A privacy-preserving data aggregation mechanism for VANETs

Abstract

It has been envisioned that vehicular ad hoc networks (VANETs) would play an important role in future traffic monitoring applications. This paper investigates how VANETs can overcome the strictly limited bandwidth and privacy issues. Firstly, an aggregation scheme is presented to minimize the required overall bandwidth. Subsequently, a privacy algorithm capable of ensuring user privacy in applications is proposed. This proposed mechanism can not only protect the private data of each individual against the adversaries with arbitrary auxiliary information, but also achieve the optimal accuracy of aggregates. Through simulations, the viability of this approach is confirmed.

Keywords

VANETs data aggregation differentially private

1. Introduction

As an important component of the intelligent transportation system (ITS) and a novel form of mobile ad hoc network, vehicular ad hoc networks (VANETs) for ubiquitous vehicles to sense and collect an enormous amount of traffic related information has attracted much attention from the government, industries and academic institutions. The collected information can be utilized for road traffic report, accident warnings and parking recommendation to improve road safety, traffic efficiency, and convenience for drivers. In the information broadcast or multi-hop transmissions, vehicles shall not only broadcast their own collected information, but also deliver others’ messages. Therefore, local data aggregation is needed to reduce the communication cost and improve the efficiency [7].

In VANETs, data aggregation is accomplished in the following way. Locally, each car makes observations for some essential measured values (i.e., speed, location, mileage and timestamp). The newly observed values are then integrated into the current aggregate record through appropriate weighted averages for the respective parameters to generate the new aggregate.

In this way, the bandwidth for transmitting separate observations is saved for each vehicle. Though the aggregates without obvious information about individuals, an adversary can infer the location and speed of an individual by comparing the new aggregate with the old one [9]. A person’s whereabouts may imply sensitive private information, such as health problems, lifestyles and political associations [14].

By carefully adding the chosen random noises, such as differential privacy, individual observations are not revealed to the adversary by hiding the difference between two continuous aggregates. First proposed in statistical databases, differential privacy [9] adds noise to the answers of queries so that the querying system cannot detect the presence or absence of a single tuple or a set of tuples, which provides a provable foundation for measuring privacy loss regardless of the information collected by an adversary. However, introducing differential privacy into data aggregation in VANETs imposes the following challenges: The data are distributed across a potentially large number of vehicular devices and roadside units (RSUs), without a centralized database. Some differential privacy approaches are restricted to static scenarios, which may not be suitable for the dynamic vehicular environment.

In order to address those challenges, a differentially private aggregation mechanism is proposed for VANETs, which can protect the privacy of each individual’s data against the adversary even if there is any arbitrary auxiliary information, and achieve the optimal accuracy of aggregates.

The rest of this paper is structured as follows. In Section 2, the notions of data aggregation and differential privacy from the literature are discussed, and their weaknesses and strengths are pointed out. In Section 3, the scheme for aggregating travel time information in city environments is proposed and introduced. Besides, distributed differential privacy settings and data aggregation model for VANETs are explained. Then, a differential privacy aggregation mechanism is described in Section 4, and the results of a simulative evaluation are presented and discussed in Section 5. Finally, a conclusion of this paper is drawn in Section 6.

2. Related work

In this section, the state of the art of data aggregation for vehicular communication and recent applications of differential privacy are reviewed.

2.1. Data aggregation for vehicular communication

Because of the limited bandwidth in vehicular communications, the information of several vehicles is often aggregated into a single message or record. This process is called data aggregation. So far, many data aggregation schemes have been proposed, such as SOTIS [21], TrafficView [15], and CASCADE [13], for collecting and combining information about position and speed of vehicles. Scheuermann [19] have proved that any suitable aggregation scheme shall be able to reduce the bandwidth with the information about an area at a distance of d provided to the cars asymptotically faster than $1 / d^{2}$ .

