The mobile crowdsensing (MCS) technology with a large number of Internet of Things (IoT) devices provides an economic and efficient solution to participation in coordinated large-scale sensing tasks. Edge computing powers MCS to form the mobile edge crowdsensing (MECS) framework. Privacy disclosure of sensing data in multiple stages is a significant challenge in the MECS. To tackle this issue, combining machine learning with game theory, in this article, we propose an artificial intelligence (AI)-enabled three-party game (ATG) framework for guaranteed data privacy in the MECS of IoT. Specifically, based on the random forest classifier and the $k$ -anonymity algorithm, we propose a classification-anonymity model that effectively guarantees the privacy of sensitive data. Moreover, we construct a three-party game model for analyzing the data privacy leakage in different phases in the MECS. Finally, we conduct numerical and theoretical analyses and ample simulations. The results indicate that the ATG framework is effective and efficient, and better suited to the MECS of IoT.

An AI-Enabled Three-Party Game Framework for Guaranteed Data Privacy in Mobile Edge Crowdsensing of IoT

With rapid development of e-healthcare systems, patients that are equipped with resource-limited e-healthcare devices (Internet of Things) generate huge amount of health data for health management. These health data possess significant medical value when aggregated from these distributed devices. However, efficient health data aggregation poses several security and privacy issues such as confidentiality disclosure and differential attacks, as well as patients may be reluctant to contribute their health data for aggregation. In this paper, we propose a privacy-preserving heath data aggregation scheme that securely collects health data from multiple sources and guarantee fair incentives for contributing patients. Specifically, we employ signature techniques to keep fair incentives for patients. Meanwhile, we add noises into the health data for differential privacy. Furthermore, we combine Boneh–Goh–Nissim cryptosystem and Shamir’s secret sharing to keep data obliviousness security and fault tolerance. Security and privacy discussions show that our scheme can resist differential attacks, tolerate healthcare centers failures, and keep fair incentives for patients. Performance evaluations demonstrate cost-efficient computation, communication and storage overhead.

Secure Data Aggregation of Lightweight E-Healthcare IoT Devices With Fair Incentives

Mobile CrowdSensing is a new paradigm in which requesters launch tasks to the mobile users who provide the sensing services. The tasks, in practice, are usually heterogeneous (have diverse spatial-temporal requirements), which make it hard to select an efficient subset of users to perform the tasks. In this paper, we present a point of interest (PoI) based mobility prediction model to obtain the probabilities that tasks would be completed by users. Based on it, we propose a greedy offline algorithm to select a set of users under a participant number constraint. Furthermore, we extend the user selection problem to a more realistic online setting where users come in real time and we decide to select or not immediately. We formulate the problem as a submodular $k$k-secretaries problem and propose an online algorithm. Finally, we design a distributed user selection framework Crowd UserS and implement an Android prototype system as proof of the concept. Extensive simulations have been conducted on three real-life mobile traces and the results prove the efficiency of our proposed framework.

A Prediction-Based User Selection Framework for Heterogeneous Mobile CrowdSensing

The rapid development of wireless infrastructure and data acquisition technologies contributes to the explosive growth of data, especially trajectory data with rich information. Trajectory data, which records locations of moving objects at certain moments, has long been an important means of studying human behavior and solving traffic problems. In this paper, we mainly introduce the trajectory data from the perspective of applications and services. According to the degree of data structured, we divide the trajectory data into explicit trajectory data and implicit trajectory data, and describe each type in detail. Then, we introduce the applications of trajectory data from travel behavior, travel patterns, and other aspects. Combined with case studies, we provide a description to the services of trajectory data in terms of transportation administration and commercial service. Finally, we focus on challenges in trajectory data, including privacy protection, human mobility causality, and emission reduction.

Big Trajectory Data: A Survey of Applications and Services

Reverse auction-based incentive mechanisms have been commonly proposed to stimulate mobile users to participate in crowdsensing, where users submit bids to the platform to compete for tasks. Recent works pointed out that bid is a private information which can reveal sensitive information of users (e.g., location privacy), and proposed bid-preserving mechanisms with differential privacy against inference attack. However, all these mechanisms rely on a trusted platform, and would fail in bid protection completely when the platform is untrusted (e.g., honest-but-curious). In this paper, we focus on the bid protection problem in mobile crowdsensing with an untrusted platform, and propose a novel privacy-preserving incentive mechanism to protect users’ true bids against the honest-but-curious platform while minimizing the social cost of winner selection. To this end, instead of uploading the true bid to the platform, a differentially private bid obfuscation function is designed with the exponential mechanism, which helps each user to obfuscate bids locally and submit obfuscated task-bid pairs to the platform. The winner selection problem with the obfuscated task-bid pairs is formulated as an integer linear programming problem and proved to be NP-hard. We consider the optimization problem at two different scenarios, and propose a solution based on Hungarian method for single measurement and a greedy solution for multiple measurements, respectively. The proposed incentive mechanism is proved to satisfy $\epsilon$-differential privacy, individual rationality and $\gamma$-truthfulness. The extensive experiments on a real-world data set demonstrate the effectiveness of the proposed mechanism against the untrusted platform.

