Thesis

2.2. Resistance to single member compromise
where N is the total number of members, and |Pi|/N is the probability of selecting a member from
subset Pi. The resistance to single member compromise, denoted by R, is defined as the normalized
expected anonymity set size, which can be computed as follows:
R = ¯ S
N =
=
=
where it is used that
1
N 2
1
N 2
ℓ∑
i=0
|Pi| 2
N 2
( 1 + (bℓ − 1) 2 + ((bℓ−1 − 1)bℓ) 2 + . . . + ((b1 − 1)b2b3 . . . bℓ) 2)
⎛
⎝1 + (bℓ − 1) 2 ∑ℓ−1
+ (bi − 1) 2
i=1
|P0| = 1
|P1| = bℓ − 1
ℓ∏
j=i+1
|P2| = (bℓ−1 − 1)bℓ
b 2 j
|P3| = (bℓ−2 − 1)bℓ−1bℓ
. . . . . .
|Pℓ| = (b1 − 1)b2b3 . . . bℓ
⎞
⎠ (2.2)
As its name indicates, R characterizes the loss of privacy due to the compromise of a single
member of the system. If R is close to 1, then the expected anonymity set size is close to the total
number of members, and hence, the loss of privacy is small. On the other hand, if R is close to
0, then the loss of privacy is high, as the expected anonymity set size is small. R is used as a
benchmark metric based on which different systems can be compared.
This metric can be seen as being a little ad hoc, but actually the same metric is used in other
papers like [Avoine et al., 2005] with a different more complex definition:
Theorem 1. The expected anonymity set size based metric (R) is complement to the one tag
tampering based metric (M) defined in [Avoine et al., 2005].
Proof. The metric M used in [Avoine et al., 2005] is defined in that paper as:
1. The attacker has one tag T0 (e.g., her own) she can tamper with and thus obtain its complete
secret. For the sake of calculation simplicity, we assume that T0 is put back into circulation.
When the number of tags in the system is large, this does not significantly affect the results.
2. She then chooses a target tag T. She can query it as much as she wants but she cannot
tamper with it.
3. Given two tags T1 and T2 such that T ∈ {T1, T2}, we say that the attacker succeeds if she
definitely knows which of T1 and T2 is T . We define the probability to trace T as being the
probability that the attacker succeeds. To do that, the attacker can query T1 and T2 as many
times as she wants but, obviously, cannot tamper with them.
In the following P1 . . . Pk are the subsets of the tags after the compromise of some tags
( ∑k i=1 Pi = N).
In the third step, the attacker can be successful if (and only if) T1 and T2 belongs to different
subsets.
The probability of the attacker’s success is the probability that two randomly chosen tags
belongs to two different subsets. This probability can be calculated as follows:
M = 1 − Pr(T1, T2 are in P1) − . . . − Pr(T1, T2 are in Pk) = 1 −
This is the complement of the metric R (M + R = 1).
13
k∑
i=1
( ) 2
Pi
N