Efficient Anonymous Category-level Joint Tag Estimation

Transcription

1 Eicient Anonymous Category-eve Joint Tag Estimation Min Chen Jia Liu Shigang Chen Qingjun Xiao Department o Computer & Inormation Science & Engineering University o Forida, Gainesvie, FL 3611, USA State Key Laboratory or Nove Sotware Technoogy Nanjing University, P.R. China Key Laboratory o Computer Network & Inormation Integration Southeast University, P.R. China Abstract Radio-requency identiication (RFID) technoogies have been widey used in many appications, incuding inventory management, suppy chain, product tracking, transportation, ogistics, etc. Tag estimation, which is to estimate the cardinaity o a singe tag set, is an important research topic. This paper expands the estimation research as oows: It perorms joint estimation between two tag sets (which exist at dierent ocations or at the same ocation but dierent times). More importanty the estimation is ine-grained in an eort to accommodate common practica scenarios, where each tag set consists o tags beonging to dierent categories. For any two given tag sets, we want to know the detaied inormation about the joint property o each category, instead o just the aggregate inormation o the whoe sets. Furthermore, due to the open nature o RFID communications, it is oten desirabe that tag estimation can be perormed in an anonymous way without reveaing the tags ID inormation. To support these requirements, we deveop a new technique caed mask bitmap that can encode a tag set without requiring the tags to report their IDs or category IDs. Any two mask bitmaps o dierent tag sets can be combined to perorm category-eve joint estimation. Through orma anaysis, we determine how to set system parameters to meet a given accuracy requirement that can be arbitrariy set. Extensive simuation resuts conirm that the proposed soution can yied accurate category-eve estimates in an eicient way, and preserve tags anonymity as we. I. INTRODUCTION Radio Frequency Identiication (RFID) technoogies integrate simpe communication, storage, and computation components into attachabe tags that can communicate with RFID readers wireessy over a distance [1], []. Due to this signiicant advantage over traditiona bar code systems, RFID systems have been widey used in many appications [3] [7]. Generay, an RFID system consists o three components: One or more readers, a arge number o tags and a backend server. In RFID systems, tags with unique IDs are attached to objects, varying rom products in a warehouse, merchandizes in a retai store, animas in a zoo, or medica equipments in a hospita. Each tag can not ony identiy the tagged object, but aso indicate the category inormation through a subied o tag ID caed category ID. One important RFID research topic is tag estimation, which is to estimate the cardinaity o a tag set (i.e., the number o tags in the set) at a certain ocation [8] [16]. Tag estimation can be used as a preprocessing step or optimizing the rame size o rame-sotted ALOHA protocos in tag identiication [10]. In addition, it can be appied to monitor the inventory eve in a warehouse, the saes in a retai store, etc. Tag estimation is much more time-eicient than tag identiication that needs to coect a tag IDs [10]. Moreover, since tag estimation does not need to identiy any tags, the tags anonymity can be preserved [9]. Athough numerous approaches or tag estimation have been proposed, they have some imitations. First, most approaches ony consider a singe tag set [8] [16]. Ony imited prior work [17] [0] studies the joint estimation o two or more tag sets. Moreover, amost a prior work, incuding [18] [0], ony estimates the aggregate inormation o the whoe tag set(s), but ignores a common scenario where tagged objects may beong to dierent categories. Prior work [15], [16] investigates the category-eve tag estimation, but they ony consider a singe tag set. This paper studies a new probem caed category-joint tag estimation, which attempts to expand the research on tag estimation into a coupe o new directions: First, not ony do we perorm joint estimation between two tag sets, but more importanty the estimation is ine-grained at the category eve in an eort to accommodate practica scenarios, where each tag set consists o tags beonging to dierent categories. Given two tag sets, we want to estimate the cardinaity o the intersection set or each category. For exampe, consider a distribution network o warehouses, each carrying tagged products in various categories. For any two warehouses, i we have an automatic way to earn the cardinaity o the intersection o their tag sets in each product category, we wi have a means to track over time how each category o products ow through the network. For a singe warehouse, knowing the cardinaity o per-category intersection o tag sets at dierent times aows us to track how each category o products are moving in and out o the warehouse. Second, we want to carry out category-eve joint estimation anonymousy without giving away the tags private inormation, incuding tag IDs and category IDs [1], []. The widespread use o tags in traditiona ways o depoyment raises a serious privacy concern: The tags wi report their IDs to any readers upon request, giving away the privacy o /16/$ IEEE 1

