Here Global B.v.

Arizona State University

Carnegie Mellon University

Stefano Bennati

Elena Vidyakina

Aleksandra Kovacevic

Elena Mumford

Kai Pöthkow

Gavin Brown

Ori Dov

Johannes Braese

Olivier Dousse

Paulo Shakarian

Tero Juhani Keski-Valkama

Zack Zhu

Raghavendran Balu

Eric Nunes

Arash Ostadzadeh

Christian Lebiere

Henri Kujala

Robert Thomson

Casey Buto

Embodiments described herein relate to anonymizing of trajectories of mobile devices through the obfuscation of stay points. Methods may include: receiving probe data points of a trajectory in real-time or near real-time from a probe apparatus as it travels along the trajectory; calculating, for each probe data point, a probability of the trajectory reaching a stay point within a predetermined distance; providing sequential sub-sets of probe data points of the trajectory to a location-based service provider in response to the sequential sub-sets of probe data points including probe data points having a probability failing to satisfy a predetermined value; and identifying a potentially last sub-set of probe data points of the sequential sub-sets of probe data points to provide to the location-based service provider in response to identifying a probe data point having a probability of the trajectory reaching a stay point within the predetermined distance satisfying the predetermined value.

Method, apparatus, and computer program product for anonymizing trajectories and stay points

Embodiments described herein relate estimating a privacy level of an anonymized dataset based on an anonymization strategy selected using parameters of the dataset that form a dataset profile. Methods may include: receiving a dataset defining at least one trajectory; determining parameters of the dataset; generating a profile of the dataset based on the parameters of the dataset to establish a dataset profile; identifying a predetermined profile corresponding to the dataset profile; determining an anonymization strategy corresponding to the predetermined profile; anonymizing the dataset using the anonymization strategy to generate an anonymized dataset; and publishing the anonymized dataset for use with location-based services. According to some embodiments, identifying the predetermined profile corresponding to the dataset profile includes identifying a predetermined profile having parameters within a predefined degree of similarity of the parameters of the dataset.

Method, apparatus, and computer program product for estimating the privacy risk of anonymized trajectory data

A method, apparatus, and computer program product are provided for anonymizing a trajectory. Methods may include: receiving a sequence of probe data points defining a portion of a trajectory, each probe data point defining a location, where an origin includes a starting point of the trajectory and a destination includes an ending point of the trajectory; initiating a timer; in response to the timer reaching a predetermined time and the portion of the trajectory not including the origin or the destination, publishing the sequence of probe data points; and in response to the timer reaching a predetermined time and the portion of the trajectory including the destination and not the origin, generating a generalized destination of the trajectory as a current geographic grid cell of the trajectory and publishing the generalized destination.

Method, apparatus, and computer program product for anonymizing trajectories

An approach is provided for managing pseudonymous or anonymous user data and relevant data management requests. The approach involves, for example, converting a numerical feature of a data point into a categorical form. The categorical form represents a value range into which a numerical value of the numerical feature falls. The approach also involves determining an identifier of a data contributor associated with the data point. The approach further involves concatenating the identifier with the categorical form. The approach further involves cryptographically hashing the identifier concatenated with the categorical form to generate a mark. The approach further involves associating the mark with the data point to generate marked pseudonymous-anonymous data. The approach further involves transmitting the pseudonymous-anonymous data to a data platform.

Method and apparatus for managing user requests related to pseudonymous or anonymous data

An approach is provided for automated purpose limitation and compatibility verification on a data platform. The approach, for example, involves generating metadata that indicates a purpose that has been allowed for processing a dataset. The approach also involves storing the metadata in a metadata catalog to associate the purpose with the dataset. The approach further involves querying the metadata catalog to perform a verification of a compatibility of the purpose with a requested purpose for a new processing activity of the dataset, to perform a limitation of the new processing activity, or a combination thereof.

Method, apparatus, and system for automated purpose limitation and compatibility verification on a data platform

A method, apparatus, and computer program product are provided for estimating parking availability in an area based on probe data points in response to a request while maintaining data privacy. A method may include: receiving probe data associated with a plurality of vehicles; determining, from the probe data, location information, parking event information, and a timestamp; receiving a parking availability query, where the parking availability query includes a location; generating and transmitting a request for parking availability information corresponding to the location; receiving a plurality of partial results in response to the request for parking availability information corresponding to the location; determining, from the plurality of partial results, parking availability information corresponding to the location; and providing the parking availability information corresponding to the location responsive to the parking availability query.

Method, apparatus, and computer program product for anonymized parking likelihood estimation

A method, apparatus, and computer program product are provided for using confidential computing to execute code on sensitive data in an encrypted area of an apparatus limiting access to data and code to only their respective owners. Methods may include: generating an outer enclave and at least one inner enclave within the outer enclave; providing an outer enclave key and an inner enclave key to a service provider; providing an inner enclave key to a data provider; receiving, from the data provider, a data retrieval location; processing data from the respective retrieval location at the data provider inner enclave using data provider code to generate data provider processed data; providing the data provider processed data to the service provider inner enclave; and processing the data provider processed data with service provider code to generate resultant data; decrypting the resultant data in the outer enclave.

