Towards Private Navigation of Tree Structured Spatial Indexes

With many location-based services, spatial data such as points of interest are indexed at a potentially untrusted host and queries are evaluated by navigating the underlying index structure used to partition the data. While encryption can prevent the host from learning the data content (i.e., what is accessed), it cannot hide the frequency that index nodes are accessed while navigating the index for query processing. Combining the knowledge of such access frequencies with public knowledge readily available about points of interest, the host can infer sensitive information about the indexed data and hence the locations of the users querying it (violating location privacy). In this paper, we propose a technique that hides frequency access to the nodes of tree-structured spatial indexes (e.g., R-tree) from an untrusted server hosting the data. With our approach, each access to an index node requires reading an extra node using a precomputed node-based probability distribution function to guarantee uniform node access at all tree levels. We analytically verify the strong level of privacy achieved with a constant computation and acceptable communication and storage overhead for employing our private index navigation scheme.