With the advance of location technologies, people can now determine their location in various ways, for instance, with GPS or based on nearby cellphone towers. These technologies have led to the introduction of location-based services, which allow people to get information relevant to their current location. Location privacy is of utmost concern for such location-based services, since knowing a person's location can reveal information about her activities or her interests. In this thesis, we first focus on location-based services that need to know only a person's location, but not her identity. We propose a solution using location cloaking based on k-anonymity, which requires neither a single trusted location broker, which is a central server that knows everybody's location, nor trust in all users of the system and that integrates nicely with existing infrastructures. We present two such protocols. The evaluation of our sample implementation demonstrates that one of the protocol is sufficiently fast to be practical, but the performance of the other protocol is not acceptable for its use in practice. In addition to the distributed k-anonymity protocol we then propose four protocols---Louis, Lester, Pierre and Wilfrid--- for a specific, identity required, location-based service: the nearby-friend application, where users (and their devices) can learn information about their friends' location if and only if their friends are actually nearby. Our solutions do not require any central trusted server or only require a semi-trusted third party that dose not learn any location information. Moreover, users of our protocol do not need to be members of the same cellphone provider, as in existing approaches. The evaluation on our implementation shows that all of the four protocols are efficient.

With the advance of location technologies, people can now determine their location in various ways, for instance, with GPS or based on nearby cellphone towers. These technologies have led to the introduction of location-based services, which allow people to get information relevant to their current location. Location privacy is of utmost concern for such location-based services, since knowing a person's location can reveal information about her activities or her interests. In this thesis, we first focus on location-based services that need to know only a person's location, but not her identity. We propose a solution using location cloaking based on k-anonymity, which requires neither a single trusted location broker, which is a central server that knows everybody's location, nor trust in all users of the system and that integrates nicely with existing infrastructures. We present two such protocols. The evaluation of our sample implementation demonstrates that one of the protocol is sufficiently fast to be practical, but the performance of the other protocol is not acceptable for its use in practice. In addition to the distributed k-anonymity protocol we then propose four protocols---Louis, Lester, Pierre and Wilfrid--- for a specific, identity required, location-based service: the nearby-friend application, where users (and their devices) can learn information about their friends' location if and only if their friends are actually nearby. Our solutions do not require any central trusted server or only require a semi-trusted third party that dose not learn any location information. Moreover, users of our protocol do not need to be members of the same cellphone provider, as in existing approaches. The evaluation on our implementation shows that all of the four protocols are efficient.

Users face location-privacy risks when accessing Location-Based Services (LBSs) in an Opportunistic Mobile Social Networks (OMSNs). In order to protect the original requester's identity and location, we propose two location privacy obfuscation protocols utilizing social ties between users. The first one is called Multi-Hop Location-Privacy Protection (MHLPP) protocol. To increase chances of completing obfuscation operations, users detect and make contacts with one-hop or multi-hop neighbor friends in social networks. Encrypted obfuscation queries avoid users learning important information especially the original requester's identity and location except for trusted users. Simulation results show that our protocol can give a higher query success ratio compared to its existing counterpart. The second protocol is called Appointment Card Protocol (ACP). To facilitate the obfuscation operations of queries, we introduce the concept called Appointment Card (AC). The original requesters can send their queries to the LBS directly using the information in the AC, ensuring that the original requester is not detected by the LBS. Also, a path for reply message is kept when the query is sent, to help reduce time for replying queries. Simulation results show that our protocol preserves location privacy and has a higher query success ratio than its counterparts. We have also developed a new OMSN simulator, called OMSN Routing Simulator (ORS), for simulating OMSN protocols more efficiently and effectively for reliable performance.

