LAUSR

Location-based services have significantly affected mobile users’ everyday life, and location privacy has become essential. Some applications (e.g., location-based recommendation, mobility analytics) do not need the raw location data, and the service providers adopt aggregation to protect users’ location traces. However, some works show that even these aggregation data may disclose users’ location privacy when additional prior knowledge is available to an adversary. We consider the location privacy problem in the presence of Location Uniqueness, a property by which some geographical locations can be re-identified based on the aggregated point-of-interest information. We first study whether existing protection mechanisms are adequate for defending against this type of attack. Then we present two practical attacks for inferring users’ actual locations based on the POI aggregates. A secure POI aggregate release mechanism is proposed for defending against this type of re-identification attack and achieving differential privacy at the same time. We conduct extensive experiments on real-world datasets. The results show that the existing protection mechanisms cannot provide sufficient protection against location re-identification attacks. The proposed attacks can significantly improve the inference performance, and the proposed protection mechanism achieves satisfactory performance.