Towards Providing Scalable and Robust Privacy in Vehicular Networks

In vehicular networks, there is a strong correlation between a vehicle's identity and that of the driver. It follows that any effort to protect driver privacy must attempt to make the link between the two harder to detect. One of the most appealing solutions to hiding the identity of a vehicle is the use of pseudonyms, whereby each vehicle is issued one or several temporary identities (i.e., pseudonyms) that it uses to communicate with other vehicles and/or the roadside infrastructure. Due to the large number of vehicles on our roadways and city streets and of the sophistication of possible attacks, privacy protection must be both scalable and robust. The first main contribution of this work is to take a nontrivial step towards providing a scalable and robust solution to privacy protection in vehicular networks. To promote scalability and robustness we employ two strategies. First, we view vehicular networks as consisting of nonoverlapping subnetworks, each local to a geographic area referred to as a cell. Depending on the topology and the nature of the area, these cells may be as large as few city blocks or, indeed, may comprise the entire downtown area of a small town. Each cell has a server that maintains a list of pseudonyms valid for use in the cell. Instead of issuing pseudonyms to vehicles proactively, as virtually all existing schemes do, we issue pseudonyms only to those vehicles that request them. Our second main contribution is to model analytically the time-varying request for pseudonyms in a given cell. This is important for capacity planning purposes since it allows system managers to predict, by taking into account the time-varying attributes of the traffic, the probability that a given number of pseudonyms will be required at a certain time as well as the expected number of pseudonyms in use in a cell at a certain time. Empirical results obtained by detailed simulation confirmed the accuracy of our analytical predictions.