$n$-VDD: Location Privacy Protection Based on Voronoi-Delaunay Duality

TL;DR

This paper introduces a geometric framework using Voronoi-Delaunay duality to enhance location privacy in location-based services by hiding user locations within irregular Voronoi cells and intersection zones.

Contribution

It presents a novel geometric approach based on Voronoi-Delaunay duality for location privacy protection, introducing multiple anonymizing models with efficient linear computations.

Findings

The framework effectively conceals user locations.

The methods are computationally efficient due to linear line intersections.

Experiments demonstrate the approach's efficacy across various parameters.

Abstract

To date, location privacy protection is a critical issue in Location-Based Services (LBS). In this work, we propose a novel geometric framework based on the classical discrete geometric structure, the Voronoi-Delaunay duality (VDD). We utilize the fact that the user location cannot be recovered if only given an irregular $n$-sided Voronoi cell around it, and the anonymity zone is the intersection of all the parallel strips perpendicular to and bounded by $n$ Voronoi edges. The irregular Voronoi cell and its variations can be used as the concealing space to hide the user location or the region of interest and submitted to the LBS server. Within this framework, we propose multiple typical anonymizing models by introducing irregularity to the convex regular VDD structure by shifting the interior Voronoi cell, exterior Delaunay polygon, sector rays, or their combinations. The proposed methods are efficient by taking advantage of the VDD principle where main computations are linear line-line intersections. Experiments with various parameters demonstrate the efficiency and efficacy of the proposed $n$-VDD framework.

Tables

Table 1. Table I : Table of Symbols

Symbol	Definition
$O$	User’s location (or seed)
$n$	Number of vertices of polygon around $O$
${𝐏}_{𝐜}$ (${𝐏}_{𝐜}^{\prime }$/${𝐏}_{𝐜}^{\ast }$)	Delaunay polygon (shifted/scaled)
$C_i$ ($C_i^{\prime }$/$C_i^{\ast }$)	Delaunay polygon vertices (shifted/scaled)
${𝐏}_{𝐯}$ (${𝐏}_{𝐯}^{\prime }$/${𝐏}_{𝐯}^{\ast }$)	Voronoi polygon (shifted/scaled)
$V_i$ ($V_i^{\prime }$/$V_i^{\ast }$)	Voronoi polygon vertices (shifted/scaled)
${𝐀}_{𝐳}$ (${𝐀}_{𝐳}^{\prime }$/${𝐀}_{𝐳}^{\ast }$)	Anonymity zone (shifted/scaled)
$A_i$ ($A_i^{\ast }$)	Anonymity zone vertices (scaled)
$\alpha$	$\frac{2\pi }{n}$, sector angle
$\left|\overline{OX}\right|$	Length of line segment $\overline{OX}$
$\tau$	Range of vertices on a line
$\kappa$	Range of random angle adaption
$r$	User-defined radius of interest
$\lambda$	Scaling factor
$\Psi$	Concealing cost
$\Gamma$	Privacy level

Table 2. Table II : The n 𝑛 n -VDD models. IR - Irregularity. Model α 𝛼 \alpha is not applicable for anonymization.

Model	IR.1 Interior Sifting	IR.2 Exterior Shifting	IR.3 Sector Shifting	Anonymizing Protocol	Generated Polygons
I	$\surd$	-	-	S0 $\to$ R1 $\to$ P1 $\to$ R0	${𝐏}_{𝐜}\to {𝐏}_{𝐯}\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\ast }$
II	-	$\surd$	-	S0 $\to$ P2 $\to$ R1 $\to$ R0	${𝐏}_{𝐜}\to {𝐏}_{𝐜}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\ast }$
III	$\surd$	$\surd$	-	S0 $\to$ P2 $\to$ R1 $\to$ P1 $\to$ R0	${𝐏}_{𝐜}\to {𝐏}_{𝐜}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\ast }$
$\alpha$	-	-	$\surd$	N/A	N/A
Iα	$\surd$	-	$\surd$	S1 $\to$ R1 $\to$ P1 $\to$ R0	${𝐏}_{𝐜}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\ast }$
IIα	-	$\surd$	$\surd$	S1 $\to$ P2 $\to$ R1 $\to$ R0	${𝐏}_{𝐜}^{\prime }\to {𝐏}_{𝐜}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\ast }$
IIIα	$\surd$	$\surd$	$\surd$	S1 $\to$ P2 $\to$ R1 $\to$ P1 $\to$ R0	${𝐏}_{𝐜}^{\prime }\to {𝐏}_{𝐜}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\prime }\to {𝐏}_{𝐯}^{\ast }$

Equations

$${\mathbf{P}}_{\mathbf{v}}^{\prime }=⟨V_0^{\prime }{V}_1^{\prime }...V_{n-1}^{\prime }⟩.$$

$${\mathbf{P}}_{\mathbf{c}}^{\prime }=⟨C_0^{\prime }{C}_1^{\prime }...C_{n-1}^{\prime }⟩.$$

$${\mathbf{P}}_{\mathbf{v}}^{\ast }=⟨V_0^{\ast }{V}_1^{\ast }\dots V_{n-1}^{\ast }⟩.$$

$$|\overline{O{C}_i^{\prime }}|\cos {\alpha }_i<|\overline{O{C}_{i+1}^{\prime }}|<\frac{|\overline{O{C}_i^{\prime }}|}{\cos {\alpha }_i}.$$

$$|\overline{O{C}_i^{\prime }}|\cos {\alpha }_i<|\overline{O{C}_{i+1}^{\prime }}|<\min (\mu |\overline{O{C}_i^{\prime }}|,\frac{|\overline{O{C}_i^{\prime }}|}{\cos {\alpha }_i}).$$

$${\alpha }_i\leftarrow (1\pm ϵ)\alpha ,\forall i=0,\dots ,n-1,$$

Full text

I Introduction

With the help of pervasive global positioning system (GPS) and radio frequency identification (RFID) enabled mobile computing, the market share of location-based services (LBS) is increasing rapidly [6]. Today, people frequently use LBS to find the nearest ATM, restaurant, hospital, or gas station. Social networks, including but not limited to Facebook, LinkedIn and Twitter, as well as Internet telephony service providers such as Skype have all created frameworks for geosocial networking. LBS providers require users to divulge their exact location but guarantee a higher quality of service (QoS) with more accurate location data. If one uses Yelp to look for restaurants in a 15 mile radius, it would not matter if the location data is not as accurate, with the search being conducted in a relatively large area. Conversely, if a user looks to find the nearest gas station, Google Map would require a more accurate location to ensure a higher QoS. A user may enjoy receiving services with higher precisions, but is unaware of the possible exploitations of his/her location data. LBS providers can use this data to understand a user’s mobility pattern, enabling them to send unwanted advertisements; and attackers can perform malicious attacks. This has led to a general consensus that protecting a user’s location privacy is a highly important issue in LBS.

Previous studies have designed location privacy models based on a trade-off between location privacy and QoS. If the degree of privacy is high, then the QoS is low and vice versa. So, it is important to understand this trade-off while designing a LBS privacy model. We classify the previous methods to protect location privacy into three main categories [36]: 1) $k$-anonymity, 2) position dummies, and 3) spatial obfuscation.

