Lecture Notes in Computer Science 5185

Preservation of Privacy in Thwarting the Ballot Stuffing Scheme 199
The latter problem applies to the trading system and is more of an implementation
issue. Fortunately, it is easily solved in the form of a ticketing system.
Details handed out by the service provider may include the coordinates in addition
to a unique identifier (the ticket) that may be used to look up the associated
coordinate at a later stage, for example, the coordinates for the cell phone u1
may be released by the service provider in the form (x, y, t1). At a later stage
the (x, y) coordinates may be retrieved using only the ticket t1.
The former problem has the potential to be far more serious. In calculating
the distance from a patron of Service Provider 1 (SP1) to a patron of Service
Provider 2 (SP2), the service provider now has a basis from which to start
inferring exactly where the patron of SP2 might be.
Initially, there may be too many possibilities from which to draw a meaningful
conclusion, i.e., the cell phone holder could be located on any point on the
circumference of a circle with a radius of n kilometers. However, if SP1 applies the
knowledge of its patron’s coordinates in addition to domain specific knowledge
it may have regarding SP2 it may be in a position to make far better decisions
as to where SP2 might be.
4.2 Solution II - Comparing Distance
In the previous section we discuss the implications of privately calculating the
distance from one service provider’s patron to another. Unfortunately, knowing
the distance to another service provider’s coordinates in addition to one’s own
coordinates can be used to launch a privacy attack.
Fortunately, the privacy-preserving distance measurement protocol developed
by Yonglong et al [12] allows two parties to compute the distance from two points
without either of the parties actually knowing what the distance is. Essentially,
the two parties are left with a result that can be used to compare the distance to
something else. The authors discuss a point inclusion problem which is closely
related to the problem discussed in this paper.
Alice and Bob want to determine if Alice’s point p(x0,y0) falls within Bob’s
circle C :(x − a) 2 +(y − b) 2 = r 2 . As is always the case in these examples,
Alice and Bob do not want to share their data with one another. In protocol 4 of
their paper (point-inclusion), Yonglong et al describe a technique whereby Bob
and Alice collaborate with one another to determine if Alice’s point falls within
Bob’s circle.
The process consists of two steps. In the first step they use the technique
developed in protocol 3 (two dimensional Euclidean distance measure protocol)
which leaves Alice with s = n + v where n is the actual distance from the center
of Bob’s circle to Alice’s point and v is a random variable known only to Bob.
The two parties then use the millionaire protocol to compare variants of s in
order to establish whether or not Alice’s point is within Bob’s circle.
This example is important because no coordinates were shared between the
two parties. In addition to this, the distance between the two points (n)wascompared
to r using a protocol where neither party knew n and only one party knew
r. By extending the problem discussed in this paper from a distance problem to