Typically, site survey is an inevitable phase for WiFi fingerprint-based localization which is regarded as one of the most promising techniques for indoor localization. However, the site survey can cause potential location privacy leakage for the participants who contribute their WiFi fingerprint measurements. In this paper, we propose a privacy-preserving site survey scheme for WiFi fingerprint-based localization. In the proposed scheme, we use homomorphic encryption to protect the location privacy of the participants which get involved in the site survey. Further, we employ differential privacy model to ensure that the released data will not breach an individual’s location privacy regardless of whether she is present or absent in the site survey group. We theoretically analyze the security of the proposed scheme and use simulation experiments on a real-world data to validate the efficiency of the proposed scheme.
Hinweise
Competing interests
The authors declare that they have no competing interests.
1 Introduction
Due to the increasing demand for location-based services (LBSs) and the lack of GPS signals in indoor environments, indoor localization has become more and more popular in recent years. Researchers have proposed a vast range of approaches, among which WiFi fingerprint-based indoor localization is one of the most promising technologies [1‐4]. A typical WiFi fingerprint-based localization algorithm consists of two phases, offline site survey and online operating. In the offline site survey phase, the service provider collects WiFi signal strengths from multiple access points (APs) at every location of an interested area. Next, in the online operating phase, a to-be-localized client measures the signal strengths at a specific location from nearby APs, and then algorithms such as k-nearest neighbors [1, 3] or probability-based algorithms [5] are employed to infer the user’s location based on the measured WiFi signal strengths.
Usually the site survey is conducted in a crowdsourced way [2, 6, 7]. Suppliers recruited by the service provider measure the WiFi signal strengths of nearby APs when they visit the places which the service provider is interested in, and then send the measured WiFi signal strengths and the corresponding locations to the service provider. The service provider aggregates the data contributed by the suppliers to estimate the parameters which will be used in the online operating phase. The parameters which need to be estimated depend on the algorithms used in the online operating phase. In k-nearest neighbor-based algorithms, the mean of the WiFi signal strength of every AP at every location needs to be estimated, while in the probability-based algorithms, both the mean and variance of the signal strength of every AP are required. Crowdsourcing is an efficient way to conduct the site survey, but the measurements contributed by the suppliers will inevitably leak their location privacy. The service provider can infer the locations that the suppliers visit based on the data they contribute. Existing research indicates that location traces can leak information about the individuals’ habits, interests, activities, and relationships [8, 9]. Consequently, the loss of location privacy can expose the suppliers to unwanted advertisements and location-based spams/scams and may cause social reputation or economic damage to the suppliers and can make the victims of blackmails or even physical violence.
Anzeige
Several approaches have been proposed to address the privacy issues of indoor localization algorithms. In [10], Shu et al. studied the privacy issues in range-based localization algorithms and proposed a scheme to protect users’ privacy during the localization process. In [11], Wang et al. developed a privacy-preserving fuzzy localization scheme with CSI (Channel State Information) fingerprint. These privacy-preserving schemes were not designed for WiFi fingerprint-based localization algorithms; thus, they cannot be used to address the privacy issues presented in this paper. The most closely related work to this paper is that of Li et al. [12] which proposed a privacy-preserving scheme to address the privacy issues of the online operating phase in WiFi fingerprint-based localization algorithms. However, they did not consider the privacy leaks of the offline site survey phase.
In this paper, we propose a privacy-preserving site survey scheme which can protect the suppliers’ location privacy in crowdsourcing-based site survey for WiFi fingerprint-based localization and, at the same time, can ensure the usability of the aggregated result for the service provider. Under this scheme, all the suppliers involved in the site survey form a group and they cooperate with each other to hide their measurements from the service provider based on homomorphic encryption. Further, every supplier releases her measurements in a differential private manner to guarantee that the released data will not breach an individual’s location privacy regardless of whether she is present or absent in the group. The contributions of this paper are summarized as follows:
To the best of our knowledge, this work is the first to address the privacy issues of the site survey in WiFi fingerprint-based localization algorithms.