2 the tag carriers. The RFID research community has recenty devoted tremendous eorts to designing new mechanisms that keep the useuness o tags whie doing so anonymousy [3] [7], athough they cannot be directy appied to the tag estimation probem. Leaking a category ID aone (without eaking the whoe tag ID) wi aso be probematic. The category ID may indicate certain unique properties or private inormation about the tagged objects o a particuar category. As an exampe, the category inormation o a medicine may identiy its speciic unctions or targeted diseases, which can be used to iner what disease a patient may have i he/she buys this medicine. Thereore, we want to incude the anonymity requirement in the design o a new protoco or category-eve joint estimation. It is aways preerred that a protoco can achieve the same unctionaity with comparabe perormance, but preserve the tags anonymity at the same time. Category-eve joint estimation is much more compicated than traditiona tag estimation since we need to consider the joint properties o two tag sets, each urther consisting o numerous dierent categories. Moreover, the anonymity requirement brings more chaenges to the probem. Intuitivey, each category o tags shoud be processed separatey so that we can easiy combine the inormation o a particuar category rom dierent tag sets. The diicuty is how to identiy which category a tag beongs to without requiring it to report its category ID? To our best knowedge, this is the irst work that studies anonymous category-eve joint estimation in RFID systems with new contributions summarized as oows: First, we expand the traditiona research on tag estimation which ony considers a singe set or ignores the disparity o dierent tag categories into new domains o category-eve estimation and anonymity. The category-eve joint estimation is capabe o depicting the dynamics between two arbitrary tag sets at the category eve. Second, we propose a orma anonymous mode to numericay evauate the anonymity o dierent tag estimation protocos or the irst time. In addition, we revea the inherent tradeo between estimation accuracy and anonymity o our proposed protoco. Third, we deveop a new technique caed mask bitmap to achieve anonymous category-eve joint estimation. Mask bitmaps can tactuy encode a tags o dierent categories without knowing their tag IDs or category IDs, whie the inormation o each category can be retrieved ater or joint estimation. We derive an estimator or the joint estimation o each category, ormay anayze its mean and variance, and show that it can produce approximatey unbiased resuts within an absoute error bound that can be set arbitrariy. Finay, we perorm extensive simuations to compement the theoretic anaysis. The simuation resuts demonstrate that by oowing proper parameter settings our estimator can give very accurate estimates in an eicient way and preserve tags anonymity as we. II. SYSTEM MODEL AND PROBLEM STATEMENT A. System Mode Suppose a objects in an RFID system can be cassiied into m dierent categories, represented by a set M o category IDs {cid 1,cid,...,cid m }. Each object is attached with a tag or identiication purpose. Since each tag uniquey identiies one object, we wi use object and tag interchangeaby in the seque. Given an arbitrary tag t, its tag ID id contains a subied caed category ID and is denoted as cid, indicating which speciic category its associated object beongs to. Let a be the ength o any tag ID (in number o bits) and b (< a) be the ength o any category ID. RFID readers are instaed to monitor tag sets ocated in their coverage areas. The readers can be connected to backend servers which provide suppementa storage, computation and communication resources. A reader communicates with tags using a rame-sotted ALOHA protoco. The reader initiates the communication by broadcasting a request that incudes a necessary parameters. The tags are synchronized by the reader s signa. In the oowing time rame, each tag sends its response in a randomy chosen sot. Based on the duration o sots, they can be cassiied into two types: One aows the transmission o a tag ID, whose duration is denoted by t id ; the other is much shorter and ony carries one bit inormation, whose duration is denoted by t s.at s sot is caed an empty sot i no tag repies, or a busy sot i one or mutipe tags respond. B. Anonymous Mode Low-cost RFID tags ony have very imited computation, communication and storage resources. Hence, they cannot impement any cassica cryptographic primitives, rendering the communications between a reader and a tag unprotected. Any adversary can pant unauthorized readers at chosen ocations to eavesdrop on the transmissions between tags and readers, thereby capturing conidentia or private inormation such as tag IDs and category IDs. We assume that the adversary has no prior knowedge o any tag IDs or category IDs in the system. We use two two numerica vaues to evauate how much anonymity o a tag is preserved ater executing a tag estimation protoco: (1) ID anonymity, which is the probabiity p id that the adversary cannot iner a tag s ID rom the transmissions; () Category anonymity, which is the probabiity p cid that the adversary cannot crack a tag s category ID based on the transmissions. C. Probem Statement Consider two arbitrary tag sets Np and Nq in a arge distributed RFID system. They may reer to two sets at dierent ocations, p and q, respectivey, or two sets at the same ocation but dierent times, in which p and q reer to time. The widcard superscript means that the notation covers tags o a categories. Let n p = Np and n q = Nq, Nc = Np Nq, and n c = Nc, where the subscript c means common tags in the two sets Np and Nq. Given an arbitrary category cid M, N p (cid) is the subset o tags in Np that beong to category cid, and

