On the Optimal Placement of Mix Zones Julien Freudiger, Reza Shokri and Jean-Pierre Hubaux PETS, 2009

Phones – Always on (Bluetooth, WiFi) – Background apps New hardware going wireless – Cars, passports, keys, … Wireless Trends 2

Peer-to-Peer Wireless Networks Message Identifier 2 2

Examples 4 Urban Sensing networks Delay tolerant networks Peer-to-peer file exchange VANETs Social networks

Location Privacy Problem 5 a b c Monitor identifiers used in peer-to-peer communications

bluetoothtracking.org 6

Previous Work Pseudonymous location traces – Home/work location pairs are unique [1] – Re-identification of traces through data analysis [2,3,5] Location traces without any pseudonyms – Re-identification of individual trace and home [4] Attack: Spatio-Temporal correlation of traces 7 Message Identifier [1] P. Golle and K. Partridge. On the Anonymity of Home/Work Location Pairs. Pervasive Computing, 2009 [2] A. Beresford and F. Stajano. Location Privacy in Pervasive Computing. IEEE Pervasive Computing, 2003 [3] B. Hoh et al. Enhancing Security & Privacy in Traffic Monitoring Systems. Pervasive Computing, 2006 [4] B. Hoh and M. Gruteser. Protecting location privacy through path confusion. SECURECOMM, 2005 [5] J. Krumm. Inference Attacks on Location Tracks. Pervasive Computing, 2007 Pseudonym Message

Location Privacy with Mix Zones Prevent long term tracking 8 Mix zone a a b b ? Change identifier in mix zones [6,7] Key used to sign messages is changed MAC address is changed [6] A. Beresford and F. Stajano. Mix Zones: User Privacy in Location-aware Services. Pervasive Computing and Communications Workshop, 2004 [7] M. Gruteser and D. Grunwald. Enhancing location privacy in wireless LAN through disposable interface identifiers: a quantitative analysis. Mobile Networks and Applications, 2005

Mix Zones Mix network Mix networks vs Mix zones 9 Mix node Mix node Mix node Mix node Mix node Mix node Alice Bob Alice home Alice work

Where to place mix zones? 10

Outline 1.Mix Zone Effectiveness 2.Placement of Mix Zones 3.Application Example 11 Shibuyu Crossing, Tokyo

Mobility Model Nodes move according to flows [8] – A flow defines a trajectory in network – Nodes belong to a single flow – Several nodes share same flow 12 [8] M.C. Gonzalez, C.A. Hidalgo, and A.-L. Barabasi. Understanding individual Human Mobility Patterns. Nature, 2008

Mix Zones Model Mix zones have – Set of entry/exit points – Traversed by mobile nodes Mobility profile of a mix zone [6] – Trajectory – Sojourn time 13

Trajectory 14 3/41/40 1/3 2/301/3 1/21/4

Sojourn Time 15 ΔtΔt Pr( Δ t)

Mix Zone Effectiveness Event-Based Metric [6] 16 P v is probability of assignment I = total number of assignments T t t Entering events Exiting events 1 2 ab

Event-Based Discussion Precise Measures attacker success Requires installing eavesdropping stations at every mix zones What if nodes are across various windows T High complexity (compute all assignments) – –

Mix Zone Effectiveness Flow-based Metric Desired properties – Prior to network operation – Rely on general statistics of mobility – Efficient Key idea – Consider average behavior in mix zones – Measure probability of error of adversary 18

Decision Theory Model Assume 2 flows f 1, f 2 converge to same exit 19 Mix zone 1 1 x x 2 2 Choice under uncertainty Any event

Bayes Decision Rule Choose hypothesis with largest a posteriori probability Minimizes probability of error 20 is the a priori probability that an event belongs to f j is the conditional probability of observing x knowing that x belongs to f j

pepe Probability of Error 21

Jensen-Shannon Divergence Measure distance between probability distributions 22 Provides both lower and upper bounds for the probability of error

Outline 23 Illustration of Metric

Outline 1.Mix Zone Effectiveness 2.Placement of Mix Zones 3.Application Example 24

Description Central authority decides offline where to deploy mix zones – Knows mobility model – Knows effectiveness of possible mix zones locations 25

Distance to Confusion [9] Between mix zones, adversary can track nodes Mix zone = confusion point Bound distance between mix zones 26 Mix zone 1 Mix zone 2 Distance-to-confusion [9] B. Hoh et al.. Virtual Trip Lines for Distributed Privacy-Preserving Traffic Monitoring. MobiSys, 2008

Cost of mix zones Use pseudonyms Must remain silent for a period of time Bound cost for each node 27

Placement Optimization Use a subset of all possible mix zones 28 Cost Distance to confusion Mix zone effectiveness where w i is cost of a mix zone W max is maximum cost C max is maximum distance-to-confusion

Illustration of Algorithm

Outline 1.Mix Zone Effectiveness 2.Placement of Mix Zones 3.Application Example 30

Simulation Setup Urban mobility simulator (SUMO) – Real (cropped) map – Flows Attack Implementation (MOBIVACY) – Compute mobility profiles for each mix zone – Predict most probable assignment of entering/exiting nodes for each mix zone 31

Map of New York City 32

Metric & Configuration Matching success of mix zone i Tracking success System parameters – dtc <= 2km – cost <= 3 mix zones 33

Mix Zone Performance 34

Mix Zone Placement 35 (avg=0.48) (avg=1.56) (avg=1.55) (avg=3.56)

Tracking Success for different deployments 36

Performance of Deployment 37

Tracking Success with different traffic conditions 38

Conclusion Construct a network of mix zones Measure of mix zones effectiveness based on – Mobility profiles – Jensen-Shannon divergence Optimization model Results – Optimal algorithm prevents bad placement – 30% increase of location privacy compared to random 39

BACKUP SLIDES 40

Future Work Real mobility traces – More realistic intersection model Weight location in optimization – Some regions are more sensitive Larger map Other attacks 41

How to obtain mix zones? Silent mix zones – Turn off transceiver Passive mix zones – Where adversary is absent – Before connecting to Wireless Access Points Encrypt communications – With help of infrastructure – Distributed 42

Event-based Metric Assume adversary knows mobility profiles Consider nodes entering/exiting mix zone i over T time steps P v is probability of assignment I = total number of assignments Average entropy: 43

Generalization Consider average behavior 44 Mix zone 1 1 x x

Mix Zone Placement 45 Average number of traversed mix zone = average cost Optimal performs close to full at much lower cost

Tracking Success for different adversary strength 46

Tracking Success for different mix zone radius 47

Average Tracking Success 48