Privacy-Preserving Point-to-Point Transportation Traffic Measurement through Bit Array Masking in Intelligent Cyber-Physical Road Systems

Transcription

1 Privacy-Preerving Point-to-Point Tranportation Traffic Meaureent through Bit Array Making in Intelligent Cyber-Phyical Road Syte Yian Zhou Qingjun Xiao Zhen Mo Shigang Chen Yafeng Yin Departent of Coputer & Inforation Science & Engineering Departent of Civil and Coatal Engineering Univerity of Florida, Gaineville, FL 36, USA Abtract Traffic eaureent i a critical function in tranportation engineering. We conider privacy-preerving point-to-point traffic eaureent in thi paper. We eaure the nuber of vehicle traveling fro one geographical location to another by taking advantage of capabilitie provided by the intelligent cyber-phyical road yte that enable autoatic collection of traffic data. The challenge i to allow the collection of aggregate point-to-point data while preerving the privacy of individual vehicle. We propoe a novel eaureent chee which utilize bit array to collect data and adopt axiu likelihood etiation MLE) to obtain the eaureent reult. Both atheatical proof and iulation deontrate the practicality and calability of our chee. Keyword-tranportation traffic eaureent, privacy, cyber-phyical yte, axiu likelihood etiation I. INTRODUCTION Traffic eaureent i a critical function in tranportation engineering []. There are two categorie of traffic tatitic, point tatitic and point-to-point tatitic. Point tatitic tell the nuber of vehicle travering a pecific point location). Variou prediction odel have been propoed to etiate the [], [3]. Point-to-point tatitic decribe the nuber of vehicle traveling between two point. They are eential input to a variety of tudie including etiation of traffic link flow ditribution a part of invetent plan, calculation of road expoure rate a part of afety analyi, and characterization of turning oveent at interection for ignal tiing deterination. While pointto-point tatitic ay be inferred fro point data [4], little work ha been done on direct eaureent of point-topoint traffic particularly when driver location privacy i of concern. Thi paper conider the iportant proble of privacypreerving point-to-point tranportation traffic eaureent. The et of vehicle traveling fro one geographical location to another i odeled a a traffic flow, whoe ize i the nuber of vehicle in the et. To enable autoatic collection of traffic data, we take advantage of intelligent cyber-phyical road yte CPRS), which integrate the latet technologie in wirele counication and on-board coputer proceing to iprove afety and efficiency of tranportation yte [5] [6]. For exaple, IntelliDrive [7] fro USDOT [8] enviion a nationwide yte where vehicle counicate with roadide equipent RSE) in real tie via dedicated hort range counication. In CPRS, vehicle ay report their ID to RSE when they pa by, and that inforation can be ued by the authority to eaure traffic flow. However, if a vehicle keep tranitting it unique identifier to RSE, that inforation will enable other to track it entire oving hitory. A ore and ore people are concerned about their location privacy, the degree of privacy that a chee preerve will directly affect it applicability. To addre the iue of privacy, there are any iue that we need to conider: Firt of all, we need a criteria to tell what i good privacy and what i not. In thi paper, we capture the eence of privacy in traffic flow eaureent, and quantify it a a probability that a potential tracker cannot identify any trace of any vehicle. Secondly, given that criteria, how can we preerve the optial privacy? Apparently, the better the privacy preervation i, the ore applicable the eaureent chee will be. Furtherore, to protect the privacy of vehicle, only randoized and deidentified inforation i collected. We propoe a novel chee for privacy-preerving traffic flow eaureent. The new chee utilize bit array to encode tranportation traffic data ent fro vehicle to RSE, and adopt the axiu likelihood etiation MLE) to obtain the eaureent reult. The eaureent accuracy a well a privacy preerved by our propoed chee are analyzed through both atheatical proof and iulation, which deontrate the applicability of our chee. The ret of the paper i organized a follow: Section II give the yte and threat odel, the proble tateent, and the perforance etric that we conider. Section III dicue oe traightforward olution and their liitation, followed by Section IV which preent our novel olution and it perforance analyi. Section V how the iulation reult. Section VI uarize the related work. Finally, Section VII draw the concluion. A. Syte Model II. PRELIMINARIES We conider an intelligent cyber-phyical road yte involving three group of entitie: vehicle, roadide