3 Fig. 1: The Venn diagram or sets N p, N q, N c, N p, N q and N c. simiary N q (cid) is the subset o tags in Nq that beong to category cid. Let n p (cid) = N p (cid), n q (cid) = N q (cid), N u (cid) = N p (cid) N q (cid), n u (cid) = N u (cid), N c (cid) =N p (cid) N q (cid), and n c (cid) = N c (cid). Most o the time, our protoco description ony needs to reer to one arbitrary category. Hence, we wi abbreviate N p (cid) simpy as N p when the context does not raise ambiguity. Simiary, we wi use N q, N u, N c, n p, n q, n u, and n c without expicity incuding (cid) in order to simpiy these notations. The Venn diagram in Fig. 1 iustrates the reation between sets Np, Nq, Nc, N p, N q and N c. The probem o anonymous category-eve joint estimation is to estimate the vaue o n c or each category under an accuracy requirement and an anonymity requirement. Once we have an estimate o the intersection cardinaity n c,itis trivia to estimate the union cardinaity n u and the dierence cardinaities, N p N q and N q N p, which are not presented in this paper due to space imitation. An intuitive interpretation or n c is the number o tags in category cid that are transported rom ocation p to ocation q or et behind rom time p to time q i the two tag sets are recorded at the same ocation. We use three perormance metrics or evauating anonymous category-eve joint estimation, which are isted as oows. Estimation accuracy: Our goa is to give an accurate estimate ˆn c or n c, such that Prob{ ˆn c n c } 1 θ, (1) where is an absoute error bound and θ is a probabiity. For exampe, i =50and θ = 10%, we require that the absoute estimation error ˆn c n c has a probabiity no ess than 90% to be within [0, 50]. In other words, [ˆn c, ˆn c + ] is a (1 θ) conidence interva or n c. In contrast to our absoute error mode, the traditiona protocos [8] [14], [16], [19], [0] or tag estimation empoy a reative error mode Prob{ ˆn n εn} 1 θ, where n is the cardinaity o a tag set, and ε is the reative error o the singe-set estimation ˆn. This mode has been adopted by the prior work on joint estimation o two tag sets [19], [0]. However, such adoption is not practicay suitabe in our opinion or the oowing reason: The singeset estimation protocos aways assume a arge tag set, which generay makes sense because a sma set o tags does not need estimation they can be directy counted. However, or two-set joint estimation, even though both sets are big, their intersection may be sma or even empty (e.g., no object movement between two warehouses). According to the resuts in [0], the time compexity o the estimation procedure wi approach to ininity when the intersection approaches to empty, which is not acceptabe because we cannot assume that the intersection o any two tag sets in a distributed RFID system is aways arge in practica appications. Hence, this paper advocates the absoute error mode [18], which makes practica sense: For instance, consider a distribution network where each warehouse periodicay encodes its tag set in an eicient, anonymous data structure (to be proposed ater). We want to estimate the number o tagged products in each category that are moved between any two warehouses in each period, with an error o ±50 tags at 95% conidence eve. We wi make the estimation by comparing the corresponding data structures. Execution Time: Since RFID tags operate with ow-speed communication channes, time eiciency is a key perormance metric or a RFID protocos. Tag estimation shoud compete in a short time to avoid intererence with other norma activities in an RFID system. Anonymity: Weusep id and p cid to measure the preserved anonymity o any tag ater perorm category-eve joint estimation. More speciicay, we want to maximize p id and p cid and make them as cose to 1 as possibe, such that it is practicay ineasibe or the adversary to iner the ID or category ID o any tag in N p or N q by eavesdropping on the execution o our estimation protoco. III. RELATED WORK There is no prior work on anonymous category-eve joint estimation. Beow we present some reated work that can be appied to category-eve joint estimation ater sight modiications, and then point out their issues. A. Tag Identiication The most straightorward approach or cacuating n c o an arbitrary category is to execute a tag identiication protoco, e.g., Dynamic Framed Sotted ALOHA (DFSA) [8], [9] used by the EPC C1G standard. First, a tag IDs in Np and Nq are coected by the readers. With the knowedge o Np and Nq, we can easiy ind n c or each category. One probem is that coecting a IDs is not eicient or arge RFID systems, particuary when it has to be perormed requenty. Due to transmission coisions, the ower bound o execution time to coect the IDs o n tags is e n t id [8], [9], where e is the natura constant. To make things worse, any IDs transmitted rom the tags to the readers may be captured by the adversary, rendering p id = p cid =0. B. Prior Work on Joint Tag Estimation Bitmap [30] is a compact data structure that is widey used or tag estimation [10], [31]. A bits in a bitmap are initiaized to zeroes. Each tag is pseudo-randomy hashed to a bit in the bitmap and sets that bit to one. The ZDE protoco [19] everages bitmap or joint estimation o two tag sets. The basic idea is to encode each tag set to an equa-size bitmap. Arbitrary two bitmaps can ater be combined to estimate the cardinaity o the union, dierentia, or intersection o the corresponding two tag sets. However, ZDE does not provide an expicit way o setting the bitmap size such that the estimation resut can meet a given accuracy requirement. The 3

4 Fig. : Two virtua bitmaps VB(cid 1 ) and VB(cid ) are buit on top the mask bitmap B or categories cid 1 and cid, respectivey. The bit in grey is shared by both virtua bitmaps. JREP protoco [18] is based on a simiar idea, but improves the time eiciency o ZDE by enabing variabe-size bitmaps. JREP irst estimates the cardinaity o a tag set, and then sets a proper size or the bitmap according to the estimated cardinaity. Any two bitmaps can sti be combined or joint tag estimation athough they may have dierent sizes. In [0], a generic Composite Counting Framework (CCF) is proposed to provide a cardinaity estimate or any set expression with desired accuracy. CCF coects a synopsis or each tag set, which incudes the d smaest hash vaues (o tag IDs) o that tag set. The synopses coected rom dierent tag sets are everaged to estimate the cardinaity o a set expression. To enabe per-category estimation, we can empoy ZDE, JREP, or CCF to perorm joint estimation or every category. When perorming estimation on a certain category, the reader can inorm the tags beonging to that category to participate in the protoco execution, whie other tags keep sient. However, the probem o ZDE and CCF is that their designs are based on a questionabe reative error mode, as we have expained previousy. For