# Development of User-Participatory Crowdsensing System for Improved Privacy Preservation
## 5 Performance Evaluation
### Security Analysis
In implementing the proposed system, the user database, request database, and data processing node pool database were constructed using PostgreSQL. The security vulnerabilities of session key management through PostgreSQL are the same as the normal PostgreSQL security vulnerabilities. The session key is securely exchanged with the data processing node using RSA public key encryption when the data provider participates in the operation. Therefore, there are two ways that an attacker can steal the session key from the initial exchange or through the storage attack of the data processing node. Since the safety of the RSA public key cryptography is already proven, a possible attack is to threaten PostgreSQL within the data processing node. The attack can be prevented by applying the solutions (e.g., PostgreSQL anomaly detector [31] and homogeneous encryption implementation for Relational DBMSs such as PostgreSQL [32]) that are DB security solutions to compensate for the security vulnerabilities of PostgreSQL DB. PostgreSQL also provides its own security solutions, such as access control lists (ACLs) [33] and encryption [34], which can be used to improve the key management security of our system. To ensure the enhanced security of the proposed system, we measure the number of data processing requests allocated to these nodes continuously as the number of malicious or compromised data processing nodes increase, as shown in Figure 11. In this experiment, we perform an experiment to allocate 100 data processing requests. In order for an attacker to obtain personal information from advanced analysis (e.g., the movements or behavior patterns of a particular user), the attacker would have to steal the continuous record of the user (i.e., multiple series of sensing data). If the central \(SP\) processes all the sensed data, the attacker can access all the sensed data simply by stealing the authority of \(SP\). However, in the proposed system, an attacker must take over all data processing nodes in order to access all the sensing data. Even if an attacker successfully compromises 50% of the total data processing nodes, the number of consecutive sensing data that an attacker can obtain is very low (i.e., less than 10). It can be seen that an attacker must threaten at least 72% of the data processing nodes in order to reliably steal 10 or more consecutive sensing data. Depending on the number of data processing nodes that compose the system, the cost of threatening the data processing nodes would vary, but the cost of attacking the data processing nodes, which account for 72% of the total, is generally expected to be very high. In addition, unlike existing systems where service providers may use malicious sensing data in a malicious way, a service provider in the proposed system acts as a checker for the data processing nodes and, thus, post-processing after the problem occurs is also possible. That is, if the information provided by the data processing node is incorrect, the service provider can restrict the participation of the node.