We propose a privacy-preserving site survey scheme for WiFi fingerprint-based localization based on homomorphic encryption and differential privacy model.
We theoretically analyze the security of the proposed scheme and carry out simulation experiments on a real-world dataset to evaluate the performance of our scheme.
The rest of the paper is organized as follows. We first discuss the related work and introduce the background. Then, we present the detailed design of our scheme and the security analysis. Finally, we report the evaluation results and conclude this paper.
2 Related work
Location privacy in LBSs has been widely studied in the literature. In general, all the existing works can be classified into two categories: privacy-preserving service request and privacy-preserving localization.
Anzeige
2.1 Privacy-preserving service request
In LBSs, users send their locations to the service provider to get the services, which will inevitably leak their privacy. Many schemes have been proposed to protect users’ location privacy when they request the location-based services. k-anonymity [13, 14] provides a form of plausible deniability by ensuring that the client cannot be individually identified from a group of k clients. Mix zone-based schemes [15] divide the whole region into application and mix zones. Clients report their locations in application zones and receive new, unused pseudonyms at mix zones. Cryptography-based approaches [16, 17] protect users’ location privacy based on secure multiparty computation protocols. Since all the above schemes focus on the privacy issues when users request the location services, thus they cannot be used to address the privacy issues we discuss in this paper.
2.2 Privacy-preserving localization
To address the location privacy issues in localization, Shu et al. [10] addressed the privacy leakage problem for range-based localization algorithms, thus preventing the leakage of the location information of both the target and the anchors. Wang et al. [11] developed a privacy-preserving fuzzy localization scheme with CSI fingerprint using homomorphic encryption and fuzzy logic. These privacy-preserving schemes were not designed for WiFi fingerprint-based localization; thus, they cannot be used to address the privacy issues presented in this paper. Li et al. [12] studied the privacy issues in WiFi fingerprint-based localization and proposed a privacy-preserving scheme to protect both the users’ and the service provider’s privacy during the online operating phase. However, they did not consider the privacy leaks during the site survey phase.
3 Background
3.1 WiFi fingerprint-based localization
The process of WiFi fingerprint-based localization can be divided into two phases: offline site survey phase and online operating phase. In the offline site survey phase, a supplier ui recruited by the service provider measures the WiFi signal strengths \({V_{s}^{i}}\) of nearby APs when they visit a place ls and send \((l_{s}, {V_{s}^{i}})\) to the service provider which aggregates the measurements and estimates the parameters which will be used in the online operating phase. In the online operating phase, a to-be-localized user measures the WiFi signal strengths at her current location, denoted as \(V^{\prime }=\left (v_{1}^{\prime },v_{2}^{\prime },\ldots,v_{j}^{\prime },\ldots,v_{N}^{\prime }\right)\). Then, the service provider uses k-nearest neighbors or probability-based algorithms to determine the location of the user.
In k-nearest neighbor-based algorithms [1, 3], the service provider estimates the average WiFi signal strengths \(\overline {V_{s}}\) at every location ls based on the suppliers’ measurements and stores \((l_{s}, \overline {V_{s}})\) in the WiFi fingerprint database. In the online operating phase, k-nearest neighbors of V′ are identified from the database to estimate the location of the user. In probability-based algorithms [18, 19], the location loc of the user is determined based on the Bayes’ theorem
A common assumption is that the signal strength of APi at location l follows a normal distribution parameterized with mean μ and variance δ. The parameters μ and δ are estimated by the service provider based on the measurements of the suppliers.
3.2 Differential privacy
The concept of differential privacy is originally introduced by Dwork [20]. Differential privacy ensures that a supplier is not at increasing risk of privacy when she participates in a certain statistical database. An algorithm \(\mathcal {A}\) is ε-differential privacy, if for any datasets D1 and D2, where D1 and D2 differ in at most one record, and for all subsets of possible answers \(S \subseteq \text {Range}(\mathcal {A})\),
The above equation indicates that the output of \(\mathcal {A}\) is insensitive to the modification of any single user’s data in the datasets (including its removal or addition). The parameter ε allows us to control the balance between the level of privacy and the data utility. A smaller ε implies stronger privacy. One common way to achieve differential privacy is to add Laplace noises to the original output of \(\mathcal {A}\) according to the following theorem.