exampe, CCF requires at east Θ( nu ε n c n 1 θ ) synopses to ensure Prob{ ˆn c n c εn c } 1 θ, which transates to excessivey arge execution time when nu n c is arge, e.g., n c =0. JREP adopts an absoute error mode, but it must irst estimate the cardinaity o each category to set a proper bitmap size. Athough the execution time or estimating the cardinaity o one category is sma, the overa execution time can be very arge when there are numerous categories. More importanty, a these approaches break the anonymity due to the transmissions o category IDs, resuting in p cid =0. With the absoute error mode, per-category estimation and the anonymity requirement, the prior work cannot sove this probem very we, which drives us to expore new ways or category-eve joint estimation. IV. ANONYMOUS CATEGORY-LEVEL JOINT ESTIMATION A. Design Overview Instead o perorming joint estimation or each category one by one, which can be time-consuming, we want to enabe category-eve joint estimation in batch mode: A tags in one set, regardess o which categories they beong to, can be encoded to a bitmap simutaneousy. Moreover, we want to avoid the transmissions o category IDs to protect the anonymity o tags. To achieve our objectives, we design a new data structure caed mask bitmap, a variant o traditiona bitmap. Our idea is to use a singe arge bitmap B to accommodate a categories. For each category, we buid a virtua bitmap (VB) by randomy choosing some bits rom B, and any bit in B can be shared by mutipe categories. Fig. iustrates two virtua bitmaps VB(cid 1 ) and VB(cid ) randomy chosen rom the mask bitmap B or categories cid 1 and cid, respectivey, where the bit in grey is shared by both virtua bitmaps. A signiicant advantage o such bit-eve sharing is that a categories use a common bitmap. Hence, each bit in the mask bitmap is shared by numerous tags in dierent categories, which heps concea the tag ID and the category ID o a tag setting this bit. Our anonymous category-eve joint estimation protoco (CJEP) consists o two components: an encoding component or encoding a tag set to a mask bitmap, and an oine data anaysis component to combine two arbitrary mask bitmaps, retrieve inormation o each category, and estimate n c or each category (or any interested categories). Ony the encoding component invoves operations rom the tags. In order to simpiy the unctions to be impemented on resource-constrained tags, our protoco oows an asymmetric design principe that pushes most compexity to the oine component whie eaving the encoding component as simpe as possibe. B. Encoding a Tag Set We irst describe the process o encoding a tag set covered by a singe RFID reader. Consider the tag set Np. We denote the mask bitmap or encoding Np as Bp, consisting o bits. Let Bp[i] represent the ith bit in Bp, where 0 i 1. Virtua Bitmap: Each category cid is assigned a virtua bitmap VB p (cid) (abbreviated as VB p ) by pseudo-randomy taking bits rom Bp. This can be achieved by using independent hash unctions H k (), each o which maps cid to the bit Bp[H k (cid)], where 0 k 1 and the vaue o H k () is uniormy distributed over [0,). Denote the kth bit in VB p as VB p [k]. Wehave VB p[k] Bp[H k (cid)]. () There are eicient ways to impement hash unctions on a tag. One approach is to empoy a mater hash unction H () and a set R o dierent random seeds as oows: H k (cid) =H (cid R[k]), (3) where is the XOR operator. The backend server generates the seeds and shares them with a readers, and each reader wi incude the seeds as part o the request message sent to the tags. Another approach reies on a pseudo-random number generator (which is required to be impemented on tags under the EPC C1G standard). Two random seeds, r 1 and r, are needed. We use cid r 1 as the seed to the pseudo-random number generator. The vaue o H k (cid) is the (kr +1)th output rom the generator. That is, we use an output each time ater dropping r vaues. Encoding: A bits in Bp are initiaized to zeroes. The reader initiates the encoding process by broadcasting a request and the system parameters incuding the vaue o and random seeds. The request is oowed by a time rame F, consisting o sots. Consider an arbitrary tag with id as its ID and cid as its category ID. The purpose o the tag is to set a bit randomy chosen rom the virtua bitmap o category cid to one. To do so, the tag wi pseudo-randomy seects a 4

5 sot based on its own category ID and tag ID, which wi be urther expained shorty. The tag waits ti the chosen sot to transmit a one-bit response. The reader keeps istening to the channe and sets B p[i] =1i and ony i the ith sot is busy. There exists a one-to-one mapping between the ith sot in the time rame F and the ith bit in the mask bitmap B p. Simiary, there is aso a mapping rom a virtua bitmap VB p to the sots in F since a bits in VB p are rom B p. The sots corresponding to the bits in VB p orm the category s virtua rame. Their indices in the whoe rame F are H k (cid), where 0 k<. The tag wi choose a sot rom the virtua rame o category cid uniormy at random to transmit a one-bit response. To do that, it needs another hash unction h(), which can aso be impemented rom the master hash unction or the pseudorandom number generator as mentioned above, where the range o h() is [0,). The tag chooses the h(tid)th sot in the virtua time rame, corresponding to the h(tid)th bit in VB p. By (), this bit is in act the H h(tid) (cid)th bit in B p, and in turn it corresponds to the H h(tid) (cid)th sot in the whoe rame F. By the encoding design, the tag eectivey sets the oowing bit to one. VB p[h(tid)] B p[h h(tid) (cid)] = 1. (4) We stress that the tag never constructs the virtua bitmap VB p expicity. Its operation is actuay very simpe: A it does is to compute two hashes or the vaue o H h(tid) (cid) and then waits or that sot to transmit a signa, which sets a randomy chosen bit in the virtua bitmap o category cid to one. Mutipe readers: In case that mutipe readers are needed to cover a tags in