Multicriteria-Based Location Privacy Preservation in Vehicular Ad Hoc Networks

Department of Computer Science, Islamia College Peshawar, Peshawar, Pakistan Department of Computer Science, FATA University, FR Kohat, Pakistan Deanship of Scientific Research, King Saud University, Riyadh, Saudi Arabia Faculty of Computer Science and IT, Universiti Malaysia Sarawak, Kota Samarahan, Malaysia Department of Computer Science, University of Peshawar, Peshawar, Pakistan Department of Computer Science & IT, Sarhad University of Science and IT, Peshawar, Pakistan Shiekh Zayed Islamic Center, University of Peshawar, Peshawar, Pakistan School of Computer Science and Engineering, Kyungpook National University, Daegu, Republic of Korea


Introduction
VANET is a network of vehicles to transfer information to each other directly or through fixed unit known as road side unit (RSU).The purpose of VANETs is to share safety and nonsafety messages such as weather information, entertainment, accidents, and monitoring of road traffic [1,2].Vehicles can directly communicate with each other known as vehicle-to-vehicle (V2V), while in vehicle to infrastructure (V2I), vehicles communicate with RSU.VANETs help Intelligent Transportation Systems (ITS) to provide safer, better, and more organized roads.The vehicles play an imperative role in our daily life.Every day, people spend considerable time on roads and feel stress while waiting in traffic jams that might result in road accidents.In order to make driving experiences safe, it is necessary to improve the transportation system by making it more reliable, effective, and proactive [3,4].Due to open nature of VANETs, privacy is considered as an important issue because vehicles try to communicate without disclosing their location details.The malicious performance of nodes, injecting false information, and changing and repeating messages could be harmful to other nodes.Moreover, the privacy-associated information of a node should be secure to avoid an observer from revealing actual identity of a node, tracking their position, and concluding sensitive data.Protection and privacy guarantee benefits of enhanced driving.However, serious attacks may expose location privacy since an attacker could track routes of the concerned vehicle and obtain location information.
In literature, different efforts have been made to solve traffic problems to provide comfort to both drivers and passengers.Researchers in both industry and academia are making efforts to examine some key issues such as privacy preservation of the source vehicle and traffic monitoring.The focus of this paper is to preserve the location privacy of the source node, so that data transferring the location should not be shared with other vehicles in its communication range.The source node forwards data to the phantom node which is selected considering certain parameters such as distance, speed, acceleration, trust, and direction.Every time the source changes, it selects a new phantom node for communication, so that attacker may find it difficult to track the position of a source node.
In this paper, the selection of the phantom node is based on different parameters which makes it a multicriteria decision problem.Moreover, an analytical network process (ANP) [5] is used as a multicriteria decision tool.The ANP was introduced to solve the interdependencies and feedback between elements within a cluster or between the clusters.The ANP is suitable in those situations where parameters have dependencies on each other and need feedback as well.
Here, we have used the ANP to select the optimal node as a trusted phantom node to address the dependencies of elements to come up with the most suitable option.Furthermore, ranking of the criteria and alternative elements will be determined for decision-making.
The rest of the paper is organized as follows.The overview of source location privacy in VANETs is discussed in Section 2; Section 3 is dedicated to multicriteria decisionmaking along with generic steps involved in an analytical network process.The phantom node selection using the analytical network process is explained in Section 4. Results and discussions are presented in Section 5, and finally, Section 6 concludes the paper with future directions.

