On the Fundamentals of Anonymity Metrics

Abstract

In recent years, a handful of anonymity metrics have been proposed that are either based on (i) the number participants in the given scenario, (ii) the probability distribution in an anonymous network regarding which participant is the sender / receiver, or (iii) a combination thereof. In this paper, we discuss elementary properties of metrics in general and anonymity metrics in particular, and then evaluate the behavior of a set of state-of-the-art anonymity metrics when applied in a number of scenarios. On the basis of this evaluation and basic measurement theory, we also define criteria for anonymity metrics and show that none of the studied metrics fulfill all criteria. Lastly, based on previous work on entropy-based anonymity metrics, as well as on theories on the effective support size of the entropy function and on Huffman codes, we propose an alternative metric-the scaled anonymity set size-that fulfills these criteria.

Anonymization in Intelligent Surveillance Systems

“…Metrics for anonymity have been compared [9], [10], but both works do not consider the requirements of surveillance systems. A detailed description of them would go beyond this work.…”

Measuring the Effectiveness and the Fairness of Relation Hiding Systems

“…[3]- [14]). From this literature it is evident that one is typically interested to measure multiple aspects of the protection of privacy that is provided by a system.…”

“…2 In this paper, we restrict our attention to systems that hide a binary relation over a given set. 3 We do not distinguish between passive and active adversaries.…”

“…It is assumed that the adversary knows S and the set of 'candidate' relations R, and that it tries to identify R τ through interaction with (or observation of) the system. 3 As a result of this interaction, the adversary, denoted by A(R) in the sequel, assigns to each R ∈ R a probability that R = R τ . We call the resulting probability distribution A(R)'s 'view on R' and use the entropy of this distribution [17] as a metric for the opaqueness of R τ .…”

Relations among privacy notions

“…In particular, the parameter space for voting system as A 2 vs = N, where N is the identifier set of eligible voters, and C is used as the set of users. In particular, on reception of an input((c 0 , u 0 ), (c 1 , u 1 )) query, the challenger invokes the system 3 We are unaware of any formal treatments of ballot secrecy in the literature; our formal model below follows the intuition provided by the notion of 'perfect ballot secrecy' that is informally described in [28]. 4 These systems do not hide this correspondence in order to provide 'individual verifiability', a property that enables each voter to verify that his own vote has been accounted for in the tally.…”