the system, we assume that a reader schedue is estabished based on signa measurement in order to avoid reader-to-reader coisions. Ony non-conicting readers, each covering a non-overapping area, are schedued to be active at the same time. Ater every reader reports its mask bitmap, the backend server perorms a bitwise OR operation over a mask bitmaps to obtain a combined mask bitmap that encodes the whoe tag set. The prescribed system parameters, incuding the time rame size and virtua bitmap size, are used by a readers across the system. We wi introduce an agorithm or determining the system parameters shorty. C. Oine Inormation Retrieva Ater N p and N q are encoded to mask bitmaps B p and B q, respectivey, the bitmaps are ooaded to the backend server or permanent storage. For a query to estimate the cardinaity n c o their intersection on an arbitrary category cid, the backend server irst retrieves the two virtua bitmaps o category cid rom B p and B q as oows: VB p[k] B p[h k (cid)] VB q[k] B q [H k (cid)], where 0 k 1. The server then perorms a bitwise OR operation on the two virtua bitmaps, resuting in another -bit bitmap, denoted by VB u, VB u[k] =VB p[k] VB q[k], 0 k 1, (6) where the subscript u means that VB u encodes the union o N p (cid) and N q (cid). Fig. 3 shows the process o retrieving VB p, VB q, and generating VB u rom B p and B q. By the (5) Fig. 3: The process o retrieving VB p, VB q, and generating VB u rom B p and B q. encoding design, a tags in N p are encoded in VB p in a probabiistic way; reca that N p is abbreviation o N p (cid). Simiary, a tags in N q are encoded in VB q. Hence, a tags in N p N q are encoded in VB u. However, as we have discussed previousy and iustrated in Fig., dierent virtua bitmaps share bits, which means that a bit o 1 in VB p (or VB q, VB u ) may not be set by tags in category cid, but instead set by tags in another category. Hence, whie bit sharing heps achieve anonymity and eiciency, it aso introduces inter-category noise. To dea with the noise issue and accuratey estimate the vaue o n c, we resort to probabiistic anaysis in the next subsection. In addition, the backend server combines Bp and Bq by perorming a bitwise OR operation to obtain another useu bitmap, denoted by Bu. Hence, B u[k] =B p[k] B q [k], 0 k 1. (7) We know that B p, B q and B u encode the tag sets, N p, N q and N p N q, respectivey. D. Estimator or n c In this Section, we derive an estimator ˆn c or estimating n c using Bp, Bq, Bu, VB p, VB q and VB u. We irst present and prove the oowing theorem. Theorem 1. An arbitrary tag t has a probabiity 1 mapped to a given bit z in a -bit mask bitmap. to be Proo: The process or a tag to randomy choose a sot in a time rame can be cast into bins and bas probem [3]. We denote the -bit virtua bitmap or t s category as VB. Let random variabe X represent the number o physica bits occupied by VB in the mask bitmap. We have ( ) x x! S(, x) Prob(X = x) =, where S(, x) = 1 x x! i=0 ( 1)i( x i) (x i) is the Stiring number o the second kind [33]. S(, x) gives the number o ways to partition a set o bas into x non-empty bins. In addition, the probabiity that z is one o the x bits is 1 ( ) ( 1 x / ) x. The tag ID has a probabiity 1 x to be mapped to z among those x bits. Thereore, the probabiity or t to be mapped to z is ( ) ( x x! S(, x) 1 ) x p z = (1 ) ) 1 x x=1 = 1 +1 x=1 x ( x ( ) (8) x! S(, x) = 1, where we have used x=1 ( x) x! S(, x) = [33]. 5

6 Now et us continue to derive an estimator ˆn c. Let X j be the event that the jth bit in Bp is0(0 j 1), and 1 Xj be the corresponding indicator random variabe, namey, { 1, i B 1 Xj = p[j] =0, 0, i Bp[j] =1. Thereore, we have Prob(X j) = (1 1 )n p, and E(1Xj ) = 1 Prob(X j)+0 (1 Prob(X j)) = (1 1 )n p. Let Up be a random variabe o the raction o bits in Bp that remain zeros ater encoding a tags in Np.Wehave U p = 1 1 j=0 1X j. Hence, E(U 1 1 p)= E(1 Xj )=(1 1 )n p. (9) j=0 Simiary, et Y j be the event that the jth bit in Bq is 0, and U q be a random variabe or the raction o bits in Bq that remain zeros. We have E(U q)=(1 1 )n q. (10) Let Z j be the event that the jth bit in B u is 0. Since this bit is OR o the jth bit in B p and B q, Prob(Z j)=prob(x j Y j)=prob(x j Y j) Prob(Y j)=(1 1 )n p +n q n c. Let random variabe U u denote the raction o zeroes in B u.wehave E(U u)=(1 1 )n p +n q n c. (11) Combining (9), (10) and (11), we know E(U u ) = E(U p )E(U q )(1 1 ) n c. Thereore, (1 1 ) n c = E(U u) E(U p)e(u q). (1) Now et us move orward to investigate the properties o VB p, VB q and VB u. Let C j (0 j 1) be the event that the jth bit in VB p is 0, and 1 Cj be the corresponding indicator random variabe. For event C j to happen, neither a tag in N p nor a tag in Np N p sha be mapped to VB p [j]. The probabiity is Prob(C j)=(1 1 )np (1 1 )n p np, and thereore E(1 Cj )=(1 1 )np (1 1 )n p np. Let V p represent the raction o 0s invb p.wehave E(V 1 1 p)= E(1 Cj )=(1 1 )np (1 1 )n p np. (13) j=0 Appying (9) to (13), we have E(V p)=(1 1 )np (1 1 ) np E(U p). (14) Substituting E(V p ), E(U p ) with V p, U p, respectivey, and taking the ogarithm o the both sides, we derive an estimator or n p as oows: ˆn p = n V p n U p n(1 1 ) n(1 1 ). (15) Let D j be the event that the jth bit in VB q is 0, and V q represent the raction o 0s invb q. Simiary, we have E(V q)=(1 1 )nq (1 1 )n q nq, (16) ˆn q = n V q n U q n(1 1 ) n(1 1 ). (17) Consider an arbitrary bit z in VB u. Ony i the oowing two conditions are satisied wi its vaue remains zero. 1) z is not chosen by any tag in N p N q. ) z is not chosen by any tag in (N p N q ) (N p N q). For the irst condition, each tag in N p N q has a probabiity 1 to seect z and set it to 1. Hence, the probabiity q 1 to satisy condition one can be cacuated by q 1 =(1 1 )np+nq nc. (18) For the second condition, each tag in (Np Nq ) (N p N q ) has a probabiity 1 to choose z. Hence, q =(1 1 )n p +n q n c (np+nq nc). (19) Let E j be the event that the jth bit in VB u is 0, 1 Ej be the