Theorem1.
For all f:D→Rd, the following mechanism \(\mathcal {A}\) is ε-differential private: \(\mathcal {A}(D)=f(D)+\mathcal {L}(\Delta (f)/\epsilon)\), where \(\mathcal {L}(\Delta (f)/\epsilon)\) is an independently generated random variable following the Laplace distribution and Δ(f) denotes the global sensitivity of f, which is defined as follows:
$$ \Delta f = \underset{D_{1},D_{2}}{\max }\left\vert f(D_{1})-f(D_{2})\right\vert $$
(3)
for all D1 and D2 differing in at most one record.
3.3 The Paillier cryptosystem
In this work, we employ the Paillier cryptosystem as our cryptographic primitive. Invented by Pascal Paillier [21], the Paillier cryptosystem is a probabilistic asymmetric algorithm based on the decisional composite residuosity problem. Paillier cryptosystem is summarized below to facilitate the understanding of our algorithm.
Key generation: To construct the public and private keys, one first chooses two large primes p, q of equivalent length and computes N=pq, λ=lcm(p−1,q−1), g=N+1, and μ=φ(N)−1 mod n, where φ(N)=(p−1)(q−1). The public key PK and private key PR are (N,g) and (λ,μ), respectively.
Encryption: Let m be the plaintext to be encrypted. We denote the ciphertext of m by E(m), which is given by
$$ E(m) =g^{m}r^{N}\mod N^{2}, $$
(4)
where \(r\in \mathbb {Z}_{N}\) is a random number.
Decryption: Let c be the ciphertext, the plaintext D(m) is obtained by
$$ D(m) = L(c^{\lambda} \mod N^{2})\mu \mod N. $$
(5)
The Paillier cryptosystem is additively homomorphic. Given only the public key, one can compute E(m1+m2) from E(m1) and E(m2) as follows:
A typical scenario of crowdsourcing-based site survey in WiFi fingerprint-based localization is depicted in Fig. 1. In general, there are n suppliers and an aggregator (i.e., the service provider). The suppliers could be volunteers or workers recruited by the service provider. Every supplier ui records the WiFi signal strengths \({V_{i}^{s}} = (v_{i}^{s1}, v_{i}^{s2},\ldots, v_{i}^{sj},\ldots)\) when she visits location ls and stores \((l_{s}, {V_{i}^{s}})\) in her local database Vi, where \(v_{i}^{sj}\) is the measured WiFi signal strength of the jth AP, 1≤i≤n, ls∈L, and L is a location set defined by the service provider. The aggregator collects the measurements from the suppliers and would like to estimate the mean and variance of the WiFi signal strengths of every AP at every specific location in L based on the measurements of the suppliers.
Fig. 1
System model of crowdsourcing-based site survey
×
4.2 Design goal
In the crowdsourcing-based site survey, the aggregator estimates the parameters based on the data (i.e., the measured WiFi signal strengths and the corresponding locations) contributed by the suppliers. However, the released data inevitably leak the location privacy of the suppliers. The aggregator can learn the locations that the suppliers visit. The goal of this paper is to ensure that the aggregator can estimate the mean and variance of WiFi signal strengths of every AP at every location in L, and at the same time, the location privacy of the suppliers is not compromised. In detail, we want to achieve the following privacy goals:
Location privacy: Our scheme should ensure that the aggregator cannot learn the locations that the suppliers visited before. Also, the WiFi signal strengths collected by the suppliers should not be revealed, since the aggregator can infer their location privacy based on their measured WiFi signal strengths.
Differential privacy: In the crowdsourcing-based site survey, even though the measurements of every supplier are completely hidden from the aggregator, it still can infer the location privacy of a supplier ui by comparing the aggregating result when the ui is in the site survey group and that when ui is not in the site survey group.1 Therefore, our scheme should achieve differential privacy which has been accepted as a standard for privacy preservation [20, 22]. Differential privacy can guarantee that the aggregator can retrieve information about any supplier only up to a predefined threshold, no matter what auxiliary information it knows about that supplier.
