Abstract
In this chapter, we study the application of the SGUM framework to pseudonym change for personalized location privacy.
Keywords
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.
This is a preview of subscription content, log in via an institution.
Buying options
Tax calculation will be finalised at checkout
Purchases are for personal use only
Learn about institutional subscriptionsNotes
- 1.
Another privacy metric is the entropy of the adversary’s uncertainty of a user’s pseudonym. However, it is usually difficult to compute since it requires probability distribution which is difficult to attain.
- 2.
As we focus on pure strategies in this work, we use “strategy” and “action” interchangeably.
- 3.
For SO-PCG, an SNE is equivalent to a NE for a standard non-cooperative game. For consistency of terminology, we still call it “SNE” in this case.
- 4.
We conjecture that problem (5.5) is an NP-hard problem.
- 5.
To protect privacy, only one community in common is revealed if they have multiple communities in common.
References
A. Beresford, F. Stajano, Location privacy in pervasive computing. IEEE Pervasive Comput. 2(1), 46-55 (2003)
J. Freudiger, M.H. Manshaei, J.-P. Hubaux, D.C. Parkes, On non-cooperative location privacy: A game-theoretic analysis. ACM CCS. 324-337 (2009)
X. Liu, H. Zhao, M. Pan, H. Yue, X. Li, Y. Fang, Traffic-aware multiple mix zone placement for protecting location privacy. IEEE INFOCOM. 972-980 (2012)
D. Yang, X. Fang, G. Xue, Truthful incentive mechanisms for k-anonymity location privacy. IEEE INFOCOM. 2994-3002 (2013)
X. Liu, K. Liu, L. Guo, X. Li, Y. Fang, A game-theoretic approach for achieving k-anonymity in location based services. IEEE INFOCOM. 2985-2993 (2013)
B. Hoh, M. Gruteser, Protecting location privacy through path confusion. SECURECOMM. 194-205 (2005)
B. Hoh, M. Gruteser, H. Xiong, A. Alrabady, Enhancing security and privacy in traffic-monitoring systems. IEEE Pervasive Compu. 38-46 (2006)
J. Krumm, Inference attacks on location tracks. IEEE Pervasive Comput. 127-143 (2007)
M. Osborne, A. Rubinstein, A Course in Game Theory (MIT Press, Cambridge, 1994)
WeChat: The new way to connect (2014), http://www.wechat.com/:
WhatsApp: Simple. Personal. Real time messaging (2014), http://www.whatsapp.com/
G. Zhong, I. Goldberg, U. Hengartner, Louis, Lester and Pierre: Three protocols for location privacy. ACM PETS. 62-76 (2007)
B. Mu, S. Bakiras, Private proximity detection for convex polygons. ACM MobiDE. 36-43 (2013)
R. Zhang, Y. Zhang, J. Sun, G. Yan, Fine-grained private matching for proximity-based mobile social networking. IEEE INFOCOM. 1969-1977 (2012)
L. Zhang, X.-Y. Li, Y. Liu, Message in a sealed bottle: Privacy preserving friending in social networks. IEEE ICDCS. 327-336 (2013)
P. Erdos, A. Renyi, On the evolution of random graphs. Publ. Math. Inst. Hung. Acad. Sci. 17–61 (1960)
SNAP: Network datasets: Brightkite (2014), http://snap.stanford.edu/data/loc-brightkite.html
Author information
Authors and Affiliations
Corresponding author
Appendix
Appendix
For convenience, let \(\mathcal{N}_{I,k}\) and \(\mathcal{N}_{II,k}\) denote the set of users that become determined in phase I and phase II of round k in Algorithm 2, respectively. Let \(\mathcal{N}_0({\boldsymbol a})\triangleq \{i\in\mathcal{N}|a_i=0\}\) denote the set of users with action 0 under profile \({\boldsymbol a}\).
5.1.1 Proof of Proposition 5.1
Since SO-PCG is a special case of SA-PCG, Property 5.1 also applies to the individual utility function u i . Therefore, due to Property 5.1, a user who changes its strategy from 1 to 0 will not change it back to 1. As a result, best response dynamics always terminates and results in a profile \({\boldsymbol a}^o\) that is a SNE.