In $k$-anonymity, the framework pairs a user’s location with $k$-1 locations of other neighboring users [16, 13, 40, 22, 15, 33, 28] [12, 23, 10] and provides the LBS provider with a box containing that user and the other $k-1$ locations. This approach engenders several problems. It has an inherent dependency on the presence of the other $k-1$ users in the specified region or time. Furthermore, each user cannot have a personalized privacy setting with the settings of the other neighboring users overlapping. Gedik et al. proposed the CliqueCloak theorem [14] to improve the original $k$-anonymity approach that joins multiple queries that overlap together into a clique, and sends the minimum bounding rectangle of those users as a single query. Although it is advantageous in the case of reducing computation time and increasing the privacy of the users, it can fail to join users into a clique. Marius et al. [36] classified several improved methods of $k$-anonymity: strong $k$-anonymity [39, 34], l-diversity [4], $t$-closeness [25], $p$-sensitivity[31], and historical $k$-anonymity [29, 37, 1, 26]. In these schemes, the probability of identifying a user is $1/k$. These approaches also suffer from a high communication and query processing cost [11].

The position dummy based techniques direct multiple fake positions along with user’s true location to location service providers [9, 27, 32, 21, 35, 20]. Hua et al. [27] proposed a dummy-based method, titled PAD, which generates dummy users in a virtual grid or circle. Qilang et al. [32] proposed a user dummy generation based clustering method to provide privacy on road networks. Location obfuscation methods have the advantage of generating dummy locations by itself, unlike the $k$-anonymity based methods. However, generating indistinguishable dummy locations is a challenge for these methods [36].

To address the problems of $k$-anonymity and dummy based methods, some solutions propose spatial obfuscation methods [2, 18, 24, 38, 19, 30, 7, 3, 5], based on the idea of providing a user-defined obfuscation area without revealing explicit location information at the expense of quality of services. Ardagna et al. [2] proposed a method to submit a circle instead of a user’s exact location. Different methods were presented to use other geometric transformations to preserve a user’s location. Kalnis et al. proposed transformations based on the $k$-anonymity concept for nearest neighbor search, while hiding user’s location. Gutscher et al. [18] detailed the use of coordinate transformation to protect a user’s privacy. Min et al. [38] proposed a privacy scheme based on a line-symmetric transformation for database privacy in cloud computing. Li et al. [24] proposed a geometric approach towards location privacy that divides the user’s region of interest (ROI) into $n$ concealing disks ($n$-CD) and submits the centers and the radii of those concealing disks for transmission. Guo et al. [17] extended $n$-CD by introducing dynamic pseudonyms-changing mechanism with the expense of concealing and communication costs. The proposed framework in this work falls into this category, and is comparable to the $n$-CD approach.

I-A Our Approach

In this work, we propose a novel framework based on the classical geometric structure, the so-called Voronoi-Delaunay Duality (VDD). Table I gives the symbols used in the work.

As shown in Fig. 1, we treat the user location $O$ as the center and properly select $n$ discrete points $\mathbf{C}=\{C_{0},C_{1},...,C_{n-1}\}$ ($n\geq 3$) on the Euclidean plane surrounding $O$ to result a Delaunay triangulation $\mathbf{T}$, by connecting edges $C_{i}O$ and $C_{i}C_{i+1}$ ($C_{n}=C_{0}$). Each triangle $\vartriangle C_{i}OC_{i+1}$ satisfies empty circle criterion, i.e., the circumcircle of the triangle doesn’t contain any other point. The Voronoi diagram of $\mathbf{C}\cup\{O\}$ is computed by the perpendicular bisector lines of all the edges of $\mathbf{T}$ and their intersection points $\mathbf{V}=\{V_{0},V_{1},...,V_{n-1}\}$. The Voronoi diagram and the Delaunay triangulation $\mathbf{T}$ are dual to each other. The dual relationship is unique. The VDD gives a two-layered dual structure defined around the user location $O$, including the exterior convex Delaunay polygon $\mathbf{P_{c}}=\langle C_{0}C_{1}...C_{n-1}\rangle$ and the interior convex Voronoi polygon $\mathbf{P_{v}}=\langle V_{0}V_{1}...V_{n-1}\rangle$, as shown in Fig. 1(a). The facts include:

1. $\mathbf{P_{c}}$ and $O$ define the interior $\mathbf{P_{v}}$ uniquely;

2. $\mathbf{P_{v}}$ and $O$ define $\mathbf{P_{c}}$ uniquely; and

3. $\mathbf{P_{c}}$ and $\mathbf{P_{v}}$ define $O$ uniquely.

However, if only $\mathbf{P_{v}}$ and without any other information, one cannot figure out the exact location of the center $O$. But it can give the feasible region containing the user location. Based on the VDD perpendicular rule, we draw the parallel strip perpendicular to each edge of Voronoi cell, the intersecting region of all the parallel strips and the Voronoi cell is a convex polygon $\mathbf{A_{z}}=\langle A_{0}A_{1}...A_{m}\rangle$, where any point may be the user location. This region is the so-called anonymity zone in our framework. Figure 1(a) shows one example when $n=5$ where the anonymity zone $A_{z}$ is within the Voronoi cell, and (b) gives two examples when $n=3,4$, where the anonymity zone is the Voronoi polygon itself. It means that at a Voronoi polygon vertex with corner angle $\leq\pi/2$, the associated perpendicular lines are either outside the Voronoi cell or overlap the Voronoi edges, and then the associated Voronoi polygon edges are used for computing the intersection. Therefore, the interior Voronoi polygon $\mathbf{P_{v}}$ can be used to hide the user location $O$. In the $n$-VDD framework, we submit the Voronoi polygon or its variations to the LBS provider.

The unique degenerated case is that if $\mathbf{P_{c}}$ is a convex regular polygon111In Euclidean geometry, a regular polygon is a polygon that is equiangular and equilateral. taking $O$ as the centroid, then the $\mathbf{P_{v}}$ is regular with the same centroid, as shown in Fig. 2. In this case, if there is such a principle in the protocol public to users/attackers: $\mathbf{P_{c}}$ is regular around $O$, then $O$ can be easily recovered from $\mathbf{P_{v}}$, i.e., the centroid of $\mathbf{P_{v}}$. To conquer this, our strategy is to introduce irregularity to the VDD structure of a convex regular polygon, in detail, by shifting the exterior polygon $\mathbf{P_{c}}$, or interior polygon $\mathbf{P_{v}}$, or both, to be irregular. The following three models are given to demonstrate the performance of the $n$-VDD framework.

Model I - Interior Shifting.

$\mathbf{P_{c}}$ is a regular $n$-sided convex polygon with the centroid at $O$. We adapt the corresponding Voronoi cell $\mathbf{P_{v}}$ to be irregular by parallelly shifting each Voronoi edge along the dual Delaunay edge while keeping all the Voronoi cell vertices within each original sector and $\mathbf{P_{c}}$. The shifting position is uniformly and randomly selected within a range calculated based on the above condition, which guarantees the user location $O$ is included in the shifted Voronoi cell.

Model II - Exterior Shifting.

