrypted values.However, this is not the case in our scheme. The number of POIsreturned bySP depends on the query area size, which is encryptedand unknown, and therefore,QS is not able to derive any usefulinformation from the number of POIs, e.g., whether the user is ina dense or sparse region. See Lemma2 for the detailed analysis.

After decrypting the query forwarded byQS, a SP obtainsthe query area which contains the user. Other than this, it learnsnothing, since the user could be anywhere in the area. See Lemma1 for the proof. Regarding the integrity, every encrypted POIisauthenticated bySP using a MAC and the authentication key isonly shared between the user andSP . Guaranteed by the securityof the MAC,QS is unable to modify the information of any POIreturned to the user, nor to add a “fake” POI. See Lemma3 for theproof. As shown in Fig.1 (Section2) there are four message flowsin a basic query in our DGS. We denote them byMsg1 (from theuser toQS), Msg2 (from QS to SP ), Msg3 (from SP to QS)andMsg4 (from QS to the user), respectively. In the followingsubsections we analyze the security of our scheme in detail.

4.1 Privacy Against Service Provider (SP )

We require thatSP cannot learn the user’s location any better thanmaking a random guess. Formally, we consider the following gameplayed between a challengerC and a (malicious)SP , denoted byA.

The challenger prepares the system parameters, and gives themto A. A specifies a POI-type, the grid structure, a query area andtwo locations(x0, y0) and(x1, y1) in this area, and gives them toC. C chooses at randomb ∈ {0, 1}, uses(xb, yb), the specifiedgrid structure and POI-type to generateMsgb2 with respect to theidentity ofA, i.e., the message that the maliciousSP expects toreceive.C then givesMsgb2 toA. A outputs a bitb′ and wins thegame ifb′ = b.

Definition 1. A DGS achievesPrivacy Against Service Provider(SP ) if for any SP , its success probability of winning the gameabove is at most1/2 + negl(ℓ), wherenegl(·) is a negligiblefunction1 in the security parameter.

Lemma 1. Our DGS achieves Privacy AgainstSP .

Proof. The message thatSP receives fromQS isMsg2 = query,which is an IBE of POI-type,K, the query area and grid structureunder SP ’s identity (see Equation2), and is independent ofthe user’s location. Hence a (malicious)SP does not gain anyadvantage in guessingb chosen by the challenger.

4.2 Privacy Against Query Server (QS)

This requires thatQS cannot tell from the user’s request orSP ’stranscript about where the user is, provided that it does notcolludewith the intendedSP . Formally, we consider the following gameplayed between an adversaryA (which is the dishonestQS) and achallengerC which acts the roles of the user and service providers.

Given the system parameters,A begins to issuePrivate KeyQuery for polynomially many times: it submits the identity ofa SP to C, and receives the corresponding private key. Thismodels the case thatQS colludes with a (non-intended)SP . Athen specifies the POI-type, the identity of the intendedSP (the

1. A function f : N → [0, 1] is negligible if for all positive polynomialpoly(·) there exists anN such that for alln > N , f(n) < 1/poly(n).

private key of which has not been queried), the grid structure, aquery area, and two user locations(x0, y0) and (x1, y1) in thequery area, and gives them toC. C tosses a coinb ∈ {0, 1}, anduses(xb, yb) and the other information specified byA to generateMsgb1 as the user’s message toQS, and the correspondingSPmessageMsgb3. It sends bothMsgb1 andMsgb3 toA. A continuesto issue queries as above except that it cannot ask for the privatekey of the intendedSP . Finally,A outputs a bitb′ as its guess ofb, and wins the game ifb′ = b.

Definition 2. A DGS achievesPrivacy Against Query Server(QS) if for all probabilistic polynomial-timeA, its probability ofwinning the above game is negligibly close to1/2.

Lemma 2. Our DGS achieves Privacy AgainstQS.

Proof. We prove the lemma by a series of games,G0, · · · ,Gi,and denote byXi the event thatA wins gameGi. G0: Thisis the original game defined in Definition2. Given the systemparameters,A begins to issue private key queries. At some point,it chooses a POI-type, the identity of the intendedSP , the gridstructure, a query area and two user locations(x0, y0), (x1, y1)in the query area, and sends them to the challenger, which selects(xb, yb) for some random bitb to generate the user messageMsgb1and the correspondingSP messageMsgb3, and returns them toA.The adversary continues to issue private key queries as beforeexcept to ask for the private key of the intendedSP . Finally,Aoutputs a bitb′ and wins the game ifb′ = b. Notice that there existtwo ranges, e.g.,R0 andR1, such that the grids intersected withthe circles with rangesR0 andR1, and centered at(x0, y0) and(x1, y1) respectively, contain the same number of POIs. Besides,the ranges are chosen by the users, and thus are unknown to theadversary.G1: We change the generation of(HK,EK,MK). Now werandomly select them from the spaceKH×KE×KM . Guaranteedby the security ofKDF, we have that|Pr[X1] − Pr[X0]| isnegligible [25], [26].G2: We change the generation ofli in Msgb1. Instead of theencryption of the real location, nowli is the encryption of arandom location (other than(x0, y0) and(x1, y1)) under the keyEK. Guaranteed by the semantic security ofSE, we have that|Pr[X2]− Pr[X1]| is negligible [25], [26].G3: Similar toG2, we change all theCi’s in Msgb1 and all theCi’s in Msgb3 to be the encryptions of randomly selectedhi’s,under the constraint that all POIs in the same grid cell sharethesamehi with the grid cell itself. The semantic security ofSEimplies that|Pr[X3]− Pr[X2]| is negligible.G4: We change request in the client message to the encryption ofa random tuple with the same length. The security of IBE impliesthat |Pr[X4]−Pr[X3]| is negligible [17]. In G4, bothMsgb1 andMsgb3 are independent ofb chosen by the challenger. Therefore,Acould succeed in outputting the correct bit with probability at most1/2, and we have|Pr[X0]− 1