In this paper, we adopt the “honest-but-curious” model which assumes that each player honestly follows the designated protocols and procedures while it intends to disclose the other’s private information.
5 Privacy-preserving site survey
In this section, we present a novel privacy-preserving crowdsourcing-based site survey scheme which can estimate the distribution of the WiFi signal strengths at each specific location without leaking the privacy of each supplier. The proposed scheme consists of four phases which are detailed as follows.
5.1 Preparation and initiation
In this phase, n suppliers and an aggregator form a site survey group. Within this site survey group, every supplier ui generates its public key PKi and private key PRi using the Paillier cryptosystem and then sends the public key PKi to other suppliers and the aggregator. The above process can be executed offline and only needs to be performed once. If the aggregator wants to estimate the mean and variance of the WiFi signal strengths from the jth AP at location ls, it sends a request with <APj,ls> to every supplier in this group.
5.2 Adding noises
After receiving the aggregator’s request, every supplier ui first queries its local dataset Vi to get a tuple \((m_{i},v_{i}^{sj})\), where mi indicates whether the supplier ui visited location ls before and \(v_{i}^{sj}\) is the measured WiFi signal strength of the jth AP at location ls. If the supplier ui visited location ls before, mi is set to 1 and \(v_{i}^{sj}\) is set to the measured WiFi signal strength. If the supplier ui never visited location ls before, mi and \(v_{i}^{sj}\) are both set to 0.
To ensure that the presence or absence of the supplier ui in the site survey group will not significantly increase her chance of being compromised (i.e., to achieve ε-differential privacy), every supplier ui adds appropriately chosen random noises to \(v_{i}^{sj}\) and mi as follows:
where \(\mathcal {G}_{1}(n,\lambda _{1})\) and \(\mathcal {G}_{2}(n,\lambda _{1})\) are independent and identically distributed (i.i.d.) random variables having gamma distribution with probability density function (PDF)
λ1=Δf1/ε and λ2=Δf2/ε, where Δf1 and Δf2 are the global sensitivity of the WiFi signal strength and m, respectively. Since the WiFi signal strength ranges from −90 to 0 dbm and m∈{0,1}, we set Δf1=90 and Δf2=1. The parameter ε controls the trade-off between the desired privacy level and the data utility. A smaller ε yields a stronger privacy guarantee but generates more noises. In the evaluation section, we will investigate the impact of ε on the data utility. We will prove that the proposed scheme can achieve ε-differential privacy in the next section.
5.3 Encrypting data
After adding noises to her data, every supplier employs secret sharing [23] and Paillier cryptosystem to hide her data from the aggregator. For simplicity, we only demonstrate how to hide \(v_{i}^{\prime }\). The way to hide \(m_{i}^{\prime }\) is the same. Each supplier ui first splits \(v_{i}^{\prime }\) into n random shares as follows:
where η is a large integer. Then, each supplier ui keeps \(v_{ii}^{\prime }\) for herself, encrypts \(v_{ij}^{\prime }\) using the public key of supplier uj, and then sends \(E_{\text {PK}_{j}}(v_{ij}^{\prime })\) to the aggregator. After the aggregator receives the encrypted shares from all the suppliers, she adds the shares which are encrypted by the same public key based on the additively homomorphic property of the Paillier cryptosystem as follows:
Then, the aggregator sends Vi to the supplier ui. Every supplier ui decrypts Vi using her secret key PRi, and adds her share \(v_{ii}^{\prime }\phantom {\dot {i}\!}\) to \(D_{\text {PK}_{i}}(V_{i})\phantom {\dot {i}\!}\) to get \(V_{i}^{\prime } = \sum _{j=1}^{n}v_{ji}^{\prime }\phantom {\dot {i}\!}\) in plaintext and sends \(v_{i}^{\prime }\) to the aggregator. Adding all \(V_{i}^{\prime }(1\leq i\leq n)\) together, the aggregator can get \(V^{\prime } = \sum _{i=1}^{n}V_{i}^{\prime }\) which is equal with \(\sum _{i=1}^{n}v_{i}^{\prime }\). We will prove its correctness in next section. In the same way, every supplier can hide \(m_{i}^{\prime }\) from others, but the aggregator can get \(M^{\prime } = \sum _{i=1}^{n}m_{i}^{\prime }\).
