# Towards a Collection of Security and Privacy Patterns
## 4 Privacy Patterns
### Anonymity  
Anonymity \"ensures that a user may use a resource or service without disclosing the user's identity\" (ISO/IEC 15408-2008 [29]). A definition more evidently considering the current legislative privacy landscape (e.g., GDPR), thus focusing on personally identifiable information (PII), states that, \"Anonymity is a characteristic of information that does not permit a personally identifiable information principal to be identified directly or indirectly\" (ISO/IEC 29100:2011 [26]). Nevertheless, a more generic view of anonymity is provided in the following: \"Anonymity of a subject means that the subject is not identifiable within a set of subjects, the anonymity set\" [58], whereby \"anonymity set\" is the set of all possible subjects. A formal definition of anonymity is as follows (originally defined in [65], adapted in [66]):  
Let \(\text{R}_{\text{U}}\) denote the event that an entity U (e.g., a user) performs a role R (e.g., as a sender or receiver of a message) during an event E (e.g., communication event or a service access). Let A denote an attacker, and let \(\text{NC}_{\text{A}}\) be the set of entities that are not cooperating with A. An entity U is called anonymous in role R for an event E against an attacker A, if for each observation B that A can make, the following holds:  
\[\forall\text{U}^{\prime}\in\text{NC}_{\text{A}}\text{: 0 <P (\text{R}_{\text{U}^{\prime}}\ |\ \text{B})<1}\]  
A less strict requirement could be that the above relation does not have to hold for all but does for at least most non-cooperating entities from the set \(\text{NC}_{\text{A}}\). However, anonymity for an entity U in the role R can only be guaranteed if the value P(\(\text{R}_{\text{U}}\ |\ \text{B}\)) is not too close to the values 1 or 0. Thus, an additional requirement should be:  
\[0<<P(\text{R}_{\text{U}}\ |\ \text{B})<<1\ [\text{A <<B means that A is much smaller than B}]\]  
As mentioned above, anonymity also depends on the model considered, leading to different types of anonymity: sender anonymity means the user is anonymous in their role as a sender (the receiver might not be), and vice versa for receiver anonymity. Elaborating on the above:  
An entity U is defined as perfectly anonymous in role R for an event E against an attacker A, if for each observation B that A can make:  
\[\forall\text{U}^{\prime}\in\text{NC}_{\text{A}}\text{: P (\text{R}_{\text{U}^{\prime}})=P (\text{R}_{\text{U}^{\prime}}\ |\ \text{B})}\]  
That is, observations give an attacker no additional information. Figure 19: Hierarchical graph of Privacy properties and relevant patterns. Thus, in perfect sender (or receiver) anonymity, the attacker cannot distinguish the situations in which a potential sender (receiver) actually sent (received) communications and those in which he did not. As such, anonymity facilitates user access to services and resources without revealing their identity or other sensitive information (e.g., exact location), blocking tracking and profiling attempts. Nevertheless, some constraints have to be considered--e.g., strong anonymity implies a large anonymity set (i.e., a large set of users, which is not always possible), while strong anonymity also constrains the usability of data (e.g., location-based or personalized services cannot be as accurate). A significant number of PETs can be leveraged to implement anonymity, as the development of anonymous communication networks (ACNs) comprises one of the most prominent areas of privacy-related research and development efforts.