2 equipent RSE), and a central erver. Each vehicle ha a unique ID, e.g., it VIN, or other nuber choen peranently or teporarily. Each RSE alo ha a unique ID. Both vehicle and RSE are equipped with coputing and counication capabilitie, e.g., on-board coputer chip and counication odule. Vehicle counicate with RSE in real tie via dedicated hort range counication DSRC) [8]. RSE are connected to the central erver through wired or wirele ean. They collect inforation fro vehicle and tranfer it to the central erver for further proceing at the end of each eaureent period. B. Proble Stateent We define a traffic flow between one RSE-equipped location and another RSE-equipped location a the et of vehicle traveling between the two location during a eaureent period. The traffic flow ize i the nuber of vehicle in the et. The proble i to eaure the ize of traffic flow in a road yte between all pair of location where RSE are intalled while protecting vehicle privacy. To achieve the privacy-preerving end, we need a olution in which a vehicle never tranit any unique identifier. Ideally, the inforation tranitted by the vehicle to the RSE look totally rando, out of which neither the identity nor the trajectory of any vehicle can be pried with high probability. We aue that a pecial MAC protocol i ued to upport privacy preervation uch that the MAC addre of a vehicle i not fixed. Vehicle ay pick an MAC addre randoly fro a large pace for one-tie ue. C. Threat Model We aue a ei-honet odel for the RSE. On the one hand, all RSE are fro trutworthy authoritie, which can be enforced by authentication baed on PKI. Each vehicle i pre-intalled with the public key of the truted third partie. Each RSE ut have a public-key certificate fro the. It broadcat the certificate in each query that it end out. When receiving a query, the vehicle verifie the certificate, and then ue the RSE public key to authenticate it. On the other hand, the authoritie ay exploit the inforation collected by RSE to track individual vehicle when they need to do o. For intance, if a vehicle tranit any unique identifier upon each query, that identifier can be exploited for tracking purpoe. Note that there are alo other way to track a vehicle, for exaple, tailgating the vehicle, or etting caera near RSE to take photo and uing iage proceing to recognize it. Thee ethod are beyond the cope of thi paper. In thi paper, we focu on preventing tracking caued by the traffic flow eaureent chee itelf. D. Perforance Metric In thi paper, we ue three perforance etric to evaluate a traffic flow eaureent chee: eaureent accuracy, coputation overhead, and preerved privacy. ) Meaureent Accuracy: Let n c be the true ize of a traffic flow between a pair of location and ˆn c be the correponding eaured reult. We pecify the eaureent accuracy through a paraeter β which atifie the following requireent: the probability for n c to fall into the interval [ˆn c β), ˆn c + β)] ut be at leat α, where α i a pre-deterined paraeter in the range of [, ]. Given α, a aller value of β ean better eaureent reult. For exaple, when α = 95%, a olution with β =.5 i better than a olution with β =. becaue the forer enure the eaured traffic flow ize ha a probability of 95% to be within ±5% of the true value, while the latter only enure the eaured reult to be within ±% of the true value. ) Coputation Overhead: We conider the coputation overhead for vehicle, RSE, and the central erver. For vehicle, we eaure the coputation overhead for each vehicle per RSE en route. For RSE, we eaure the coputation overhead for each RSE per paing vehicle. For the central erver, we eaure the coputation overhead to copute the traffic flow ize of per pair of RSE. 3) Preerved Privacy: We capture the eence of privacy preervation in point-to-point tranportation traffic eaureent, which i allowing the tracker only a liited chance to identify any partial or full trajectory of any vehicle. Accordingly, we quantify the privacy of a chee through a paraeter p which atifie the following requireent: the probability for any trace of any vehicle not to be identified ut be at leat p, where a