2 | ≤∑3

i=0 |Pr[Xi+1]−Pr[Xi]|+|Pr[X4]− 1

2 | which is negligible.

4.3 Integrity

This is to ensure thatQS cannot modify any messages returnedby SP or add any messages without being detected. Formally, weconsider the following game, where the adversaryA is aQS, andthe challengerC plays the roles of the client and all the serviceproviders.

9

Given the system parameters,A adaptively issues the fol-lowing queries for polynomially number of times:Private KeyQuery: A submits the identity of aSP , and is returned thecorresponding private key.Service Query: A generates a usermessageMsg1 and sends it toSP indicated inMsg1. It thenreceives the answerMsg3. A then submits the POI-type, theidentity of the intendedSP (the private key of which has not beenqueried), the grid structure, a query area, and a user’s location(x, y). C generates the user’s messageMsg∗1, and the intendedSP ’s messageMsg∗3, and sends them toA. Finally, A outputsMsg∗4. Let Msg4 be the correct answer that an honestQS wouldreturn to the user.A wins the game ifMsg∗4 6⊆ Msg4 but the useracceptsMsg∗4.

Definition 3. A DGS achievesintegrity if there is no probabilisticpolynomial-time adversaryA which wins the above game withnon-negligible probability.

Lemma 3. Our DGS achieves integrity.

Proof. Again, we useXi to denote the event thatA wins the gameGi. G0 is the original game described above.G1: We change the generation ofMsg∗1 andMsg∗3. Instead ofbeing output byKDF on input a randomK, MK is now selectedat random fromKM . It is also used in the verification of theadversary’s final output, i.e., checking the validity of theMACs inMsg∗4. The security ofKDF implies that|Pr[X1] − Pr[X0]| isnegligible. Below we show that the adversary wins this game onlywith negligible probability.We useA to construct an algorithmB which breaks the strongunforgeability of MAC [25], [26]. Given oracle access toOM , Bgenerates system parameters which include the IBE key. It theninvokesA on input the system parameters, and begins to answerA’s queries as following.Private Key Query: Given the identityof aSP ,B uses the IBE key to generate the private key ofSP , andreturns it toA. Service Query: Given a client messageMsg1 =〈SP, request, Se〉, B uses the private key ofSP (which can becomputed from the IBE key) to decrypt request and obtains POI-type,K, m, (xb, yb) and(xt, yt). It then follows the prescribedstrategy of aSP to generateMsg3, and returns it toA.

WhenMsg3 is ready,A outputs the identity of an intendedSP , the private key of which has not been queried.A also outputsPOI-type, the grid structure, a query region and a user’s location(x, y). B then generatesMsg∗1 using the information given byAand alsoMsg∗3 as follows:

For all the POIs,B computesCi and li using keys derivedfrom K which is embedded inUMsg∗. It then sends(Ci, li) tothe oracleOM and is returnedσi = MACMK(Ci, li).B returns bothMsg∗1 andMsg∗3 to A, which finally outputs

Msg∗4 = {(Ci, li, σi)}. Assume thatA wins its game. We havethat the user acceptsMsg∗4, and thus all theσi’s are valid MACtags on(Ci, li)’s, and thatMsg∗4 is not a subset of the messageMsg4 that an honestQS would return to the user. Then theremust exist some tuple(Cj , lj , σj) ∈ Msg∗4 which is differentfrom all the tuples contained inMsg∗3. B outputs((Cj , lj), σj) asits forgery of the MAC scheme. It is readily seen thatB’s outputis valid, sinceB did not ask its oracleOM to produce a MAC tagσj on the message(Cj , lj). Therefore, the security of the MACscheme is broken; hence, we havePr[X0] ≤ |Pr[X1]−Pr[X0]|+Pr[X1] which is negligible.

Com

puta

tion

Tim

e [m

s]

0

5

10

15

20

25

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

5 50 500 5000 50000Number of POIs

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

5 50 500 5000 50000

1

10

100

1000

10000

100000

1000000

Number of POIs

Service ProviderClient

(b) Communication Cost

Fig. 5. Number of POIs (NN queries).

5 EXPERIMENTAL RESULTS

In this section, we evaluate the performance of our DGS for bothcontinuous range andk-NN queries through simulations.Baseline algorithm.We implemented a continuous spatial cloak-ing scheme using thefully-trusted third party model(TTP) [2].TTP relies on a fully-trusted location anonymizer, which isplacedbetween the user and the service provider (SP ), to blur a queryinguser’s location into a cloaked area that contains the querying userand a set ofK − 1 other users to satisfy the user specifiedK-anonymity privacy requirement. To preserve the user’s continuouslocation privacy, the location anonymizer keeps adjustingthecloaked area to contain the querying user and theK − 1 users.A privacy-aware query processor atSP returns a set of candidatePOIs to the querying user through the location anonymizer [6],[27]. Then, the querying user computes an exact query answerfrom the candidate POIs. We compare our DGS with the TTPscheme for both continuous range andk-NN queries.