Method, apparatus, and computer program product for confidential computing

An approach is provided for data-preserving trajectory anonymization. The approach involves, for example, processing a plurality of location trajectories to determine one or more exchange twists. The plurality of location trajectories are respectively a sequence of locations points determined by a location sensor of a device, and the one or more exchange twists are one or more locations at which at least two trajectories of the plurality of location trajectories match based on a matching criterion. The approach also involves initiating a swapping of one or more trajectory identifiers among the plurality of location trajectories based on the one or more exchange twists to generate anonymized trajectory data. The approach further involves providing the anonymized trajectory data as an output to a location-based service.

Method and apparatus for trajectory anonymization based on a trajectory exchange twist

The linkability of trajectory data based on similarities to candidate trajectory data is measured and quantified as describer herein. Methods may include: receiving a set of probe data points defining a target trajectory from a probe apparatus; characterizing the trajectory based on features of the target trajectory; identifying a plurality of candidate trajectories sharing at least some features with the target trajectory; calculating, for each of the plurality of candidate trajectories, a similarity score with respect to the target trajectory; calculating a privacy score representing a likelihood of identifying the probe apparatus from the target trajectory based on a number of trajectories in the plurality of candidate trajectories and their respective similarity score; and providing information associated with the target trajectory for location-based services in response to the privacy score satisfying a predetermined value.

Method, apparatus, and computer program product for quantifying the linkability of trajectory data

Embodiments described herein relate measuring and quantifying the privacy risk for disclosure of trajectory data based on one or more attributes of the trajectory data. Methods may include: receiving probe data points defining at least one trajectory; identifying attributes of the at least one trajectory, where the identified attributes include values for respective trajectories; calculating a privacy risk associated with the at least one trajectory based, at least in part, on a distribution of values of the identified attributes, where the privacy risk includes a measure of difficulty in identifying a source of the at least one trajectory; and providing information associated with the at least one trajectory for location-based services in response to the privacy risk satisfying a predetermined value.

Method, apparatus, and computer program product for quantifying the privacy risk of trajectory data

An approach is provided for probe trajectory anonymization using based on a negative gap. The approach involves, for example, receiving a probe trajectory generated from at least one sensor of a probe device. The approach also involves processing the probe trajectory to segment the probe trajectory into a first subtrajectory and a second subtrajectory based on a negative gap between the first subtrajectory and the second subtrajectory. The negative gap specifies an amount of overlap between the end of the first subtrajectory and the beginning of the second subtrajectory. The approach further involves assigning a first pseudonym (e.g., a first new probe identifier) to the first subtrajectory, and a second pseudonym (e.g., a second new probe identifier) to the second subtrajectory. The approach then involves providing the first subtrajectory and the second subtrajectory as a trajectory anonymization output.

Method and apparatus for trajectory anonymization based on negative gapping

A method, apparatus, and computer program product are provided for anonymizing the trajectory of a vehicle. Methods may include: receiving a sequence of probe data points defining a trajectory; for a subset of the sequence of probe data points defining the trajectory beginning at an origin: updating a counter value at each probe data point, where the counter value is updated based, at least in part, on properties of a number of road links emanating from each junction through which the trajectory passed to reach a location associated with the respective probe data point; in response to the counter value satisfying a predetermined value after an update relative to a given probe data point, removing probe data points before the given probe data point in the sequence of probe data points to obtain origin-obscured probe data points; and creating a cropped trajectory including the origin-obscured probe data points.

Embodiments described herein relate to anonymizing of trajectories of mobile devices through the introduction of gaps between sub-trajectories. Methods may include: receiving a set of probe data points defining a trajectory; identifying a temporal length range of sub-trajectories; receiving a mode, where the mode is established based on a preceding set of probe data points defining a trajectory, where the mode includes an indication of whether to generate a sub-trajectory or a gap from the beginning of the received set of probe data points; and establishing at least one sub-trajectory including a sub-set of the set of probe data points, where the at least one sub-trajectory is established to satisfy the temporal length range of sub-trajectories.

Embodiments described herein relate to establishing a privacy risk score between two datasets based on features common to the datasets. Methods may include: receiving a first dataset of probe data points defining a trajectory; receiving a second dataset of the probe data points defining the trajectory; identifying a plurality of features common to the first dataset and the second dataset; computing a privacy risk value for the identified features common to the first dataset and the second dataset; and computing an aggregate privacy risk score between the first dataset and the second dataset.

Method, apparatus, and computer program product for identifying privacy risks in datasets

An approach is provided for device-side probe trajectory anonymization based on negative gapping. The approach involves, for example, collecting a probe trajectory stream from a sensor of a probe device, wherein the probe trajectory stream comprises a time-sequence of location data points representing a sensed movement of the probe device. The approach also involves generating a plurality of subtrajectory streams from the probe trajectory stream. The approach further involves processing the plurality of subtrajectory streams to create a negative gap between the plurality of subtrajectory streams. The approach further involves providing the plurality of subtrajectory streams as an output in place of the probe trajectory.

Growing community of inventors

Zurich, Switzerland

Stefano Bennati