We shift $\mathbf{P_{c}}$ to be an irregular $n$-sided convex polygon around $O$ such that the corresponding triangulation $\mathbf{T}$ is still Delaunay. The resulted Voronoi cell $\mathbf{P_{v}}$ is also irregular. For each Delaunay vertex $C_{i+1}$, we compute the valid range on its sector ray such that the Voronoi vertex $V_{i}$ is within the corresponding sector $\sphericalangle C_{i}OC_{i+1}$, and then we randomly and uniformly select a point in the valid range as $C_{i+1}$.

Model III - Double Shifting.

We first shift $\mathbf{P_{c}}$ to be an irregular $n$-sided convex polygon around $O$ as Model II, to guarantee the corresponding triangulation $\mathbf{T}$ is Delaunay, and then we shift the resulted Voronoi cell $\mathbf{P_{v}}$ as Model I. This is a combination of Models I, II. Generally, both the exterior and interior polygons are irregular.

Sector Shifting

Another aspect to generate irregularity from the convex polygon is to shift the sector rays to make the sector angles not equal. We integrate the sector shifting operation into the above three Models I, II and III, to generate three variation Models Iα, IIα and IIIα accordingly. In each anonymizing model, we first randomly and uniformly perturb the sector rays in a range to achieve the sector angle inequality, and then apply other anonymizing principles. Note that the randomness of sector rays itself on a convex regular polygon can generate an irregular convex polygon with the same sector radius. The resulted Voronoi cell is irregular. We call this Model $\alpha$. However, it can not be used for anonymization. That is because the center $O$ can be easily calculated by the intersection of the bisectors of two Voronoi edges due to the property of the same sector radius, as shown in Fig. 3 with a simulation example. Therefore, only angle randomness on the convex regular polygon is not enough for hiding the user location.

In summary, there are three irregularity principles to adapt the convex regular polygon to achieve irregular VDD structures, (1) interior shifting, (2) exterior shifting and (3) sector shifting. The combinations of the three can form totally 7 models (see Table II), among which the Model $\alpha$ is not applicable for anonymization, and other 6 Models I, II, III, Iα, IIα, and IIIα are to be used for anonymization (see Figs. 4, 5 and 6). Details will be explained in later sections.

In this framework, the scaled Voronoi cell $\mathbf{P_{v}^{*}}$ of the shifted Voronoi cell $\mathbf{P_{v}^{\prime}}$ will be used as the concealing space $\Omega_{cs}$ of the user, which hides the user location and is submitted to the LBS providers. The area of the anonymity zone $\mathbf{A_{z}^{*}}$ resulted from the concealing space $\mathbf{P_{v}^{*}}$, is defined as the privacy level. Thus, bigger concealing space generates bigger anonymity zone and higher privacy level for the user location privacy.

When the user submits a query of places of interest within a circular range $r$, the query area is $\tau_{0}=\pi r^{2}$. We compute the closest distance $d_{0}$ to the edges of the originally generated $\mathbf{P_{v}^{\prime}}$ and define the scalar $\lambda_{v}=\frac{r}{d_{0}}$, and then transform the Voronoi polygon $\mathbf{P_{v}^{\prime}}$ by a scaling operation with scalar $\lambda_{v}$ and the user location $O$ as the origin. The transformed Voronoi polygon, i.e., the final concealing space, is denoted as $\mathbf{P_{v}^{*}}=\lambda_{v}\mathbf{P_{v}^{\prime}}$, which covers the query region with radius $r$, as shown in Fig. 7. Users also have flexibility to customize the privacy level in the system by setting the expected anonymity range $\iota$. Then, similarly, we compute a scalar $\lambda_{z}=\frac{\iota}{d_{0}}$, and transform the Voronoi polygon to be $\mathbf{P_{v}^{*}}=\lambda_{z}\mathbf{P_{v}^{\prime}}$ by a $\lambda_{z}$-scaling around $O$. If the user customizes both privacy level and concealing space, we use compute $\mathbf{P_{v}^{*}}=\max(\lambda_{v},\lambda_{z})\mathbf{P_{v}^{\prime}}$.

All the computations are constructive by using planar geometry and linear algebra, and therefore are efficient.

I-B Contributions

In this work, we present a novel location privacy framework, named $n$-VDD, based on the unique discrete geometric structure Voronoi-Delaunay Duality (VDD). In detail,

• •

Six models are proposed, to introduce irregularity to convex regular VDD structure.

• •

The concealing space is derived from the Voronoi polygon. The privacy level can be customized.

• •

The method is efficient by utilizing the planar VDD, where computations are linear line-line intersections.

The rest of the paper is organized as follows: Section II describes the system model, Section III presents the algorithms of the $n$-VDD models, Section IV details the application settings, experiments and discussions, and finally Section V concludes the paper.

II $n$-VDD Location Privacy Protection Model

In this section, we first review the background knowledge of VDD, and then describe the VDD-based system for location privacy protection and the anonymizing protocol, and finally perform the attack analysis.

II-A Background

II-A1 Voronoi-Delaunay Duality (VDD)

Voronoi diagram and Delaunay triangulation are the classical geometric structures in computational geometry [8]. The Voronoi diagram of a point set $\mathbf{C}$ of $n$ points in the plane is a subdivision of the plane into $n$ Voronoi cells, such that each Voronoi cell around $C_{i}\in\mathbf{C}$ is the set of all points from which $C_{i}$ is the closest among all other points in $\mathbf{C}$. The dual of the Voronoi diagram is a unique triangulation, known as the Delaunay triangulation. A triangulation is Delaunay means that it satisfies the empty circumcircle criterion, i.e., for any triangle, its circumcircle doesn’t contain any other point, such triangle is called Delaunay triangle. The optimal time complexity for constructing Voronoi diagram and Delaunay triangulation is $O(n\log n)$, and the dual conversion between them costs $O(n)$.

II-A2 Local Structures

In our model, we require a proper exterior polygon such that the triangulation $T$ obtained by connecting each vertex of the polygon to the user location $O$ is Delaunay. Once the exterior polygon is fixed, the VDD structure is determined. Based on the VDD property, three convex polygons surrounding $O$ are generated, as follows:

• •

Delaunay Polygon $\mathbf{P_{c}}=\langle C_{0}C_{1}...C_{n-1}\rangle$, the convex boundary polygon of the Delaunay triangulation $\mathbf{T}$.

• •

Voronoi Polygon $\mathbf{P_{v}}=\langle V_{0}V_{1}...V_{n-1}\rangle$, the convex polygon generated by applying the VDD principle on $\mathbf{T}$.

• •

Anonymity Zone $\mathbf{A_{z}}=\langle A_{0}A_{1}...A_{n-1}\rangle$, the convex polygon generated by the intersection of the perpendicular strips for the edges of Voronoi polygon.

We start from the Voronoi-Delaunay structure of the convex regular $n$-sided polygon using $O$ as the center, and make variations to the structure to introduce irregularity. We adapt the exterior Delaunay polygon or/and interior Voronoi polygon to be irregular, which guarantees that the anonymity zone is a convex region, not a single point. Different variations induce different anonymizing protocols. The $n$-VDD framework may have other variations by introducing different irregularities.

