SGUM-based Pseudonym Change for Personalized Location Privacy

Abstract

In this chapter, we study the application of the SGUM framework to pseudonym change for personalized location privacy.

Appendix

For convenience, let $\mathcal{N}_{I,k}$ and $\mathcal{N}_{II,k}$ denote the set of users that become determined in phase I and phase II of round k in Algorithm 2, respectively. Let $\mathcal{N}_0({\boldsymbol a})\triangleq \{i\in\mathcal{N}|a_i=0\}$ denote the set of users with action 0 under profile ${\boldsymbol a}$.

5.1.1 Proof of Proposition 5.1

Since SO-PCG is a special case of SA-PCG, Property 5.1 also applies to the individual utility function u _i . Therefore, due to Property 5.1, a user who changes its strategy from 1 to 0 will not change it back to 1. As a result, best response dynamics always terminates and results in a profile ${\boldsymbol a}^o$ that is a SNE.

Next we show that ${\boldsymbol a}^o$ achieves the maximum social welfare among all SNEs. It suffices to show that ${\boldsymbol a}^o$ is Pareto-superior to any other SNE. To this end, we first show that a profile ${\boldsymbol a}'$ is not a SNE if $\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^o)\neq \varnothing$. Suppose such ${\boldsymbol a}'$ is a SNE. Let $i\in\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^o)$ be the first user among $\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^o)$ whose action is changed to 0, and $\bar{\boldsymbol a}$ be the profile right before that change. Since ${\boldsymbol a}'\le\bar{\boldsymbol a}$, we have $u_i({\boldsymbol a}')\le u_i( \bar{\boldsymbol a})<0=u_i(0,{\boldsymbol a}'_{i-})$ due to that 0 is the best response strategy. This shows that ${\boldsymbol a}'$ is not a SNE. Therefore, for any SNE ${\boldsymbol a}'$ other than ${\boldsymbol a}^o$, we must have ${\boldsymbol a}'<{\boldsymbol a}^o$. Then for each $i\in\mathcal{N}_1({\boldsymbol a}')$, we have $u_i({\boldsymbol a}')\le u_i({\boldsymbol a}^o)$. For each $i\in\mathcal{N}_0({\boldsymbol a}')$, since ${\boldsymbol a}^o$ is a SNE, we have $u_i({\boldsymbol a}')=0 =u_i(0,{\boldsymbol a}^o_{-i})\le u_i({\boldsymbol a}^o)$. Therefore ${\boldsymbol a}^o$ is Pareto-superior to ${\boldsymbol a}'$. Thus we show that ${\boldsymbol a}^o$ is the best SNE.

5.1.2 Proof of Theorem 5.1

We first show that ${\boldsymbol a}^e$ is a SNE. We consider three cases of a user i as follows.

Case 1: $i\in\mathcal{N}_1({\boldsymbol a}^e)$ and $i\in\mathcal{N}_{I,k}$

Let ${\boldsymbol a}'$ be the profile right after phase I during which i remains in $\mathcal{N}_{I}$. Since ${\boldsymbol a}^e\ge{\boldsymbol a}'$, using (5.3) we have

$$\begin{aligned} f_i(1,{\boldsymbol a}^e_{-i})-f_i(0,{\boldsymbol a}^e_{-i})\ge u_i(1,{\boldsymbol a}'_{-i})+\sum_{j\in \mathcal{N}^S_{i+}\setminus\mathcal{\overline{N}}}s_{ij}a' _j \ge 0\end{aligned}$$

where the second inequality is due to the condition in line 5.

Case 2: $i\in\mathcal{N}_1({\boldsymbol a}^e)$ and $i\in\mathcal{N}_{II,k}$

Let ${\boldsymbol a}'$ be the profile right after i becomes determined in phase II. Since ${\boldsymbol a}^e\ge{\boldsymbol a}'$, using (5.3) we have

$$\begin{aligned}f_i(1,{\boldsymbol a}^e_{-i})-f_i(0,{\boldsymbol a}^e_{-i})\ge u_i(1,{\boldsymbol a}'_{-i})+\sum_{j\in \mathcal{N}^S_{i+}\setminus\mathcal{\overline{N}}}s_{ij}a' _j\ge0\end{aligned}$$

where the second inequality is due to the condition in line 10.

Case 3: $i\in\mathcal{N}_0({\boldsymbol a}^e)$

Since i is not included in $\mathcal{N}_{II}$ in phase II of the last round, using (5.3) we have

$$\begin{aligned}f_i(1,{\boldsymbol a}^e_{-i})- f_i(0,{\boldsymbol a}^e_{-i})=u_i(1,{\boldsymbol a}'_{-i})+\sum_{j\in \mathcal{N}^S_{i+}\setminus\mathcal{\overline{N}}}s_{ij}a' _j<0\end{aligned}$$

where the inequality is due to the condition in line 10.