Source Location Privacy in VANETs
Due to high congestion of automobiles on the roads, accidents are increasing day by day.Wireless technology is being used in vehicles to improve congestion by sending messages to share information with each other [6].The advance technology of VANETs improves and enhances security and privacy of VANET communication and provides safety-related applications.Researchers have been devoted to resolve traffic problems and proposed various models.Existing techniques are based on group signature [7], pseudonymous [8], mix zones radio off [9], Efficient Conditional Privacy Preservation (ECPP) [10], AMOEBA [11], Communications Architecture for Reliable Adaptive Vehicular Ad Hoc Networks (CARAVAN) [12,13], and so on.These methods are an effort to resolve many issues associated with location privacy in VANETs, but every method has its own limitation.
A number of pseudonymous base methods use public key infrastructure by using a digital signature for message authenticity, but the method involves imperative delay [14].As stated that a 400 MHz processor equipped with the on-board unit (OBU) consumes about 20 ms to verify signature.This may cause significant delays in message verification in the dense urban area.Another drawback of pseudonymous base method is the certificate revocation list (CRL).Once a certificate authority (CA) administrator decides that a specific certificate should not be trusted anymore, the CA administrator can withdraw that certificate.The CA administrator publishes CRL to communicate the withdrawal of the certificate.The CA consumes time to track suspicious certificate and cancels the certificate in a long cancellation list.
Efficient Conditional Privacy Preservation (ECPP) [10] uses anonymous authentication for delivering safety messages with a certification authority and registration authority (RA) for traceability of vehicles.They have used RSUs (road side units) and on-board units (OBUs) which can deliver fast anonymous authentication in short time.A lot of storage capacity will be required for every OBU to accommodate anonymous key pairs in a large number.If some of OBUs anonymous keys are canceled, then every OBU updates the list that consumes long time.
AMOEBA [11] is based on group navigation of vehicles to protect location privacy.This technique is evaluated in expressways and highways in the presence of two passive adversary models, and various attacks are considered for testing robustness of user's privacy.A phenomenon is discussed in which a vehicle in a group of vehicles turns off its radio.In case the radio is switched off, then the vehicle will be cut off from the entire group and consequently would not be able to receive or send any messages.
Communications Architecture for Reliable Adaptive Vehicular Ad Hoc Networks (CARAVAN) [12,13] uses spread spectrum with trusted computing platforms and a secret pseudorandom-spreading code.This code is used to prove the reliability of hardware and software of a distribution vehicle before permitting a vehicle to spread messages.The simulation result shows that CARAVAN produces message propagation latencies that are comparable to or better than less protected intervehicle communication protocols.
Another method to improve location privacy suggested for VANETs is based on pseudonyms [15].In V2V communication, vehicles change their pseudonyms [16,17] from time to time while broadcasting messages.Each message is comprised of the location, content, velocity, and time and is authenticated by signature by considering pseudonym.Different pseudonyms are used in routine by vehicles in VANETs.The vehicle location privacy can be ensured due to unlinkability of pseudonyms.However, if the pseudonym is changed by a vehicle in certain circumstances, adversary using old pseudonym can still link to the new pseudonym [18] and can monitor the whole link.Due to the information of velocity and location fixed in messages, the adversary can still guess to link the pseudonyms making privacy difficult.
The above discussed techniques have improved location privacy of the source node in VANETs, but still there is room 2 Complexity for more improvement by selecting a trusted node for privacy preservation.Therefore, in the proposed method, a trusted phantom node is selected to improve source location privacy using a multicriteria decision tool such as an ANP method.A multicriteria decision tool is being proposed because more than one parameter are involved which affect the selection of a trusted phantom node.
2.1.Adversary Model.In literature, different types of adversaries [19] are considered such as a global passive adversary (GPA), the restricted passive adversary (RPA), and local active adversary (LAA).The GPA and LAA are considered to be exterior observers which use a spectrum analyzer or angle of arrival to overhear the communication.
In the proposed model, a global passive adversary is assumed which is able to eavesdrop broadcasts of all vehicles and will be able to guess their locations.The actions of an adversary are such as injection of wrong information, hop by hop or backtracking through a spectrum analyzer or angle of arrival, and unnecessary message spreading.In addition, numerous types of attacks have also been identified and classified in the literature [20][21][22][23][24][25] on the basis of network layers used by attackers; their characteristics and intentions are mentioned in Table 1.

Multicriteria Decision-Making
The multicriteria decision-making (MCDM) is used where selection of elements are based on multiple factors that help in decision-making.In MCDM, on the basis of considered parameters, one element is selected among the available elements.In literature, different approaches are used to achieve the objective using different techniques such as the analytical network process (ANP) and analytical hierarchy process (AHP).In this paper, the ANP is used as it is widely used in literature in different fields such as software engineering, wireless sensor network (WSN), VANETS, and resource management [26][27][28][29].In software engineering, an ANP is used for software component selection.The optimum cluster head selection in WSN based on ANP is proposed in [26].The ANP has also been used for next forwarder vehicle selection to efficiently disseminate data in VANETs.The ANP scheme is briefly discussed in the following.

Analytical Network Process. The analytical network process is the enhanced version of analytical hierarchy process
proposed by Saaty [30,31].The objective of the ANP is to deal with interdependency and feedback between elements within a cluster or among clusters.The ANP structures a given problem into network of clusters where each cluster has different components connected to each other.The general steps of the ANP are as follows: (1) The first step is to formulate the problem, in which the problem is identified and divided into subproblems, if required.The objective is clearly defined along with the criteria (parameters) and alternatives (elements).Defining criteria/subcriteria is very important because the objective entirely depends on these parameters.On the basis of these parameters, alternatives are selected.
(2) Components in each cluster are pairwise compared, based on the quantitative scale proposed by Saaty [31] as presented in table.Each element is scaled according to its importance over other elements by considering certain parameter.A matrix is generated against each comparison made, where 1 is of equal importance while 9 represents the most importance.
(3) Local priorities are assigned to each comparison and every individual comparison matrix is represented through eigenvector to get the normalized weights.
(4) It is very important to check the reliability of each comparison made.In order to do so, Saaty [31] proposed the consistency ratio (CR), which defines how much of the comparison made is consistent.
The CR needs to be equal to or less than 0.1, which means that inconsistency is allowed up to 10%.If it exceeds, the comparison need to be revised.
(5) The outcome of all the comparison matrix is combined into unweighted supermatrix.These local priorities are transformed into weighted supermatrix by making it column stochastic.
(6) The weighted supermatrix is transformed into limit matrix by raising it to the power of 2k to get more stable values, where k is any arbitrary number.Limit matrix is the resultant matrix, containing final weight of each element.It determines the best alternative and most important criteria as well.
(7) Sensitivity check is performed to determine the stability of alternatives' ranking.