II-B System Model

In a typical LBS system, a user generates a query $q_{0}$ which is a tuple of his/her identification, the location $O=(x,y)$, the radius of the neighborhood $r$, and the points of interests (POI) $I$, such as the gas stations, ATMs and so on. That is, $q_{0}=\langle u_{id},\langle(x,y),r\rangle,I\rangle$. This query is transmitted to a local anonymizer engine which generates the concealing space (i.e., adapted Vononoi polygon), and based on the query framework, the concealing space is transmitted to LBS system.

• •

Model I: exterior polygon $\mathbf{P_{c}}$ is convex regular; interior Voronoi polygon is shifted to be irregular. The interior polygon generated by shifting is denoted as

[TABLE]

• •

Model II: exterior convex regular polygon $\mathbf{P_{c}}$ is shifted to be irregular. The exterior polygon generated by shifting is denoted as

[TABLE]

The interior Voronoi polygon $\mathbf{P_{v}^{\prime}}$ of $\mathbf{P_{c}^{\prime}}$ is irregular.

• •

Model III: exterior polygon is shifted to be irregular $\mathbf{P_{c}^{\prime}}$; the interior Voronoi polygon of $\mathbf{P_{c}^{\prime}}$ is shifted to $\mathbf{P_{v}^{\prime}}$.

Suppose the area of the finally resulted interior polygon $\mathbf{P_{v}^{\prime}}$ in each model is denoted as $\tau_{v}$. According to the closest distance $d_{0}$ to the edges of the originally generated $\mathbf{P_{v}}$, we compute a scaling transformation of the $\mathbf{P_{v}^{\prime}}$ with scalar $\lambda_{v}=\frac{r}{d_{0}}$ ($O$ as the origin), denoted as $\mathbf{P_{v}^{*}}=\lambda_{v}\mathbf{P_{v}^{\prime}}$. $\mathbf{P_{v}^{*}}$ is the final concealing space,

[TABLE]

Then the original query $q_{0}$ becomes $q_{v}=\langle u_{id},\mathbf{P_{v}^{*}},I\rangle.$

The user may also set privacy level $\rho_{0}$, defined by the expected the anonymity radius parameter $\iota$, $\rho_{0}=\pi\iota^{2}$. In this case, the original query $q_{0}=\langle u_{id},\langle(x,y),r,\iota\rangle,I\rangle$. Similarly, we compute a scalar $\lambda_{z}=\frac{\iota}{d_{0}}$. Then we have $\mathbf{P_{v}^{*}}=\max(\lambda_{v},\lambda_{z})\mathbf{P_{v}^{\prime}}$. If the user only cares about the customized privacy level, then $\mathbf{P_{v}^{*}}=\lambda_{z}\mathbf{P_{v}^{\prime}}$.

II-C Anonymizing Protocol

The anonymizing protocols are generally public to audience. The followings are the common principles for all models:

• •

R0 - Scaling: The submitted concealing space denoted as $\mathbf{P_{v}^{*}}$ is obtained by a $\lambda$-scaling of a convex polygon $\mathbf{P_{v}^{\prime}}$ around the user location. The $\lambda$ is computed based on the user’s requirements on privacy level and range of interest.

• •

R1 - Voronoi-Delaunay Duality: The convex polygon $\mathbf{P_{v}^{\prime}}$ has a dual convex polygon $\mathbf{P_{c}^{\prime}}$: 1) each edge has a perpendicular dual edge; 2) all the dual edges intersect at the user location; and 3) all other endpoints of the dual edges are outside $\mathbf{P_{v}^{\prime}}$ and form $\mathbf{P_{c}^{\prime}}$, $\mathbf{P_{c}^{\prime}}\supset\mathbf{P_{v}^{\prime}}$. For each edge of $\mathbf{P_{v}^{\prime}}$, a feasible strip is computed, which is perpendicular to the edge and exactly bounds it. The intersection of the feasible strips of all the edges is a convex feasible region, denoted as $\mathbf{A_{z}}$. Similarly, the final anonymity zone $\mathbf{A_{z}^{*}}$ can be computed from $\mathbf{P_{v}^{*}}$. $\mathbf{A_{z}^{*}}$ differs from $\mathbf{A_{z}}$ by a scalar $\lambda$, which is $\lambda_{z}$ or $\lambda_{v}$.

The exterior polygon $\mathbf{P_{c}}$ can be convex regular (equiangular and equilateral) or irregular with different sector angles, then there are the following alternative principles:

• •

S0 - Sector Uniformization: The polygon $\mathbf{P_{c}}$ is convex and regular taking the user location $O$ as the centroid, and forms a Delaunay triangulation by connecting each vertex of $\mathbf{P_{c}}$ to $O$, which defines sector rays. Then, the resulted dual Voronoi polygon $\mathbf{P_{v}}$ around $O$ is constructed by the perpendicular bisector intersections, and is regular.

• •

S1 - Sector Shifting: The sector rays of the original exterior polygon $\mathbf{P_{c}}$ are randomly shifted in a range to generate a new exterior polygon $\mathbf{P_{c}^{\prime}}$, such that each vertex of the resulted dual Voronoi polygon $\mathbf{P_{v}^{\prime}}$ is shifted within its corresponding sector.

Besides the above, each model has its own principle:

• •

P1 - Interior Shifting: The exterior polygon $\mathbf{P_{c}}$ and $O$ form a Delaunay triangulation by sector rays. The interior polygon $\mathbf{P_{v}^{\prime}}$ is generated by randomly shifting each edge of the Voronoi cell $\mathbf{P_{v}}$ of $\mathbf{P_{c}}$ in parallel, such that each vertex of $\mathbf{P_{v}^{\prime}}$ is shifted within its original sector.

• •

P2 - Exterior Shifting: The exterior polygon $\mathbf{P_{c}^{\prime}}$ is generated by shifting each vertex of the original polygon $\mathbf{P_{c}}$ along its sector ray, such that each vertex of the resulted Voronoi polygon $\mathbf{P_{v}^{\prime}}$ is shifted within its original sector.

• •

P3 - Double Shifting (P1,P2): The exterior polygon $\mathbf{P_{c}^{\prime}}$ is generated by shifting the vertices of the original $\mathbf{P_{c}}$ along sector rays, and the resulted Voronoi edges are shifted in parallel to form the interior polygon $\mathbf{P_{v}^{\prime}}$, such that each vertex of $\mathbf{P_{v}^{\prime}}$ is shifted within its original sector. It is the combination of P1 and P2.

Table II gives the anonymizing pipeline in each model.

II-D Attack Analysis

We analyze the ability of the VDD models to protect the user location $O$ from the attacker. Suppose the query message $q_{v}$ is obtained by the attacker. Then the attacker has:

• •

An $n$-sided convex irregular polygon $\mathbf{P_{v}^{*}}$, which is a scaled (shifted) Voronoi polygon hiding the user location;

• •

An anonymizing protocol, one of Table II.

II-D1 Protocol Attack

Attacking can be tried by reversing the anonymizing process and analyzing each principle. The common principles are analyzed as follows:

• •

R0*-1* - Scaling: The scaling uses the user location as the origin, which guarantees the user location is always within $\mathbf{P_{v}^{*}}$, and the shape of $\mathbf{P_{v}^{*}}$ is similar to that of the resulted interior polygon $\mathbf{P_{v}^{\prime}}$ in all the models.

