Dynamic mix zones

A method for providing anonymity in geographic data for probes using a variable mix zone in a geographic region, the method comprising:

• identifying one or more map features in the geographic region;
• defining, using a processor, a mix zone boundary having a size based on the one or more map features;
• receiving probe data for at least one probe, the probe data including a location within a predetermined distance of the mix zone boundary;
• selecting, using the processor, a pseudonym for the at least one probe in response to the location of the probe data;
• and
• applying the pseudonym for the at least one probe in the geographic data when the at least one probe exits the mix zone,
• wherein the size of the mix zone boundary is based on an anonymity level and
• the anonymity level is a k-anonymity for a probe such that a probability of identifying the probe from k probes in the mix zone is 1/k.

An apparatus for providing anonymity in geographic data for probes using a variable mix zone in a geographic region, the apparatus comprising:

• a geographic database configured to store one or more map features in the geographic region;
• a mix zone generator configured to define a mix zone boundary and monitor probe data for at least one probe, the probe data including a location within a predetermined distance of the mix zone boundary;
• a pseudonym generator configured to select a pseudonym for the at least one probe in response to the location of the probe data and apply the pseudonym for the at least one probe in the geographic data when the at least one probe exits the mix zone;
• and
• an anonymity calculator configured to calculate an anonymity level, wherein a size of the mix zone boundary is based on the anonymity level.

A non-transitory computer readable medium including instructions that when executed by a process perform a method comprising:

• generating first location data for a first location of a probe, wherein one or more map features are identified in response to the first location data;
• sending the location data to a mix zone generator for defining a mix zone, wherein the first location is within the mix zone;
• generating second location data for a second location of the probe;
• receiving a pseudonym in response to the second location of the probe being outside the mix zone;
• and
• disabling at least one location-based service for at least one device associated with the probe in response to the probe crossing the mix zone.