Magíster en Ciencias, Mención Computación / Ingeniera Civil en Computación / Con el objeto de medir la calidad de acceso a Internet móvil, NIC Chile Research Labs desarrolló Adkintun Mobile, un monitor pasivo instalado en los celulares de usuarios voluntarios. Periódicamente, la aplicación registra datos relativos al estado de la red, los que son enviados a un servidor que los recolecta. Los investigadores del laboratorio tienen acceso a los datos almacenados por el colector. A partir de la conexión a las antenas de celulares, la ubicación del dispositivo puede ser deducida, por lo que la ubicación de los usuarios queda expuesta a la vista de los investigadores, lo que resulta preocupante desde el punto de vista de la privacidad de ubicación de los individuos. Más aún, sólo cuatro puntos espacio temporales son suficientes para reidentificar al 95% de la población a partir de una base de datos anonimizada. Es por ello que este trabajo se enfoca en resolver el problema usando un enfoque criptográfico. Se propone un modelo en el que los investigadores pueden acceder, consultar y calcular agregaciones sobre los datos almacenados, pero sólo obteniendo de la ubicación de los individuos el resultado de las agregaciones. El modelo utiliza encriptación homomórfica para resguardar la privacidad de ubicación. La información relativa a la ubicación es enviada encriptada desde los celulares hacia el servidor. El servidor puede calcular homomórficamente funciones predefinidas, como contar el número de usuarios en un determinado lugar. Las consultas a la base de datos y la desencriptación, se ejecutan en capas separadas, para evitar que la llave secreta sea utilizada en la desencriptación directa de los datos. Se implementaron dos versiones de la capa de privacidad de ubicación, con encriptación completamente homomórfica (FHE) usando el esquema BGV, y con encriptación parcialmente homomórfica (PHE) usando el esquema Paillier. El desempeño y overhead del sistema, muestran que el modelo es adecuado para cálculo offline de estadísticas. Las contribuciones de este trabajo consisten en proponer una aplicación práctica de FHE para privacidad de ubicación; y discutir sobre el trade-off entre privacidad de ubicación y el desempeño del sistema en ambas implementaciones (FHE y PHE). -------------------------- In order to measure the quality of access to mobile Internet, NIC Chile Research Labs developed Adkintun Mobile, a passive monitor installed in volunteer users' mobile phones. Periodically, the client application records data related to network state, which is sent to the collector server. Researchers of the laboratory have access to such stored data. Since from connexion to antennas location can be deduced, location data of individuals is exposed to researchers, which is a concern for location privacy. Moreover, as only four spatio-temporal points are enough to identify 95\% of the population in an anonymized dataset, this work takes a cryptographic approach to solve the problem. We propose a model where researchers can access, query and compute aggregations on stored data, learning nothing more about users' location than the result of the aggregation. Our model uses homomorphic encryption to preserve location privacy. Location data is sent encrypted from mobile devices to the server. The server can homomorphically evaluate predefined functions such as counting the number of users in a given location. Query and result decryption are performed from a separate layer, which protects the secret key from being used for direct decryption of the records. We implemented two versions of the location privacy layer using a Leveled Fully Homomorphic encryption (FHE) scheme (BGV), and a Partial (additive) Homomorphic encryption (PHE) scheme (Paillier). The overhead and performance evaluation show that both versions are adequate for offline statistical analysis. The contribution of this work is to propose a practical use of FHE for location privacy; and to discuss the trade-off between location privacy and system performance for implementations using FHE and PHE.

With the growth in social, political and economic importanceof the Internet, it has been recognized that the underlyingtechnology of the next generation Internet must not only meetthe many technical challenges but must also meet the socialexpectations of such a pervasive technology. As evidence ofthe strategic importance of the development of the Internet,the European Union has adopted a communication to the Counciland the European Parliament focusing on the next generationInternet and the priorities for action in migrating to the newInternet protocol IPv6 andalso a new Directive (2002/58/EC) on'processing of personal data and protection of privacy in theelectronic communication sector'. The Data Protection Directiveis part of a package of proposals for initiatives which willform the future regulatory framework for electroniccommunications networks and services. The new Directive aims toadapt and update the existing Data ProtectionTelecommunications Directive (97/66/EC) to take account oftechnological developments. However, it is not well undersoodhow this policy and the underlying Internet technology can bebrought into alignment. This dissertation builds upon the results of my earlierlicentiate thesis by identifying three specific, timely, andimportant privacy areas in the next generation Internet: uniqueidentifiers and observability, privacy enhanced location basedservices, and legal aspects of data traffic. Each of the three areas identified are explored in the eightpublished papers that form this dissertation. The paperspresent recommendations to technical standarization bodies andregulators concerning the next generation Internet so that thistechnology and its deployment can meet the specific legalobligations of the new European Union data protectiondirective.

Wireless sensor networks (WSN) are an attractive solution for a plethora of communication applications, such as unattended event monitoring and tracking. One of the looming challenges that threaten the successful deployment of these sensor networks is source-location privacy, especially when they are used to monitor sensitive objects. In order to enhance source location privacy in sensor networks, we propose the use of an opportunistic routing scheme and we examine four different approaches. In opportunistic routing, each sensor transmits the packet over a dynamic path to the destination. Every packet from the source can therefore follow a different path toward the destination, making it difficult for an adversary to backtrack hop-by-hop to the origin of the sensor communication. Through theoretical analysis, we attempt to justify the use of opportunistic routing for the source-location problem. Moreover, simulations have been conducted in order to evaluate the performance of all the proposed schemes, in terms of source-location privacy.

Wireless sensor networks (WSN) are an attractive solution for a plethora of communication applications, such as unattended event monitoring and tracking. One of the looming challenges that threaten the successful deployment of these sensor networks is source-location privacy, especially when they are used to monitor sensitive objects. In order to enhance source location privacy in sensor networks, we propose the use of an opportunistic routing scheme and we examine four different approaches. In opportunistic routing, each sensor transmits the packet over a dynamic path to the destination. Every packet from the source can therefore follow a different path toward the destination, making it difficult for an adversary to backtrack hop-by-hop to the origin of the sensor communication. Through theoretical analysis, we attempt to justify the use of opportunistic routing for the source-location problem. Moreover, simulations have been conducted in order to evaluate the performance of all the proposed schemes, in terms of source-location privacy.