corresponding indicator random variabe, and V u be the raction o 0s invb u. Combining (18) and (19), we have Prob(E j)=(1 1 )np+nq nc (1 1 )n p +n q n c (np+nq nc), E(V u)=(1 1 )np+nq nc (1 1 )n p +n q n c (np+nq nc). (0) We know n u = n p + n q n c. Appying (11) to (0), E(V u)=(1 1 )nu (1 1 ) nu E(U u). n V u n U u nˆ u = n(1 1 ) n(1 1 ). (1) Appying (1), (13) and (16) to (0), we have E(V 1 1 E(U u) u)=e(v p)e(v q)( 1 1 ) nc E(U. p)e(u q)) Hence, we can cacuate E(V n u) E(V n E(U u) p)e(v q) E(U p)e(u q) n c = n(1 1 ) n(1 1 ) () Repacing E(V u ), E(V p ), E(V q ), E(U u ), E(U p ) and E(U q ) with observed vaues V u, V p, V q, U u, U p and U q, respectivey, we obtain an estimator or n c as oows ˆn c = (n Vp n Up)+(nVq n Uq) (n Vu n Uu) n(1 1 ) n(1 1 ). (3) Note that and shoud be set propery such that U p, U q, U u, V p, V q, and V u are non-zero. E. Anaysis o ˆn c We have derived E( ˆn c ) and Var(ˆn c ) but cannot present the derivation process here due to space imitation. The expected vaue o ˆn c is E( ˆn c) n c + evp+wp + e vq+wq e vu+wu v p v q + v u 1. (4) Note that when the vaues o v p, w p, v q, w q, v u and w u are sma, Bias( ˆn c )=E( ˆn c ) n c 0, which means ˆn c is an asynpoticay unbiased estimator o n c. Since the cose orm o Var(ˆn c ) is extremey compicated, we aso obtain an upper bound or Var(ˆn c ) that takes a much simper orm as oows: Var(ˆn c) < evu+wu v u 1 c where c =n(1 1 ) n(1 1 ). + (1 e vu ), (5) c 6

7 Protoco Identiication ZDE/JREP CCF CJEP p cid b p id D a b a b 1 a TABLE I: Preserved anonymity o a tag ater executing dierent protocos or category-eve joint estimation, where a is the ength o tag IDs and b is the ength o category IDs. F. Anaysis o Anonymity In this section, we anayze the preserved anonymity o a tag ater executing CJEP under our proposed anonymous mode. We assume that the adversary has unimited computing and storage resources such that given an arbitrary sot it knows which tags wi be mapped to this sot (which requires O( a ) preprocessing overhead). This assumption overrates the adversary s capabiity, so the oowing two theorems provide a ower bound o the anonymity o CJEP. Theorem. Given an arbitrary tag and its response in a time rame incuding sots, p cid =1. b Proo: With a b-bit category ID, there are b dierent category IDs. For each category, a -bit virtua bitmap is aocated, which corresponds to dierent sots. Hence, the mean number o categories mapped to each sot is b, and there is no other cue or the adversary to distinguish any two categories mapped to the same sot. As a resut, the probabiity or the adversary to guess the category ID o a tag based on 1 its response is =. Hence, p b b cid =1. b Theorem 3. Given an arbitrary tag and its response in a time rame incuding sots, p id =1 a. Proo: According to Theorem, the adversary has a probabiity to correcty guess its category ID based on b its chosen sot. With a a-bit tag ID and a b-bit category ID, each category can have as many as a b tags, which are eveny distributed to sots (-bit virtua bitmap). Thereore, each sot averagey has a b tags beonging to that category. Thereore, the probabiity to iner the u ID correcty is = b a b. Hence, p a id =1, which is extremey a sma when reasonaby ong tag IDs, e.g., 10 bits, are used. Tabe I compares the preserved anonymity o a tag ater executing dierent protocos or category-eve joint estimation. Ony CJEP can preserve category anonymity. For CCF [0], D is the size o hash space, and it shoud be set to O(n ), where n is the cardinaity o a tag set. Generay, we have <D. Thereore, CJEP has the best ID anonymity when the same rame size is used by ZDE/JREP. G. Parameter Setting In this section, we propose an agorithm to set appropriate parameters and under the accuracy requirement given in (1). We use g(,) to represent the upper bound o Var(ˆn c ) Agorithm 1 Procedure o determining optima and. Input: n p, n q, n u, n p, n q, n u,, θ 1: =1{Initiaizes } : repeat 3: = + s {s is the step size or increasing } 4: w p = n p, w q = n q, w u = n u 5: binary search or that satisies g 6: v p = np, v q = nq, v u = nu 7: unti Var(ˆn c) /Z θ Output:, given in (5): g(,) = evu+wu v u 1 c =0 + (1 e vu ) c (6) (e vu+wu v u 1) + 3 (1 e vu ), since c =(n(1 1 ) n(1 1 )) ( ) 1 when. Taking the partia derivative o g(,) with respect to, wehave g = wuevu+wu 3 (1 e vu ) < 0. Hence, g(,) decreases with the increase o. For the setting o, we have the oowing theorem. Theorem 4. Given a vaue o, there exists one and ony one optima, denoted by, that minimizes g(,). Proo: Taking the partia derivative o g(,) with respect to, wehave g = evu+wu (1 v u) 1+ (3(1 e vu ) v ue vu ). In addition, we can cacuate g = v ue vu+wu + (6 6e vu 4v ue vu v ue vu ). It is easy to prove that (6 6e vu 4v ue vu vue vu ) is monotonicay increasing with respect to v u. Hence (6 6e vu 4v u e vu vue vu ) 0, with the minimum reaching at v u = 0. Thereore, g g 0, which impies that is monotonicay increasing with respect to. Moreover, we have g =0 0 and g > 0. Thereore, there is ony one vaue that satisies g =0, which minimizes g(,). In other words, there is an optima vaue o that minimizes the upper bound o Var(ˆn c ) given an arbitrary setting o. For a norma distribution with E( ˆn c ) n c, the requirement in (1) can be transated to where Z θ is the 1 θ distribution. Thereore, Z θ Var(ˆnc), percentie or the standard Norma Var(ˆn c) /Z θ. (7) We need to set arge enough such that Var(ˆn c ) is no arger than /Z θ. For a given vaue o, we cacuate the optima that minimizes g(,). With this (,) pair, we check whether the condition in (7) satisies. I not, we urther 7

