Privacy of Community Pseudonyms in Wireless Peer-to-Peer Networks

Abstract

Wireless networks offer novel means to enhance social interactions. In particular, peer-to-peer wireless communications enable direct and real-time interaction with nearby devices and communities and could extend current online social networks by providing complementary services including real-time friend and community detection and localized data sharing without infrastructure requirement. After years of research, the deployment of such peer-to-peer wireless networks is finally being considered. A fundamental primitive is the ability to discover geographic proximity of specific communities of people (e.g, friends or neighbors). To do so, mobile devices must exchange some community identifiers or messages. We investigate privacy threats introduced by such communications, in particular, adversarial community detection. We use the general concept of community pseudonyms to abstract anonymous community identification mechanisms and define two distinct notions of community privacy by using a challenge-response methodology. An extensive cost analysis and simulation results throw further light on the feasibility of these mechanisms in the upcoming generation of wireless peer-to-peer networks.

Appendix: Proof of Theorem 1

Proof

We prove the first part of Theorem 1 by showing that ability to breach community anonymity (CAN) implies ability to breach community unlinkability (CUN) as well.

Hence, let an arbitrarily chosen algorithm for breaching community anonymity be A _CAN(p _j ,C _i ). The algorithm outputs yes if p _j  ∈ C _i and no if $p_{j} \not \in C_{i}$. We have for some communities C _i (that do not belong to the graph G′):

$$ \sigma = Pr(A_{\rm CAN}(p_{j},C_{i}) \mbox{ is correct} ) >\frac{1}{2} $$

Given A _CAN, we can now construct a probabilistic algorithm, A _CUN(p _j ,p _k ), for deciding whether any two community pseudonyms belong to the same community or not:

• 1. Given community pseudonyms p _j and p _k each of which belong to either a community C ₀ or to a community C ₁.

• 2. Call A _CAN(p _j , C ₀) and guess if p _j  ∈ C ₀.

• 3. Call A _CAN(p _k , C ₀) and guess if p _k  ∈ C ₀ .

• 4. Output yes if the two guesses both say yes or both say no, else output no.

The probability of success of A _CUN(p _j ,p _k ) is μ = σ ² + (1 − σ)² where σ ² corresponds to the case A _CAN guesses both p _j and p _k correctly, and (1 − σ)² corresponds to the case where A _CAN does not guess either p _j or p _k correctly (but the final answer still is correct).

We observe that when σ = 0.5, we have μ = 0.5, when σ > 0.5, we have μ > 0.5 and when σ = 1, we have μ = 1. Hence, regardless of how the challenger chooses C ₀ and C ₁, we obtain that A _CUN succeeds with probability greater than a random guess. This completes the first part of the proof.

We prove the second part by giving an example of a pseudonym scheme that has the property of CAN but not the property of CUN. We consider a scheme where every community is given a single community pseudonym. This kind of scheme was introduced in Section 4.1. Within a community, all users share the same pseudonym which has been chosen randomly. Consequently, community messages are trivially linkable, hence we do not have CUN. On the other hand, an adversary cannot break anonymity because it does not know how to relate pseudonyms to communities. Hence, there is CAN.□