Only recently, the security aspects of data aggregation have begun to attract attention. Picconi et al. [17] have developed a probabilistic solution for validating the aggregated data-probabilistically detecting malicious cars that generate false aggregated information. Dietzel et al. [12] have proposed a secure aggregation which is resilient against both malicious users of the system and wrong information as faulty sensors are taken into consideration.

Nevertheless, the privacy issues of aggregation mechanisms in vehicular networks still have not been researched. In [6], a new privacy metric is put forward to measure the privacy enhancements brought by in-network aggregation, which is considered as a promising technology to protect privacy, because the aggregates do not contain individual atomic information. In this paper, a strong attack model, with which an adversary can infer individual information based on the difference between two continuous aggregates, is considered.

2.2. Differential privacy

As a notion of privacy from the area of statistical databases, differential privacy [9] aims to protect an individual’s data while publishing aggregate information about the database. Among the existing privacy models, differential privacy provides one of the strongest privacy guarantees. A typical way to achieve this notion is to add controlled random noise to the query output, such as that drawn from a Laplace distribution. Although most works on differential privacy assume a centralized database, there is no centralized database existing in vehicular communication environment, where vehicles or RSUs maintain traffic-related data. Consequently, distributed differential privacy is considered in this paper.

A number of prior works have provided differential privacy in distributed settings. Shi et al. have designed distributed differential privacy mechanisms based on applied cryptographic techniques, as shown in [20]. However, their distributed key distribution protocols cannot work in a dynamic vehicular environment. In [4,5], Chen at al. have proposed some practical systems that not only provide distributed differential privacy but also limit the effect of the malicious users on query results. Unfortunately, none of them can be directly applied to VANETs due to the multi-dimensional spatial data in VANETs.

There have been limited works applicable to spatial data. Andres et al. [2] have introduced differential privacy into location-based systems that protect the users’ exact location information, allowing the approximate location to be released for obtaining services. Cormode et al. [18] have studied how to apply differential privacy to spatial decompositions. In consequence, how to apply distributed differential privacy to spatial data aggregation in VANETs is studied in this paper.

3. Preliminaries

In addition to the adversarial model and distributed differential privacy settings, the data aggregation model for VANETs based on the framework proposed in [8] is demonstrated in this section.

Fig. 1.

Network model in VANETs.

3.1. Data aggregation model

A scenario is assumed in VANETs, where cars need to send their observations (e.g. location, speed, and timestamp) to a server through Vehicle-to-Vehicle (V2V) or Vehicle-to-Infrastructure (V2I) communications. With the dynamic traffic information, the server can provide users with services such as road traffic report and navigation. For reducing the communication cost, vehicles combine the received messages with their own information. As shown in Fig. 1, Vehicle 2 aggregates the message from Vehicle 1, and Vehicle 4 collects the message from Vehicle 3, enabling RSU to receive a message that contains traffic information on the road interval.

3.2. Adversary model

In this paper, a global passive adversary is hypothesized, which is able to eavesdrop on all the vehicles. Its prior knowledge is represented as a tuple $R = ⟨ U, A ⟩$ , where U is the set of all the users, and A is the set of all the aggregated messages. In this model, the goal of the adversary is to find out individuals’ sensitive location and speed information. To achieve this goal, the adversary infers the sensitive information from the difference between the continuous aggregated messages. The ability of the adversary to learn about the user’s sensitive information can be measured by comparing its prior distribution $Pr [o_{i}]$ and posterior distribution $Pr [o_{i} | R]$ , which can be expressed as below: $\begin{matrix} Pr [o_{i} | R] - Pr [o_{i}] = Pr [o_{i} | A] - Pr [o_{i}] = Pr [o_{i} | A_{i}, A_{i - 1}] - Pr [o_{i}] . \end{matrix}$

Provided that $Pr [o_{i} | R] - Pr [o_{i}]$ is small, the adversary gains no extra knowledge from individuals’ sensitive information, regardless of the prior knowledge R, which is well known as a property of differential privacy.

