2013 | Miguel E. Andrés, Nicolás E. Bordenabe, Konstantinos Chatzikokolakis, Catuscia Palamidessi
Geo-indistinguishability is a privacy definition for location-based systems that protects the user's exact location while allowing approximate information to be released. It generalizes differential privacy, where the level of privacy depends on the radius r. A mechanism is defined as ε-geo-indistinguishable if, for any radius r > 0, the user enjoys εr-privacy within r. This ensures that the user is protected within any radius, with privacy increasing with distance. The mechanism achieves geo-indistinguishability by adding controlled random noise to the user's location, using a planar Laplace distribution. This distribution is efficiently generated by transforming to polar coordinates. However, discretization is necessary for practical applications, which can degrade privacy guarantees. The paper shows how to use this mechanism to enhance LBS applications with geo-indistinguishability guarantees without compromising quality. It compares the mechanism with existing ones and finds that it offers the best privacy guarantees for the same utility. The paper also discusses the implications of using different metrics and the importance of abstracting from the adversary's prior knowledge. The mechanism is shown to preserve geo-indistinguishability at the cost of a degraded privacy parameter ε. The paper concludes that geo-indistinguishability provides a formal framework for justifying the use of Laplace noise in location privacy, while avoiding the need for an anonymity set.Geo-indistinguishability is a privacy definition for location-based systems that protects the user's exact location while allowing approximate information to be released. It generalizes differential privacy, where the level of privacy depends on the radius r. A mechanism is defined as ε-geo-indistinguishable if, for any radius r > 0, the user enjoys εr-privacy within r. This ensures that the user is protected within any radius, with privacy increasing with distance. The mechanism achieves geo-indistinguishability by adding controlled random noise to the user's location, using a planar Laplace distribution. This distribution is efficiently generated by transforming to polar coordinates. However, discretization is necessary for practical applications, which can degrade privacy guarantees. The paper shows how to use this mechanism to enhance LBS applications with geo-indistinguishability guarantees without compromising quality. It compares the mechanism with existing ones and finds that it offers the best privacy guarantees for the same utility. The paper also discusses the implications of using different metrics and the importance of abstracting from the adversary's prior knowledge. The mechanism is shown to preserve geo-indistinguishability at the cost of a degraded privacy parameter ε. The paper concludes that geo-indistinguishability provides a formal framework for justifying the use of Laplace noise in location privacy, while avoiding the need for an anonymity set.