<p>With the growth in social, political and economic importanceof the Internet, it has been recognized that the underlyingtechnology of the next generation Internet must not only meetthe many technical challenges but must also meet the socialexpectations of such a pervasive technology. As evidence ofthe strategic importance of the development of the Internet,the European Union has adopted a communication to the Counciland the European Parliament focusing on the next generationInternet and the priorities for action in migrating to the newInternet protocol IPv6 andalso a new Directive (2002/58/EC) on'processing of personal data and protection of privacy in theelectronic communication sector'. The Data Protection Directiveis part of a package of proposals for initiatives which willform the future regulatory framework for electroniccommunications networks and services. The new Directive aims toadapt and update the existing Data ProtectionTelecommunications Directive (97/66/EC) to take account oftechnological developments. However, it is not well undersoodhow this policy and the underlying Internet technology can bebrought into alignment.</p><p>This dissertation builds upon the results of my earlierlicentiate thesis by identifying three specific, timely, andimportant privacy areas in the next generation Internet: uniqueidentifiers and observability, privacy enhanced location basedservices, and legal aspects of data traffic.</p><p>Each of the three areas identified are explored in the eightpublished papers that form this dissertation. The paperspresent recommendations to technical standarization bodies andregulators concerning the next generation Internet so that thistechnology and its deployment can meet the specific legalobligations of the new European Union data protectiondirective.</p>

People value their privacy; however, they typically do not make the protection of their privacy a priority. Privacy is oftentimes not tangible, complicating the efforts of technology users to express and act according to their privacy needs. Additionally, people may not be fully aware of the risks they are subjecting themselves to once they use the Internet for financial transactions, or create profiles on online social networks. Companies post privacy policies inform people about their informational practices; but, this information is extremely difficult to use and typically not considered in users’ decision-making processes. Privacy concerns have also had an impact on users’ adoption of new technologies that share personal information. A plethora of mobile location-finding technologies applications have become available over the last two decades, but the products and services offered by the technology developers may not comprehensively address the privacy implications and privacy concerns surrounding their use. The design considerations for these products may not provide the necessarily amount of control or risk mitigation for users to ensure that their location information is not misused. In this thesis, I focus on the impact of salient privacy information on privacy concerns and behavior in two contexts: online shopping and the use of a mobile-location sharing technology. I examine several case studies focusing on the evolution of privacy attitudes after people use specific technologies. Based on the examination of the use of a location-sharing system, I highlight several design considerations for mobile-location application developers to ensure they address their users privacy concerns. I use the results of online surveys and user studies to provide concrete information on the impact of feedback on the comfort with using location-sharing technology. This research shows that users will pay a premium to purchase from websites that offer better privacy policies IF that privacy information is made visible and understandable. This research points to the importance of control in the management of privacy concerns. Whether it be mandated by legislation, or recommended in industry standards or design standards, offering users control in the form of understandable privacy policy information, or control over the disclosure of personal information by technology, is essential.

The convergence of transport, communication, computing and positioning technologies has enabled a smart car revolution. As a result, pricing of roads based on telematics technologies has gained significant attention. While there are promised benefits, systematic disclosure of precise location has the ability to impinge on privacy of a special kind, known as location privacy. The aim of this thesis is to provide technical designs that enhance the location privacy of motorists without compromising the benefits of accurate pricing. However, this research looks beyond a solely technology-based solution, For example, the ethical implications of the use of GPS data in pricing models have not been fully understood. Likewise. minimal research exists to evaluate the technical vulnerabilities that could be exploited to avoid criminal or financial penalties. To design a privacy-aware system, it is important to understand the needs of the stakeholders, most importantly the motorists. Knowledge about the anticipated privacy preferences of motorists is important in order to make reasonable predictions about their future willingness to adopt these systems. There is limited research so far Otl user perceptions regarding specific payment options in the uptake of privacy-aware systems. This thesis provides a critical privacy assessment of two mobility pricing systems, namely electronic tolls and mobility-priced insurance. As a result of this assessment. policy recommendations arc developed which could support a common approach in facilitating privacy-aware mobility-pricing strategies. This thesis also evaluates the existing and potential inferential threats and vulnerabilities to develop security and privacy recommendations for privacy-aware pricing designs for tolls and insurance. Utilising these policy recommendations and analysing user-perception with regards to the feasibility of sustaining privacy and willingness to pay for privacy, two privacy-aware mobility pricing designs have been presented which bridge the entire array of privacy interests and bring them together into a unified approach capable of sustaining legal protection as well as satisfying privacy requirements of motorists. It is maintained that it is only by social and technical analysis working in tandem that critical privacy issues in relation to location can be addressed.