We chose TTP as the baseline algorithm to compare against,as it is architecturally most similar to our DGS approach inthat both systems require third-party servers to perform the maincomputation of the respective algorithm (although DGS onlyrequires a semi-trusted third party). Other approaches such asprivate information retrieval (PIR) or oblivious transfer(OT) arefundamentally different and put a much higher burden in terms ofcomplexity of the computation on the user’s side. They typicallyalso compare unfavorably against TTP and our DGS in termsof communication bandwidth required (an important attribute inmobile environments), making the comparison between TTP andDGS the most equivalent one.Simulated experiment. Our DGS and the TTPscheme are implemented in C++. For the cryp-tographic functions we use the OpenSSL library(http://www.openssl.org), GMP (http://www.gmplib.org) and PBC(http://crypto.stanford.edu/pbc/) for the IBE. In all experiments,we generate a set of moving objects on the real road map ofHennepin County, Minnesota, USA [28] with a total area of1,571 km2. Mobile users are initially distributed among the roadsegments in the road map proportional to the length of the roads,and then move along the roads at speeds of30 − 70 miles perhour. The experiments were run on a 64-bit machine with a2.4GHz Intel CPU and 4GB RAM.Performance metrics.We measure the performance of our DGSand the TTP scheme in terms of the average computation time perquery on the client side, at the query server (QS) (or the locationanonymizer for the TTP scheme), and atSP . We also measure theaverage communication cost per query between the user andQS,as well as the communication cost betweenQS andSP .Parameter settings.Unless mentioned otherwise, the experimentconsiders 20,000 mobile users and 10,000 POIs. The default query

10C

ompu

tatio

n T

ime

[ms]

0.00.20.40.60.81.01.21.41.6

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

5 50 500 5000 50000Number of POIs

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

1

10

100

1000

10000

100000

1000000

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

5 50 500 5000 50000Number of POIs

Service ProviderClient

(b) Communication Cost

Fig. 6. Number of POIs (range queries).

Com

puta

tion

Tim

e [m

s]

0

2

4

6

8

10

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

10 20 30 40 50Number of Users (thousands)

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

05

1015202530

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

10 20 30 40 50Number of Users (thousands)

Service ProviderClient

(b) Communication Cost

Fig. 7. Number of mobile users (NN queries).

distance for range queries is 2km, and the default requestednum-ber of POIs fork-NN queries isk = 10. Since our DGS providesmore secure continuous location privacy than the TTP scheme, weonly consider a moderately highK-anonymity level for the TTPscheme, whereK = 200 [2], to give a fair comparison.Grid system. The grid system is created by laying a grid overa query area that is defined by its 4 corners. The grid dividesthe query area into non-overlapping, equal-sized cells (intermsof latitude/longitude). While the grid system does not require aspecific coordinate system, for convenience we use WGS84 in ourprototype. WGS84 is the coordinate system used for the GlobalPositioning System (GPS), and hence most easily applicabletomobile devices that contain a GPS receiver.Points of interest.The POIs are generated randomly, by placingthem onto vertices of the road map used in the experiment. Forexample, to generate 10,000 POIs, the prototype randomly picksa vertex of the road map as the location of a POI, repeating this10,000 times.

5.1 Comparison of DGS with TTP

Although DGS and TTP have architectural similarities, DGSprovides better location privacy and privacy guarantees than TTPfor the two reasons: (1) In a TTP system, the user is onlyK-anonymous, i.e., the user can be identified to be one ofK users, butwithout being able to determine the exact user. In DGS, however,QS has no information at all to narrow down the anonymity set,while SP can only narrow the anonymity set down to the queryarea, but the query area can be chosen arbitrarily large by the userwithout negative performance impacts. Furthermore, TTP requiresthe cloaking area to expand as the user moves around, while inDGS the query area can stay fixed without an impact on theanonymity of the user. (2) The trusted third party in TTP needs tobe fully trusted because it has access to all locations of allusers inthe system. In DGS, however, neitherSP norQS need to be fullytrusted, as neither of them ever has access to the exact location ofa user.

Com

puta

tion

Tim

e [m

s]

0.0

0.2

0.4

0.6

0.8

1.0

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

10 20 30 40 50Number of Users (thousands)

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

0

5

10

15

20

25

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

10 20 30 40 50Number of Users (thousands)

Service ProviderClient

(b) Communication Cost

Fig. 8. Number of mobile users (range queries).

In DGS, no entity has access to the exact location of users andthe user’s anonymity is not defined by aK value but by the queryarea, which can be chosen suitably large, so DGS provides betterprivacy guarantees than TTP. To achieve the same level of privacywith TTP compared to DGS, theK parameter in TTP would haveto be chosen to correspond to the number of users present in thewhole query area of DGS. However, the query area of DGS istypically chosen on a city-level, resulting in a largeK value, e.g.,tens of thousands of users. In TTP, however,K values are typicallychosen in the lower hundreds, e.g., 200 [2]. This shows that DGSwill by default provide much better privacy than TTP.

