Anonymity Set Size Research Articles

Virtual Pseudonym-Changing and Dynamic Grouping Policy for Privacy Preservation in VANETs.

Location privacy is a critical problem in the vehicular communication networks. Vehicles broadcast their road status information to other entities in the network through beacon messages. The beacon message content consists of the vehicle ID, speed, direction, position, and other information. An adversary could use vehicle identity and positioning information to determine vehicle driver behavior and identity at different visited location spots. A pseudonym can be used instead of the vehicle ID to help in the vehicle location privacy. These pseudonyms should be changed in appropriate way to produce uncertainty for any adversary attempting to identify a vehicle at different locations. In the existing research literature, pseudonyms are changed during silent mode between neighbors. However, the use of a short silent period and the visibility of pseudonyms of direct neighbors provides a mechanism for an adversary to determine the identity of a target vehicle at specific locations. Moreover, privacy is provided to the driver, only within the RSU range; outside it, there is no privacy protection. In this research, we address the problem of location privacy in a highway scenario, where vehicles are traveling at high speeds with diverse traffic density. We propose a Dynamic Grouping and Virtual Pseudonym-Changing (DGVP) scheme for vehicle location privacy. Dynamic groups are formed based on similar status vehicles and cooperatively change pseudonyms. In the case of low traffic density, we use a virtual pseudonym update process. We formally present the model and specify the scheme through High-Level Petri Nets (HLPN). The simulation results indicate that the proposed method improves the anonymity set size and entropy, provides lower traceability, reduces impact on vehicular network applications, and has lower computation cost compared to existing research work.

Privacy‐preserving multilevel obfuscation scheme for vehicular network

AbstractFor accessing various location‐based services (LBS), a device needs to update its location frequently. The vehicle requires to exchange location messages with LBS while moving on the road network. These messages contain sensitive information of vehicles, that is, location, identity, direction, and other contents. LBS is not trusted and may conspire with an adversary to capture the location messages and based on the location information the adversary tracks the future location spots of the vehicle driver. Existing location privacy schemes require the collaboration of neighbor vehicles to anonymize their location. However, such collaboration needs the consent of the neighbor vehicles. In addition, the messages exchanged with LBS contain the real identity of a vehicle and the vehicle is exposed to identity threat. In this article, we propose a multilevel location privacy scheme (MLPS) for a vehicle using location services. The vehicle generates duplicate messages by taking location positions of transmission range vehicles to anonymize its location and identity. We simulate the proposed scheme for various vehicle traffic densities. The simulation results show that the proposed scheme MLPS is more efficient than the existing scheme in terms of anonymity set size, location obfuscation, and location traceability. The MLPS reduces the vehicle location traceability from 50% to 1% compared with the existing scheme.

MARP: A Distributed MAC Layer Attack Resistant Pseudonym Scheme for VANET

Modern vehicles are equipped with wireless communication technologies, allowing them to communicate with each other and forming large self-organized ad hoc networks (or vehicular ad hoc networks (VANETs)). VANETs, while promising new approaches for improving road safety, require privacy of vehicles (or drivers) to be protected from a variety of threats. Although pseudonym schemes have provided a promising solution at the upper layers, privacy attacks could still be carried out from medium access control (MAC) layer. In this paper, we first introduce a new MAC layer context linking attack, which could link the old and new pseudonyms of a vehicle by analyzing its transmission characteristics. To deal with the attack, we propose a time division multiple access based MAC-layer-Attack-Resistant Pseudonym (MARP) scheme. Unlike traditional approaches that design the MAC protocols and pseudonym schemes separately, MARP allows vehicles to change their transmission slots and pseudonyms collaboratively. Thus, the unlinkability is guaranteed. Taking the pseudonym age, anonymity set size and time-to-confusion as the location privacy metrics, we derive an analytical model to quantify location privacy achieved in MARP. The analytical model is general to be applied for other pseudonym schemes. Extensive simulation results have validated the analytical model, showed that MARP can resist the MAC context linking attack and guarantee location privacy and efficient transmission for vehicles in VANETs.

