On the Tradeoff between Trust and Privacy in Wireless Ad Hoc Networks

1. On the Tradeoff betweenTrustandPrivacyin Wireless Ad Hoc Networks Maxim…...….Raya Reza…….….Shokri Jean-Pierre..Hubaux LCA1, EPFL, Switzerland The Third ACM Conference on Wireless Network Security (WiSec‘10) March 2010 Hoboken, NJ, USA

2. The Trust-Privacy Tradeoff Entity-centric trust Data-centric trust Trust is built in the data Entities can keep privacy • Trust is built in each entity • The cost is reduced privacy privacy security privacy security

3. The Dilemma of Data-Centric Trust • Data increasingly comes from multiple sources • Mobile devices reflect their users’ preferences and hence characterize them Ephemeralnetwork More contributions = More accurate trust Users are not fully hidden behind their data!

4. The Privacy-Preserving Gene How to build data-centric trust in ephemeral networks with privacy-preserving entities? Building data-centric trust is a collective effort Users might lose some of their privacy What if entities are privacy-preserving? A privacy-preserving entity maximizes its privacy Game theory: A selfish entity optimizes its utility Privacy-preservation = Selfishness 4

5. Example: VANET • CA pre-establishes credentials offline • Entities communicate attributes (e.g., credentials, location) • Communication is sequential • There are deadlines on making decisions • Benign entities disseminate truthful info • Adversaries disseminate false info

6. Trust-Privacy Games • Problem: privacy-preserving entities building data-centric trust in the presence of privacy-preserving attackers • Game theory can help by modeling situations where the decisions of players affect each other • Attacker-Defender Game GAD • Trust Contribution Game GTC • Similar to eBay auctions: privacy = money. • But, privacy cannot be «reimbursed»

7. Deadline Start Time … … A D Minimum required trust threshold A D

8. Deadline Start Time … … A D A D Winner

9. Deadline Start Time A D Attacker-Defender Game: captures at the macroscopic level the competition between attackers and defenders to support their respective versions of the truth

10. Deadline Start Time A D Trust Contribution Game: defines at the microscopic level the individual amounts of privacy to be contributed by entities in each side to collectively win GAD

11. Attacker-Defender Game Deadline • Players • Attackers • Defenders • Strategies • Wait (W) • Send (S) Access to channel is probabilistic Theorem: The strategy (W,W) is the Perfect Bayesian Equilibrium of GAD Start

12. Trust Contribution Game Theorem: The Subgame Perfect Equilibrium of GTC is defined by: No entity contributes!

13. Corollary: The strategy (S,S) can be enforced in GAD by choosing appropriate reward r. I Game with Incentives Deadline reward for playingearly Incentives help Theorem: The equilibrium of is defined by: K: # of users Start

14. Conclusion • Data-centric trust can reduce privacy losses compared to entity-centric trust • Privacy-preserving entities are selfish by definition and need a game-theoretic analysis • Without incentives, privacy-preserving entities do not contribute to trust establishment