trace of a vehicle i a pair of RSE it ha paed by. A larger value of p ean better privacy. Intuitively, a chee with p =.5 i better than one with p =. in ter of privacy becaue the latter give the tracker a better chance to link trace of a vehicle to obtain it trajectory ince it allow the trace to be identified with a higher probability, i.e., p. III. STRAIGHTFORWARD APPROACHES AND THEIR LIMITATIONS To eaure the traffic flow ize between all pair of RSE in the road yte, a traightforward approach i aking vehicle report their ID to all RSE that they pa by. RSE collect the ID fro the paing vehicle. At the end of each eaureent period, all RSE end their collected ID et to the central erver, which then eaure the traffic flow ize between each pair of RSE by iply coparing the two correponding ID et: if a vehicle ID appear in both ID et, then the vehicle ut have paed both RSE. Thu, the nuber of ID that appear in both ID et equal the true traffic flow ize between the two correponding RSE. However, thi iple approach lead to eriou privacy breaching a it reveal vehicle identitie along the way. A natural follow-up thinking i aking vehicle report their encrypted ID EID) to the RSE en route. The central erver will copute traffic flow ize baed on

3 the EID et collected by RSE. To prevent the tracker fro uing fixed EID to identify vehicle, each vehicle ha any EID encrypted by different key. However, the EID of a vehicle ut atify the following property: they will produce the ae reult after a certain procedure of coputation, allowing the central erver to find out they repreent the ae vehicle. In thi chee, although vehicle true identitie are hidden, trace of each vehicle are till revealed and can be linked to obtain it full trajectory. An alternative approach i having the RSE broadcat their ID RID). Each vehicle will record the RID of all RSE it ha paed by, and tranit the to every RSE that it pae in the future. RSE collect thoe RID fro paing vehicle, and end the to the central erver at the end of each eaureent period. To copute the ize of a traffic flow between two RSE, R x and R y, the central erver iply goe through the RID et collected by R y R x ), and count the nuber of tie that R x R y ) appear in thi et. Thi i the ize of the directional traffic flow fro R x R y ) to R y R x ). The undirectional traffic flow between R x and R y i the u of both directional flow ize. Clearly, thi approach alo reveal a vehicle trajectory in the for of a lit of RID ent to each RSE that it pae. IV. PRIVACY PRESERVING POINT-TO-POINT TRANSPORTATION TRAFFIC MEASUREMENT In thi ection, we preent our novel chee for privacy preerving point-to-point tranportation traffic eaureent. There are two phae for each eaureent period: online coding and offline decoding. Online coding i an interaction between vehicle and RSE, where neceary inforation for traffic flow eaureent are ecurely collected. Later in the offline decoding phae, the central erver will ue thoe inforation to copute traffic flow ize. In the following, we firt illutrate the two eaureent phae, and then evaluate our chee with repect to the three perforance etric decribed in Section II-D. A. Online Coding Phae In our chee, each RSE R x aintain a counter n x, which keep track of the total nuber of vehicle paing by during the current eaureent period. R x alo aintain a bit array B x with a fixed length > ) to ak vehicle identitie. At the beginning of each eaureent period, n x and all the bit in B x are et to zero. In addition, each vehicle v ha a logical bit array LB v, which conit of < < ) bit randoly elected fro B x. The indice of thee bit B x are Hv K v X[]),..., Hv K v X[ ]), where i the bitwie XOR, H...) i a hah function whoe range i [, ), X i an integer array of randoly choen The identity of a vehicle ay be revealed by a photograph triggered by the vehicle ruhing a red light or by a police car topping the vehicle. When the identify i cobined by the trajectory tranitted by the vehicle, the entire traveling path of the driver will be revealed. contant whoe purpoe i to arbitrarily alter the hah reult, and K v i the private key of v whoe purpoe i to protect the privacy of it logical bit array. The online coding phae i quite iple. RSE broadcat querie in pre-et interval e.g., once a econd), enuring that each paing vehicle receive at leat one query and eanwhile giving enough tie for the vehicle to reply. Colliion can be reolved through well-etablihed CSMA