8 increase the vaue o to reduce Var(ˆn c ). Agorithm 1 shows the procedure o determining optima and. In practice, the vaues o n p, n q, n u, n p, n q, and n u are unknown. We wi shorty show how to set those parameters in Section V. V. SIMULATION RESULTS In this section, we evauate the perormance o CJEP through simuations. As we have expained in Section III, there is no prior work on anonymous category-eve joint estimation. Thereore, we use a tag identiication protoco as a benchmark or comparison. In addition, we appy state-o-theart protocos on joint tag estimation, which are JREP [18] and CCF [0], to per-category joint estimation ater some sight modiications. A. Parameter Settings In our simuations, the communication parameters are set oowing the speciication o EPC C1G standard [1]. Any two consecutive communications between the reader and tags are separated by a time interva o 30 μs. The transmission rate between the reader and tags is in the range o 6.7 kbps to 18 kbps. We set the transmission rate to 6.7 kbps (simiar simuation resuts can be observed under other parameter conigurations). That is, it takes the reader or tags μs to transmit one bit. Thereore, we have t s = = μs, and tid = = μs. We set the number m o categories to 1000 to ensure there are enough categories or evauating CJEP in a probabiistic way. We et the vaue n c o each category oow a uniorm distribution over [0, 500], so that every vaue o n c have enough sampes. In act, the adoption o absoute error mode guarantees that CJEP works regardess o the distribution o n c. We et the numbers n p and n q o tags in each category oow severa common distributions as oows: Dist. 1: n p and n q independenty oow a uniorm distribution Uni(300, 700). Dist. : n p and n q independenty oow a norma distribution Norm(500, 50 ). Dist. 3: n p and n q o independenty oow a zip distribution [34] over [400, 1000] at steps o 10 (61 dierent vaues in tota). With the vaue o the exponent characterizing the distribution set to 1.0, the requency o the rank-j vaue is 1/j (j) = 61 (1/i). i=1 The absoute error bound varies rom 0 to 100, at steps o 10. In addition, we set θ to 0.1 and 0.05, and Z θ is thereore and 1.960, respectivey. The vaues o and are obtained rom Agorithm 1, where the step size s is set to We set n p = n q = , which gives an estimated upper bound o the cardinaity o a tag set 1 (e.g., the number o goods can be stored in a warehouse). In addition, we approximatey set n p = n p m, n q = n q m, n u = n p + n q, and n u = n p + n q. For CCF, the size D o hash space is set to to avoid hash coisions. Hence, the ength o each hash vaue is 1 Note that the purpose or the arge setting o n p and n q here is to ensure there are enough categories and each category contains suicient number o tags or evauating CJEP in a probabiistic way. og =17bits. Instead o setting the number d o synopses to Θ( nu ε n c n 1 θ ), which otherwise can be excessivey arge when n c is sma (n c is not known in advance), we ix d to 400. The setting o JREP exacty oows that in [18]. B. Execution time We irst compare the execution time o dierent protocos or category-eve joint estimation. Fig. 4 and Fig. 5 show the resuts when θ =0.1 and θ =0.05, respectivey. In each pot, the x axis is the absoute error bound, and the y axis is the average execution time o each category. Simiar resuts can be observed even though n p and n q oow dierent distributions. This is because the tota number o tags in each tag set is cose and the number o categories is the same in dierent settings. Both JREP and CJEP take ess execution time with the increase o, meaning a arger estimation error is aowed. The dierence is that the execution time o CJEP decreases more dramaticay than that o JREP with the increase o. Athough CJEP takes a onger execution time than the other three protocos when is very sma, it is much more eicient than others when is moderatey arge. For exampe, when =50and θ =0.1, CJEP ony takes 38.7%, 4.3%, 19.7% o the execution time o JREP, CCF and an identiication protoco, respectivey. In addition, a smaer θ requires that the absoute estimation error n c ˆn c has a higher probabiity to be bounded by (i.e., a more stringent requirement on estimation accuracy). Thereore, the execution time o CJEP increases when θ decreases to 0.05 rom 0.1. C. Estimation accuracy Next we evauate the estimation accuracy o dierent protocos. For the purpose o air comparison, we choose a setting o and θ that makes the protocos have cose execution times. More speciicay, we set = 40 when θ =0.1, and =30when θ =0.05. Since an identiication protoco has no estimation error or n c, we do not incude the identiication protoco in the perormance comparison. For the (n c, ˆn c ) pair o each category in the estimation resuts, we cacuate the absoute estimation error n c ˆn c. Fig. 6 and Fig. 7 show the cumuative distribution unction (CDF) o the absoute estimation error. In Fig. 6, the 90 percentie o n c ˆn c o JREP, CCF, and CJEP are respectivey 16,, and 3, which are a within the error bound =30. In Fig. 7, the 95 percentie o n c ˆn c o JREP, CCF, and CJEP are respectivey 0, 6, and 30, which are aso bounded by =40. Overa, the estimation accuracy o JREP is a itte better than that o CCF and CJEP, and CCF and CJEP yied estimates with comparabe accuracy. The bit-eve sharing in mask bitmaps o CJEP heps preserve tags anonymity, but aso introduces inter-category noise that brings some negative eect on the estimation accuracy. D. Anonymity Reca that an identiication protoco does not preserve any ID anonymity or category anonymity. From Tabe I, we know p id 1 or CCF, JREP and CJEP when the ID ength a is arge enough, e.g., 96 bits. Since CCF and JREP cannot 8

9 s θ s θ Fig. 4: Execution time comparison o dierent protocos when θ =0.1. s θ s θ s θ s θ Fig. 5: Execution time comparison o dierent protocos when θ =0.05. θ n c n c θ n c n c θ n c n c Fig. 6: Cumuative probabiity o the the absoute estimation error n c ˆn c when =30and θ =0.1. θ θ θ n c n c n c n c n c n c Fig. 7: Cumuative probabiity o the the absoute estimation error n c ˆn c when =40and θ =0.05. θ % 99.01% 99.51% 99.69% 99.78% 99.8% 99.85% 99.88% 99.89% % 98.38% 99.6% 99.56% 99.69% 99.77% 99.81% 99.84% 99.86% TABLE II: p cid o CJEP when b =0. 9