5.2 Number of POIs

Fig.5 shows the performance of our DGS and TTP for NN querieswhen varying the number of POIs several orders of magnitudefrom 5 to 50,000. The results show that DGS outperforms TTP(for a system with 50 or more POIs in total), as shown in Fig.5aand 5b. The computation time for DGS is well below1 ms forall cases, compared to TTP which is significantly more expensive(4 to 24 ms). The computation time of TTP also increases morequickly than DGS as the number of POIs increases above 500.This is mainly because TTP has to keep expanding cloaked areasto preserve the user’s continuous location privacy. A larger cloakedarea generally leads to a larger search area for a NN query whichincreases computation cost. For the communication cost, inDGS,most of the data is transferred betweenSP andQS, while thedata transferred fromQS to the user is small (one POI). However,in a system with more than 50 POIs, TTP requires a much largeramount of data to be transferred to the user, as the size of theuser’s cloaked area increases.

Fig. 6 shows the scalability of our DGS and TTP for con-tinuous range queries when varying the number of POIs from 5to 50,000. The computation cost of DGS is slightly larger thanTTP (Fig. 6a) for POI databases with up to 5,000 POIs, andabout twice as expensive for a database with 50,000 POIs. Thisis mainly due to the fact that the privacy-aware query processingcost for range queries using TTP is much lower than that for NNqueries. Although our DGS incurs a higher computation cost thanTTP due to the use of cryptographic primitives in DGS, DGSprovides better location privacy and privacy guarantees for theuser than TTP. Fig.6b shows that for a system of more than 50POIs, the communication cost of our DGS is smaller than in TTP,and significantly so for larger POI databases (e.g., 3.5KB for DGSversus 110KB for TTP for a database of 50,000 POIs), makingour DGS more suitable for mobile environments.

5.3 Number of Mobile Users

Fig. 7 and 8 depict the scalability of our DGS and TTP withrespect to varying the number of mobile users from 10,000 to

11C

ompu

tatio

n T

ime

[ms]

02468

1012

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

5 50 500

K-Anonymity

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

05

101520253035

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

5 50 500

K-Anonymity

Service ProviderClient

(b) Communication Cost

Fig. 9. K-anonymity levels (NN queries).

Com

puta

tion

Tim

e [m

s]

0.00

0.20

0.40

0.60

0.80

1.00

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

5 50 500

K-Anonymity

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

05

101520253035

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

5 50 500

K-Anonymity

Service ProviderClient

(b) Communication Cost

Fig. 10. K-anonymity levels (range queries).

50,000. The results show that DGS is independent of the numberof users, while TTP depends heavily on the user density and/orthe user distribution. Thus, DGS has the desirable privacy featurefor privacy-preserving location-based services that it isfree fromprivacy attacks based on the user distribution or density. Fig. 7shows the performance of our DGS and TTP for continuousNN queries. The computation time of DGS remains constant,well below 1 ms (Fig. 7a). For TTP, the computation time isbetween 10 to 20 times higher than that of DGS, decreasing asthe number of users increases. This is because the cloaked areacomputed by TTP becomes smaller with more users. Fig.7b showssimilar results for communication cost, which is constant for DGS,while significantly higher for TTP. Fig.8 shows the results forcontinuous range queries. For10, 000 users, TTP is slightly moreexpensive than DGS, in terms of computation cost (Fig.8a),while DGS is two to three times more expensive than TTP forthe number of users from20, 000 to 50, 000. This can again beexplained by the use of cryptographic functions that provide amuch more secure scheme than TTP. However, the computationcost of DGS is constant, showing that it does not depend onthe number of users. Fig.8b also shows that the communicationcost of DGS is lower than TTP and fairly constant in terms ofbandwidth consumption.

5.4 K-Anonymity Levels for the TTP Scheme

Fig. 9 and 10 show the results of increasing theK-anonymitylevels from 5 to 500 for continuous NN and range queries,respectively, while keeping the other parameters constant. Sinceour DGS uses a two-tier architecture (i.e.,QS and SP ) andcryptographic functions to preserve the user location privacy, itsperformance is not affected by the increase ofK. For DGS thequery area was divided into50× 50 cells, and spanned4× 4km2,and these parameters stayed fixed throughout the experiment. ForNN queries, DGS performs much better than TTP, as shown inFig. 9a and9b, when the anonymity requirement becomes stricter(i.e., largerK). This is because TTP has to generate larger cloakedareas to satisfy the stricter anonymity requirements. These larger

Com

puta

tion

Tim

e [m

s]

0.00.20.40.60.81.01.21.41.6

5 50

50

0

Requested Number of POIs fork-NN Queries

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

0

500

1000

1500

2000

2500

3000

5 50

50

0

Requested Number of POIs fork-NN Queries

Service ProviderClient

(b) Communication Cost

Fig. 11. The requested number of NN POIs (k).

