Location Privacy in Pervasive Computing Lab workers wore bats (small mobile devices with radio transceivers and ultrasonic transmitters) to provide position information to location-aware applications and colleagues in the lab. * The strong correlation between entry and exit motion is not modeled in anonymity sets. Per Shannon's1 definition of maximal entropy, only when all the members of an anonymity set are of interest to the observer, anonymity set size is a good measure of anonymity. *If all elements are equiprobable, for a set size of n, a log2 n bits of information is needed to identify one element.

Modeling user movements can show the anonymity level offered by the mix zone. Knowledge encoded in a movement matrix enables an observer to make a "guess" about user activity superior to the accuracy that can be achieved through a random choice. The identity of users is expressible as a conditional probability of the users' next action. A hostile observer can unlink pseudonyms more successfully than the size of the anonymity set suggests because the actions are not equiprobable.

Experimental Data From AT&T Lab

Mix Networks and Mix Zones

Applications Collude & Share Information About User Sightings

"To thwart more sophisticated attacks, users should change pseudonyms frequently, even while being tracked."

Beresford & Stajano 2003

"The mix zone store-and-forward network offers anonymous communication facilities."

Future Research

Prevent preferences from the multiple pseudonyms created from identifiably mapping back to the...