3.3. Distributed differential privacy

In VANETs, individual observations are made and stored in vehicles or RSUs. As there is no centralized database, distributed differential privacy is adopted, with which users control their released data by adding sufficient noise to ensure the differential privacy [1]. Formally, vehicles and RSUs evaluate a function $f : O \times A$ on the basis of their noise data $\overset{⌢}{o} \in O$ and the received message $A_{i} \in A$ . Each vehicle generates independent randomness $r_{i} \in Ω$ according to some distributions, and applies some randomization function $X : D \times Ω \to D$ to the data $x_{i}$ to produce ${\overset{⌢}{x}}_{i} = X (x_{i}, r_{i})$ . Given $x_{i} \in D^{n}$ and $r \in D^{n}$ , the notation $\overset{⌢}{x} = \overset{⌢}{x} (r) = (X (x_{1}, r_{1}), X (x_{2}, r_{2}), \dots, X (x_{n}, r_{n}))$ is utilized. That is to say, the dependence of $\overset{⌢}{x}$ on r is implicit.

Given a subset K of participants, it is assumed that $r_{k} = {r_{i} | i \in K}$ , and $\bar{K}$ is the complement of K, i.e. $\bar{K} = {1, 2, \dots, n} / K$ .

It is required that the following notion of distributed differential privacy is applied to each time period $t \in N$ .

Definition of $(ε, δ)$ -distributed differential privacy ([16]).

Provided that $ε > 0$ , $0 < δ < 1$ , $0 < γ ⩽ 1$ , and the joint distribution $r = (r_{1}, r_{2}, \dots, r_{n})$ , the data randomization procedure and the randomization function X achieve $(ε, δ)$ -distributed differential privacy with respect to function f under the fraction of uncompromised participants, on the premise of the following conditions: neighboring vectors $x, y \in D^{n}$ , subset $S \subseteq O$ , and $\bar{K}$ of uncompromised participants has a size of at least $r_{n}$ , $\begin{matrix} Pr [f (\hat{x}) \in S | r_{k}] ⩽ e^{ε} \cdot Pr [f (\hat{y} \in S | r_{k})] + δ . \end{matrix}$

In the above definition, the two vectors $x, y \in D^{n}$ are considered to be the neighbors or neighboring vectors if they differ in exactly one coordinate, corresponding to the case in which only one user changes his/her data. The parameter $ε > 0$ is made public and specified by a data owner. Lower values of provide a stronger privacy guarantee. Typically, the values of should be small, such as 0.01 and 0.1, or less than 2 or 3 in some cases [10]. When ε is very small, $e^{ε} \approx 1 + ε$ .

When K is the set of compromised nodes, the above definition requires the remaining honest participants’ randomness to be sufficient, so as to ensure differential privacy. As a result, the probability is conditioned on the randomness $r_{k}$ of compromised participants. In other words, the probability is taken over by the randomness $r_{\bar{k}}$ of honest participants. The definition of distributed differential privacy requires that for any set $\bar{K}$ of uncompromised participants, as long as $| \bar{K} | ⩾ γ n$ .

Formally, a computation F gives $(ε, δ)$ -differential privacy, if $D_{1}$ and $D_{2}$ differ in one record for all the datasets, and $S \subseteq Range (F)$ for all the outputs: $\begin{matrix} Pr [F (D_{1}) \in S] ⩽ exp (ε) \times Pr [F (D_{2}) \in S] + δ . \end{matrix}$

To put it another way, the probability that the computation F produces a given output is almost independent on whether this record is present in the dataset for any possible record.

