Trajectory Anonymization by Map Tile Filtering and Re-Anonymization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing location-based services face challenges in maintaining user anonymity while providing accurate and timely navigation and route guidance, as current anonymization strategies are often tailored to specific use cases and can lead to reduced data utility or increased privacy risks when applied across different use cases.
Innovation Solution
A method and apparatus for applying a second level of anonymization to mobility data, identifying and removing subsets of data that fail to meet predefined anonymity parameters, and re-anonymizing these data to ensure high utility and privacy, using geometric patterns and trajectory analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If a first level of anonymization is applied to mobility data, then privacy is improved, but trajectory reconstruction and reidentification attacks can still succeed in certain map tiles
Solution Approach 1:
The geographic area is divided into multiple map tiles, and the anonymization process is applied independently to each tile. This segmentation allows the system to identify and remove insufficiently anonymized data from specific tiles while preserving anonymized data from other tiles, thereby improving overall anonymization quality without sacrificing privacy across the entire dataset.
Solution Approach 2:
Before publishing mobility data, the system performs a preliminary analysis of each map tile to determine whether the first level of anonymization is sufficient. Tiles that fail to meet the anonymity threshold are flagged for second-level anonymization or removal, preventing potentially compromising data from being published while maintaining privacy for adequately anonymized regions.
2Reliability
If mobility data is removed from map tiles where first level anonymization fails, then anonymization quality is improved, but data utility for location-based services is reduced
Solution Approach 1:
By segmenting the geographic area into map tiles, the system can selectively remove only the problematic data from specific tiles while retaining useful anonymized data from other tiles. This approach minimizes the loss of overall data utility while improving anonymization quality in the affected regions.
Solution Approach 2:
Instead of removing all data from the entire geographic region, the system applies a partial action by removing only the insufficiently anonymized portions (specific map tiles) while keeping the adequately anonymized data intact. This partial removal strategy preserves maximum data utility while achieving the necessary anonymization quality improvement.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method, apparatus, and computer program product are provided for establishing and applying a second level of anonymization of trajectories to improve privacy. Methods may include: receiving anonymized mobility data for a geographic region subdivided into a plurality of map tiles, where the mobility data includes a plurality of probe data points anonymized with a first anonymization level, where sequences of probe data points define trajectories; determining, based on the anonymized mobility data, one or more map tiles of the plurality of map tiles where anonymization of trajectories using the first anonymization level fails to satisfy a predefined anonymity parameter value; removing a subset of the anonymized mobility data corresponding to the one or more map tiles; and publishing the anonymized mobility data without the subset of the mobility data corresponding to the one or more map tiles for use with one or more location-based services.