Com

puta

tion

Tim

e [m

s]

0.0

0.5

1.0

1.5

2.0

2.5

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

2km 4km 6km 8km 10km

Query Distance for Range Queries

Service Provider

ClientQuery Server

(a) Computation Cost

Com

mun

icat

ion

Cos

t [by

tes]

020406080

100120140160

DG

S

DG

S

DG

S

DG

S

DG

S

TT

P

TT

P

TT

P

TT

P

TT

P

2km 4km 6km 8km 10km

Query Distance for Range Queries

Service ProviderClient

(b) Communication Cost

Fig. 12. Query distance for range queries.

cloaked areas incur higher query processing overhead atSP andlead to a larger set of candidate POIs returned to the user. Sincethe overhead for processing range queries in TTP is much lowerthan that for NN queries, the computation cost of TTP is betterthan DGS for low anonymity levels, but it performs worse thanDGS for stricter anonymity levels, i.e., whenK ≥ 500 (Fig. 10a).In terms of communication cost (Fig.10b), DGS is much lessexpensive than TTP. The communication cost of TTP increaseswith K, because more POIs have to be returned fromSP to theuser through the fully-trusted third party, as the cloaked area sizegets larger.

5.5 Query Parameters

Fig. 11 shows the performance of our DGS when increasing therequested number of POIs (k) for k-NN queries from 5 to 500.As depicted in Fig.11a, the computation cost of DGS increasesask gets larger. The increase in the computation cost only affectsthe user andQS, the workload forSP remains the same in theexperiments even whenk increases. This is because an increase ofk does not increase the size of the query area, which is the onlyparameter relevant toSP . The communication cost also increasessteadily (Fig.11b). However, the increase ofk only results ina higher communication cost for the user, as the user requestsmore POIs in the vicinity. Also, for this experiment we increasedthe query area from the default of 2km to 10km to ensure thatenough POIs were returned to the client, especially for the caseof k = 500 POIs. Fig.12 shows the effect on the performanceof DGS and TTP when increasing the query distance of rangequeries from 2km to 10km. The computation cost of DGS andTTP is comparable (Fig.12a), with DGS slightly more expensivethan TTP for smaller query distances, while it performs better thanTTP as the query distance gets larger (i.e., the query distance isequal to or larger than 10km). For communication cost (Fig.12b),DGS is much better than TTP as the query distance increases.

5.6 Mobile Device Performance

In a real-world scenario, however, some of the operations will beperformed on a mobile device. While mobile devices have become

12

TABLE 1Benchmark of cryptographic operations performed on a mobile device.

Java NativeIBE Encryption (per request) 1074ms 52.2msHash / Encryption (per request) 0.147ms 0.0046ms (4.6µs)AES Decryption (per POI) 0.24ms 0.0042ms (4.2µs)

quite powerful, we decided to run additional benchmarks of ourscheme on actual mobile devices to verify that the cryptographicoperations necessary in our protocol can be run efficiently onmobile devices. In our protocol, the mobile device has to per-form three operations that necessitate cryptographic calculations:(1) Request Generation. The initial request generation by theuser requires encrypting the request using IBE over elliptic curves,which is expensive in terms of computational power required.(2) Hashing / Encryption. To retrieve the matching POIs fromQS, the client needs to hash and then encrypt the grid indicesfor each grid cell that it is interested in. This involves onehash-ing (SHA256) and one symmetric encryption operation (AES).(3) POI Decryption. Once the client receives the response fromQS, it needs to decrypt the POIs to display them locally. Thisrequires the client to perform one decryption operation perPOIusing a symmetric cipher (AES).

Benchmark setup. The performance benchmarks for mo-bile devices were done on a Samsung Galaxy SIII Androidsmartphone that has a quad-core Cortex-A9 1.4GHz CPU and1GB RAM. Android uses Java to write applications, but italso allows to run code natively by cross-compiling for theARM architecture and then calling native code from withinan application written in Java. For the benchmark we firstevaluated the performance of doing the cryptographic opera-tions in Java, using built-in symmetric cryptography and JPBC(http://gas.dia.unisa.it/projects/jpbc/index.html), a Java port ofPBC, for performing IBE. We then also cross-compiled thelibraries used in the prototype (OpenSSL, GMP and PBC) forARM to evaluate the performance when running the cryptographicoperations natively on the device.

Results. Table 1 shows the benchmark results for IBE en-cryption and AES decryption that refer to encrypting one requestfor SP and decrypting one POI received fromQS, respectively.These results show that smartphones are easily capable of per-forming the cryptographic operations necessary in our protocol.While IBE is still a somewhat expensive operation requiringonthe order of 50ms, this is an infrequent request and hence notabottleneck. Hashing / encrypting and AES decryption on the otherhand are much more frequent operations in our protocol, but theoperations are very efficient when done natively, so that a mobiledevice can easily decrypt up to several hundred thousand POIs persecond, or even more if multiple cores are used (at which pointbandwidth is more likely to become the bottleneck).

6 RELATED WORK

Spatial cloaking techniques have been widely used to preserveuser location privacy in LBS. Most of the existing spatial cloakingtechniques rely on a fully-trusted third party (TTP), usually termedlocation anonymizer, that is required between the user and theservice provider (e.g., [1]–[8]). When a user subscribes to LBS,the location anonymizer will blur the user’s exact locationinto acloaked area such that the cloaked area includes at leastk − 1

other users to satisfyk-anonymity. The TTP model has fourmajor drawbacks. (a) It is difficult to find a third party that canbe fully trusted. (b) All users need to continuously update theirlocations with the location anonymizer, even when they are notsubscribed to any LBS, so that the location anonymizer has enoughinformation to compute cloaked areas. (c) Because the locationanonymizer stores the exact location information of all users,compromising the location anonymizer exposes their locations.(d) k-anonymity typically reveals the approximate location of auser and the location privacy depends on the user distribution. Ina system with suchregional location privacyit is difficult for theuser to specify personalized privacy requirements. The feeling-based approach [29] alleviates this issue by finding a cloaked areabased on the number of its visitors that is at least as popularas theuser’s specified public region.