CPESP: Cooperative Pseudonym Exchange and Scheme Permutation to preserve location privacy in VANETs

In VANETs, vehicles exchange information to/from the surrounding entities (vehicles, infrastructure, network, device, pedestrian) in wireless mode for various safety and non-safety applications. This Vehicle-to-Everything (V2X) wireless communication poses privacy risks because it can be exploited to collect the vehicle's trajectories. Preserving the location privacy is an essential aspect in a vehicular network. Various pseudonym changes-based privacy-preserving schemes have been proposed to protect location privacy in VANETs. However, when evaluated using essential privacy metrics in the simulation, the performance of these schemes found low. In this paper, we propose an enhanced scheme called Cooperative Pseudonym Exchange and Scheme Permutation (CPESP) to preserve the users' privacy in a VANETs. In our schemes, we allow vehicles to exchange their pseudonyms cooperatively and propose a novel mechanism where like pseudonym the schemes can also be changed (permute) by vehicles to create confusion for the adversary that can further improve the privacy. Since we are exchanging the pseudonyms between vehicles, it also eliminates location tracking by service providers. We evaluate the strength of our proposed scheme and compare it with existing mechanisms on a PREXT simulation platform. We use several popular privacy metrics such as anonymity set size, entropy, traceability, normalized traceability, and average confusion for comparison. Simulation results reveal that our scheme has the great potential to preserve the location privacy in VANETs and can also be enhanced to deliver much better than the existing schemes.

Location and trajectory privacy preservation in 5G-Enabled vehicle social network services

5G-based Vehicular Social Networks (VSNs) demand an advanced location and trajectory privacy preserving scheme for vehicles. Because VSNs present the characteristics of high mobility and multiple hop relays, we design a 5G-based VSN framework that incorporates Mobile Femtocell (MFemtocell) technology. Then, we propose the Dynamic Group Division algorithm (DGD), which is suitable for the dynamic properties of 5G and meets the real-time demands of VSN. To preserve privacy, the DGD algorithm increases the likelihood of exchanging pseudonyms via the proposed Group Generating Protocol and Pseudonym Exchanging Protocol. Then, we adopt the composite metric KDT (where K is the average anonymity set size, D is the average distance deviation, and T is the anonymity duration) and pseudonym entropy to quantify the degree of privacy. We evaluate and validate the effectiveness of our proposed algorithm based on the following three aspects: anonymity set size, distance deviation and pseudonym entropy. The simulation results show that our DGD algorithm better protects the location and trajectory privacy of VSNs while sustaining higher real-time demand than current approaches.

Pseudonym changing strategy with multiple mix zones for trajectory privacy protection in road networks

SummaryIn road network, vehicles' location may be identified, and their transmissions may even tracked by eavesdrops (eg, safety messages) that contain sensitive personal information such as identity and location of the vehicle. This type of communication leads to breaking the users' trajectory privacy. Frequently changing pseudonyms are widely accepted as a solution that protects the trajectory privacy of users in road networks. However, this solution may become invalid if a vehicle changes its pseudonym at an improper occasion. To cope with this issue, we presented an efficient pseudonym change strategy with multiple mix zones scheme to provide trajectory privacy for road network. In addition, we protected vehicles against linkability attack by cheating mechanism. Henceforth, we constructed a cheating detection mechanism which allows the vehicles to verify whether the pseudonym change process is successful or not and also detect to malicious vehicles. In this way, users' trajectory privacy can be improved. Finally, by taking the anonymity set size (ASS) as the trajectory privacy metric, we exhibit by means of simulations that the proposed scheme is effective in multiple networks scenarios.