Next we show that \({\boldsymbol a}^o\) achieves the maximum social welfare among all SNEs. It suffices to show that \({\boldsymbol a}^o\) is Pareto-superior to any other SNE. To this end, we first show that a profile \({\boldsymbol a}'\) is not a SNE if \(\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^o)\neq \varnothing\). Suppose such \({\boldsymbol a}'\) is a SNE. Let \(i\in\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^o)\) be the first user among \(\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^o)\) whose action is changed to 0, and \(\bar{\boldsymbol a}\) be the profile right before that change. Since \({\boldsymbol a}'\le\bar{\boldsymbol a}\), we have \(u_i({\boldsymbol a}')\le u_i( \bar{\boldsymbol a})<0=u_i(0,{\boldsymbol a}'_{i-})\) due to that 0 is the best response strategy. This shows that \({\boldsymbol a}'\) is not a SNE. Therefore, for any SNE \({\boldsymbol a}'\) other than \({\boldsymbol a}^o\), we must have \({\boldsymbol a}'<{\boldsymbol a}^o\). Then for each \(i\in\mathcal{N}_1({\boldsymbol a}')\), we have \(u_i({\boldsymbol a}')\le u_i({\boldsymbol a}^o)\). For each \(i\in\mathcal{N}_0({\boldsymbol a}')\), since \({\boldsymbol a}^o\) is a SNE, we have \(u_i({\boldsymbol a}')=0 =u_i(0,{\boldsymbol a}^o_{-i})\le u_i({\boldsymbol a}^o)\). Therefore \({\boldsymbol a}^o\) is Pareto-superior to \({\boldsymbol a}'\). Thus we show that \({\boldsymbol a}^o\) is the best SNE.
5.1.2 Proof of Theorem 5.1
We first show that \({\boldsymbol a}^e\) is a SNE. We consider three cases of a user i as follows.
Case 1: \(i\in\mathcal{N}_1({\boldsymbol a}^e)\) and \(i\in\mathcal{N}_{I,k}\)
Let \({\boldsymbol a}'\) be the profile right after phase I during which i remains in \(\mathcal{N}_{I}\). Since \({\boldsymbol a}^e\ge{\boldsymbol a}'\), using (5.3) we have
where the second inequality is due to the condition in line 5.
Case 2: \(i\in\mathcal{N}_1({\boldsymbol a}^e)\) and \(i\in\mathcal{N}_{II,k}\)
Let \({\boldsymbol a}'\) be the profile right after i becomes determined in phase II. Since \({\boldsymbol a}^e\ge{\boldsymbol a}'\), using (5.3) we have
where the second inequality is due to the condition in line 10.
Case 3: \(i\in\mathcal{N}_0({\boldsymbol a}^e)\)
Since i is not included in \(\mathcal{N}_{II}\) in phase II of the last round, using (5.3) we have
where the inequality is due to the condition in line 10.
Next we show that \({\boldsymbol a}^e\) is Pareto-optimal. Suppose there exists \({\boldsymbol a}'\) that is Pareto-superior to \({\boldsymbol a}^e\). It suffices to show that (i) \(\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)=\varnothing\) and (ii) \(\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')=\varnothing\). We first show part (i). Suppose \(\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)\neq\varnothing\). Then for each \(i\in\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)\), we have \(u_i({\boldsymbol a}')\ge u_i({\boldsymbol a}^e)=0\). Let i be the first user among \(\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)\) whose action is set to 0 during phase I of the last round, and \(\bar{\boldsymbol a}\) be the profile right before \(a_i=0\) is performed. Since \(\bar{\boldsymbol a}_{-i}\ge{\boldsymbol a}'_{-i}\), we have \(u_i(1,\bar{\boldsymbol a}_{-i})+\sum_{j\in \mathcal{N}^S_{i+}\setminus\mathcal{\overline{N}}}s_{ij}\bar{a}_j\ge u_i(1,\bar{\boldsymbol a}_{-i})\ge u_i(1,{\boldsymbol a}'_{-i})\ge0\), which contradicts to the condition in line 5.
