Large-scale collection of contextual information is often essential in order to gather statistics, train machine learning models, and extract knowledge from data. The ability to do so in a privacy-preserving way -- i.e., without collecting fine-grained user data -- enables a number of additional computational scenarios that would be hard, or outright impossible, to realize without strong privacy guarantees. In this paper, we present the design and implementation of practical techniques for privately gathering statistics from large data streams. We build on efficient cryptographic protocols for private aggregation and on data structures for succinct data representation, namely, Count-Min Sketch and Count Sketch. These allow us to reduce the communication and computation complexity incurred by each data source (e.g., end-users) from linear to logarithmic in the size of their input, while introducing a parametrized upper-bounded error that does not compromise the quality of the statistics. We then show how to use our techniques, efficiently, to instantiate real-world privacy-friendly systems, supporting recommendations for media streaming services, prediction of user locations, and computation of median statistics for Tor hidden services.
@cite_61 propose a privacy-preserving participatory sensing application which allows users to locate nearby friends without disclosing exact locations, via secure function evaluation @cite_60 , but do not address the problem of scaling to large streams number of users. De Cristofaro and Soriente @cite_25 introduce a privacy-enhanced distributed querying infrastructure for participatory and urban sensing systems. Work in @cite_20 and @cite_49 provide either @math -anonymity @cite_16 and @math -diversity @cite_29 to guarantee anonymity of users through Mix Network techniques @cite_36 . However, their techniques are not provably-secure and they only provide partial confidentiality. Then, @cite_37 suggest data perturbation in a known community for computing statistics and protecting anonymity. Trusted Platform Modules (TPMs) are instead used in @cite_50 and @cite_32 to protect integrity and authenticity of user contents.
@cite_61 @cite_37 @cite_60 @cite_36 @cite_29 @cite_32 @cite_49 @cite_50 @cite_16 @cite_25 @cite_20
2109784850 2145060596 1994123014 2103112159
The ubiquity of mobile devices has brought forth the concept of participatory sensing, whereby ordinary citizens can now contribute and share information from the urban environment. However, such applications introduce a key research challenge: preserving the privacy of the individuals contributing data. In this paper, we study two different privacy concepts, k-anonymity and l-diversity, and demonstrate how their privacy models can be applied to protect users' spatial and temporal privacy in the context of participatory sensing. The first part of the paper focuses on schemes implementing k-anonymity. We propose the use of microaggregation, a technique used for facilitating disclosure control in databases, as an alternate to tessellation, which is the current state-of-the-art for location privacy in participatory sensing applications. We conduct a comparative study of the two techniques and demonstrate that each has its advantage in certain mutually exclusive situations. We then propose the Hybrid Variable size Maximum Distance to Average Vector (Hybrid-VMDAV) algorithm, which combines the positive aspects of microaggregation and tessellation. The second part of the paper addresses the limitations of the k-anonymity privacy model. We employ the principle of l-diversity and propose an l-diverse version of VMDAV (LD-VMDAV) as an improvement. In particular, LD-VMDAV is robust in situations where an adversary may have gained partial knowledge about certain attributes of the victim. We evaluate the performances of our proposed techniques using real-world traces. Our results show that Hybrid-VMDAV improves the percentage of positive identifications made by an application server by up to 100 and decreases the amount of information loss by about 40 . We empirically show that LD-VMDAV always outperforms its k-anonymity counterpart. In particular, it improves the ability of the applications to accurately interpret the anonymized location and time included in user reports. Our studies also confirm that perturbing the true locations of the users with random Gaussian noise can provide an extra layer of protection, while causing little impact on the application performance. Grassroots Participatory Sensing empowers people to collect and share sensor data using mobile devices across many applications, spanning intelligent transportation, air quality monitoring and social networking. In this paper, we argue that the very openness of such a system makes it vulnerable to abuse by malicious users who may poison the information, collude to fabricate information, or launch Sybils to distort that information. We propose and implement a novel trusted platform module (TPM), or angel based system that addresses the problem of providing sensor data integrity. The key idea is to provide a trusted platform within each sensor device to attest the integrity of sensor readings. We argue that this localizes integrity checking to the device, rather than relying on corroboration, making the system not only simpler, but also resistant to collusion and data poisoning. A "burned-in" private key in the TPM prevents users from launching Sybils. We also make the case for content protection and access control mechanisms that enable users to publish sensor data streams to selected groups of people and address it using broadcast encryption techniques. With the proliferation of sensor-embedded mobile computing devices, participatory sensing is becoming popular to collect information from and outsource tasks to participating users. These applications deal with a lot of personal information, e.g., users' identities and locations at a specific time. Therefore, we need to pay a deeper attention to privacy and anonymity. However, from a data consumer's point of view, we want to know the source of the sensing data, i.e., the identity of the sender, in order to evaluate how much the data can be trusted. “Anonymity” and “trust” are two conflicting objectives in participatory sensing networks, and there are no existing research efforts which investigated the possibility of achieving both of them at the same time. In this paper, we propose ARTSense, a framework to solve the problem of “trust without identity” in participatory sensing networks. Our solution consists of a privacy-preserving provenance model, a data trust assessment scheme and an anonymous reputation management protocol. We have shown that ARTSense achieves the anonymity and security requirements. Validations are done to show that we can capture the trust of information and reputation of participants accurately. The continual advancement in semiconductor technology has enabled vendors to integrate an increasing number of sensors, e.g., accelerometer, gyroscope, digital compass, high resolution cameras and others, in modern mobile phones. Combining with the ever expanding market penetration of mobile phones, the onboard sensors are driving the sensing community towards a new paradigm called participatory sensing in which ordinary citizens voluntarily collect and share information from their local environment using personal mobile devices. The inherent openness of this platform is a double-edged sword. While encouraging user participation on the one hand, it also makes it easy to contribute corrupted data. As such, data trustworthiness becomes a key issue which needs to be addressed to ensure sustainable development of this emerging paradigm. In this paper, we propose a reputation system in which a reputation score is calculated for each device as a reflection of the trustworthiness of its sensor data. We adopt the Gompertz function as a fundamental building block of our system, since it is better suited to deal with the unique characteristics of participatory sensing. We present an application-agnostic implementation of the system, which can work with a wide variety of participatory sensing applications. We evaluate the performance of our reputation system in the context of two real-world participatory sensing applications. Our results show that the proposed reputation system outperforms existing solutions by up to a factor of six.