Phantom Node Selection Using an ANP Model
The location of the source is very important in VANETs; therefore, it is important to preserve privacy of a node.In this paper, an ANP model is used to select the phantom node to preserve privacy of the source location.The proposed technique considers V2V infrastructure in which vehicles directly communicate with each other.Source node communicates through a trusted phantom node, which is based on certain parameters such as trust, speed, distance, acceleration, and direction, as presented in Table 2. Every time, the source selects a different phantom node for communication, so that it is difficult for the attacker to track the position of the source.The selected node acts as a phantom node that forwards messages to improve source location privacy within its communication range.
In the proposed network scenario as shown in Figure 1, in order to forward data, a source node sends a packet to a phantom node.The phantom node is selected on the basis of trust, distance, speed, acceleration, and direction.Trust [32] indicates the confidence of a node over another node in a network.Distance [11,33] can be measured between 3 Complexity the source and phantom node in meters, while speed [11] can be defined as the rate of movement of a vehicle in a network.Acceleration is considered as the rate of change of velocity of a vehicle with respect to time [11,34].We have considered direction as well, because it is very important to determine the direction of the source node to the phantom node.The node in the opposite direction will have low priority as compared to the one in the same direction.A source node selects the phantom node within its communication range as shown in Algorithm 1.The selection of the phantom node using an ANP is explained.

Problem Identification.
The identified problem is structured into goal, criteria, and alternatives.In this paper, goal is to select the optimal vehicle as a phantom node, based on five given criteria (parameters).Alternatives are the vehicles upon which has to be made.In problem formulation, criteria selection is very important as the decision is based on these parameters.Once all the parameters and alternatives are identified, each element of criteria cluster is compared with every element of alternative cluster and vice versa.

Pairwise Comparison.
In pairwise comparison, the importance of elements in one cluster is judged in accordance with the elements of another cluster.Each comparison is assigned with a local weight and represented through matrix.These weights must be carefully assigned as the decision mainly depends on these comparisons.The elements of criteria and alternative clusters are compared with each other, according to the 9-point quantitative scale, 1 represents equal importance where 9 for the high priority.Elements compared with itself have equal importance, hence represented by 1 as shown in matrix (3).

Criteria
Comparison with respect to Alternatives.Each element of criteria cluster is pairwise compared with respect to each alternative according to Table 3.The resultant of all comparison is the comparison matrix, which includes all the comparisons made as shown in matrix (4).The values above diagonal are obtained from pairwise comparison where below values are the reciprocal of these comparisons.For instance, in the proposed scenario as shown in Figure 1, V1 is considered for all elements in criteria.Matrix (4) is the resultant of all comparisons of elements in criteria for V1.Each column obtained in matrix ( 4) is summed up, and each individual value is divided by its corresponding column total as shown in matrix (5).Afterwards, the average of each individual row is considered as eigenvector (EV).To check the reliability of pairwise comparison, the consistency ratio (CR) is calculated.According to Saaty [31], CR must be equal to or less than 0.1, otherwise pairwise comparison needs to be revised.The CR can be calculated using (1), where CI is the consistency index and RI is the random index.CI can be obtained using (2), and the value of RI can be determined using Table 4 [31].The CR for V1 is 0.08 as shown in matrix (6).The remaining matrices ( 7) and ( 8) are obtained using same process.The value of CR of all matrices must be less than 0.1.In matrix (7), elements in criteria are compared with respect to V2, V3, V4, V5, V6, and V7, respectively.

Results and Discussions
In this section, the results are thoroughly discussed taking into account the ANP major steps (discussed in Section 4) and outcome of each step.The outcome of the ANP model is limit matrix, which provides insight for best alternative and criteria.Alongside, sensitivity analysis has been performed to check the stability of these alternatives and the impact of criteria on it.