Towards Privacy-preserving Incentive for Mobile Crowdsensing Under An Untrusted Platform

The continuous publication of aggregate statistics over crowd-sourced data to the public has enabled many data mining applications (e.g., real-time traffic analysis). Existing systems usually rely on a trusted server to aggregate the spatio-temporal crowd-sourced data and then apply differential privacy mechanism to perturb the aggregate statistics before publishing to provide strong privacy guarantee. However, the privacy of users will be exposed once the server is hacked or cannot be trusted. In this paper, we study the problem of real-time crowd-sourced statistical data publishing with strong privacy protection under an untrusted server. We propose a novel distributed agent-based privacy-preserving framework, called DADP, that introduces a new level of multiple agents between the users and the untrusted server. Instead of directly uploading the check-in information to the untrusted server, a user can randomly select one agent and upload the check-in information to it with the anonymous connection technology. Each agent aggregates the received crowd-sourced data and perturbs the aggregated statistics locally with Laplace mechanism. The perturbed statistics from all the agents are further combined together to form the entire perturbed statistics for publication. In particular, we propose a distributed budget allocation mechanism and an agent-based dynamic grouping mechanism to realize global $w$w-event $\epsilon$e-differential privacy in a distributed way. We prove that DADP can provide $w$w-event $\epsilon$e-differential privacy for real-time crowd-sourced statistical data publishing under the untrusted server. Extensive experiments on real-world datasets demonstrate the effectiveness of DADP.

Privacy-Preserving Crowd-Sourced Statistical Data Publishing with An Untrusted Server

Mechanisms built upon geo-indistinguishability render location privacy, where a user can submit obfuscated locations to Location-Based Service providers but still be able to correctly utilize services. However, these mechanisms are vulnerable under inference attacks. Particularly, with background knowledge of a user's obfuscated locations, an attacker can infer actual locations by carrying out long-term observation attacks. Unfortunately, how to defend long-term observation attacks in the field of differential location privacy remains open. In this paper, we first demonstrate the vulnerabilities of existing mechanisms under long-term observation attacks. In light of these vulnerabilities, we devise a novel mechanism, referred to as Eclipse, which bridges the gap between location protection and usability of services. Specifically, we harness geo-indistinguishability and k-anonymity to obfuscate locations and hide each location based on an anonymity set. As a result, our mechanism effectively perturbs the distribution of locations and suppresses leakage under long-term observation attacks. Moreover, the set of possible outputs is utilized to minimize the impacts to usability and correctness. We formally define and rigorously prove the security of the proposed mechanism by leveraging differential privacy. Moreover, we implement the proposed mechanism and conduct a series of experiments on real-world datasets to demonstrate its efficacy and efficiency.

Eclipse: Preserving Differential Location Privacy Against Long-Term Observation Attacks

Users usually have different privacy demands when they contribute individual data to a dataset that is maintained and queried by others. To tackle this problem, several personalized differential privacy (PDP) mechanisms have been proposed to render statistical information of the entire dataset without revealing individual privacy. However, existing mechanisms produce query results with low accuracy, which leads to poor data utility. This is primarily because (1) some users are over protected; (2) utility is not explicitly included in the design objective. Poor data utility impedes the adoption of PDP in the real-world applications. In this paper, we present an adaptive personalized differential privacy framework, called AdaPDP. Specifically, to maximize data utility in different cases, AdaPDP adaptively selects underlying noise generation algorithms and calculates the corresponding parameters based on the type of query functions, data distributions and privacy settings. In addition, AdaPDP performs multiple rounds of utility-aware sampling to satisfy different privacy requirements for users. Our privacy analysis shows that the proposed framework renders rigorous privacy guarantee. We conduct extensive experiments on synthetic and real-world datasets to demonstrate the much less utility losses of the proposed framework over various query functions.

AdaPDP: Adaptive Personalized Differential Privacy

Personalized Differential Privacy (PDP) was proposed to satisfy users’ different privacy requirements. However, most of the existing PDP mechanisms may significantly destroy the utility of released statistical results. Differentially private statistical results with poor utility may mislead the data analysts, thus it may even decrease the acceptability of the technique used to protect data privacy. Therefore, in this paper, our goal is to pursue higher data utility while satisfying personalized differential privacy. To achieve this goal, we propose the Utility-aware Personalized Exponential Mechanism (UPEM) to effectively achieve PDP while pursuing better utility. UPEM distinguishes the different possible results with the same personalized score, which is used in Personalized Exponential Mechanism (PEM) [1]. PEM considers the personalized privacy budgets of changing elements to achieve PDP. Based on PEM, our UPEM further considers the quantitative changes of these changing tuples to enhance the utility. We confirm the effectiveness and efficiency of UPEM through extensive experiments.

Utility-aware Exponential Mechanism for Personalized Differential Privacy

Location privacy continues to attract significant attentions from both industry and academia in recent years. However, Location Based Service (LBS) servers or some other adversaries who can monitor a particular user's historical and current status in a long-term way may likely infer user's location privacy. To solve this problem, we propose a Longterm Observation-aware Dummy Selection (LODS) algorithm to achieve k-anonymity for users in LBSs. Different from existing approaches, the LODS takes the historical anonymity sets into account, since mobile users may query LBSs at certain places such as home or office. LODS selects candidate sets containing dummy locations with less number of occurrences firstly, in order to achieve the preferred distribution. Then, LODS further filters out candidate sets with smaller entropy. Finally, we choose the anonymity set with highest Quality of Service (QoS) as the result. Extensive experiment indicates our algorithm can protect user's location privacy effectively against long-term observation, and satisfy user's QoS requirement at the same time.

Yahong Chen

Papers

Privacy-Preserving Crowd-Sourced Statistical Data Publishing with An Untrusted Server

Eclipse: Preserving Differential Location Privacy Against Long-Term Observation Attacks

AdaPDP: Adaptive Personalized Differential Privacy

Utility-aware Exponential Mechanism for Personalized Differential Privacy

Achieving Personalized k-Anonymity against Long-Term Observation in Location-Based Services