• •

R1*-1* - Voronoi-Delaunay Duality: For each edge of $\mathbf{P_{v}^{*}}$, we can find a feasible strip which is perpendicular to the edge and exactly bounds the edge. The intersection of all the feasible strips forms the anonymity zone $\mathbf{A_{z}^{*}}$. For any point $o\in\mathbf{A_{z}^{*}}$, we find the point $C_{i}^{*}$ for edge $V_{i-1}^{*}V_{i}^{*}$ of $\mathbf{P_{v}^{*}}$ such that $V_{i-1}^{*}V_{i}^{*}$ is the perpendicular bisector of $oC_{i}^{*}$. All the $C_{i}^{*}$’s form the exterior Delaunay polygon $\mathbf{P_{c}^{*}}$ (see Fig. 1). The Delaunay edges $C_{i-1}^{*}C_{i}^{*}$ exist and are uniquely determined. Therefore, every point in the anonymity zone has a VDD structure satisfying principle R1, and could be the user location $O$.

Principles specific to each model are analyzed as follows:

• •

S0*-1* - Sector Uniformization: From S0, the surrounding angles around the user location are identical to be $\frac{2\pi}{n}$, where $n$ is the number of vertices of $\mathbf{P_{v}^{*}}$ (convex). For any point $o\in\mathbf{A_{z}^{*}}$, we draw the perpendicular lines to all the edges of $\mathbf{P_{v}^{*}}$ and the angles surrounding $o$ won’t change when we shift the point within $\mathbf{A_{z}^{*}}$.

• •

(S0, P1)-1 - Interior Shifting: From P1, irregular $\mathbf{P_{v}^{*}}$ is obtained by shifting the regular Voronoi polygon, which takes the user location as the centroid/center. Given any point $o\in\mathbf{A_{z}^{*}}$, by shifting back the edges of $\mathbf{P_{v}^{*}}$, it is guaranteed to generate a regular polygon to induce a Delaunay polygon by R1. Therefore, every point in the anonymity zone satisfies principles (S0, P1) (Model I).

• •

(S0, P2)-1 - Exterior Shifting: For any point $o\in\mathbf{A_{z}^{*}}$, the Delaunay polygon $\mathbf{P_{c}^{*}}$ resulted from the irregular $\mathbf{P_{v}^{*}}$ is unique and irregular (by R1). From S0, all surrounding angles at $o$ are equal. Then by shifting the edges of $\mathbf{P_{c}^{*}}$, it is guaranteed to generate a regular polygon taking $o$ as the centroid. That means every point in the anonymity zone satisfies principles (S0, P2) (Model II).

• •

(S0, P3)-1 - Double Shifting: For any point $o\in\mathbf{A_{z}^{*}}$, the Delaunay polygon $\mathbf{P_{c}^{*}}$ is uniquely computed (by R1). We shift $\mathbf{P_{v}^{*}}$ with a random range to $\mathbf{P_{v}^{\prime}}$ and then update the Delaunay polygon to be $\mathbf{P_{c}^{\prime}}$. By shifting $\mathbf{P_{c}^{\prime}}$, it is guaranteed to generate a regular polygon which takes $o$ as the centroid. That means every point in the anonymity zone satisfies principles (S0, P3) (Model III).

• •

S1*-1* - Sector Shifting: From S1, the surrounding angles around the user location are unequal, and $\mathbf{P_{v}^{*}}$ is irregular. For any point $o\in\mathbf{A_{z}^{*}}$, we compute the Delaunay polygon $\mathbf{P_{c}^{*}}$ of $\mathbf{P_{v}^{*}}$ by R1. The angles around $o$ can be computed and won’t change if shifting the point within $\mathbf{A_{z}^{*}}$.

• •

(S1, P1)-1 - Sector & Interior Shifting, (S1, P2)-1 - Sector & Exterior Shifting, (S1, P3)-1 - Sector & Double Shifting: For any point $o\in\mathbf{A_{z}^{*}}$, the Delaunay polygon $\mathbf{P_{c}^{*}}$ is uniquely computed (by R1). Shifting $\mathbf{P_{v}^{*}}$, $\mathbf{P_{c}^{*}}$, or both won’t influence the surrounding angles, and also won’t generate a regular polygon. Therefore, every point in the anonymity zone satisfies corresponding principles (Models Iα-IIIα).

Therefore, in all Models I-III, Iα-IIIα, every point in the anonymity zone could be the user location, and the attackers cannot differentiate the points in the anonymity zone.

II-D2 Centroid Attack

Centroid is easy to compute for a given polygon. Here, we need analyze whether the centroid can be used for the attack.

First of all, all the anonymizing protocols introduce the irregularity, so that the centroid of the submitted Voronoi polygon $\mathbf{P_{v}^{*}}$ (concealing space), denoted as $C_{Pv}$, is not guaranteed to coincide with the user location. In Models I-III, $\mathbf{P_{v}^{*}}$ is with equal sector angles, and the centroid of interior/exterior regular polygon in a VDD structure gives the user location, however, the centroid of irregular $\mathbf{P_{v}^{*}}$ is not the user location. In Models Iα-IIIα, there is no guarantee that the centroid of irregular $\mathbf{P_{v}^{*}}$ is the user location. Therefore, direct concealing space centroid attack can be avoided for each model. To verify this, we generated $1000$ irregular polygons by random shifting the vertices along the sector rays (exterior vertex shifting), and computed the centroids. Figure 8 gives two examples of the distribution of the centroids around the user location $O$ (top), and also plots the average distance from $O$ for $n=3..10$. It is observed that the centroid $C_{Pv}$ is away from the user location $O$ in general case.

After generating the anonymity zone $\mathbf{A_{z}^{*}}$ from $\mathbf{P_{v}^{*}}$, is it possible to use the centroid of $\mathbf{A_{z}^{*}}$, denoted as $C_{Az}$, to reveal the user location? Similarly, $C_{Az}\in\mathbf{A_{z}^{*}}$, $C_{Az}$ is not guaranteed to coincide with the user location. Similar experiments verified that. Then, will the two centroids, $C_{Pv}$ and $C_{Az}$, give a hint to shrink the range? First, $C_{Pv}$ can be inside or outside $C_{Pv}$, there is no fixed relationship between their positions, as shown in Fig. 9 (top). We then create a circle passing through the two centroids and using the segment between them as the diameter, and detect whether the circle includes the user location $O$. Figure 9 (bottom) shows that the only a low portion (less than $23\%$) of the 1000 examples in the cases of $n=5..10$ has the user location in the circle of the two centroids. That means the circle cannot be used to replace or shrink $\mathbf{A_{z}^{*}}$.

III Computational Algorithms

This section details the computation of the anonymizing process and the anonymity zone for the proposed models. They share the same algorithms for the common anonymizing principles R0 (scaling) , R1 (VDD), and have different algorithms for their specific principles.