5.4 Estimating the parameters
After getting \(V^{\prime } = \sum _{i=1}^{n}V_{i}^{\prime }\) and \(M^{\prime } = \sum _{i=1}^{n}m_{i}^{\prime }\), the aggregator can estimate the mean (denoted as μ′) of the WiFi signal strengths of APt at location ls as follows:
Since every supplier adds controlled noises to her data, the estimated mean μ′ is not exactly the same as \(\mu = \sum _{i=1}^{n}v_{i}^{sj}/\sum _{i=1}^{n}m_{i}\). The estimation error is controlled by the parameter ε. We will investigate the impact of ε on the estimation errors and show that the localization accuracy when we use μ′ is comparable with that when we use μ in most cases.
To estimate the variance δ′, the aggregator send μ′ back to every supplier ui which can then get δi as follows:
Following the same rules described above, every supplier ui adds a random noise \(\mathcal {G}_{5}(n,\lambda _{1}) - \mathcal {G}_{6}(n,\lambda _{3})\) to δi to get \(\delta _{i}^{\prime } = \delta _{i} + \mathcal {G}_{5}(n,\lambda _{1}) - \mathcal {G}_{6}(n,\lambda _{3})\), and then sends \(\delta _{i}^{\prime }\) to the aggregator in a secret way. \(\mathcal {G}_{5}(n,\lambda _{1})\) and \(\mathcal {G}_{6}(n,\lambda _{3})\) are i.i.d. random variables having gamma distribution with PDF
where λ3=902/ε. Following the same rules above, the aggregator computes \(\sum _{i=1}^{n}\delta _{i}^{\prime }\) without knowing every \(\delta _{i}^{\prime }\), and the variance of the WiFi signal strengths of APt at location ls can be estimated by \(\delta ^{\prime } = \sum _{i=1}^{n}\delta _{i}^{\prime }/M^{\prime }\).
6 Theoretical analysis of the proposed scheme
In this section, we will theoretically analyze the correctness of the proposed scheme and prove that the proposed scheme can achieve the desired privacy goals.
6.1 The correctness of the scheme
In our scheme, we employ secret sharing and homomorphic encryption to protect the privacy of every supplier. Every supplier ui splits her data \(v_{i}^{\prime }\) into n shares and submits \(v_{i}^{\prime }\) to the aggregator. Adding all \(V_{i}^{\prime }(1\leq i\leq n)\) together, the aggregator can get \(V^{\prime } = \sum _{i=1}^{n}V_{i}^{\prime }\). We claim that \(V^{\prime } = \sum _{i=1}^{n}V_{i}^{\prime }\) is equal to \(\sum _{i=1}^{n}v_{i}^{\prime }\), which is supported by the following theorem.
Theorem2.
Only given \(V_{i}^{\prime }(1\leq i\leq n)\), the aggregator can correctly compute \(\sum _{i=1}^{n}v_{i}^{\prime }\) by adding \(V_{i}^{\prime }(1\leq i\leq n)\) together.
Proof.
As described above, \(V_{i}^{\prime } = D_{\text {PK}_{i}}(V_{i}) + v_{ii}^{\prime }\) thus, we have
Then, we have \(\sum _{i=1}^{n}V_{i}^{\prime } = \sum _{i=1}^{n}v_{i}^{\prime }\), which proves Theorem 2.
Following the same rules, we can also prove that the aggregator can correctly compute \(\sum _{i=1}^{n}m_{i}^{\prime }\) and \(\sum _{i=1}^{n}\delta _{i}^{\prime }\). Therefore, the correctness of the proposed scheme is proved.
6.2 The security of the scheme
In the proposed scheme, every supplier adds random noises having gamma distribution to achieve differential privacy and further employs secret sharing to hide her data. We claim that the proposed scheme can achieve the desired privacy goals, which is supported by the following two Theorems:
Theorem3.
