# MAC Address Anonymization for Crowd Counting
## 1 Introduction
### Comparison with the State of the Art  
The authors of ([9], Section 5) succinctly mentioned using random binary sequences appended to the MAC addresses prior to hashing (or to replace MAC addresses with tokens, more specifically, universally unique identifiers (UUIDs) [10]). Our anonymization scheme uses a similar idea, except that we prepend random sequences a central server partially generates and then shares with time-synchronized sensors. Each sequence is used simultaneously by all our sensors for one minute, a time after which the server and the sensors erase it. Thus, brute force attacks consist in recovering a pepper of high entropy instead of hashed MAC addresses, whose entropy is too low to withstand such attacks [9; 11; 12]. We also split peppers into two parts (which [9] does not propose), with one unknown to the server.  
In [13], the authors developed a system similar to ours but for road traffic monitoring. Their anonymization scheme ([13], Section VI) relies on a truncation of the MAC address prior to hashing, whereas we rely on time-varying peppers of sufficiently high entropy to ensure anonymity and prevent brute-force attacks. Based on their experiments, it is unclear whether their anonymity scheme based on MAC address truncation would yield unacceptably high collision rates for large-scale crowds.  
A very recent work [14] presented research similar to ours. In [14], the authors derived the collision rate we present in Theorem 1 ([14], Section 4.2) and also justified the interest of such a derivation within the framework of WiFi and Bluetooth signal detection for crowd counting. They also validated Theorem 1 numerically for a number of MAC addresses lower than \(2\times 10^{5}\) and for a number of output bits after hashing of up to 24 bits ([14], Section 1). Thanks to our precise approximation of the collision rate (see Theorem 2), wecan handle vastly higher values (e.g., a number of output bits of 64 bits and \(10^{7}\) MAC addresses). Moreover, our method is based on secret peppers that are forgotten and that are split in two parts: one stored on sensors and the other stored on a central server, so that if either the sensors or central server are compromised, anonymity still holds (see Section 2.1). The time-varying nature of our peppers also makes it impossible to track individuals (see Section 2.2). We also discussed the impact of typical time-synchronization errors on modern networks and found them to have no significant impact on the counting process we used in [3; 4] (see Section 2.3). Finally, we point out that our (novel) approximation of the collision rate (and its analytical error bounds) are nontrivial mathematical results to derive (see Section 2.3 and the Appendix A).  
Other related works on crowd counting using WiFi probe requests are [15; 16]. In particular, Ref [15] discussed smartphone-executed MAC address randomization and its impact on crowd-counting algorithms. The authors also proposed a method for generating fingerprints that allowed them to track individuals whose smartphones emit PRs (a possibility that our system precludes on purpose for privacy reasons). The work [16] dealt with user positioning, especially in indoor environments and for nondense crowds. They notably improved positioning accuracy by leveraging signal strength indicators.