III-A Common Algorithms

III-A1 Voronoi Polygon

The Voronoi polygon $\mathbf{P_{v}}$ is generated from the Delaunay triangulation $\mathbf{T}$ formed by the Delaunay polygon $\mathbf{P_{c}}$ and the seed $O$ (user location). Each vertex $V_{i}$ of $\mathbf{P_{v}}$ is the intersection of perpendicular bisector lines of line segments $\overline{OC_{i}}$ and $\overline{OC_{i+1}}$ ($\overline{OC_{n}}=\overline{OC_{0}}$) (see Fig. 1).

III-A2 Anonymity Zone

From a given Voronoi polygon $\mathbf{P_{v}}$, the anonymity zone (feasible Region) $\mathbf{A_{z}}$ is generated by computing the intersecting region of the parallel strips, which are perpendicular to and bounded by the Voronoi edge $\overline{V_{i}V_{i+1}}$. Any point in $\mathbf{A_{z}}$ could be a feasible solution to the seed $O$. In detail, assume $\overline{L_{i}}$, $\overline{L_{i+1}}$ are the perpendicular lines at $V_{i}$, $V_{i+1}$, respectively, and the parallel strip is denoted as $\mathbf{\Gamma}_{i+1}=\overline{L_{i}}\wedge\overline{L_{i+1}}$. Then $\mathbf{A_{z}}=\cap\{\mathbf{\Gamma}_{i}\},\forall i=0,\ldots,n-1$.

III-A3 Scaling

After getting the interior (shifted) Voronoi polygon $\mathbf{P_{v}^{\prime}}$ and its anonymity zone $\mathbf{A_{z}^{\prime}}$, we perform a scaling transformation using the user location $O$ as the origin with a scaling factor $\lambda$. $\lambda$ can be computed in different ways according to the user query about the ROI radius or the privacy level or both, as reported in Section II-B. Therefore, the obtained concealing space $\mathbf{P_{v}^{*}}=\lambda\mathbf{P_{v}^{\prime}}$.

III-B Model I - Interior Shifting

Model I introduces the irregularity to the interior Voronoi polygon by shifting the Voronoi edges in their corresponding feasible ranges to guarantee the Voronoi vertices are still in their original sectors (to grantee $O\in\mathbf{A_{z}^{\prime}}$).

Algorithm 1 shows the computation pipeline. We first generate a regular polygon using the user location as the centroid and compute the Voronoi polygon based on Voronoi-Delaunay duality, then shift the Voronoi edges to generate an irregular Voronoi polygon, and finally scale the shifted Voronoi polygon and submit the result to LBS providers.

In detail, after getting the regular Voronoi polygon, we fix the first Voronoi edge $e_{0}^{\prime}=e_{0}$, and shift the left Voronoi edges $e_{i}=\overline{V_{i}V_{i+1}}$ to the new one $e_{i}^{\prime}$ one by one. For each Voronoi edge $e_{i}$, the shift range is determined by the previous Voronoi edge $e_{i-1}^{\prime}$. For the last Voronoi edge $e_{n-1}$, the shift range is determined by both $e_{0}$ and $e_{n-2}^{\prime}$.

As shown in Fig. 10, $e_{i}^{\prime}$ is extended to intersect $\overline{OC_{i}}$ and $\overline{OC_{i+1}}$ at $t_{i}$, $t_{i+1}$, respectively. From $t_{i}$, we issue a ray perpendicular to $\overline{OC_{i}}$ which intersects $\overline{OC_{i+1}}$ at $t_{i+1}^{\prime}$. Then the range $\tau_{i+1}=[t_{i+1}^{\prime},t_{i+1}]$. The position witihn this range can guarantee the new Voronoic polygon vertex $V_{i}^{\prime}=e_{i}^{\prime}\cap e_{i+1}^{\prime}$ is within the Delaunay triangle $\bigtriangleup C_{i}OC_{i+1}$. For the last Voronoi edge $e_{n-1}$, we compute the range $\tau_{n-1}$ determined by $e_{n-2}^{\prime}$, and the range $\tau_{0}$ determined by $e_{0}^{\prime}$. Therefore, $\tau_{n-1}\leftarrow\tau_{n-1}\cap\tau_{0}$. The uniformly and randomly selected Voronoi edge $e_{n-1}^{\prime}$ within the range $\tau_{n-1}$ intersects $e_{n-2}^{\prime}$ and $e_{0}^{\prime}$ and produces $V_{n-2}^{\prime}$ and $V_{n-1}^{\prime}$, respectively. Then the resulted shifted Voronoi cell is $\mathbf{P_{v}^{\prime}}=\langle V_{0}^{\prime}V_{1}^{\prime}\ldots V_{n-1}^{\prime}\rangle$.

For the case of $n=3$ or $4$, the Voronoi polygon is a triangle or rectangle, then the anonymity zone is itself. They give very strong and interesting results, where the attacker can do nothing for predicting the user location. In addition, the probability to generate a regular shifted Voronoi polygon with $n$ random numbers is very low and almost won’t happen. We never met this situation in our large amounts of experiments. In order to make it for sure, one may add a regularity test to avoid this case. Figure 4 shows the simulation results, which include three layers of polygons, $\mathbf{P_{c}}$, $\mathbf{P_{v}^{\prime}}$ and $\mathbf{A_{z}^{\prime}}$. Figure 11 gives the histograms of the distances from the shifted Voronoi edge to the user location $O$ by generating 200 5-sided polygons, to show the irregularity generated by Voronoi edge (interior) shifting. Note that in the original convex regular polygon $\mathbf{P_{c}}$ with sector radius 1.0, the distance of Voronoi edge to the center $O$ is identical to be 0.5.

III-C Model II - Exterior Shifting

Model II introduces irregularity to the exterior Delaunay polygon by shifting the regular Delaunay polygon vertices along their corresponding sector rays within a shifting feasible range, so that the resulted Voronoi polygon is irregular.

Algorithm 2 gives the computation pipeline. We first generate an irregular Delaunay polygon around the user location, then compute the Voronoi polygon, and finally scale the Voronoi polygon and submit the result to LBS provides.

We first select one point in the neighborhood of the user location $O$ as the vertex $C_{0}^{\prime}$. We generate the vertices $C_{i}^{\prime}$ one by one. Here, we set the sector angles to be equal, $\alpha_{i}=\alpha=\frac{2\pi}{n}$. The range for $C_{i+1}^{\prime}$ is determined by $C_{i}^{\prime}$ to guarantee the Voronoi vertex $V_{i}^{\prime}$ is within the triangle $\bigtriangleup C_{i}^{\prime}OC_{i+1}^{\prime}$. Similarly, the last vertex $C_{n-1}^{\prime}$ is determined by both $C_{0}^{\prime}$ and $C_{n-2}^{\prime}$.

