Thesis

Finally, for vertices ⟨i1, . . . , iℓ−1⟩ just above the leaves, we get:
¯S ⟨i1,...,iℓ−1⟩ = (bℓ − k ⟨i1,...,iℓ−1⟩) 2
bℓ
2.4. Analysis of the general case
+ k ⟨i1,...,iℓ−1⟩
bℓ
(2.11)
Expressions (2.9 – 2.11) can be used to compute the expected anonymity set size in the system
iteratively, in case of any number of compromised members. However, note that the computation
depends not only on the number c of the compromised members, but also their positions in the tree.
This makes the comparison of different systems difficult, because for a comprehensive analysis,
all possible allocations of the compromised members over the leaves of the key-tree should be
considered. Therefore, such a formula is preferred that depends solely on c, but characterizes the
effect of compromised members on the level of privacy sufficiently well, so that it can serve as a
basis for comparison of different systems. In the following, such a formula is derived based on the
assumption that the compromised members are distributed uniformly at random over the leaves of
the key-tree. In some sense, this is a pessimistic assumption as the uniform distribution represents
the worst case, which leads to the largest amount of privacy loss due to the compromised members.
Thus, the approximation that is derived can be viewed as a lower bound on the expected anonymity
set size in the system when c members are compromised.
Let the branching factor of the key-tree be B = (b1, b2, . . . , bℓ), and let c be the number of
compromised leaves in the tree. We can estimate k ⟨−⟩ for the root as follows:
k ⟨−⟩ ≈ min(c, b1) = k0
(2.12)
If a vertex ⟨i⟩ at the first level of the tree is compromised, then the number of compromised
leaves in the subtree rooted at ⟨i⟩ is approximately c/k0 = c1. Then, we can estimate k ⟨i⟩ as
follows:
k ⟨i⟩ ≈ min(c1, b2) = k1
(2.13)
In general, if vertex ⟨i1, . . . , ij⟩ at the j-th level of the tree is compromised, then the number
of compromised leaves in the subtree rooted at ⟨i1, . . . , ij⟩ is approximately cj−1/kj−1 = cj, and
we can use this to approximate k ⟨i1,...,ij⟩ as follows:
k ⟨i1,...,ij⟩ ≈ min(cj, bj+1) = kj
(2.14)
Using these approximations in expressions (2.9 – 2.11), we can derive an approximation for
¯S ⟨−⟩, which is denoted by ¯ S0, in the following way:
¯Sℓ−1 = (bℓ − kℓ−1) 2
. . . . . .
bℓ
+ kℓ−1
bℓ
¯Sj = ((bj+1 − kj)bj+2 . . . bℓ) 2
. . . . . .
bj+1 . . . bℓ
¯S0 = ((b1 − k0)b2 . . . bℓ) 2
b1 . . . bℓ
+ k0 ¯S1
b1
+ kj ¯Sj+1
bj+1
(2.15)
(2.16)
(2.17)
Note that expressions (2.17 – 2.15) do not depend on the positions of the compromised leaves
in the tree, but they depend only on the value of c.
In order to see how well ¯ S0 estimates ¯ S ⟨−⟩, some simulations are run. The simulation parameters
are the following:
total number of members N = 27000;
upper bound on the maximum authentication delay Dmax = 90;
Two branching factor vectors are considered: (30, 30, 30) and (72, 5, 5, 5, 3);
The number c of compromised members is varied between 1 and 270 with a step size of one.
21