Design and Evaluation of an Architecture for Location Privacy

Many operators of cellphone networks now offer location-based services to their customers, whereby an operator often outsources service provisioning to a third-party provider. Since a person’s location could reveal sensitive information about the person, the operator must ensure that the service provider processes location information about the operator’s customers in a privacy-preserving way. We propose an architecture for location-based services based on Trusted Computing and Secure Logging. Trusted Computing lets an operator query the configuration of a location-based service. The operator will hand over location information to the service only if the service is configured such that the service provider cannot get access to location information using software-based attacks. This includes passive attacks, where the provider monitors the composition or the timing of information flowing into and out of its service, and active attacks, where the provider modifies or injects customer queries to the service. We introduce several requirements that must be satisfied by a location-based service to defend against passive attacks. Furthermore, we present Secure Logging, an auditing mechanism to defend against active attacks. We present an implementation of our architecture and demonstrate its usefulness by building two sample location-based services on top of it. The evaluation of our architecture shows that its processing delay is hardly noticeable and that timing attacks are very unlikely to succeed.