As shown in Fig. 12, by VDD, we have $|\overline{OM}|=\frac{1}{2}|\overline{OC_{i}^{\prime}}|$, $|\overline{ON}|=\frac{1}{2}|\overline{OC_{i+1}^{\prime}}|$, $|\overline{XM}|\perp|\overline{OC_{i}^{\prime}}|$, and $|\overline{YN}|\perp|\overline{OC_{i+1}^{\prime}}|$. In addition, $|\overline{OM}|=|\overline{OX}|\cos{\alpha_{i}}$, and $|\overline{ON}|=|\overline{OY}|\cos{\alpha_{i}}$. In order to keep the intersection of $|\overline{OC_{i}^{\prime}}|$ and $|\overline{OC_{i+1}^{\prime}}|$ in the sector $\sphericalangle C_{i+1}^{\prime}OC_{i}^{\prime}$, the following conditions must hold:

$|\overline{ON}|<|\overline{OX}|$: then $|\overline{ON}|<\frac{|\overline{OM}|}{\cos{\alpha_{i}}}$ $\Rightarrow|\overline{ON}|<\frac{|\overline{OC_{i}}|}{2cos{\alpha_{i}}}$ $\Rightarrow\frac{|\overline{OC_{i+1}}|}{2}<\frac{|\overline{OC_{i}}|}{2\cos{\alpha_{i}}}$ $\Rightarrow|\overline{OC_{i+1}}|<\frac{|\overline{OC_{i}}|}{\cos{\alpha_{i}}}$. 2. 2.

$|\overline{OM}|<|\overline{OY}|$: then $|\overline{OC_{i+1}^{\prime}}|>|\overline{OC_{i}^{\prime}}\cos{\alpha_{i}}|$, similarly.

So, we have the inequality

[TABLE]

For $n\geq 5$, $\alpha_{i}<\pi/2$. For $n=3,4$, the angle is close to or greater than $\pi/2$, then the upper bound will be very large or no intersection. So we give a parameter $\mu$ to constrain the range. Therefore, we have

[TABLE]

For the last vertex $C_{n_{1}}^{\prime}$, we take the intersection of the ranges based on $C_{0}^{\prime},C_{n-2}^{\prime}$ using the similar strategy. Then the resulted irregular Delaunay polygon is $\mathbf{P_{c}^{\prime}}=\langle C_{0}^{\prime}C_{1}^{\prime}\ldots C_{n-1}^{\prime}\rangle$. Similarly, for $n=3,4$, $\mathbf{P_{c}^{\prime}}$ is a triangle or rectangle (see Fig. 1), and $\mathbf{A_{z}^{\prime}}$ is $\mathbf{P_{c}^{\prime}}$ itself. Figure 5 shows more simulation results, which include three layers of polygons, $\mathbf{P_{c}^{\prime}}$, $\mathbf{P_{v}^{\prime}}$ and $\mathbf{A_{z}^{\prime}}$.

III-D Model III - Double Shifting

Model III introduces the irregularity to both the exterior Delaunay polygon and interior Voronoi polygon. We first shift the exterior polygon to $\mathbf{P_{c}^{\prime}}$ using Algorithm 1, then compute the VDD on $\mathbf{P_{c}^{\prime}}$ to get the irregular Voronoi polygon $\mathbf{P_{v}^{\prime}}$, and finally update $\mathbf{P_{v}^{\prime}}$ by shifting using Algorithm 2. Figure 6 shows the simulation results, which include three layers of polygons, $\mathbf{P_{c}^{\prime}}$, $\mathbf{P_{v}^{\prime}}$ and $\mathbf{A_{z}^{\prime}}$.

III-E Models $\alpha$, Iα, IIα, IIIα - Sector Shifting

Models Iα, IIα, IIIα introduce another dimension of irregularity by shifting sector rays from the original equal divisions ($\alpha=\frac{2\pi}{n}$) while generating $n$ sectors. The surrounding angles are computed as follows:

[TABLE]

where a random number $\epsilon=Rand[0,\kappa]$, and we select $\kappa\in\{0,0.02,0.04,0.06,0.08,0.1\}$ in our experiments. The sector shifting (on sector rays) is not conflict with the previous interior/exterior shifting (on vertices/edges with fixed sector rays). Once we get the exterior polygon with random sector sifting, we then perform the algorithms of Models I-III to generate the result. Figures 4, 5 and 6 show the simulation results, which include three layers of polygons, $\mathbf{P_{c}^{\prime}}$, $\mathbf{P_{v}^{\prime}}$ and $\mathbf{A_{z}^{\prime}}$. For $n=4$, the interior polygon $\mathbf{P_{c}^{\prime}}$ is not a rectangle because of the unequal sector angles and the perpendicular lines at vertices with acute corner angle are outside $\mathbf{P_{c}^{\prime}}$, as shown in Fig. 13.

III-F Analysis

The following guarantees that the obtained anonymity zone is qualified to protect user location from attacking.

Lemma 1

The seed $O$ is within the anonymity zone.

Proof: Based on the definition of Voronoi-Delaunay duality, the Voronoi edge $\overline{V_{i}V_{i+1}}$ is the perpendicular bisector of the sector ray $\overline{OC_{i+1}}$, and the Voronoi vertices $V_{i},V_{i+1}$ are in the two sides of $\overline{OC_{i+1}}$, respectively. According to the construction of the anonymity zone, the seed $O$ is within the feasible strip $\mathbf{\Gamma}_{i}$, $O\in\Gamma_{i}$, and $\mathbf{A_{z}}=\cap\{\mathbf{\Gamma}_{i}\}$. Thus $O\in\mathbf{A_{z}}$. Proof for the finally generated irregular $\mathbf{A_{z}^{\prime}}$ is similar.

Lemma 2

The probability of any point in anonymity zone to be the seed $O$ is equally likely.

Proof: According to Lemma 1, given the anonymity zone $\mathbf{A_{z}}$, the user location $O\in\mathbf{A_{z}}$. Using the conclusions in attack analysis Section II-D for all the models, every point in the anonymity zone could be the user location. In theory, if the sampling resolution of the anonymity zone goes to infinity, then the probability of revealing the exact location of $O$ goes to zero. In practice, if it is known that there are $M$ points in $\mathbf{A_{z}}$ for attempting, then the probability of identifying the user is $\frac{1}{M}$; if no such preconditions, the probability to reveal $O$ is infinitely small (zero). With the same sampling resolution, the greater the area of anonymity zone $Area(\mathbf{A_{z}})$ (the greater $M$), the more difficult to reveal the seed.

Lemma 3

The anonymity zone area decreases with the increase of $n$, for the same radius of interest $r$.

Proof: According to Lemma 1, anonymity zone is the intersection region of all the lines drawn at Voronoi vertices and perpendicular to Voronoi edges. So, the number of the perpendicular lines are $2n$. With the increase of $n$, a convex polygon tends to be more circular, then the resulted (shifted) Voronoi edges become shorter, the perpendicular strips become narrower, and therefore, the area of the intersections of perpendicular strips (anonymity zone) decreases. This can also be observed in Fig. 19.

IV Performance Evaluation

In this section, we evaluate the proposed $n$-VDD models in terms of the main principles: privacy level $\Gamma$, concealing cost $\Psi$, and communication cost $\Omega$. We demonstrate the efficiency and efficacy of the $n$-VDD models by experimental simulations and comparison.

IV-A Experimental Setup

We first consider a network region, with a square area of $10^{4}m\times 10^{4}m$. The location of the user is randomly picked within this region. The user’s region of interests (ROI) with a radius will always be within this network region. The different parameters used to evaluate the performance of the proposed methods include the number of vertices $n$, the range for random angle shifting $\kappa$, and the expected neighborhood radius around the user or of the region of interest $r$ (meter). We apply this parameter setting to test all the models. For each combination of these parameters, we perform 1000 iterations of the algorithm and then compute the average value of concealing cost and privacy level to generate the statistics.