The proposed scheme satisfies ε-differential privacy.
Proof.
In the proposed scheme, \(v_{i}^{\prime }=v_{i}+\mathcal {G}_{1}(n,\lambda _{1}) - \mathcal {G}_{2}(n,\lambda _{1})\), where \(\mathcal {G}_{1}(n,\lambda _{1})\) and \(\mathcal {G}_{2}(n,\lambda _{1})\) are i.i.d. random variables having gamma distribution with PDF
Let \(\mathcal {L}(\lambda)\) denote a random variable which has a Laplace distribution with PDF \(f(x,\lambda _{1})=\frac {1}{2\lambda _{1} }e^{\frac {\left \vert x\right \vert }{\lambda _{1}}}\). According to [24], the distribution of \(\mathcal {L}(\lambda _{1})\) is infinitely divisible. Furthermore, for every integer n≥1, \(\mathcal {L}(\lambda _{1}) = \sum _{i=1}^{n}\left [ {\mathcal {G}}_{1}(n,\lambda _{1})-{\mathcal {G}}_{2}(n,\lambda _{1})\right ]\), where \(\mathcal {G}_{1}(n,\lambda _{1})\) and \(\mathcal {G}_{2}(n,\lambda _{1})\) are i.i.d. random variables having gamma distribution with PDF \(g(x,n,\lambda _{1})=\frac {(1/\lambda _{1})^{1/n}}{\Gamma (1/n)}x^{\frac {1}{n}-1}e^{-x/\lambda _{1} }\), where x≥0. Thus, we have
where \(\mathcal {L}(\lambda _{2})\) and \(\mathcal {L}(\lambda _{3})\) are two random variables following the Laplace distribution with PDF \(f(x,\lambda _{1})=\frac {1}{2\lambda _{2} }e^{\frac {\left \vert x\right \vert }{\lambda _{2}}}\) and \(f(x,\lambda _{3})=\frac {1}{2\lambda _{3} }e^{\frac {\left \vert x\right \vert }{\lambda _{3}}}\), respectively. According to Theorem 1, the proposed scheme achieves ε-differential privacy.
Theorem4.
The proposed scheme can protect every supplier’s location privacy.
Proof.
In the proposed scheme, every supplier ui splits its data \(v_{i}^{\prime }\), \(m_{i}^{\prime }\), and \(\delta _{i}^{\prime }\) into n random shares and sends the other encrypted n−1 shares to the aggregator. Even the aggregator gets the plaintexts of the other n−1 shares, it still cannot know \(v_{i}^{\prime }\), \(m_{i}^{\prime }\), and \(\delta _{i}^{\prime }\) since ui keeps one share after splitting the data. Therefore, the aggregator cannot figure out whether ui visited ls and the measured WiFi signal strength, which proves that the proposed scheme can protect every supplier’s location privacy.
7 Evaluation
In this section, we evaluate the performance of the proposed scheme. We focus on two important metrics in the evaluation: the utility of the aggregated data and the efficiency of the proposed scheme.
7.1 Experiment setup
We implement the supplier side of the proposed scheme on a Android platform with a Qualcomm Snapdragon600 Quad-Core 1.7 GHz CPU and 2 G RAM, and the aggregator side of the proposed scheme on a 32-bit computer with Intel i7 CPU of 3.4 GHz and 4 G memory. The Paillier modulus used in this work is set to 1024. In the experiments, we use a real-world WiFi fingerprint dataset to evaluate the performance of our algorithm. The dataset has total 1000 records which are collected in a typical indoor environment. Each record contains the WiFi signal strengths from nearby APs. The total number of APs used in the experiments is 10 (i.e., n=10) and the total number of locations in the indoor environment is 76 (i.e., |L|=76). In the simulations, the data are randomly distributed to the suppliers and then the aggregator tries to estimate the WiFi fingerprint at every location.