Next we show that ${\boldsymbol a}^e$ is Pareto-optimal. Suppose there exists ${\boldsymbol a}'$ that is Pareto-superior to ${\boldsymbol a}^e$. It suffices to show that (i) $\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)=\varnothing$ and (ii) $\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')=\varnothing$. We first show part (i). Suppose $\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)\neq\varnothing$. Then for each $i\in\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)$, we have $u_i({\boldsymbol a}')\ge u_i({\boldsymbol a}^e)=0$. Let i be the first user among $\mathcal{N}_1({\boldsymbol a}')\setminus\mathcal{N}_1({\boldsymbol a}^e)$ whose action is set to 0 during phase I of the last round, and $\bar{\boldsymbol a}$ be the profile right before $a_i=0$ is performed. Since $\bar{\boldsymbol a}_{-i}\ge{\boldsymbol a}'_{-i}$, we have $u_i(1,\bar{\boldsymbol a}_{-i})+\sum_{j\in \mathcal{N}^S_{i+}\setminus\mathcal{\overline{N}}}s_{ij}\bar{a}_j\ge u_i(1,\bar{\boldsymbol a}_{-i})\ge u_i(1,{\boldsymbol a}'_{-i})\ge0$, which contradicts to the condition in line 5.

Next we show part (ii). Suppose $\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')\neq\varnothing$. Since we have shown part i), we must have ${\boldsymbol a}'<{\boldsymbol a}^e$. Then for each $i\in\mathcal{N}_1({\boldsymbol a}')\subset\mathcal{N}_1({\boldsymbol a}^e)$, we have $u_i({\boldsymbol a}')\le u_i({\boldsymbol a}^e)$. Since $u_i({\boldsymbol a}')=0= u_i({\boldsymbol a}^e)$ for each $i\in\mathcal{N}_0({\boldsymbol a}')\cap\mathcal{N}_0({\boldsymbol a}^e)$, there must exist $i\in\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')$ such that $u_i({\boldsymbol a}^e)<u_i({\boldsymbol a}')=0$. Suppose i is included in $\mathcal{N}_{II}$ during phase II of some round. Let $\bar{\boldsymbol a}$ be the profile right before $a_i=1$ is performed. Since $\bar{\boldsymbol a}\le{\boldsymbol a}^e$, we have $u_i(\bar{\boldsymbol a})\le u_i({\boldsymbol a}^e)<0$. Then it follows from $0\le f_i(1,\bar{\boldsymbol a}_{-i})- f_i(0,\bar{\boldsymbol a}_{-i})=u_i(1,\bar{\boldsymbol a}_{-i})+\sum_{j\in \mathcal{N}^S_{i+}}s_{ij}\bar{a}_j$ that there must exist $j\in \mathcal{N}^S_{i+}$ such that $\bar{a}_j=1$, and therefore $a^e_j=1$. If $j\in\mathcal{N}_1({\boldsymbol a}')$, we have $u_j({\boldsymbol a}^e)-u_j({\boldsymbol a}')\ge a^e_i-a' _i=1>0$, which is a contradiction. Therefore we must have $j\in\mathcal{N}_1({\boldsymbol a}^e)\setminus\mathcal{N}_1({\boldsymbol a}')$ and $u_j({\boldsymbol a}^e)\le u_j({\boldsymbol a}')=0$. Let $\hat{\boldsymbol a}$ be the profile right before $a_j=1$ is performed. Since j is included before i, we have $u_j(\hat{\boldsymbol a})<u_j({\boldsymbol a}^e)\le0$. Then we can use the above argument sequentially, until we find some k that leads to contradiction.

5.1.3 Proof of Theorem 5.2

Let $\mathcal{N}'_{I,k}$ be the set of users in $\mathcal{N}_{I,k}$ during the execution that computes ${\boldsymbol a}^{e'}$. For each $i\in\mathcal{N}_{I,1}$, we have

$$\begin{aligned}u_i(1,{\boldsymbol a}'_{-i})+\!\!\sum_{j\in \mathcal{N}^{S'}_{i+}\setminus\mathcal{\overline{N}}'}\!\!s' _{ij}a_j\ge u_i(1,{\boldsymbol a}_{-i})+\!\!\sum_{j\in \mathcal{N}^S_{i+}\setminus\mathcal{\overline{N}}}\!\!s_{ij}a_j\ge0.\end{aligned}$$

Therefore we must have $\mathcal{N}_{I,1}\subseteq\mathcal{N}'_{I,1}$. Similarly, we can show that for any $i\in\mathcal{N}_{II,1}\setminus\mathcal{N}'_{I,1}$, we must have $i\in\mathcal{N}'_{II,1}$. Using this argument sequentially, we can show that $\cup^k_{i=1}\left(\mathcal{N}_{I,i}\cup\mathcal{N}_{II,i}\right)\subseteq\cup^k_{i=1}\left(\mathcal{N}'_{I,i}\cup\mathcal{N}'_{II,i}\right)$ for any k, and therefore ${\boldsymbol a}^e\le{\boldsymbol a}^{e'}$. When a user becomes determined with action 1, the increment of social welfare of determined users by changing its action from 0 to 1 is no less than the increment of its social group utility derived from determined users, which is non-negative. Therefore we can see that $v({\boldsymbol a}^e)\le v({\boldsymbol a}^{e'})$.