Fact 1.
Provided that $ε > 0$ , u and v are two integers so that $| u - v | ⩽ Δ$ , r is a random variable with the distribution $Geom (exp (\frac{ε}{Δ}))$ , then the following formula is valid for any integer k, $\begin{matrix} Pr [u + r = k] ⩽ exp (ε) \cdot Pr [v + r = k] . \end{matrix}$

As shown in Fact 1, if the statistical Function $F (x)$ has a sensitivity Δ, then adding the size of the proportion of geometric noise is enough to achieve differential privacy.
4. Differential privacy aggregation mechanism

Differential privacy [19] is a rigorous privacy model that makes no assumption about an adversary’s background knowledge. A differentially-private mechanism ensures that the probability of any output (released data) is equally likely from all the nearly identical input data sets, which thus guarantees that all the outputs are insensitive to the data of any individual. In view of this, an individual’s privacy is not at risk owing to his/her participation in the data set.

An untrusted aggregator (RSU) which may have arbitrary auxiliary information is taken into consideration. For instance, the aggregator may collude with a set of vehicles, which may leak their data and noise to the aggregator in turn. Such information can be considered as a form of auxiliary information. In fact, auxiliary information about vehicles can also be obtained through other means (e.g. public datasets on the websites, or personal knowledge about a specific vehicle). The goal of this research is to ensure the privacy of each vehicle’s data, even when the aggregator has arbitrary auxiliary information. The formal privacy concept satisfies aggregator with inscient and distributed differential privacy.

To achieve this goal, a privacy model similar to the differential privacy notion is adopted. In this model, data aggregator and other vehicles are untrusted. This proposed privacy preserving mechanism is strong enough even if the aggregator has any prior knowledge or even some collusions.

4.1. Realization of aggregation security

How to make the vehicles and the aggregator achieve safety aggregation at the minimum cost of communication is one challenge. If one allows the vehicles and the aggregator to interact with each other in real time, then standard secure multi-party computation [11] techniques can be utilized to ensure that the data aggregator can only get the sum. Nonetheless, it is required that all the vehicles shall keep simultaneously online and interact with each other periodically, which is impractical. With this solution, no further interaction is needed except for uploading a noisy encryption to the data aggregator, after a trusted setup between all the vehicles and the data aggregator which may be performed by a trusted third-party or through a standard secure multi-party protocol.

Meanwhile, the intuition behind this construction is illustrated. It is assumed that the vehicles and the aggregator randomly share 0 during every time period $t \in N$ . In other words, they generate $p_{1, t}, \dots, p_{n, t} \in Z_{n}$ , and $\begin{matrix} \sum_{i = 0}^{n} p_{i, t} = 0 . \end{matrix}$

Specifically, $p_{0, t}$ is the aggregator’s capability at time t, and vehicles get $p_{1, t}$ through 1 and $p_{n, t}$ through n, respectively. Thus, the following method allows the aggregator to decrypt the sum information of all the vehicles without obtaining the individual’s value.

To encrypt the value ${\overset{⌢}{x}}_{i, t} = x_{i, t} + r_{i, t}$ in time period t, Vehicle i simply computes the following ciphertext: $\begin{matrix} c_{i, t} = {\overset{⌢}{x}}_{i, t} + p_{i, t} . \end{matrix}$

At time $t \in N$ , the aggregator receives $c_{1, t}, \dots, c_{n, t}$ . The aggregator may get the plaintext simply by summing up ciphertexts and its capability $p_{0, t}$ , $\begin{matrix} V \leftarrow p_{0, t} + \sum_{i = 1}^{n} c_{i, t} . \end{matrix}$

Since $\sum_{i = 0}^{n} p_{i, t} = 0$ , the aggregator gets $\sum_{i = 0}^{n} {\hat{x}}_{i}$ as the desired sum. The question is how the vehicles and the aggregator can obtain random shares of 0 without interaction. The proposed scheme is based on a trusted setup phase during which each vehicle gets a secret key ${sk}_{i}$ and the aggregator gets a capability ${sk}_{0}$ . Moreover, $\sum_{i = 0}^{n} {sk}_{i, t} = 0$ and H denotes a hash function that maps an integer to an appropriate mathematical group. Each vehicle computes $R_{i, t} = H_{(t)}^{{sk}_{i}}$ , and the aggregator computes $R_{0, t} = H_{(t)}^{{sk}_{0}}$ . The ${sk}_{i}$ sum to zero and $\prod_{i = 0}^{n} R_{i, t} = 1$ . On the basis of this attribute, a mechanism is constructed, in which the vehicle no longer interacts with each other at any phase other than the trusted setup phase. Furthermore, if Decisional Diffie–Hellman is hard in the mathematical group in question, it is proved that the numbers $R_{i, t}$ are “seemingly” random under the random oracle model.