Although some spatial clocking techniques can be applied topeer-to-peer environments [30]–[32], these techniques still relyon the k-anonymity privacy requirement and can only achieveregional location privacy. Furthermore, these techniquesrequireusers to trust each other, as they have to reveal their locationsto other peers and rely on other peers’ locations to blur theirlocations. In [33], another distributed method was proposed thatdoes not require users to trust each other, but it still uses multipleTTPs. Another family of algorithms uses incremental nearestneighbor queries, where a query starts at an “anchor” locationwhich is different from the real location of a user and iterativelyretrieves more points of interest until the query is satisfied [34].While it does not require a trusted third party, the approximatelocation of a user can still be learned; hence only regional locationprivacy is achieved.

Cryptographic tools were used to protect outsourcing data.An order-preserving encryption scheme [35] uses a bucket-basedencryptionE such thatE(x) < E(y) for every pair of valuesfor which x < y. However, there does not seem to be astraightforward way to extend it to protect spatial data. Anotherapproach described in [36] for outsourcing data uses homomor-phic encryption to enable aggregate SQL queries over encrypteddatabases. The scope focuses only on simple numerical domainsand aggregate queries in SQL. This approach has also been shownto be insecure in [37].

For spatial data, another family of privacy-preserving tech-niques uses cryptographic tools such as private information re-trieval (PIR) or oblivious transfer (OT). PIR allows a user toretrieve a POI from a database without the server knowing whichPOI was retrieved. OT has the additional property that the useronly learns the requested POI and does not learn anything aboutany other POI. Ghinita et al. proposed a PIR-based schemewhich eliminates the trusted location anonymizer [9]. Their workuses a PIR matrix withn POIs in total and sizet × t witht = ⌈√n⌉. Using PIR a user can retrieve POIs only column-wise, corresponding toO(

√n) POIs for each request. This is

significantly more expensive than just retrieving theO(1) relevantPOIs. Their experimental results show that the communicationoverhead of their scheme is much higher than that of using theTTP model.

Vishwanathan et al. proposed to use a two-level combinationof PIR and OT [11]. First, a user selects the appropriate columnin a grid using PIR and then uses OT to retrieve the exact gridcell. Their approach focuses on protecting the data of the databasesystem by allowing the user to only learn the POIs in the currentgrid cell of the user. Because of the nature of PIR, however, the

13

user still needs to receive the whole column (and thusO(√n)

points of interest). A scheme proposed in [10] uses OT to hideusers’ locations from a service provider while enabling a paymentinfrastructure, but the scheme still requires a proxy as a TTP.

Also studied for privacy in LBS are methods which work onencrypted or transformed data. For example, Khoshgozaran andShahabi proposed a system which uses Hilbert curves to maplocations into a different space and then solves NN queries in thetransformed space [38]. A similar approach but using encryptionwas proposed by Wong et al. in [39]. Their work focuses onoutsourcing a database in encrypted format to a service providerand allows users to performk-NN queries on the encrypteddatabase. Their focus, however, is more on protecting the databaseinstead of the privacy of the users. Similar work was done in [40].

A few privacy-preserving techniques have attempted to use theTTP model for continuous LBS [2], [7], [41]. The idea of [2] is tokeep expanding an initial cloaked area to include at least the samek users, [7] is to predict a user’s footprints and blur each footprintinto ak-anonymized area, and [41] is to use a mix-zone to makethe users located in there at the same time indistinguishable.The TTP model has been extended to protect the privacy of ananonymized group of users by generalizing their spatial queryregions to make their queries indistinguishable [42] and guaranteethat the number of their requested service values is at leastmto achievem-invariance [43]. Temporal cloaking and encryptiontechniques are used for aggregate traffic data collection [44], butthey cannot provide privacy-preserving continuous LBS.

Another technique proposed to protect continuous LBS isusing dummy queries together with a real query [45]. However,this technique issues more queries than the user really needs.In our system a user never transmits actual location information(apart from the query area, which is only seen by the serviceprovider and which can be chosen arbitrarily large), and thetypeof POI in a query can only be read by the service provider. Thequery server has even less information available, it does not knowthe query area nor the type of POI searched for.

7 CONCLUSION

In this paper, we proposed a dynamic grid system (DGS) forproviding privacy-preserving continuous LBS. Our DGS includesthe query server (QS) and the service provider (SP ), and crypto-graphic functions to divide the whole query processing taskintotwo parts that are performed separately byQS andSP . DGS doesnot require any fully-trusted third party (TTP); instead, we requireonly the much weaker assumption of no collusion betweenQSandSP . This separation also moves the data transfer load awayfrom the user to the inexpensive and high-bandwidth link betweenQS andSP . We also designed efficient protocols for our DGSto support both continuousk-nearest-neighbor (NN) and rangequeries. To evaluate the performance of DGS, we compare it tothestate-of-the-art technique requiring a TTP. DGS provides betterprivacy guarantees than the TTP scheme, and the experimentalresults show that DGS is an order of magnitude more efficientthan the TTP scheme, in terms of communication cost. In termsofcomputation cost, DGS also always outperforms the TTP schemefor NN queries; it is comparable or slightly more expensive thanthe TTP scheme for range queries.