or TDMA protocol, which are not the focu of thi paper. Every query that an RSE end out include the RSE RID and it public-key certificate. Suppoe a vehicle, whoe ID i v, receive a query fro an RSE, whoe ID i R x. The vehicle firt verifie the certificate, and then ue the RSE public key to authenticate the RSE. After verifying that R x i fro the trutworthy authority, the vehicle v will randoly elect a bit fro it logical bit array LB v by coputing an index b = Hv K v X[HR x ) od ]). The vehicle v then end the reulting index b to the RSE R x. Upon receiving the index b, R x will firt increae it counter n x by, and then et the bth in B x to : B x [Hv K v X[HR x ) od ])] =. ) B. Offline Decoding Phae At the end of each eaureent period, all RSE will end their counter and bit array to the central erver, which then perfor the offline eaureent. We eploy the axiu likelihood etiation MLE) [9] to eaure the ize of traffic flow baed on the counter and bit array. Suppoe the et of vehicle that pa RSE R x R y ) i denoted a S x S y ) with cardinality S x = n x S y = n y ). Clearly, the et of vehicle that pa both RSE R x and R y i S x S y. Denote it cardinality a n c, which i the value that we want to eaure. Furtherore, denote by S the ubet of vehicle in S x S y that happen to et the ae bit in B x and B y, where B x and B y are the bit array at R x and R y, repectively. Let n o be the cardinality of S, i.e., n o = S. Clearly, S S x S y and n o n c. For any vehicle, it ha the ae probability to et any bit in it -bit logical bit array. A a reult, the probability for an arbitrary vehicle v fro S x S y to elect the ae bit in both B x and B y i =. Therefore, the nuber of uch vehicle, n o, i binoially ditributed according to Bn c, ). Accordingly, the probability for n o = z z n c ) i nc P n o = z) = z ) )z )nc z. ) Given the counter n x and n y, and bit array B x and B y, we eaure n c a follow: Firt, take a bitwie AND of B x and B y, and denote the reulting bit array a B c. Naely, B c [i] = B x [i] B y [i], i [, ]. 3) Calculate the nuber of in B c and denote it a U c. For an arbitrary bit b in B c, it i if and only if the following

4 two condition are atified: Firt, it i not choen by any vehicle in S. If b i choen by a vehicle v S, we know that bit b in B x and B y are both et to hence bit b in B c i alo ). Since each vehicle in S x S y ha probability to et bit b to, the probability for the vehicle not to chooe bit b i. There are n o vehicle in S. Therefore, the probability for bit b not choen by any vehicle in S i q = )no. 4) Second, it i either not choen by any vehicle in S x S or not choen by any vehicle in S y S. Otherwie, bit b in both B x and B y will be et to hence bit b in B c i alo ). Siilar to the previou analyi, we can obtain that the probability for bit b not choen by any vehicle in S x S i )nx no, and the probability for bit b not choen by any vehicle in S y S i )ny no. Therefore, the probability for the econd condition to be atified i q = )nx no ) )ny no ) = )nx no + )ny no )nx+ny no. 5) Cobining the above analyi, the conditional probability for bit b in B c to reain given n o = z i q q, naely, qn c n o = z) = )nx + )ny )nx+ny z. 6) Given qn c n o = z) and the ditribution of n o, the overall probability qn c ) for bit b in B c to reain i qn c ) = = n c z= n c qn c n o = z) P n o = z) qn c n o = z) z= ) nc z )z )nc z = )nx + )ny )nx+ny + ) ) ) nc. 7) Since each bit in B c ha a probability qn c ) to be, and the oberved nuber of bit in B c i U c, the likelihood function for thi obervation to occur i: L = qn c )) Uc qn c )) Uc. 8) We follow the tandard proce of MLE to find the optial value of n c that axiize the likelihood function in 8): ˆn c = arg ax n c {L} 9) To find ˆn c, we take logarith on both ide of 8): ln L = U c ln qn c ) + U c ) ln qn c )). ) Take the firt order derivative of ), we have: d ln L Uc = dn c qn c ) U ) c q n c ), ) qn c ) where q n c ) can be coputed fro 7) a follow: q n c ) = dqn c) dn c = )nx+ny + ) ) ) nc ln + ) ) ). ) To copute ˆn c, we et the right ide of ) to : Uc qn c ) U ) c q n c ) =. 3) qn c ) Oberve fro ) that q n c ) cannot be when > and >. Therefore, we have: U c qn c ) U c =. 4) qn c ) Subtituting 7) to 4), we obtain the MLE etiator ˆn c of the deired traffic flow ize n c a follow: ˆn c = ln + )nx )ny Uc ) n x + n y ) ln ) ) ln C. Meaureent Accuracy + ) ) 5) In the previou ubection, we give the MLE etiator ˆn c of the traffic flow ize n c. Now we analyze it eaureent accuracy. According to the tandard theory of MLE [], when the value of, n x, and n y are large enough, the eaured traffic flow ize approxiately follow the noral ditribution below: ˆn c Nor n c, ), 6) Iˆn c ) where Iˆn c ) i the fiher inforation of L, defined a: [ d ] ln L Iˆn c ) = E. 7) dn c According to ), we copute the econd-order derivative of ln L in the following: d ln L dn = U c q n c ) c q U c) q ) n c ) n c ) qn c )) q n c ) Uc + qn c ) U ) c q n c ) ln C, 8) qn c )