IV-B Concealing Cost, Privacy Level

We define the concealing cost $\Psi$ as the measurement of the area of the concealing space, i.e., the scaled Voronoi polygon $\mathbf{P_{v}}^{*}$, for all the models. We then define the privacy level $\Gamma$ as the measurement of the area of the anonymity zone, i.e., the scaled most interior polygon $\mathbf{A_{z}}^{*}$.

IV-B1 Impact of Radius of ROI

In theory, with the increase of the radius $r$ of ROI, the concealing cost $\Psi$ and the privacy level $\Gamma$ will linearly increase. This can be easily explained in our method as follows: in our settings, we set the initial radius as $r_{0}=1.0$. Then after generating the shifted Voronoi polygon $\mathbf{P_{v}}^{\prime}$, we adapt it to get the concealing space by a linear scaling with scalar $\lambda$ (linear to the customized $r$) to cover the ROI. Therefore, we have the linear theoretic claim. As shown in Fig. 14, an almost similar upward linear trend of $\Psi$ and $\Gamma$ appears for different $n$ over $r$ (Model I). Other $n$-VDD models have similar results.

IV-B2 Impact of Number of Vertices $n$

We analyze the concealing cost $\Psi$ and the privacy level $\Gamma$ with different $n$ for all the models. As shown in Fig. 15, $\Psi$ decreases when $n$ changes from 3 to 5, but increases when $n$ increases above 5, while $\Gamma$ decreases with the increase of $n$ from 3 (Model I). The plots for other models are similar in our simulations. This is consistent to Lemma 3.

IV-B3 Impact of Angle Randomness Range $\kappa$

We analyze the concealing cost $\Psi$ and the privacy level $\Gamma$ with different range of angle randomness $\kappa$ for all the models. As shown in Fig. 16, the values are almost linear for different $\kappa$.

IV-C Communication Cost

We compute the communication cost $\Omega$ as the sum of upstream and downstream cost in the network traffic.

IV-C1 Upstream Traffic

For the $n$-sided concealing polygon $\mathbf{P_{v}}^{*}$, the upstream traffic is computed as $48+8\times n$, where a packet header costs 40 bytes, 8 bytes are added for the user ID $u_{id}$, and then 8 bytes are used to represent the $x,y$ coordinates of each ${V_{i}}^{*}$.

IV-C2 Downstream Traffic

For the $N$ number of preferences of interest (POIs) returned, the downstream traffic is computed as $40+8\times N$, where a packet header costs 40 bytes, and each POI $x,y$ coordinates costs 8 bytes.

IV-D Comparison

In this work, we compare our method with the closely related method, the $n$-CD model [24], which uses $n$ concealing disks to cover the user location and the region of interest, reporting the rotated disk centers and radii of the LBS server. The intersection region of all these concealing disks defines the anonymity zone, as shown in Fig. 18. In terms of computation, the proposed $n$-VDD models are easy to implement and practical; the computations are mainly based on line-line intersections, and therefore the anonymizing algorithm is linear. In contrast, the $n$-CD model requires circle-circle intersections which is computationally more expensive. Thus, our method is more efficient than the $n$-CD one. The following details the comparison of the anonymizing performance in terms of concealing cost, privacy level, and communication cost (see the plots in Fig. 19 for different $n$ with $r=10^{3},\kappa=0.02$).

IV-D1 Concealing Cost, Privacy Level

Figure 19(a-b) shows the plots for the $n$-VDD models I-III, in which, for $n=3,4$, the concealing space and the anonymity zone overlap. We observe that in the $n$-VDD models, the concealing cost has a peak at $n=5$ and decreases from $n=5$, and the privacy level decreases as the value of $n$ increases; in the $n$-CD model, they are almost linear (almost identical). While the number of vertices $n$ is small ($n=3,4$) and big ($n\geq 8$), the concealing cost of the $n$-VDD models are much lower than $n$-CD when the radius of ROI $r$ ($10^{3}$) is fixed. We can simply get that one can achieve higher privacy level with lower concealing cost using the models of $n$-VDD than $n$-CD with smaller value of $n$. Minimizing the trade-off between $\Psi$ and $\Gamma$ is the primary goal of an anonymizing protocol. We analyze and compare this trade-off as the ratio of the two terms $\Psi$, $\Gamma$ for the $n$-CD and the $n$-VDD. Figure 19(c) shows that for smaller value of $n$ ($\leq 5$), this ratio in the models of $n$-VDD is much smaller than $n$-CD, i.e., we can have higher privacy level compared to concealing cost for smaller value of $n\leq 5$ than $n$-CD. At $n=3,4$, the ratio in $n$-VDD is 1.0 because the concealing space and the anonymity zone overlap, while $n$-CD is much higher. At $n=6$, the two models have close values. Therefore, we can select $n\leq 6$ in practice. This trade-off shows the strength of our proposed methods in case of smaller values of $n$. In the other hand, there is flexibility to adapt the values (performance) by changing $n$ in our models, while the values for the $n$-CD model are almost stable with different $n$.

IV-D2 Communication Cost

In the $n$-CD model, the upstream traffic cost is calculated as $48+12\times n$, where $n$ denotes the number of concealing disks, $48$ is the sum of 40 bytes for the packet header and 8 bytes for the user id, $12$ is the sum of 8 bytes for disk center $x,y$ coordinates and 4 bytes for disk radius; the downstream traffic cost is calculated as $40+8\times N$, where $N$ denotes the number of the returned POIs and each has $8$ bytes for $x,y$ coordinates. In terms of upstream cost, we observe that the $n$-VDD models are better than $n$-CD. The downstream cost largely depends on the area of the concealing space: the larger the concealing cost, the more the downstream cost. Moreover, if the concealing cost is high, the quality of services will be low. So we can define both downstream cost and quality of services as functions of concealing cost. From Fig. 19(c), we see that the concealing cost of the $n$-VDD models are lower than that of $n$-CD, implying the maximum bound of both the communication cost and quality of services error are lower.

V Conclusion

We present a novel location privacy framework, the so-called $n$-VDD, based on the Voronoi-Delaunay duality (VDD). This work is based on the insight that only an irregular Voronoi cell around the user location can not induce the user location (or the seed) but can give the anonymity zone, which is the intersection of all the parallel strips perpendicular to and bounded by Voronoi edges. We introduce the irregularity to the Voronoi cell using three terms for random shifting and their combinations: (1) interior shifting - starting from a regular polygon and shifting the generated Voronoi cell to be irregular with randomness, (2) exterior shifting - starting from an irregular polygon generated with randomness, and (3) sector shifting - starting from a regular polygon and shifting the sector rays around the seed. All the computations are efficient based on basic planar geometry and linear algebra. Experiments and comparisons have demonstrated the efficiency and efficacy for protecting the user location. In future work, we will explore the location privacy applications in 3D environment by generalizing planar $n$-VDD to volumetric $n$-VDD.

Acknowledgment

This work was supported by NSF CCF-1544267, NSF CNS-1263124/15601334 and NSF CNS-1407067.