  Urban transportation is being transformed by mobility-on-demand (MoD)
systems. One of the goals of MoD systems is to provide personalized
transportation services to passengers. This process is facilitated by a
centralized operator that coordinates the assignment of vehicles to individual
passengers, based on location data. However, current approaches assume that
accurate positioning information for passengers and vehicles is readily
available. This assumption raises privacy concerns. In this work, we address
this issue by proposing a method that protects passengers' drop-off locations
(i.e., their travel destinations). Formally, we solve a batch assignment
problem that routes vehicles at obfuscated origin locations to passenger
locations (since origin locations correspond to previous drop-off locations),
such that the mean waiting time is minimized. Our main contributions are
two-fold. First, we formalize the notion of privacy for continuous
vehicle-to-passenger assignment in MoD systems, and integrate a privacy
mechanism that provides formal guarantees. Second, we present a scalable
algorithm that takes advantage of superfluous (idle) vehicles in the system,
combining multiple iterations of the Hungarian algorithm to allocate a
redundant number of vehicles to a single passenger. As a result, we are able to
reduce the performance deterioration induced by the privacy mechanism. We
evaluate our methods on a real, large-scale data set consisting of over 11
million taxi rides (specifying vehicle availability and passenger requests),
recorded over a month's duration, in the area of Manhattan, New York. Our work
demonstrates that privacy can be integrated into MoD systems without incurring
a significant loss of performance, and moreover, that this loss can be further
minimized at the cost of deploying additional (redundant) vehicles into the
fleet.
