# Private and Secure Distribution of Targeted Advertisements to Mobile Phones
## 6 Evaluation
### User Privacy against Other Parties (Broker and Ad-Dealers)  
Similarly to the architectures that are described in [11; 18], which we assume as secure, our model enables users to establish anonymous connections with a broadcasting station and download content without exposing any identifying information. From that perspective, our system offers a very similar level of protection, as the Ad-Dealer and Broker have no means of obtaining any information that may reveal the user's physical identity, such as username, email and home IP address.  
The main difference of our system is that users are also downloading content on behalf of others within their social network. The content is encrypted, and therefore, our system requires the transmission of cryptographic keys, which provides to the Ad-Dealer additional information about the users. The use of cryptography may therefore have implications on privacy, which we will now proceed to examine.  
Recall that every ARM that is sent to the Ad-Dealer contains a user-generated key \(K_{i}^{user}\) that is later used by the Ad-Dealer to encrypt the corresponding ADM. Furthermore, the keys are produced by a hash chain where \(K_{i}^{user}=h(K_{i-1}^{user})\). We assume that the Ad-Dealer has no way of obtaining the original key \(K_{0}^{user}\), which was computed by the user, but knows which hash function \(h()\) is used.  
Based on this knowledge, the Ad-Dealer can obtain \(K_{i}^{user}\) out of one ARM and then replicate the hash chain in order to compute all consecutive keys \(K_{i+1}^{user}\), \(K_{i+2}^{user}\), etc. without knowing \(K_{0}^{user}\). This means that the Ad-Dealer can identify ARMs that contain subsequent keys, and from that, he/she may deduce that they have all been created by the same user even if they are sent through multiple Agents and at different time instants. Therefore, the key can be used as an identifier to profile the users. However, this does not compromise privacy to a significant extent as the Ad-Dealer still has no means of learning the user's physical identity. This threat can be minimized if the user changes \(K_{0}^{user}\) very frequently, but this will require the consumption of additional processing power.  
One more aspect that needs to be considered is the fact that the Ad-Dealer is also able to infer information about the social interactions of users and, more specifically, the affiliations between Requesters and Agents. For as long as the identities of the users are kept private, this also has minimal implication to privacy, but we do need to consider the possibility of this not always being the case. Should the Ad-Dealer find a way to uncover the true identities of users, then not only can he/she associate it with their advertising interests, but he/she will also learn about their social connections with each other.  
The only way of achieving this is by compromising the software client that runs on the user's mobile device. Broker interference with the client would be classified as malicious behaviour; hence, it is out of scope in our case, as we assume an honest-but-curious Broker. Even if the Broker were malicious, tampering with the software would be easily detected and would have serious legal implications. The integrity of the software can be certified by an independent authority such as the developer of the platform it operates on (iOS, Android, Windows mobile).