## 4 Proposed Scheme
### Identity, Route, and Location Privacy (IRL)
Thus the adversary need only check packets received in \(N_{m_{1}}\) that were not received by \(N_{m_{2}}\). In this case, the sender cannot be in \(N_{m_{2}}\). In any case, the adversary has to find out the backward sets of \(\rightarrow^{2}m_{1}\) or \(\rightarrow^{2}m_{2}\), depending on where the packet was received. Since, in the adversary's knowledge, all nodes are equally likely to be senders, the probability of a packet being received at the two sets is the same. In case \(m_{2}\
otin C_{m_{1}}\), then the adversary has no real advantage except that it can see packets at two disjoint locations in the network. Thus we only state the case when \(m_{2}\in C_{m_{1}}\). We have the following result:

**Claim 3:** Suppose the adversary is in possession of two nodes \(m_{1}\) and \(m_{2}\). Assume further that \(m_{2}\in C_{m_{1}}\). Let \(c_{1}=|C_{\rightarrow^{2}m_{1}}|\) and \(c_{2}=|C_{\rightarrow^{2}m_{2}}|\) then:

\[\delta t=2\left(\frac{D}{d}\times p_{t}\right) \tag{6}\]6

In general, we have:

**Claim 4:** Let us assume that \(A\) is in possession of \(k\) nodes \(m_{k}\rightarrow^{r_{1}}\cdots\rightarrow^{r_{k-2}}m_{2}\rightarrow^{r_{k-1 }}m_{1}\) and let \(m_{f}\) and \(m_{b}\) denote the average number of forward and backward nodes averaged over all the \(k\) nodes. Let \(t=m_{f}+m_{b}+1\). Let for \(1\leq i\leq k\), \(c_{i}=|C_{\rightarrow^{2}m_{i}}|\), then:

\[\delta t=2\left(\frac{D}{d}\times p_{t}\right) \tag{6}\]7

**Observations:** The probability is lowest when the adversary is actually at the base station. If the adversary has more nodes in possession, the probability increases linearly, with more success rate when the nodes are actually connected. This also shows that if a packet originates from any node that does not have a backward node, the adversary will always know the sender. This drawback can be avoided by requiring all nodes to have backward nodes. In other words, avoid a tree topology. The above security resiliency analysis description is for route and location privacy. The security strength of identity and data privacy is mainly dependent on the encryption schemes. If encryption scheme is strong then we can achieve stronger identity and data privacy. If encryption scheme is weak then we have weak identity and data privacy. ### Memory Consumption Analysis

Each sensor node needs to maintain one table that contains the list of neighboring nodes, their direction and their trust states as shown in \[\delta t=2\left(\frac{D}{d}\times p_{t}\right) \tag{6}\]8 Node identity can be represent in two bytes [15; 33]. Four sets of directions can be easily represented in 2 bits. Trust calculation is based on time-based past interaction only. Therefore, the total size required to calculated trust value is \(4\Delta t\) bytes [22]. Here, \(\Delta t\) represents size of time window and 4 bytes are required to store number of successful (2 bytes) and unsuccessful (2 bytes) interactions. Trust value can be represented in one byte. Therefore the size of each record is \(3.25+4\Delta t\) bytes (\(26+32\Delta t\) bits). If we assume that the node has \(M\) neighboring nodes then the total size of the table will be \(M(26+32\Delta t)\) bits. In order to achieve data privacy in the presence of identity anonymity, our proposed scheme uses two keys: one Public key of the base station \(k_{bs}^{+}\) and other is shared secret key \(k_{x-bs}\). Therefore, total memory required at the sensor node for our proposed scheme is: \(M(26+32\Delta t)+k_{bs}^{+}+k_{x,bs}\). Table 3 shows the memory requirement of various privacy schemes, in which \(M\) represents the neighborhood size, \(K\) represents pseudonym space, \(4\Delta t\) represents size of time window, and \(N\) is the total number of nodes in the network.