5 where C = + ) ) and q n c ) i given in ). For an arbitrary bit b in B c, it ha probability qn c ) to reain. U c i the nuber of in B c. Therefore, U c follow a binoial ditribution B, qn c )). Accordingly, EU c ) = qn c ). 9) Subtituting 8) and 9) to copute 7), we have q n c ) Iˆn c ) = + ) q n c ) q n c ) qn c ) qn c ) q n c )) = qn c ) qn c )), ) According to 6), the variance of ˆn c i V arˆn c ) = Iˆn c ) = qn c) qn c )) q n c )). ) Therefore, the confidence interval of our eaureent i qn c ) qn c )) ˆn c ± Z α q n c )), ) where α i the confidence level paraeter and Z α i the α percentile for the tandard Gauian ditribution []. D. Privacy Guarantee Next, we evaluate the preerved privacy of our eaureent chee. Note that in our chee, the only inforation that a vehicle v ever tranit to an RSE en route i an index of a bit b randoly elected fro it - bit logical bit array, LB v. Fro the tracker point of view, it can only identify the trace of a vehicle paing by two RSE R x and R y through the obervation of the bit that are et to in both B x and B y ; thee bit will be in B c. Therefore, the preerved privacy of our chee i actually a conditional probability which tell to what degree an oberved in B c doe not repreent a coon vehicle paing by both R x and R y. We derive thi conditional probability in the following. Firtly, conider the probability for the tracker to oberve an arbitrary bit, b, to be et to in both B x and B y event A), P A). Obviouly, the probability P A) equal inu qn c ) given our analyi in Section IV-B: P A) = )nx )ny + )nx+ny + ) ) ) nc 3) Secondly, conider the conditional probability for uch a bit, b, to not repreent a coon vehicle paing both R x and R y event E), P E A). Thi i the privacy p that we want to derive. Note that event E happen if and only if bit b in B x i et only by vehicle paing only RSE R x i.e., in et S x S y ), and bit b in B y i et only by vehicle paing only RSE R y i.e., in et S y S x ). Denote thee two event a E x and E y, repectively. There are n x n y ) vehicle paing R x R y ), and n c vehicle aong the pa both R x and R y. Since each vehicle ha a probability to et bit b to, the probability for E x E y ) to happen i: P E x ) = )nx nc ) )nc, 4) P E y ) = )ny nc ) )nc. 5) Cobining the above analyi, we have the forula for the preerved privacy of our chee a follow: p = P E A) = P E x) P E y ) P A) = P A) )nc )nx ) )nc )ny ), 6) where P A) i given in 3). Oberve that there are paraeter, and, that deterine the value of P E A). Aong the, only appear in the denoinator P A), and it influence P E A) through varying the value of P A). influence both the denoinator and the nuerator. In the following, we conider the influence of and on P E A) by firt exaining the influence of on P A) hence that on P E A)) under variou value of, and then analyzing how deterine the value of P E A) given value for. ) Influence of on P A): To exaine how effect P A), we take partial derivative of 3) with repect to P A) = )nx+ny n c ) Cnc. 7) P A) Clearly, <. Therefore, with the increent of, the value of P A) decreae, and in turn, the value of P E A) increae. In other word, the preerved privacy will be better with a larger value of. The nuerical reult are hown in the firt two plot of Figure where n x = n y = n = 5,, n c = 5,, and =, 5,, correponding to three curve in each plot. Clearly, a increae, the probability P A) decreae. Another obervation fro the nuerical reult give that when > 5, the difference in probability P A) under different becoe quite all. For intance, when [5n, n], the difference in P A) when and = i aller than.5 ee the two lower curve in the econd plot of Figure ). When n >, that difference becoe negligible. Therefore, when we analyze the effect of on P E A) in the following ubection, and et up the paraeter for our iulation, we only conider the cae when =, 5,, with etablihed undertanding that larger value of will only ake negligible difference.

