# Virtual Pseudonym-Changing and Dynamic Grouping Policy for Privacy Preservation in VANETs
## 3 Models and Goals
### Adversary Model  
In this research, we take a robust adversary model. It consists of an external Global Passive Adversary (GPA), which covers a large part of the network by deploying low-cost transceivers. Figure 3 shows the coverage area of the GPA, which analyzes the data collected from various vehicles moving on the road network. The GPA can eavesdrop on any messages communicated within its coverage [29]. The primary objective of the GPA is tracking or collecting vehicle location traces during a trip on the road using captured beacon messages [48]. The compromising of location privacy requires the de-anonymization of vehicle location tracks. The de-anonymization is successful if the attacker correctly reconstructs the location traces. The GPA tries to correlate the beacon messages of old and new pseudonyms for vehicle identification. The adversary tries to match the pseudonyms of vehicles at the various visited locations. We assume that the adversary can also obtain  
Figure 2: Basic system model. the location data of vehicles from LBS. Our scheme will provide protection both against GPA and LBS adversary. The adversary can capture beacon messages broadcast during the vehicle's journey on the road at the time. The beacon contains vehicle identity, position, and speed. In the proposed scheme, we use \(G_{ID}\) instead of the pseudonym in the beacon message. The adversary captures the beacons of vehicles at time \(t\) and collects vehicles traces that contain information such as group identity, pseudonym, vehicle position and speed (S). Hence, the collected traces of data of different vehicles at time \(t\) is given by:  
\[Tr=\sum_{i=1}^{n}{((G_{ID}(P_{ID}),POS,S)V_{i}}. \tag{1}\]  
where \(Tr\) is the initial traces collected by an adversary, \(G_{ID}\) is group identity, \(P_{ID}\) is pseudo-identity of a vehicle, \(POS\) is the current position and S is the speed of a vehicle \(V_{i}\). Over time the vehicle changes position and pseudonyms for privacy protection. At time \(t^{\prime}\) the adversary collects another trace of various vehicles moving on the road that consists of vehicles pseudonyms, position and speed. The next set of traces \(Tr^{\prime}\) collected by the adversary is given by the following equation:  
\[Tr^{\prime}=\sum_{j=1}^{n}{((G_{ID}(P_{ID}),POS,S)^{\prime}V_{j}}. \tag{2}\]  
After collecting both traces, the GPA can analyze the vehicle data and try to identify the target vehicle. The traces of information contain only \(G_{ID}\), location, and speed of the vehicle, where \(P_{ID}\) is changed inside the group of vehicles. The following equation states the analysis process of GPA:  
\[Analysis(GPA)=\sum_{i=1}^{n}{Matching(Tr,Tr^{\prime})V_{i}}. \tag{3}\]  
Now the GPA will try to link pseudonyms of a target vehicle at various locations based on the vehicles collected traces at different periods. Here, the adversary takes probability \(Pr\) of matching the pseudo-identities of vehicle in the collected traces. The linking of vehicles  
Figure 3: Adversary model. pseudonyms at different locations is considered by the adversary and can be described as follows:  
\[Analysis(P_{ID},POS)=\sum_{i=1}^{n}Pr[\left((P_{ID},POS)t\rightarrow(P_{ID}^{\prime},POS^{\prime})t^{\prime}\right)V_{i}] \tag{4}\]  
The vehicle communicates with LBS for the nearest location of interest. The location message contains group identity and vehicle location. The adversary captures the location data during this communication. The captured location data of vehicles by an adversary is given below:  
\[Capture(LOC)=\sum_{i=1}^{n}MSG(G_{ID},LOC)V_{i}. \tag{5}\]  
After collecting information about different vehicles during communication with LBS, the adversary starts to analyze it. The adversary matches pseudo-identities of vehicles at different locations and tries to extract a target vehicle's actual identity and locations. The overall prediction of the GPA for identifying the target vehicle is stated in the following equation.