K-Anonymity Based Privacy Risk Budgeting System for Interactive Record Linkage

ABSTRACTObjectiveInformation privacy theory demonstrates mathematically that privacy is a budget constrained problem and that privacy preserving algorithms(e.g., differential privacy) must rely on a budgeting system. Thus, we design a privacy measure as a function of information disclosed to support incremental information disclosure required for safe interactive record linkage. The privacy measure will determine the increase in the privacy risk for any given information disclosed during record linkage.
 ApproachMathematically, the identity disclosure risk is inversely proportional to the number of entities in the population that share the information disclosed. If the information refers to one and only one person in the population, then the identity of the person has been fully disclosed by the information revealed. On the other hand, if the information disclosed is identical for multiple people(say n), then the information is less revealing as it could refer to any one of the n people. The larger the n, the lower the privacy risk. Thus, the anonymity-set size is defined as the number of people in the population that share the same identifying information. The privacy risk measure has one prespecified parameter k, which represents the minimum anonymity-set size to guarantee no privacy risk. That is, for any disclosed information, if the anonymity-set size is less than k, then a privacy risk is present and the risk score will be calculated. A commonly accepted threshold for k is 5 or 10. On the one hand, when all entities have anonymity-set size less than k, the privacy risk would be 100%. On the other hand, if all entities have anonymity-set size greater than or equal to k, the privacy risk would be 0%.
 ResultsThe budgeting system contributes to the much-needed methods for protecting privacy while still supporting high quality interactive record linkage by allowing safer manual resolution of uncertain linkages. The budgeting system supports refining effective visual encoding techniques for incrementally revealing only the required information on an as-needed basis during manual resolution of uncertain linkages as well as refining the design for a visual interface to facilitate privacy preserving data standardization, cleaning, and conflict resolution for interactive record linkage. We evaluate the budgeting system with the NC voter registry data.
 ConclusionThe k-anonymity based privacy risk budgeting system provides a mechanism where we can concretely reason about the tradeoff between the privacy risks due to information disclosed, accuracy gained, and biases reduced during interactive record linkage.

PHI: Path-Hidden Lightweight Anonymity Protocol at Network Layer

Abstract We identify two vulnerabilities for existing highspeed network-layer anonymity protocols, such as LAP and Dovetail. First, the header formats of LAP and Dovetail leak path information, reducing the anonymity-set size when an adversary launches topological attacks. Second, ASes can launch session hijacking attacks to deanonymize destinations. HORNET addresses these problems but incurs additional bandwidth overhead and latency. In this paper, we propose PHI, a Path-HIdden lightweight anonymity protocol that solves both challenges while maintaining the same level of efficiency as LAP and Dovetail. We present an efficient packet header format that hides path information and a new back-off setup method that is compatible with current and future network architectures. Our experiments demonstrate that PHI expands anonymity sets of LAP and Dovetail by over 30x and reaches 120 Gbps forwarding speed on a commodity software router.

Evaluating Location Privacy in Vehicular Communications and Applications

Vehicular ad hoc networks may one day prevent injuries and reduce transportation costs by enabling new safety and traffic management applications, but these networks raise privacy concerns because they could enable applications to perform unwanted surveillance. Researchers have proposed privacy protocols, measuring privacy performance based on metrics such as $k$ -anonymity. Because of the frequency and precision of location of queries in vehicular applications, privacy measurement may be improved by considering additional factors. This paper defines continuous network location privacy ; presents KDT -anonymity, which is a composite metric including average anonymity set size, i.e., $K$ , average distance deviation, i.e., $D$ , and anonymity duration, i.e., $T$ ; derives formulas to calculate theoretical values of $K$ , $D$ , and $T$ ; evaluates five privacy protocols under realistic vehicle mobility patterns using KDT -anonymity; and compares KDT -anonymity with prior metrics.

PACOM: Parasitic anonymous communication in the BitTorrent network

Existing anonymous communication systems mask the identities of users by adopting intermediary nodes to transform message flows. However, some recently presented traffic analysis algorithms are still able to undermine the anonymity of these systems. The traditional flow transformation strategies fail to completely eliminate the traffic correlation between adjacent communication links to prevent such attacks. To address this problem, we propose a novel parasitic anonymous communication system, named PACOM. Each PACOM client is parasitic in the BitTorrent network which is the most popular Peer-to-Peer file sharing network, and conceals the communication path in the request driven traffic compatible with the BitTorrent protocol. The traffic patterns of adjacent communication links can be proved to be statistically independent, which effectively resists the traffic analysis attacks. Meanwhile, the “effective anonymity set size” of the system can be extended enormously by mixing the PACOM clients with other millions of BitTorrent clients in the Internet. To validate the PACOM solution, we analyse the anonymity of PACOM theoretically and conduct comprehensive simulations and emulations to test the scalability and effectiveness of PACOM against various attacks.