Next we show part (ii). Suppose \(\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')\neq\varnothing\). Since we have shown part i), we must have \({\boldsymbol a}'<{\boldsymbol a}^e\). Then for each \(i\in\mathcal{N}_1({\boldsymbol a}')\subset\mathcal{N}_1({\boldsymbol a}^e)\), we have \(u_i({\boldsymbol a}')\le u_i({\boldsymbol a}^e)\). Since \(u_i({\boldsymbol a}')=0= u_i({\boldsymbol a}^e)\) for each \(i\in\mathcal{N}_0({\boldsymbol a}')\cap\mathcal{N}_0({\boldsymbol a}^e)\), there must exist \(i\in\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')\) such that \(u_i({\boldsymbol a}^e)<u_i({\boldsymbol a}')=0\). Suppose i is included in \(\mathcal{N}_{II}\) during phase II of some round. Let \(\bar{\boldsymbol a}\) be the profile right before \(a_i=1\) is performed. Since \(\bar{\boldsymbol a}\le{\boldsymbol a}^e\), we have \(u_i(\bar{\boldsymbol a})\le u_i({\boldsymbol a}^e)<0\). Then it follows from \(0\le f_i(1,\bar{\boldsymbol a}_{-i})- f_i(0,\bar{\boldsymbol a}_{-i})=u_i(1,\bar{\boldsymbol a}_{-i})+\sum_{j\in \mathcal{N}^S_{i+}}s_{ij}\bar{a}_j\) that there must exist \(j\in \mathcal{N}^S_{i+}\) such that \(\bar{a}_j=1\), and therefore \(a^e_j=1\). If \(j\in\mathcal{N}_1({\boldsymbol a}')\), we have \(u_j({\boldsymbol a}^e)-u_j({\boldsymbol a}')\ge a^e_i-a' _i=1>0\), which is a contradiction. Therefore we must have \(j\in\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')\) and \(u_j({\boldsymbol a}^e)\le u_j({\boldsymbol a}')=0\). Let \(\hat{\boldsymbol a}\) be the profile right before \(a_j=1\) is performed. Since j is included before i, we have \(u_j(\hat{\boldsymbol a})<u_j({\boldsymbol a}^e)\le0\). Then we can use the above argument sequentially, until we find some k that leads to contradiction.
5.1.3 Proof of Theorem 5.2
Let \(\mathcal{N}'_{I,k}\) be the set of users in \(\mathcal{N}_{I,k}\) during the execution that computes \({\boldsymbol a}^{e'}\). For each \(i\in\mathcal{N}_{I,1}\), we have
Therefore we must have \(\mathcal{N}_{I,1}\subseteq\mathcal{N}'_{I,1}\). Similarly, we can show that for any \(i\in\mathcal{N}_{II,1}\setminus\mathcal{N}'_{I,1}\), we must have \(i\in\mathcal{N}'_{II,1}\). Using this argument sequentially, we can show that \(\cup^k_{i=1}\left(\mathcal{N}_{I,i}\cup\mathcal{N}_{II,i}\right)\subseteq\cup^k_{i=1}\left(\mathcal{N}'_{I,i}\cup\mathcal{N}'_{II,i}\right)\) for any k, and therefore \({\boldsymbol a}^e\le{\boldsymbol a}^{e'}\). When a user becomes determined with action 1, the increment of social welfare of determined users by changing its action from 0 to 1 is no less than the increment of its social group utility derived from determined users, which is non-negative. Therefore we can see that \(v({\boldsymbol a}^e)\le v({\boldsymbol a}^{e'})\).
Rights and permissions
Copyright information
© 2014 The Author(s)
About this chapter
Cite this chapter
Gong, X., Chen, X., Yang, L., Zhang, J. (2014). SGUM-based Pseudonym Change for Personalized Location Privacy. In: Social Group Utility Maximization. SpringerBriefs in Electrical and Computer Engineering. Springer, Cham. https://doi.org/10.1007/978-3-319-12322-6_5
Download citation
DOI: https://doi.org/10.1007/978-3-319-12322-6_5
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-12321-9
Online ISBN: 978-3-319-12322-6
eBook Packages: Computer ScienceComputer Science (R0)