# Towards a Collection of Security and Privacy Patterns
## 4 Privacy Patterns
### Unlinkability  
Unlinkability \"ensures that a user may make multiple uses of resources or services without others being able to link these uses together\" and \"requires that users and/or subjects are unable to determine whether the same user caused certain specific operations in the system\" (ISO/IEC 15408-2008 [29]). A more universal definition, not focusing specifically on users but on items of interest (IOIs) in general, has been proposed by [PERSON] et al. [58]: \"Unlinkability of two or more items of interest (IOIs, e.g., subjects, messages, actions,... ) from an attacker's perspective means that within the system (comprising these and possibly other items), the attacker cannot sufficiently distinguish whether these IOIs are related or not\".  
More formally, unlinkability can be defined as follows (originally defined in [65], adapted in [66]):  
Let \(X_{E,F}\) denote the event that the events E and F have a corresponding characteristic X with. Two events, E and F, are unlinkable in regard of a characteristic X (e.g., two messages are unlinkable with a subject or with a transaction) for an attacker A, if for each observation B that A can make, the probability that E and F are corresponding in regard of X given B is greater than zero and less than one:  
\[0<P(X_{E,F}\ \mid\ B)<1.\]  
A stricter requirement for unlinkability is:  
\[0<<P(X_{E,F}\ \mid\ B)<<1\]  
E and F are perfectly unlinkable if:  
\[P\ (X_{E,F}\ \mid\ B)=P\ (X_{E,F})\]  
As such, unlinkability is related to anonymity but is a more \"fine-grained\" property; it is a sufficient condition for anonymity, but not a necessary one [58]. The benefits from unlinkability are important for users who do not wish to be tracked in terms of the services and other resources they access, thus minimizing risks that may arise from the correlation of such activities (e.g., to derive PII by combining seemingly non-personal data) and user profiling in general. Nevertheless, as it is the case with anonymity, whereby strong anonymity requires a large anonymity set, strong unlinkability also requires a large unlinkability set. To strengthen unlinkability, often, equal or near-equal distribution of traffic between all potential senders and all potential receivers is pursued (often through the generation of cover \"dummy\" traffic), which is not always practical and leads to excessive traffic overheads.  
Implementation techniques that can be used to provide the unlinkability property are, for the most part, common to those providing anonymity (e.g., Mix networks [46], DC-nets [68], and Onion Routing [69]). Other pertinent tools include various track and evident erasers [49] (e.g., spyware detection and removal tools, browser cleaning tools, activity traces erasers, and hard disk data erasers), as well as identity federation and data fragmentation techniques [18]. Finally, the use of dummies (be it dummy traffic, dummy activity traces, and any other dummy data and actions) can be used to provide unlinkability between a user and their actions [21; 57; 66].  
Mix Network  
The concept of Mix networks (often referred to as \"Mix-Nets\") was introduced by [PERSON] [67] and has had a very significant impact in the area of anonymous networking. It provides sender anonymity against the receiver (optionally recipient anonymity), as well as unlinkability of sender and receiver [66]. Combined with dummy traffic, they can also provide unobservability [58] (more on that in the sections that follow). The popular concept of Onion Routing [69] is based on mixes but adds layered encryption.  
The concept, as shown in Figure 20, relies on the existence of a chain of independent mix stations (or \"mixes\") between senders and receivers. Said stations are responsible for mixing traffic from each user with traffic from other users, collecting and storing the user messages, decrypting and re-encrypting them (to change their appearance), and outputting them in a different order than the one received.