7.2 Utility evaluation
In the experiments, the aggregator estimates the WiFi fingerprint at every location based on the data with noises provided by the suppliers, and then uses the estimated data to offer localization service. In this section, we evaluate the impact of the added noises on the aggregated results and the accuracy of the localization.
In the proposed scheme, every supplier adds two random noises with gamma distribution to her measurements to achieve ε-differential privacy. In the experiments, we employ the Euclidean distance as the metric to evaluate the usability of the data with noises. Figure 2 presents the cumulative distribution function (CDF) of the Euclidean distance between the estimated WiFi fingerprint without noises and the estimated WiFi fingerprint with noises. It is observed that the accuracy of estimation increases when ε increases from 0.4 to 2.0, and 80 % of the Euclidean distances between the noisy WiFi fingerprint and the original WiFi fingerprint are smaller than 6. A smaller ε yields larger noises, which, on the other hand, provides a stronger privacy preservation. It is a trade-off between the utility of the data and the privacy.
Fig. 2
CDF of the Euclidean distances
×
Further, we investigate the impact of our privacy-preserving scheme on the localization accuracy. In this paper, we employ k-nearest neighbors to determine the unknown locations in the online operating phase. Figure 3 shows the CDF of the localization errors when ε is set to different values and when no noises are added to the data. It is observed that the localization accuracy increases when ε increases from 0.4 to 2.0 and the localization accuracy is the highest when no noises are added to the data. We also observed that 80 % of the localization errors are within 5 m, which implies a high data usability.
Fig. 3
CDF of the localization errors
×
7.3 Computational and communication overhead
In this work, we employ Paillier cryptosystem as our cryptographic primitive to protect the suppliers’ privacy, which inevitably brings more computational and communication overhead. In this section, we evaluate the computational and communication cost of the proposed scheme. In the experiments, we set ε=0.4 and investigate the impact of the number of suppliers (i.e., n) on the computational time and communication overhead.
Figure 4 shows the time cost on the supplier side and the aggregator side for estimating the WiFi signal strength of one AP at every location. We can see that the computational time on the supplier side is proportional to the number of the suppliers. When the number of the suppliers is set to 10, the time cost on the supplier side is 1.6 s. When the number of the suppliers reaches 100, the time cost on the supplier side is 16 s. The computational time on the aggregator side is proportional to the square of the number of the suppliers. When the number of the suppliers is 10, the computational time on the aggregator side is only 0.08 s. However, when the number of the suppliers reaches 100, the computational time on the aggregator side becomes 8.8 s.
Fig. 4
The time cost of the suppliers and the aggregator
×
Figure 5 shows the impact of the number of the suppliers on the bandwidth cost of every supplier and the aggregator. It is observed that the bandwidth cost of the supplier is proportional to the number of the suppliers. The bandwidth cost is 10 kb for every supplier when the number of the supplier is 10. The bandwidth cost increases with the increase of the number of the supplers. The bandwidth cost reaches 101 kb for every supplier when the number of the supplier is 100. The bandwidth cost on the aggregator side is proportional to the square of the number of the suppliers. When the number of the suppliers is 10, the bandwidth cost of the aggregator is only 110 kb. When the number of the suppliers is 100, the bandwidth cost becomes 10100 kb.
Fig. 5
The bandwidth cost of the suppliers and the aggregator
×
8 Conclusions
In this work, we propose a privacy-preserving site survey scheme for WiFi fingerprint-based localization. The proposed scheme uses homomorphic encryption and differential privacy model to protect the location privacy of the participants which get involved in the site survey process of the WiFi fingerprint localization. We theoretically analyze the security of the scheme and use simulation experiments on real-world data to validate the efficiency of the proposed scheme.
9 Endnote
1For example, assume that the mean of the WiFi signal strengths estimated by the aggregator is μ1 when ui is in the group, and the mean of the WiFi signal strengths is μ2 when ui is not in the group. The aggregagor can get the measured WiFi signal strength of ui by the formula μ1·n−μ2·(n−1), where n is the number of suppliers in the group.
Acknowledgements
This work was supported in part by the National Natural Science Foundation of China (Grant No. 61472418).
Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.
Competing interests
The authors declare that they have no competing interests.
