Anonymity Analysis

In this section, two privacy metrics are presented to evaluate the anonymity performance of proposed system. The anonymity set and entropy, which were mentioned above from Chapter 3, purely focus on measure the level of anonymity. The car arrival rate at any place on the road is assumed a Poisson process with rate λ. Also, X is the random variable depicting the number of vehicles that arrive at a certain point during the period of time T. Thus, the probability X= x is

P(X= x) = (λT)

x

x! e

Communication System

As a result, the expected number of vehicles during the period T can be described as: E(X= x) = ∞

∑

As the expected number of vehicles specifically means surrounding vehicles around the target vehicle and changing their pseudonyms si- multaneously, these cars form the anonymity set (AS).

Since not all cars in the anonymity set are equally likely to be the tar- get, entropy-based metric should be considered. It is used for measuring the randomness of the probabilities that represent the possibility of each vehicle being the target. N is assumed as the size of AS, and pi is the

probability of each vehicle be the target of the attacker. Entropy is de- fined as: H(X) = − N

∑

While the event k of a car approaching the mix zone at time τ is de- noted by k = (n, τ), the event l of a car leaving the mix zone at time τ0 on the road e is denoted by l = (e, τ0). The probability of the car leaving at the road e that entered at the road n is denoted by P_n,e. In addition, the probability of the time from entering at road n and leaving at road e is t is denoted by qn,e(t). As a result, the probability of the mapping of an

event that a vehicle entering event k and leave event l can be denoted by P_k→l = P_n,eqn,e. For the number of n vehicles, the derivation is based on

[93]. The entropy ofP_k→l is defined as: H(l) = −

N

∑

k=1

Communication System

As the equation shows, the entropy would be affected by two factors: 1. the number of n cars in the mix zone. 2. the similarity of the distri- bution of pk→l to the uniform distribution. In addition, the accurateness

of the probability ofP_n,eand qn,e(t)is depend on the knowledge of the

attackers, which is closely related to the threat model.

The simple tracking means that the adversary is aware of the set of car approaching or leaving the mix zone but no information about their timing and trajectories. For example, A passive external attacker with a restricted observation of an intersection. Since the attacker can only know that it took a constant time C for vehicles in that mix zone. There- fore, P_k→l for the attacker is a uniform distribution. The upper-bound on the achievable location privacy, as known as maximum entropy, is defined as:

H(l) ≤log2(N) (4.6)

The maximum entropy stands for the maximum location privacy can be achieved in this case, which only depends on the amount of vehicles in the mix zone spot. As a result, the simple tracking gives an upper-bound to the achievable unlinkability.

The correlation tracking means that the adversary observe the se- quence and location of events by collecting vehicles’ entry/exit time and position. Therefore, location privacy in the mix zone depends on the tra- jectory of vehicles and the delay characteristics of the mix zone. For a time duration τ, the number of N vehicles approach at the mix zone. So vehicles arrival times τi are distributed based on a uniform distribution

where i=1, 2...N, τi ∼ U (τ).

Communication System

TABLE4.1: Simulation Parameters

Parameter Name Value

Length of RSU coverage 600 m

BSM transmit power 20 mW

Vehicle number 300

Standard derivation of the traffic distribution function 6.88

Mean of the traffic distribution function 46.56

an intersection. d = 4, which means there are 4 exits in this intersection. When vehicles entry from n1, the delay characteristics is

qn1,ei(t) ∼ N (µ1,i, σ1,i) (4.7) where i = 1, 2, ..., d and e1, e2, e3, e4 state the directions that vehicles can

exit, namely, u-turn, left, straight, and right. Changing the delay charac- teristics µandσ, the attackers model various types of intersections. Under the assumption that the attacker has knowledge about the intersections structure, the delay parameters µ and σ can be computed. Furthermore, the adversary models the vehicles trajectories by selectingPn,e <1 based

on the prior knowledge about the road structure and intersection types. Therefore, for every entry point n, the sum ofP_n,eis_∑d_e=1Pn,e =1