4.2. Realization of distributed differential privacy

The encryption operation ensures that the aggregator obtains nothing except the statistics with the noise, because the aggregator has no direct access to individual’s data. Nevertheless, individuals’ privacy may be leaked indirectly, as the aggregator can infer their information from continuous aggregated data. In this section, how to build a guarantee of $(ε, δ)$ -differential privacy into the cryptographic construction is described.

In previous literatures about differential privacy, it is always assumed that the aggregator is credible. Aiming to ensure differential privacy, a standard procedure is to add an appropriate magnitude of noise before publishing the desired statistic.

In VANET, the vehicles do not trust the aggregator. As a consequence, the real data shall not be sent to the aggregator. Instead, it shall be ensured that the aggregator only obtains the data added with noise. This approach would add noise to each vehicle’s data before encrypting them, which insures that each vehicle satisfies the differential privacy of its own data.

It is provided that $x = (x_{1}, \dots, x_{n}) \in D^{n}$ and $r = (r_{1}, \dots, r_{n}) \in Ω^{n}$ represent the data and noise values, respectively, from all the vehicles. Given that $D = O = Z_{p}$ , the cyclic group equipped with addition modulo p, and $Ω = Z$ , the aggregating function $sum : = D^{n} \to O$ is considered, with $sum (x) = \sum_{i = 1}^{n} (x_{i} + r_{i} mod p)$ . Each vehicle uses the same randomization function $X (x_{i}, r_{i}) : = x_{i} + r_{i} mod p$ .

It is supposed that the original data of each vehicle fall within the domain ${0, 1, \dots, Δ}$ . That is to say, if a single vehicle’s data change the result to the maximum Δ, i.e. the sensitivity of sum is Δ, it shall be recalled from Fact 1 if the output is added with a $Geom (exp (\frac{ε}{Δ}))$ noise, which will satisfy the ε-differential privacy. In this case, the vehicles’ noise decides the final output noise. The goal is to ensure that the accumulated noise of a similar magnitude under the condition of at least $γ^{n}$ vehicles is honest and uncompromised. In this way, it can be guaranteed that the output satisfies differential privacy with a small error.

5. Performance analysis

In the proposed encryption structure, the encryption contains a hash operation, two modular operations, and a Diffie–Hellman multiplication operation. The operation time is mainly determined by two modular operations, while the time of the hash operation and Diffie–Hellman multiplication can be neglected. As shown in literature [3], the classical Diffie–Hellman group module operation 1024-bit utilized for modular operation takes about 3 ms, whereas the operation with high-speed elliptic curve costs only 0.3 ms. Hence, the encryption algorithm takes about 0.6 ms on the modern computer, which meets the need of practical application.

Fig. 2.

Empirical error of the proposed scheme and the naive scheme.

Then, the accuracy of the data is proved. Since $| sum (x) - sum (\hat{x}) | ⩽ | \sum_{i = 1}^{n} r_{i} |$ , it is only necessary to determine that $Z : = | \sum_{i = 1}^{n} r_{i} |$ .

Theorem 1 (Boundary error).

