# Development of User-Participatory Crowdsensing System for Improved Privacy Preservation
## 5 Performance Evaluation  
### Security Analysis  
In this paper, we propose a distributed crowdsensing system with pull, partial, and participatory characteristics. Instead of sending the sensing data provision request directly to the user, the service provider announces the request and the address of the data processing node to which the request is assigned so that the user can access the data processing node voluntarily. Therefore, the service provider or an attacker cannot access real-time personal information of a specific user, and the user can stop providing sensing data as soon as it is suspected that personal information was exposed or provide \begin{table}
\begin{tabular}{c c c} \hline \hline
**Field Name** & **Data Type** & **Filed Content** \\ \hline _provider\_id_ & String & ID of user participating as data provider \\ _sess\_key_ & String & Session key used by the data provider \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Schema of participant database. ID—identifier. unnecessary personal information for sensing information as much as possible [21] (e.g., car number deletion when providing photos in smart parking system). The proposed system separates the reward data management nodes from the sensing data processing node so that sensitive personal information included in the sensing data may not be exposed to the service provider or an attacker who compromised the \(SP\). Sensing data are encrypted and transmitted using a session key shared between the data processing node and the data provider, which transmits its ID together with the header of the sensing data. The data processing node decrypts the sensing data to verify their validity, generates the reward payment data that maps the data provider ID and the compensation amount, and transmits the compensation payment data to the \(SP\). As soon as the transmission is completed, the data processing node removes the header of the sensing data, encrypts it with the data requester ID, and stores it in the database. Therefore, after the reward payment data are transmitted to the \(SP\), it is not possible to determine the identity of the provider of the specific sensing data. To both obtain the sensing data and identify their provider, the data processing node should be attacked between the decryption of the sensing data and the transmission of the reward payment data. This is a particularly short time, and, as the decrypted sensing data are not stored in the auxiliary memory, a long attack, such as memory reversal, should be carried out. Therefore, it is difficult to attack the data processing node and obtain both the sensing data and the identification information of the data provider within a short time. In addition, the proposed system is advantageous in the case where personal data can be exposed through multiple series of data analysis from a user (e.g., location trajectory privacy) by distributing sensing data processing subjects to several data processing nodes instead of a central \(SP\). In other words, if one \(SP\) processes all the data, even if the user deletes the information that can expose personal information and send it, there is a risk of exposure of secondary information (e.g., health exposure following periodic hospital visits) by analyzing multiple data. However, since the proposed system is randomly assigned to several nodes for data processing, the risk of personal information exposure by multiple data analysis can be prevented. The \(SP\) and a malicious data processing node may collaborate to allocate multiple sensing data providing requests to a data processing node and obtain the sensing data and the identification information of the data provider. However, in this case, it can be detected by the data provider that a specific data processing node is assigned an unusually large number of requests. Therefore, the data provider may refrain from providing the sensing data for the request processed by the corresponding node.