![](bg4.png)
VehicleLength and VehicleWidth (compulsory for
the HighFrequency container), which otherwise are
likely to be of great use in discriminating different ve-
hicles (Escher et al., 2021). For such an exclusion we
find justification in (WG1, 2018) which allows usage
of the codes 1023 and 62 for the length and width,
respectively, if the corresponding information is un-
available.
Because of the details described above, we will
model CAM as a vector in R
z
where z ≥ 1. Such a
step is beneficial: we can apply commonly used dis-
tortion measures such as, for example, Squared Error
(SE). This is a clear and straightforward way to re-
fer to the quality degradation of essential location ser-
vices (Shokri et al., 2016). We, nevertheless, refrain
from further discussions about the chosen distortion
measure in this paper.
2.3 Privacy Assumptions and Threats
Here we provide a high-level intuition for the system
and the threat of linkability, while the details will be
introduced in the subsequent sections. Alice and Bob
coordinate their efforts. They distribute the total al-
lowed distortion among N −1 time steps: as a result,
they know the distortion limit for every time step i.
At the beginning of every time interval i, Alice and
Bob know the true measurements (including position,
speed, acceleration, etc.) of each other. To obfus-
cate data in their CAMs they randomly agree on the
order of their arrival at RSU at every i. For every
i they define a joint distribution according to which
they change (obfuscate) their actual measurements: in
expectation, they remain within the distortion limits.
An attacker who fully controls RSU statistically
infers the source of every pair of CAMs which he ob-
serves during time i: this statistical inference is used
to calculate entropy and aligns with definition 2. For
this, the attacker refers to the joint distribution used by
Alice and Bob during the obfuscation. He also knows
other information, such as the original geo-positions
of the players at every i, and the probabilities for the
order of CAMs’ arrivals. The resulting unlinkability
in the system depends on: i) statistics for the order
of arrival of CAMs from the players; ii) the level of
allowed distortion; iii) how far apart actual measure-
ments of Alice and Bob are at every i.
3 MATHEMATICAL MODEL
We explain our mathematical model in the follow-
ing sections. To easy the reading, table 1 contains
an overview about our notations.
Table 1: Notations.
Notation Description
ITS Intelligent Transport Systems
C-ITS Cooperative Intelligent Transport Systems
ITS-SU ITS Station Unit (including installed in vehicles)
V2X Vehicle-to-Everything
CAM Cooperative Awareness Message
RSU Roadside Unit
HMM Hidden Markov Model
D
u
Set of user-related data
D
s
Set of information system-related data
U Set of information system’s users
P Set of data processing procedures at the information system
P Set of players including Alice and Bob
x
A
k
, 1 ≤k ≤ µ A hidden state for Alice
X
A
= {x
A
k
} Set of hidden states for Alice
x
B
j
, 1 ≤ j ≤ ω A hidden state for Bob
X
B
= {x
B
j
} Set of hidden states for Bob
X
(A,B)
Set of joint hidden states for
Alice, Bob
X
(B,A)
Set of joint hidden states for
Bob, Alice
R Index (label) for rose nodes
X
R
= X
(A,B)
Set of all rose nodes
B Index (label) for blue nodes
X
B
= X
(B,A)
Set of all blue nodes
L = {R ,B} Set of labels encoding
|
P
|
! combinations
Y Set of joint observable states for Alice and Bob
i ∈{1, 2,..., N −1} Time-step in discrete HMM
X
A
i
Variable on X
A
at i
X
B
i
Variable on X
B
at i
X
i
Variable for joint hidden state on step i
ℓ
i
Variable on L at i
Y
i
Variable on Y on step i
Pr(X
i+1
| X
i
) Probability of transition between hidden states
Pr(Y
i
| X
i
) Conditional probability for observable states
ϕ Order mixing (label permuting) probability
ρ
i
Distribution over hidden states on step i
ρ
i+1
|ρ
i
Conditional distribution over hidden states on step i+ 1
3.1 Markov Model for Unlinkability
To study unlinkability in V2X we use Hidden Markov
Model which graphical representation is given on
fig. 2. The following sets are needed to de-
scribe the model. The set of all players is P =
{
Alice, Bob,...
}
. For each player, there exists a set
of hidden states for his vehicle, e.g., for Alice there
is X
A
=
x
A
1
,x
A
2
,...,x
A
k
,...,x
A
µ
and for Bob there is
X
B
=
n
x
B
1
,x
B
2
,...,x
B
j
,...,x
B
ω
o
. Each state, for example,
x
A
1
can be a vector including specific position, veloc-
ity, acceleration and other characteristics applicable to
Alice’s vehicle at certain time. Throughout the paper
we assume that X
A
∩X
B
is in general non-empty.
The system of |P| players is characterized by hid-
den and observable joint states. Transition happens
between hidden states X
i
and X
i+1
when time step i
proceeds to i + 1, where joint state X
i
=
X
A
i
,X
B
i
is
the composition (concatenation) of variables X
A
i
∈X
A
and X
B
i
∈ X
B
. As such, ∀k, j(x
A
k
,x
B
j
) ∈ X
(A,B)
, where
|X
(A,B)
| = |X
A
|×|X
B
| (for simplicity of representa-
tion we further assume |P| = 2, |X
A
| = µ = 2, |X
B
| =
ω = 2).
Possible transitions from X
i
to X
i+1
are denoted
using indices 1 −16 (see fig. 2): these transitions
are governed by corresponding probabilities. For ex-
ample, the transition from X
i
=
X
A
i
= x
A
1
,X
B
i
= x
B
1
to X
i+1
=
X
A
i+1
= x
A
2
,X
B
i+1
= x
B
2
is denoted by
index 4. The probability of such a transition
is Pr
X
A
i+1
= x
A
2
,X
B
i+1
= x
B
2
| X
A
i
= x
A
1
,X
B
i
= x
B
1
. In
practice, these probabilities can be obtained based on
ICISSP 2023 - 9th International Conference on Information Systems Security and Privacy
680