10 θ % 99.97% 99.98% 99.99% 99.99% 99.99% % % % % 99.95% 99.98% 99.99% 99.99% 99.99% 99.99% % % TABLE III: p cid o CJEP when b =5. preserve category anonymity, we ocus on investigating the p cid o CJEP. Tabe II and Tabe III show the vaues o p cid when the ength b o category ID is set to 0 bits and 5 bits, respectivey. Under the same setting, a arger vaue o b, which makes the category ID more diicut to guess, eads to a arger vaue o p cid. When b =5, p cid approaches to 1 in most cases. In addition, we observe that with ixed vaues o b and θ, p cid increases with the increase o ; with ixed vaues o b and, p cid increases with the increase o θ. Generay speaking, a smaer vaue o or θ means a higher requirement o estimation accuracy, which requires a onger execution time (a arger ). According to Theorem and Theorem 3, the increase o causes p cid and p id to decrease. Thereore, there exists a tradeo between estimation accuracy and preserved anonymity. VI. CONCLUSION This paper studies a new probem o anonymous categoryeve joint estimation in RFID systems: Given a particuar category, we want to estimate its cardinaity in the intersection o two arbitrary tag sets anonymousy. We propose a protoco CJEP based on a nove data structure caed mask bitmap. We derive an estimator, anayze its mean and variance, and provide an agorithm or system parameter setting. We aso point out the inherent tradeo between the estimation accuracy and anonymity using CJEP. We perorm extensive simuations to evauate the perormance o our protoco. VII. ACKNOWLEDGMENTS This work was supported in part by the Nationa Science Foundation under grant CNS REFERENCES [1] EPC Radio-Frequency Identity Protocos Cass-1 Gen- UHF RFID Protoco or Communications at 860MHz-960MHz, EPCgoba, Avaiabe at [] J. Wang, H. Hassanieh, D. Katabi, and P. Indyk, Eicient and Reiabe Low-power Backscatter Networks, Proc. o ACM SIGCOMM, 01. [3] M. Chen, W. Luo, Z. Mo, S. Chen, and Y. Fang, An eicient tag search protoco in arge-scae rid systems with noisy channe, IEEE/ACM Transactions on Networking, vo. 4, no., pp , Apri 016. [4] J. Liu, M. Chen, B. Xiao, F. Zhu, S. Chen, and L. Chen, Eicient rid grouping protocos, IEEE/ACM Transactions on Networking, vo. PP, no. 99, pp. 1 1, 016. [5] S. Qi, Y. Zheng, M. Li, Y. Liu, and J. Qiu, Scaabe Data Access Contro in RFID-Enabed Suppy Chain, Proc. o IEEE ICNP, pp. 71 8, O 014. [6] F. Li, Impact o RFID Technoogy on Suppy Chain: A Simuation Approach, Proc. o IEEE MASS, pp. 1 4, September 009. [7] C.H. LEE and C.W. Chung, Eicient Storage Scheme and Query Processing or Suppy Chain Management using RFID, Proc. o ACM SIGMOD, pp , October 008. [8] B. Chen, Z. Zhou, and H. Yu, Understanding RFID Counting Protocos, Proc. o ACM MOBICOM, pp , 013. [9] H. Han, B. Sheng, C. Tan, Q. Li, W. Mao, and S. Lu, Counting RFID Tags Eicienty and Anonymousy, Proc. o IEEE INFOCOM, 010. [10] M. Kodiaam and T. Nandagopa, Fast and Reiabe Estimation Schemes in RFID Systems, Proc. o ACM MOBICOM, 006. [11] T. Li, S. Wu, S. Chen, and M. Yang, Energy Eicient Agorithms or the RFID Estimation Probem, Proc. o IEEE INFOCOM, March 010. [1] M. Shahzad and A. Liu, Every Bit Counts: Fast and Scaabe RFID Estimation, Proc. o ACM MOBICOM, pp , August 01. [13] Y. Zheng and M. Li, ZOE: Fast Cardinaity Estimation or Large-scae RFID Systems, Proc. o IEEE INFOCOM, pp , Apri 013. [14] Y. Zheng, M. Li, and C. Qian, PET: Probabiistic Estimating Tree or Large-Scae RFID Estimation, Proc. o IEEE ICDCS, 011. [15] W. Luo, Y. Qiao, and S. Chen, An Eicient Protoco or RFID Mutigroup Threshod-based Cassiication, Proc. o IEEE INFOCOM, pp , Apri 013. [16] L. Xie, H. Han, Q. Li, J. Wu, and S. Lu, Eicienty Coecting Histograms Over RFID Tags, Proc. o IEEE INFOCOM, 014. [17] Qingjun Xiao, Shigang Chen, and Min Chen, Joint property estimation or mutipe rid tag sets using snapshots o variabe engths, Proc. o ACM Mobihoc, pp , 016. [18] Qingjun Xiao, Min Chen, Shigang Chen, and Yian Zhou, Temporay or spatiay dispersed joint rid estimation using snapshots o variabe engths, Proc. o ACM Mobihoc, pp , 015. [19] Q. Xiao, B. Xiao, and S. Chen, Dierentia Estimation in Dynamic RFID Systems, Proc. o IEEE INFOCOM, pp , Apri 013. [0] H. Liu, W. Gong, L. Chen, W. He, K. Liu, and Y. Liu, Generic Composite Counting in RFID Systems, Proc. o IEEE ICDCS, pp , 014. [1] Min Chen, Jia Liu, Shigang Chen, and Qingjun Xiao, Anonymous category-eve joint tag estimation: Poster, Proc. o ACM Mobihoc, pp , 016. [] M. Chen and S. Chen, Etap: Enabe ightweight anonymous rid authentication with o(1) overhead, Proc. o IEEE ICNP, pp , November 015. [3] A. Jues and S. A. Weis, Deining Strong Privacy or RFID, IEEE PerCom Workshops, pp , March 007. [4] L. Lu, J. Han, R. Xiao, and Y. Liu, ACTION: Breaking the Privacy Barrier or RFID Systems, Proc. o IEEE INFOCOM, 009. [5] C. Tan, L. Xie, and Q. Li, Privacy Protection or RFID-based Tracking Systems, IEEE RFID, 010. [6] L. Lu, Y. Liu, and X. Li, Reresh: Weak Privacy Mode or RFID Systems, Proc. o IEEE INFOCOM, 010. [7] T. Li, W. Luo, Z. Mo, and S. Chen, Privacy-preserving RFID Authentication based on Cryptographica Encoding, Proc. o IEEE INFOCOM, 01. [8] C. T. Nguyen, K. Hayashi, M. Kaneko, P. Popovski, and H. Sakai, Probabiistic Dynamic Framed Sotted ALOHA or RFID Tag Identiication, Wireess Persona Communications, vo. 71, pp , August 013. [9] S. Lee, S. Joo, and C. Lee, An Enhanced Dynamic Framed Sotted ALOHA Agorithm or RFID Tag Identiication, Proc. o IEEE MobiQuitous, 005. [30] K. Y. Whang, B. T. Vander-Zanden, and H. M. Tayor, A Linear-time Probabiistic Counting Agorithm or Database Appications, ACM Transactions on Database Systems (TODS), vo. 15, no., [31] Q. Chen, H. Ngan, Y. Liu, and L. M. Ni, Cardinaity Estimation or Large-Scae RFID Systems, IEEE Transactions on Parae and Distributed Systems, vo., no. 9, pp , 011. [3] N. L. Johnson and S. Kotz, Urn Modes and Their Appication: An Approach to Modern Discrete Probabiity Theory, John Wiey and Sons Inc, [33] Stiring Numbers o the Second Kind, Avaiabe at org/wiki/stiring numbers o the second kind. [34] Zip s Law, Avaiabe at aw. 10