ACKNOWLEDGMENTS

Chi-Yin Chow was partially supported by the Guangdong Nat-ural Science Foundation (No. S2013010012363) and a researchgrant (CityU Project No. 9231131). Qiong Huang was sup-ported by the National Natural Science Foundation of China (No.61472146) and the Guangdong Natural Science Foundation (No.S2013010011859). Duncan S. Wong was supported by a researchgrant from the Research Grants Council, HKSAR (Project No.CityU 121512).

REFERENCES

[1] B. Bamba, L. Liu, P. Pesti, and T. Wang, “Supporting anonymous locationqueries in mobile environments with PrivacyGrid,” inWWW, 2008.

[2] C.-Y. Chow and M. F. Mokbel, “Enabling private continuous queries forrevealed user locations,” inSSTD, 2007.

[3] B. Gedik and L. Liu, “Protecting location privacy with personalized k-anonymity: Architecture and algorithms,”IEEE TMC, vol. 7, no. 1, pp.1–18, 2008.

[4] M. Gruteser and D. Grunwald, “Anonymous Usage of Location-BasedServices Through Spatial and Temporal Cloaking,” inACM MobiSys,2003.

[5] P. Kalnis, G. Ghinita, K. Mouratidis, and D. Papadias, “Preventinglocation-based identity inference in anonymous spatial queries,” IEEETKDE, vol. 19, no. 12, pp. 1719–1733, 2007.

[6] M. F. Mokbel, C.-Y. Chow, and W. G. Aref, “The new casper: Query pro-cessing for location services without compromising privacy,” in VLDB,2006.

[7] T. Xu and Y. Cai, “Location anonymity in continuous location-basedservices,” inACM GIS, 2007.

[8] ——, “Exploring historical location data for anonymity preservation inlocation-based services,” inIEEE INFOCOM, 2008.

[9] G. Ghinita, P. Kalnis, A. Khoshgozaran, C. Shahabi, and K.-L. Tan, “Pri-vate queries in location based services: Anonymizers are not necessary,”in ACM SIGMOD, 2008.

[10] M. Kohlweiss, S. Faust, L. Fritsch, B. Gedrojc, and B. Preneel, “Efficientoblivious augmented maps: Location-based services with a paymentbroker,” inPET, 2007.

[11] R. Vishwanathan and Y. Huang, “A two-level protocol to answer privatelocation-based queries,” inISI, 2009.

[12] J. M. Kang, M. F. Mokbel, S. Shekhar, T. Xia, and D. Zhang,“Continuousevaluation of monochromatic and bichromatic reverse nearest neighbors,”in IEEE ICDE, 2007.

[13] C. S. Jensen, D. Lin, B. C. Ooi, and R. Zhang, “Effective density queriesof continuously moving objects,” inIEEE ICDE, 2006.

[14] S. Wang and X. S. Wang, “AnonTwist: Nearest neighbor querying withboth location privacy and k-anonymity for mobile users,” inMDM, 2009.

[15] W. B. Allshouse, W. B. Allshousea, M. K. Fitchb, K. H. Hamptonb, D. C.Gesinkc, I. A. Dohertyd, P. A. Leonebd, M. L. Serrea, and W. C.Millerb,“Geomasking sensitive health data and privacy protection:an evaluationusing an E911 database,”Geocarto International, vol. 25, pp. 443–452,October 2010.

[16] A. Gkoulalas-Divanis, P. Kalnis, and V. S. Verykios, “Providing k-anonymity in location based services,”SIGKDD Explor. Newsl., vol. 12,pp. 3–10, November 2010.

[17] D. Boneh and M. K. Franklin, “Identity-based encryption from the weilpairing,” in CRYPTO, 2001.

[18] A. Menezes, M. Qu, and S. Vanstone, “Some new key agreementprotocols providing mutual implicit authentication,” inSAC, 1995.

[19] S. Yau and H. An, “Anonymous service usage and payment inservice-based systems,” inIEEE HPCC, 2011, pp. 714–720.

[20] M. Balakrishnan, I. Mohomed, and V. Ramasubramanian, “Where’s thatphone?: Geolocating ip addresses on 3G networks,” inACM SIGCOMMIMC, 2009.

[21] R. Dingledine, N. Mathewson, and P. Syverson, “Tor: thesecond-generation onion router,” inUSENIX Security, 2004.

[22] G. Bissias, M. Liberatore, D. Jensen, and B. Levine, “Privacy vulnerabil-ities in encrypted HTTP streams,” inPET, 2006.

[23] P. Golle and K. Partridge, “On the anonymity of home/work locationpairs,” in Pervasive Computing, 2009.

[24] IEEE, P1363-2000: Standard Specifications for Public-Key Cryptogra-phy, 2000.

[25] A. B. Lewko and B. Waters, “Efficient pseudorandom functions from thedecisional linear assumption and weaker variants,” inACM CCS, 2009.

14

[26] O. Goldreich, S. Goldwasser, and S. Micali, “How to construct randomfunctions,”Journal of the ACM, vol. 33, no. 4, pp. 792–807, 1986.

