Anonymizing Web Services Through a Club Mechanism With Economic Incentives Mamata Jenamani Leszek Lilien Bharat Bhargava Department of Computer Sciences and Center for Education and Research in Information Assurance and Security (CERIAS) Purdue University, West Lafayette, Indiana

Motivation Preserving privacy during Web transactions - a major concern Failure of most commercial services in providing such services –Besides technical, many economic and social factors contribute to the failures Anonymizing Web services – a solution for preserving privacy on the Web Game theory – for economic analysis

Proposed Club Mechanism Anonymity through group co-operation – An anonymity club A trustworthy central authority – Randomly matching any two club members – Can resolve conflict among club members Each member tries to maximize her profit Cheating – most rational alternative in each single transaction Cooperating – most rational alternative in repeated sequential transactions

Rules for the Sequential Strategy Becoming a club member by paying a one time initiation fee F to the central authority Two members partner for an anonymizing Web transaction during the time period t Two members receive a benefit P t each by maintaining anonymity and using each other’s service Two strategies: cooperate or defect If Alice feels that Bob cheats her, she reports it to the central authority - P claim the loss suffered by the complainant The central authority investigates the fraud If fraud is confirmed, Bob pays a fine f and Pclaim, Alice gets compensation Pclaim and the central authority gets fine f. Otherwise, Alice is charged with a false complaint and pays fine g to the central authority. The culprit who does not pay a fine or a compensation is expelled from the club.

Prisoner’s Dilemma Played at Each Stage Assumptions Both partners have symmetric privacy needs They have equal number of requests for anonymizing Benefit from privacy protection is higher than the benefits received by sacrificing the partner’s privacy (i.e. P t > l t ) At each stage each agent has two choices: either to defect (D) or to cooperate (C). The only Nash equilibrium for both players in this game is to defect

PD Played at Each Stage – cont. P t be the benefit from privacy protection received by an agent within time period t ‑ P t as the cost of privacy violation if it is suffered by an agent during that period –P t ’s are independently identically distributed random variables with a common distribution P –P max a value beyond which distribution P has no positive probability density, –E(P) is the expectation of P l t be the benefit from disclosing the privacy of another agent –a similar assumption for the random variable l t –l max as an estimate of the maximum possible benefit received by a defecting agent CD CP t, P t -P t, P t + l t DP t + l t, -P t -P t +l t, -P t +l t Payoff structure of the Prisoner’s Dilemma game

An Agent’s Time-Weighted Average Payoff Discount factor, For interest rate i, Time weighted average payoff Payoff stream for time period t Total (Lifetime) Payoff –using the relationship: –and the formula for geometric series –we get: Maximizing time weighted average payoff is equivalent to maximizing total payoff Incentive for cooperation in a time period even though defection is a dominant strategy at each stage

Analysis of the Economic Incentives Conditions such as paying initiation fee and fine occur at time period t 0 The total payoff starting from period t 0 is: The total payoff starting from period t 1 is: Exploring conditions under which the proposed sequential strategy motivates the agents to cooperate

Proposition 1 An agent will join the proposed anonymizing club, if the initiation fee (given at time period t 0 ) is less than the difference between his total future payoff from this service (starting from time period t 1 ) and the maximum future payoff from adopting any other privacy preserving technology, i.e. if the following inequality is satisfied: where is the maximum of all expected payoffs from any other privacy-preserving technology available at that time period. Proof

Proposition 2 An agent will cooperate at every stage in the sequential repeated game, if the maximum value of the benefit from the cheating behavior is less than the total future payoff (from t 0 ) minus the maximum payoff achievable in the current transaction, i.e. if the following condition is satisfied: Proof

Proposition 3 A defector who is proven guilty is willing to pay the fine, if it is lower than the difference between his total future payoff (starting from t 1 ) and the compensation claimed by his partner, i.e. if the following condition is satisfied: Proof

Proposition 4 If a player’s complaint is proven false, he is willing to pay the fine imposed on him, if it is lower than his total future payoff (starting from t 1 ), i.e. if the following condition is satisfied: Proof

Theorem The proposed sequential strategy is an equilibrium strategy if the fine is imposed following conditions in Propositions 3 and 4, i.e., if: and The average payoff for an agent in this strategy is: Proof

Future Work Consideration of agent’s belief in the fairness of the central authority Consideration of the fixed costs associated with starting the service Defining the minimum number of participants starting a club Considering the cost involved in running the matching algorithm - another variable cost, such as annual club membership The probabilistic modeling of cheating behavior of individual agents Consideration of unequal privacy concerns of individual agents Consideration of unequal number of anonymizing transactions

Proof of Proposition 1 Back

Proof of Proposition 2 Back

Proof of Proposition 3 Back

Proof of Proposition 4 Back

Proof of the Theorem Back