It is assumed that $ε > 0$ , $0 < δ < 1$ , each vehicles’ data come from the range of Δ in $Z_{p}$ , $Δ ⩾ \frac{ε}{3}$ , and at least γ of n vehicles are uncompromised, i.e. $γ ⩾ \frac{1}{n} log \frac{1}{δ}$ . As mentioned above, the random noise $r : = (r_{1}, r_{2}, \dots, r_{n})$ with $α = exp (\frac{ε}{Δ})$ and $β : = \frac{1}{γ^{n}} log \frac{1}{δ} ⩽ 1$ . Then, for all $0 < η < 1$ , $log \frac{2}{η} ⩽ \frac{1}{γ} log \frac{1}{δ}$ , with a probability of at least $1 - η$ , $\begin{matrix} | \sum_{i = 1}^{n} r_{i} | ⩽ 4 \sqrt{\frac{1}{γ} log \frac{1}{δ} log \frac{2}{η}} \cdot \frac{\sqrt{α}}{α - 1} ⩽ \frac{4 Δ}{ε} \sqrt{\frac{1}{γ} log \frac{1}{δ} log \frac{2}{η}} . \end{matrix}$

According to Theorem 1, cumulative error will have a high probability to be in the range of $O (\frac{Δ}{ε} \sqrt{\frac{1}{γ}})$ . Assuming that each vehicles’ value is chosen from $D = {0, 1, 2, \dots, n}$ , the decryption of the sum value is in the range of $[- O (\frac{Δ}{ε} \sqrt{\frac{1}{γ}}), n Δ + O (\frac{Δ}{ε} \sqrt{\frac{1}{γ}})] mod p$ , where p is the size of the mathematical group in use. Given this, the decryption will achieve a high probability of success.

As shown in Fig. 2, a comparison on the simulation results between the proposed mechanism and the conventional mechanisms. In the simulation, it is assumed that the vehicles’ data are from ${0, 1}$ . The x-axis is the number of participants, and the y-axis shows the mean and standard deviation of error (in absolute value). With the traditional mechanism, an independent random noise is added into the input information of each vehicle, to disturb the aggregate data. The traditional scheme can guarantee the differential privacy without satisfying aggregation security. In view of this, the number n of the vehicles is changed to compare the efficiency of the proposed mechanism with the conventional mechanism under fixed privacy parameters (0.1 and 0.5, respectively). The simulation results indicate that the scheme is independent of the number of vehicles, which confirms this theory.

6. Conclusion

In this paper, the aggregation problem in VANETs is studied, and a differentially private aggregation mechanism is proposed, under which VANETs protect the privacy data of each individual against the adversary with arbitrary auxiliary information. The contribution of this study mainly focuses on proposing a distributed data randomization procedure that guarantees the differential privacy of the result, even when a subset of participants might be compromised. However, further efforts remain to be made to apply this idea in real practices.

Footnotes

Acknowledgement

The work was supported by the National Natural Science Foundation of China (61202099, U1304606), Plan for Youth Backbone Teacher of Colleges and Universities in Henan Province (2013GGJS-075), Plan for Scientific Innovation Talent of Henan University of Technology (2012CXRC05), and Plan for Youth Backbone Teacher of Henan University of Technology.

References

Alhadidi,

Mohammed,

B.C.M.

Fung et al., Secure distributed framework for achieving ε-differential privacy, in: Privacy Enhancing Technologies, Lecture Notes in Computer Science, 2012, pp. 120–139.

M.E.E.A.

Andrés,

Bordenabe et al., Geo-indistinguishability: Differential privacy for location-based systems, in: CCS ’13 Proceedings of the 2013 ACM SIGSAC Conference on Computer and Communications Security, 2013, pp. 901–914.

Bernstein and

Lange (eds), EBACS: ECRYPT Benchmarking of Cryptographic Systems, 2011, http://bench.cr.yp.to. Accessed: 7 March 2011.

Chen,

B.C.M.

Fung,

P.S.

Yu et al., Correlated network data publication via differential privacy, VLDB Journal 23(4) (2014), 653–676.

Chen and

Reznichenko, Towards statistical queries over distributed private user data, in: Proceedings of Usenix Symposium on Networked Systems Design and Implementation Usenix, 2012.