[27] C.-Y. Chow, M. F. Mokbel, and W. G. Aref, “Casper*: Queryprocess-ing for location services without compromising privacy,”ACM TODS,vol. 34, no. 4, 2009.

[28] U.S. Census Bureau, “TIGER. http://www.census.gov/geo/www/tiger/.”[29] T. Xu and Y. Cai, “Feeling-based location privacy protection for location-

based services,” inACM CCS, 2009.[30] C.-Y. Chow, M. F. Mokbel, and X. Liu, “A peer-to-peer spatial cloaking

algorithm for anonymous location-based service,” inACM GIS, 2006.[31] G. Ghinita, P. Kalnis, and S. Skiadopoulos, “MOBIHIDE:A mobile peer-

to-peer system for anonymous location-based queries,” inSSTD, 2007.[32] ——, “PRIVE: Anonymous location-based queries in distributed mobile

systems,” inWWW, 2007.[33] G. Zhong and U. Hengartner, “A distributed k-anonymityprotocol for

location privacy,” inIEEE PerCom, 2009.[34] M. L. Yiu, C. S. Jensen, X. Huang, and H. Lu, “SpaceTwist:Managing

the trade-offs among location privacy, query performance,and queryaccuracy in mobile services,” inIEEE ICDE, 2008.

[35] R. Agrawal, J. Kiernan, R. Srikant, and Y. Xu, “Order-preserving encryp-tion for numeric data,” inACM SIGMOD, 2004.

[36] H. Hacigumus, B. Iyer, and S. Mehrotra, “Efficient execution of aggre-gation queries over encrypted relational databases,” inDASFAA, 2004.

[37] E. Mykletun and G. Tsudik, “Aggregation queries in the database-as-a-service model,” inDBSec, 2006.

[38] A. Khoshgozaran and C. Shahabi, “Blind evaluation of nearest neighborqueries using space transformation to preserve location privacy,” in SSTD,2007.

[39] W. K. Wong, D. W. Cheung, B. Kao, and N. Mamoulis, “SecurekNNcomputation on encrypted databases,” inACM SIGMOD, 2009.

[40] M. L. Yiu, G. Ghinita, C. S. Jensen, and P. Kalnis, “Enabling searchservices on outsourced private spatial data,”VLDB Journal, vol. 19, no. 3,pp. 363–384, 2010.

[41] B. Palanisamy and L. Liu, “Mobimix: Protecting location privacy withmix zones over road networks,” inIEEE ICDE, 2011.

[42] S. Mascetti, C. Bettini, X. S. Wang, D. Freni, and S. Jajodia, “Provi-dentHider: An algorithm to preserve historical k-anonymity in LBS,” inMDM, 2009.

[43] R. Dewri, I. Ray, I. Ray, and D. Whitley, “Query m-Invariance: Prevent-ing query disclosures in continuous location-based services,” in MDM,2010.

[44] B. Hoh, T. Iwuchukwu, Q. Jacobson, D. Work, A. M. Bayen, R. Herring,J. C. Herrera, M. Gruteser, M. Annavaram, and J. Ban, “Enhancingprivacy and accuracy in probe vehicle-based traffic monitoring via virtualtrip lines,” IEEE TMC, vol. 11, no. 5, pp. 849–864, 2012.

[45] A. Pingley, N. Zhang, X. Fu, H.-A. Choi, S. Subramaniam,and W. Zhao,“Protection of query privacy for continuous location basedservices,” inIEEE INFOCOM, 2011.

Roman Schlegel has an MSc from EPFL inSwitzerland in Communication Systems and aPhD in Computer Science from City University inHong Kong. During his doctoral studies he alsospent a year as a research assistant at IndianaUniversity Bloomington in the US. After finishinghis PhD he joined ABB Corporate Research as aresearch scientist for security in industrial controlsystems. His research interests include privacy,network security and applied cryptography.

Chi-Yin Chow received the B.A. and M.Phil.degrees from The Hong Kong Polytechnic Uni-versity in 2002 and 2005, respectively. He re-ceived the M.S. and Ph.D. degrees from theUniversity of Minnesota-Twin Cities in 2008 and2010, respectively. He is currently an assistantprofessor in Department of Computer Science,City University of Hong Kong. His research inter-ests include spatio-temporal data managementand analytics, GIS, mobile computing, location-based services, and data privacy. He was the

co-organizer of ACM SIGSPATIAL MobiGIS 2012, 2013, and 2014.

Qiong Huang got his B.S. and M.S. degreesfrom Fudan University in 2003 and 2006 re-spectively, and got his PhD degree from CityUniversity of Hong Kong in 2010. Now he is aprofessor at South China Agricultural University.His research interests include cryptography andinformation security, in particular, cryptographicprotocols design and analysis.

Duncan S. Wong received the B.Eng. degreefrom the University of Hong Kong in 1994, theM.Phil. degree from the Chinese University ofHong Kong in 1998, and the Ph.D. degree fromNortheastern University, Boston, MA, in 2002.He is currently an associate professor in the De-partment of Computer Science at the City Uni-versity of Hong Kong. His primary research inter-est is cryptography; in particular, cryptographicprotocols, encryption and signature schemes,and anonymous systems. He is also interested

in other topics in information security, such as network security, wirelesssecurity database security, and security in cloud computing.