## 4 System, Network, Threat and Traffic Models  
In this work, a framework for end-to-end location privacy using anonymity and temporal privacy is presented. The framework provides the following security elements: Sender anonymity, receiver anonymity, link anonymity, SLP, BLP, data privacy, safety period, and energy preservation. We use sink and BS alternatively throughout this work. The system would be fed with inputs such as the nature of the adversaries in the network, the residual energy in the SNs, the desired lifetime or safety period. We assume bi-directional links where two nodes are considered neighbors if and only if they can hear each other [6].The network considers one sink, which collects/aggregates sensed data (stimuli) from all the SNs. The sink works as an interface for WSN to the wired network [20]. Data packets generated by SNs are ultimately destined uplink to the sink and never destined to another SN. However, it could go through \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**No.**} & \multirow{2}{*}{**Scheme**} & **View of the** & **Anonymity** & \multirow{2}{*}{**Passive Attacks**} & \multirow{2}{*}{**Active Attacks**} \\  & & **Adversary** & **Technique** & & \\ \hline \multirow{2}{*}{1} & SAS \& CAS [20] & Global & Pseudonyms & \
\begin{tabular}{c} Eavesdropping, SN compromise, \\ limited traffic analysis \\ \end{tabular} & - \\ \hline \multirow{2}{*}{2} & HIR \& RHIR [21] & Global & Pseudonyms & Eavesdropping, SN compromise & - \\ \hline \multirow{2}{*}{3} & APR [22] & Local & Pseudonyms & Eavesdropping, hops-tracing & SN compromise \\ \hline \multirow{2}{*}{4} & DCARPS \& Global & \multirow{2}{*}{Global} & Pseudonyms & Eavesdropping, hops-tracing & - \\  & DCARPS [6] & & & & \\ \hline \multirow{2}{*}{5} & ACS [23] & Local & Pseudonyms &
\begin{tabular}{c} Rate monitoring, time correlation, \\ identity analysis, hops-trace \\ \end{tabular} & - \\ \hline \multirow{2}{*}{6} & MQA [24] & Global & Aggregation & Eavesdropping, hops-tracing & Packet injection \\ \hline \multirow{2}{*}{7} & PhID [4, 25] & Local & Pseudonyms & Eavesdropping, traffic analysis & - \\ \hline \multirow{2}{*}{8} & \multirow{2}{*}{EAC [16]} & Global & Pseudonyms & Eavesdropping, traffic analysis & DoS, SN compromise, Traffic injection \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Solutions for location privacy using anonymity [4]. SAS, Simple Anonymity Scheme; CAS, Cryptographic Anonymity Scheme; HIR, Hashing-Based ID Randomization; RHIR, Reverse HIR; APR, Anonymous Path Routing; ACS, Anonymous Communications Scheme; DCARPS, Destination Controlled Anonymous Routing Protocol for Sensor Nets; MAQ, Max Query Aggregation; PhD, Phantom ID; EAC, Efficient Anonymous Communication. a multi-hop path. Control packets can be sent from the sink, downlink, to the SNs by unicast or by broadcast messages. To enhance BLP, the sink acts like any other SN in the network while communicating with the SNs to make it absolutely indistinguishable. Most of the literature show that the operation of WSN network goes through two or more phases. However, generally speaking, the WSN runs in three phases: _Pre-deployment phase_, _setup phase_, and _communication phase_. We assume that the SNs have the ability to obfuscate the addresses at the MAC level header [20, 28]. All sensors are time synchronized using _time synchronization protocol_[20]. The WSN will need a protocol for _network topology discovery_ that allows the sink to view the global topology of the network without revealing the location of the sink [6]. The adversary nodes have very strong capabilities compared to the SNs. They are resource-rich; sufficient energy supply, computation/processing capabilities, and unlimited storage memory. An adversary could run both _passive_ and _active_ attacks. We presume _Kerchhoff's Principle_[29] for our framework, where the adversary knows everything about the system except the _keys_ and _IDs_. The framework will be able to handle both passive and active attacks.