Dietzel, Privacy implications of in-network aggregation mechanisms for VANETs, in: 2011 Eighth International Conference on Wireless On-Demand Network Systems and Services (WONS), IEEE, 2011, pp. 91–95.

Dietzel

et al., In-network aggregation for vehicular ad hoc networks, IEEE Communications Surveys and Tutorials 16(4) (2014), 1909–1932.

Duri,

Gruteser,

Liu et al., Framework for security and privacy in automotive telematics, in: WMC Proceedings of International Workshop on Mobile Commerce, 2002, pp. 25–32.

Dwork, Differential Privacy, LNIC Science, Springer, Berlin/Heidelberg, 2006, pp. 1–12.

10.

Dwork, A firm foundation for private data analysis, Communications of the ACM 54(1) (2011), 86–95.

11.

Feigenbaum,

Ishai,

Malkin et al., Secure multiparty computation of approximations, in: Automata, Languages and Programming, Lecture Notes in Computer Science, Vol. 2076, 2001, pp. 927–938.

12.

R.W.V.D.

Heijden,

Dietzel and

Kargl, SeDyA: Secure dynamic aggregation in VANETs, in: WiSec Proceedings of the Sixth ACM Conference on Security and Privacy in Wireless and Mobile Networks, 2013, pp. 131–142.

13.

Ibrahim and

M.C.

Weigle, CASCADE: Cluster-based accurate syntactic compression of aggregated data in VANETs, in: 2008 IEEE GLOBECOM Workshops, IEEE, 2008, pp. 1–10.

14.

Mohammed,

B.C.M.

Fung and

Debbabi, Walking in the crowd: Anonymizing trajectory data for pattern analysis, in: International Conference on Information and Knowledge Management, 2009, pp. 1441–1444.

15.

Nadeem,

Dashtinezhad,

Liao et al., Trafficview: Traffic data dissemination using car-to-car communication, ACM Sigmobile Mobile Computing and Communications Review 8(3) (2004), 6–19.

16.

Nissim,

Raskhodnikova and

Smith, Smooth sensitivity and sampling in private data analysis, in: Proceedings of the Thirty-Ninth Annual ACM Symposium on Theory of Computing, ACM, 2007, pp. 75–84.

17.

Picconi,

Ravi,

Gruteser et al., Probabilistic validation of aggregated data in vehicular ad-hoc networks, in: Vanet ’06 Proceedings of ACM International Workshop on Vehicular Ad Hoc Networks, 2006, pp. 76–85.

18.

Procopiuc,

Shen,

Srivastava et al., Differentially private spatial decompositions, in: 2012 IEEE 28th International Conference on Data Engineering (ICDE), IEEE, 2012, pp. 20–31.

19.

Scheuermann,

Lochert,

Rybicki et al., A fundamental scalability criterion for data aggregation in VANETs, in: Proc. Annual Int. Conf. Mobile Computing and Networking, 2009, pp. 285–296.

20.

Shi,

Chow and

T.H.H.

Chan, Privacy-preserving aggregation of time-series data, in: NDSS, 2011.

21.

Wischoff,

Ebner,

Rohling et al., SOTIS – A self-organizing traffic information system, in: The 57th IEEE Semiannual Vehicular Technology Conference, VTC 2003-Spring, IEEE, 2003, pp. 2442–2446.

A privacy-preserving data aggregation mechanism for VANETs

Abstract

Keywords

1. Introduction

2. Related work

2.1. Data aggregation for vehicular communication

2.2. Differential privacy

3. Preliminaries

3.2. Adversary model

3.3. Distributed differential privacy

Definition of ( ε , δ ) -distributed differential privacy ([16]).

4.1. Realization of aggregation security

4.2. Realization of distributed differential privacy

5. Performance analysis

6. Conclusion

Footnotes

Acknowledgement

References

Definition of $(ε, δ)$ -distributed differential privacy ([16]).