1. Virtual Trip Lines for Distributed Privacy- Preserving Traffic Monitoring Baik Hoh et al. MobiSys08 Slides based on Dr. Hoh’s MobiSys presentation

2. Collaborative Traffic Monitoring using Cellphone- based Probe Vehicles Probe Vehicles Satellite Traffic Estimation Data mining and logging Cellular Service Provider Vehicle ID | timestamp | Lon | Lat | Speed | Heading ------------------------------------------------------------------ 254,18-oct-2006 10:11:12,-85.3452,42.4928,42.18,135 372,18-oct-2006 10:11:12,-85.3427,42.4898,63.72,100 182,18-oct-2006 10:11:12,-85.4092,42.4726,50.15,75 254,18-oct-2006 10:12:12,-85.3462,42.4998,45.18,135 372,18-oct-2006 10:12:12,-85.3512,42.4944,60.01,185 182,18-oct-2006 10:12:12,-85.4102,42.4753,45.88,235 … 254,18-oct-2006 10:21:12,-85.3856,42.5129,45.67,135 Location Proxy Access Control Anonymization Anonymous Trace log files

3. Inference/Insider Attacks Compromise Location Privacy Still insider attacks and remote break-ins possible Re-identification of traces through data analysis Home Identification [Hoh06] Tracking algorithms recover individual trace [Hoh05] (Median trip time only 15min)................ Anonymous Trace log files GPS often precise enough to identify home

4. Related Works: Uncertainty-Aware Path Cloaking Requires a Trustworthy Proxy Server [Hoh07] Time-to-confusion (TTC) criterion* measures time an adversary can track with high confidence Disclosure control algorithm that selectively reveals GPS samples to limit the maximum Time-to- confusion....................

5. What if location proxy got compromised? Idea: distributed “privacy” preserving scheme (a la secret splitting) using Virtual Trip Lines (VTLs) Probe Vehicles Satellite Traffic Estimation Data mining and logging Cellular Service Provider Location Proxy Vehicle ID | timestamp | Lon | Lat | Speed | Heading ------------------------------------------------------------------ 254,18-oct-2006 10:11:12,-85.3452,42.4928,42.18,135 372,18-oct-2006 10:11:12,-85.3427,42.4898,63.72,100

6. Virtual Trip Lines (VTLs) Enables Sampling in Space Better than sampling in time (periodic reports)? Chance of distributed architecture? VTL has the same effect as "road side” sensor based measurement –VTL can be strategically chosen (optimal placement in the paper)

7. Any single entity can be compromised (but no collusion) A driver’s cellphone is trustworthy Privacy Risks and Threat Model My Phone Satellite Traffic Estimation Data mining and logging Location Proxy Cellular Service Provider Others

8. Probablistic Guarantee Model (Mix Zone) Mobile generates data: VTL ID, speed, direction Mobile encrypts data using VTL server’s public key Privacy guarantee: –Location proxy: can’t decrypt location data –VTL server: can’t find user’s identity (but still inference attack is feasible, e.g., only single vehicle reporting data..) Traffic Estimation Location Proxy Cell Service Provider VTL Server E(VTL ID, speed, dir) Mobile’s ID, E(VTL ID, speed, dir)  Remove Mobile’s ID E(VTL ID, speed, dir)  VTL decrypts the data

9. Placement Privacy Constraints: Minimum Spacing Tracking uncertainty is dependent on the spacing between VTLs, the penetration rate, and speed variations of vehicles

10. Placement Privacy Constraints: Exclusion Areas Low speed samples are likely generated by vehicles that just entered after the ramp Suppress sampling on on-/off-ramps

11. Guaranteed Privacy Model with VTL-based k-anonymity (called Distributed VTL-Based Temporal Cloaking) k=7 VTLIDnew = h (nonce, VTLIDold), h is a secure hash function

12. Distributed VTL-Based Temporal Cloaking Motivated by secret splitting scheme Traffic estimation is immune to temporal error EntityRoleIdentityLocationTime HandsetSensingYesAccurate Location VerifierDistributing VTL ID updates YesCoarseAccurate ID proxyAnonymizing and Cloaking YesNot availableAccurate Traffic ServerComputing Traffic Congestion NoAccurateCloaked Virtual Trip Lines Temporal Cloaking