The PROBE Framework for the Personalized Cloaking of Private Locations

The widespread adoption of location-based services (LBS) raises increasing concerns for the protection of personal location information. A common strategy, referred to as obfuscation (or cloaking), to protect location privacy is based on forwarding the LBS provider a coarse user location instead of the actual user location. Conventional approaches, based on such technique, are however based only on geometric methods and therefore are unable to assure privacy when the adversary is aware of the geographical context, in particular of the <em>semantic locations</em> and the statistical distribution of positions in the given space. This paper provides a comprehensive solution to this problem. We present a novel privacy model and an architectural framework for the personalized cloaking of semantic locations. In ourmodel, a cloaked location is an uncertainty regionwhich satisfies the privacy constraints specified by the user in the privacy profile (<em>obfuscated location</em>). We propose a strategy for generating obfuscated locations and evaluate different algorithms which implement efficiently such a strategy. The paper includes several experimental results assessing performance, storage requirements and accuracy for the approach. The paper also discusses the system architecture and shows that the approach can be deployed also for clients running on small devices.