A New Fuzzy-Based Approach for Anonymity Quantification in E-Services

In online services, making anonymous transactions is a crucial need in order to ensure the user's trust towards a particular service. In this context, anonymity quantification is required to provide at which level the e-service respects the user privacy regarding the link between his/her identity and actions. Most of the existing researches are limited to the anonymity quantification in a static way and based, mainly, on the user's set size. In this paper, the authors propose a new multi-agent based approach for anonymity quantification in e-services considering dynamic and mobile environment's characteristics. The authors' quantification is based on the fuzzy logic. It is based not only on the anonymity set size, which is always known in advance, but also on a set of other criteria such as the number of users and the priori and posteriori knowledge about internal and external attackers of an e-service. The carried out experimentations show competitive and better results when compared to other recently proposed anonymity quantification.

Cooperative pseudonym change scheme based on the number of neighbors in VANETs

In Vehicular Ad hoc NETworks (VANETs), trigger-based pseudonym change schemes play an important role in providing anonymity. However, the anonymity provided by these schemes usually is low mainly because the behavior of changing pseudonym is individual. Considering cooperation on changing pseudonym can enhance anonymity, in this paper, we give a general cooperation framework. As an application of the framework, we present a Cooperative Pseudonym change scheme based on the number of Neighbors (CPN). We generally analyze the anonymity provided by the CPN scheme and qualitatively compare the scheme with its corresponding scheme without cooperation, Non-CPN (NCPN). Then, under uniform traffic distribution, we develop an approximate analytical model for CPN in relatively simple one-lane VANETs to analyze the anonymity. Finally, we investigate the anonymity of CPN in one-lane and multi-lane VANETs by simulation. The results show that the ratio of the size of anonymity set in multi-lane to that in one-lane VANETs, first quickly goes up, then slowly decreases a bit, and at last approaches the value of number of lanes. In addition, the improved performance of CPN over NCPN reaches peak when the average number of neighbors approaches that number in the trigger.

An analytical model for random pseudonym change scheme in VANETs

The emerging Vehicular Ad hoc NETworks (VANETs) can improve safety, efficiency and convenience in transportation. In spite of the expected benefits, VANETs also introduce some location privacy risk by periodically broadcasting vehicular information. Pseudonym change is commonly accepted as one approach to protect location privacy in VANETs, but the effectiveness of most pseudonym change schemes has never been investigated theoretically. In this paper, focusing on the Random Pseudonym Change (RPC) scheme, we propose an analytical model to quantify its level of location privacy by calculating the size of anonymity set of a vehicle. With this model, we can analyze the probability of a vehicle changing pseudonym simultaneously with its neighbor, which can be then used to calculate the size of anonymity set of the vehicle. Further, we investigate the influence of the pseudonym lifetime distribution on the level of location privacy. Research results, which are validated via extensive simulations, show that for the RPC scheme, the uniform pseudonym lifetime distribution can provide better location privacy protection than the reciprocal pseudonym lifetime distribution. In addition, we also discuss the conditional probability of a vehicle changing pseudonym simultaneously with its neighbor given the age of pseudonym used by the neighbor at the time when the vehicle last changed pseudonym, and point out that utilizing the age of pseudonym can improve the level of location privacy.

Pseudonym Changing at Social Spots: An Effective Strategy for Location Privacy in VANETs

As a prime target of the quality of privacy in vehicular ad hoc networks (VANETs), location privacy is imperative for VANETs to fully flourish. Although frequent pseudonym changing provides a promising solution for location privacy in VANETs, if the pseudonyms are changed in an improper time or location, such a solution may become invalid. To cope with the issue, in this paper, we present an effective pseudonym changing at social spots (PCS) strategy to achieve the provable location privacy. In particular, we first introduce the social spots where several vehicles may gather, e.g., a road intersection when the traffic light turns red or a free parking lot near a shopping mall. By taking the anonymity set size as the location privacy metric, we then develop two anonymity set analytic models to quantitatively investigate the location privacy that is achieved by the PCS strategy. In addition, we use game-theoretic techniques to prove the feasibility of the PCS strategy in practice. Extensive performance evaluations are conducted to demonstrate that better location privacy can be achieved when a vehicle changes its pseudonyms at some highly social spots and that the proposed PCS strategy can assist vehicles to intelligently change their pseudonyms at the right moment and place.