Limit Matrix.
Limit matrix is the resultant matrix, which contains the final weights against each element in criteria and alternative clusters.It is obtained from the weighted supermatrix in which the values are raised to the power of 2k to get same value for each row, where k is any random number.Table 7 represents limit matrix, on the basis of which decision can be made.Figure 2 illustrates that V6 has the high weight; therefore, it is the most suitable vehicle to be selected as a phantom node, followed by V3 and so on.The most important criteria can also be determined from limit matrix.
Here, trust parameter has high priority score, followed by direction and so on.Therefore, we can conclude that V6 is the best choice among all vehicles, and trust is the most important parameter.Moreover, parameters can be prioritized using an ANP model.The parameter having very small value can be eliminated to overcome computational overhead.To check the stability of the alternative ranking, we performed sensitivity check.

Sensitivity Analysis.
It is necessary to check the stability of the alternative rankings obtained through limit matrix.
In order to do so, the sensitivity analysis is performed.It is highly recommended but not mandatory.The objective of this test is to check how much of the ranking of alternative will be influenced by the elements in criteria cluster.Element having higher weight is considered, and its impact on all 6 Complexity elements in alternative ranking is determined.Here, trust parameter has the high weight, but we have considered direction for sensitivity analysis as we want to restrict the dissemination of information (accident, weather, and entertainment) only to vehicles of interest.In order to check the impact of parameters on the alternatives, we have considered two different scenarios.

Scenario 1.
In first scenario, all nodes in the interference region of the source vehicle are considered as interested vehicles (Figure 1), to whom information (weather or entertainment) has to be communicated.In this scenario, based on parameters (already discussed in section 4) V6 has the maximum weight computed through an ANP model and therefore is the optimum choice to be a phantom node.The sensitivity analysis is performed in order to check the stability of the alternative ranking.In Figure 3, V6 is the best choice for selection as a phantom node, as it has the maximum weight, followed by V3 with weight slightly less than V6, thus making V3 the second most suitable choice.The y-axis shows the weights obtained by every vehicle, and x-axis represents the phantom node selection weights.

Scenario 2.
This subsection provides an optimized solution to the problem of phantom node selection based on the interest region of the source vehicle.In the first step, vehicles inside the interference region of the source node are classified as interested and noninterested vehicles based on effectiveness of criteria parameters.In the second step, the whole ANP is revised, where the pairwise comparison is made in  Equally to moderately more important 3 Moderately more important 4 Moderately to strongly important 5 Strongly important 6 Strongly to very strongly more important 7 Very strongly more important 8 Very strongly to extremely more important 9 Extremely important of high priority   accordance with the importance of chosen criteria parameters.Less important criteria parameters are either omitted or given less weightage in the ANP.In the third step, the alternative ranking is determined.In last step, the sensitivity analysis is performed and the impact of criteria parameter is determined on the optimized alternative ranking.For instance, the accident has occurred in the separate lane; therefore, the vehicles in the opposite lane are not considered as they are moving in the opposite direction.The less interested vehicles in the interference region of the source node are shown in the shaded region (Figure 4).Therefore, the traffic flow on the opposite lane should not be affected as shown in Figure 4.The sensitivity analysis is presented in Figure 5, where V3 is the best alternative to be selected for the phantom node.

Conclusion and Future Directions
In this paper, the goal is to select the optimal trusted node (vehicle) that can preserve location privacy of the source node in VANETs.The selection of the phantom node is based on different parameters which are distance, speed, trust, acceleration, and direction that makes it a multicriteria decision problem.Analytical network process has been used to deal with such problem.The goal, criteria, and alternatives are identified first, and then each element of criteria is  9 Complexity pairwise compared with all elements of alternatives and vice versa.The whole process of an ANP is concluded in limit matrix which presents the best alternative and most important criteria.The proposed method is tested on two different scenarios in order to check the stability of the alternatives' ranking.Scenario 1 is for nonsafety events such as weather information and entertainment, in which information is disseminated to all vehicles that are in the range of the phantom node.Among all the alternatives, V6 has high weights and considered to be the best choice for the phantom node.Safety    Complexity application is considered in scenario 2, where an accident occurs on one specific lane.The whole process of an ANP is applied and then tested for sensitivity analysis.Vehicles moving in the opposite direction are of least interest to this event and therefore given less priority.Results illustrate that the vehicles which are in the opposite direction to the source node are of less interest to the one that move in the same direction.In the future, we will extend this work by considering different highways and urban scenarios.
.2. Alternatives' Comparison with respect to Criteria.The elements in alternatives (V1 to V7) are compared with respect to every individual element in criteria cluster as shown in matrix(8) in order of acceleration, distance, speed, trust, and direction, respectively.

Figure 2 :
Figure 2: Final weights of elements in alternative cluster.

Figure 4 :
Figure 4: Information dissemination to vehicles in the interest zone only.

Table 1 :
Attacks and their characteristics.