Sender anonymity in location-based services (LBS) attempts to hide the identity of a mobile device user who sends
requests to the LBS provider for services in her proximity (e.g. “find the nearest gas station” etc.). The goal is to keep the requester’s interests private even from attackers who (via hacking or subpoenas) gain access to the request and to the locations of the mobile user and other nearby users at the time of the request. In an LBS context, the best-studied privacy guarantee is known as “sender k-anonymity”. We show that state-of-the art solutions for sender k-anonymity defend only against naive attackers who have no knowledge of the anonymization policy that is in use. We strengthen the privacy guarantee to defend against more realistic “policy-aware” attackers. We describe a polynomial algorithm to obtain an optimum anonymization policy. Our implementation and experiments show that the policy-aware sender k-anonymity has potential for practical impact: it is efficiently enforceable, with limited reduction in utility when compared to policy-unaware guarantees.
Joint work with Rick Hull (IBM TJ Watson), Avinash Vyas (Bell Labs, ex-UCSD) and Kevin Zhao (UCSD)