6 Probability PA) = = 5 5 f = / n Probability PA) = = 5 5 f = / n Privacy, p = PE A) =. = 5 5 f = / n Figure. n x = n y = n = 5,, n c = 5, ; Firt Plot: probability P A) when varie fro.n to n, controlled by different =, 5, ; Second Plot: a zoo-in of the firt plot when varie fro 5n to n; Third Plot: probability P E A) when varie fro.n to n, controlled by different =, 5,. ) Influence of on P E A): To exaine the effect of on P E A), we take the partial derivative of 6) with repect to and obtain the following P E A) P E) = P A) P A) P E) P A) 8) where P E) = P E x ) P E y ). P E x ) and P E y ) are given in 4) and 5), repectively. Therefore, the partial derivative of P E) with repect to i [ n c )nc n c + n x ) )nc+nx n c + n y ) + n )nc+ny x + n y ) ] )nx+ny P E) = 3 9) In addition, fro 3), we can copute the derivative of P A) with repect to : P A) = [ n x )nx n y )ny + )nx+ny C nc n x + n y ) ) + ln C )] 3) P E) P A) Both and are negative, eaning that both P E) and P A) decreae with the increent of. Intuitively, increaing give each vehicle a aller chance to et an arbitrary bit, b. Hence, P E) and P A) alo drop. The effect that ha on P E A) are twofold: on the one hand, the increent of decreae the denoinator P A), which pull the privacy up; on the other hand, the increent of decreae the nuerator P E), which drag the privacy down. The cobination of thee two effect give that the partial derivative of P E A) with repect to can be poitive, negative, or, according to 8). Alo, given, we can chooe an optial to achieve the bet degree of privacy. The optial i obtained by etting the right ide of 8) to. The third plot of Figure how the nuerical reult for the preerved privacy under different when n x = n y = n = 5,, n c = 5,, and =, 5,. Clearly, along each curve controlled by ), there i an optial value of that give the optial privacy, p. For intance, = 3.8n give the optial privacy p =.766 when =. Another obervation i, when i large 5 or ), there alway exit a ooth interval of near it extree point that can achieve coparable privacy a the optial. For exaple, when =, the value of within the interval [3.8n, 3.n] achieve privacy that i within 5% of the optial privacy.766. Thi ooth interval for privacy allow u to adjut the value of to achieve better eaureent reult while preerving coparable privacy. E. Coputation Overhead In our chee, when a vehicle v pae an RSE R x, the vehicle v only need to copute two hahe to obtain an index of a rando bit in it logical array LB v, and the RSE R x only need to et bit in it bit array B x, a decribed in Section IV-A. Therefore, the coputation overhead for the vehicle per RSE a well a the RSE per vehicle are both O). A for the central erver, in order to copute a traffic flow ize between a pair of location, it only need to do a bitwie AND over two -bit bit array, count the nuber of in the reulting bit array, and ue 5) to copute the MLE etiator. Therefore, the coputation overhead for the central erver i alo O). V. SIMULATION In thi ection, we evaluate the perforance of our eaureent chee through iulation. The iulation are perfored under five yte paraeter, n x, n y, n c,, and. For a pair of RSE, R x and R y, n x n y ) i the nuber of vehicle paing by R x R y ). There are n c vehicle paing both R x and R y, which ean the true traffic flow ize i n c. i the nuber of bit that each vehicle chooe in it logical bit array, and i the nuber of bit in the bit array of each RSE. In the iulation, we chooe the five paraeter a follow: n x = n y = n = 5,,,, or 5,, and n c varie fro %n to 5%n, with tep ize of.%n; =, 5,, and

7 .5 x 4 = x 4.5 x x 4.5 x 4 = x 4 Figure. Meaureent accuracy controlled by, n x = n y = n = 5,, n c = [.n,.5n]. The x-axi how true traffic flow ize, and the y-axi how the correponding eaured traffic flow ize. Firt Plot: = ; Second Plot: ; Third Plot: =. 5 x 4 = x 4 5 x x 4 5 x 4 = x 4 Figure 3. Meaureent accuracy controlled by, n x = n y = n =,, n c = [.n,.5n]. The x-axi how true traffic flow ize, and the y-axi how the correponding eaured traffic flow ize. Firt Plot: = ; Second Plot: ; Third Plot: =..5 x 5 = x 5.5 x x 5.5 x 5 = x 5 Figure 4. Meaureent accuracy controlled by, n x = n y = n = 5,, n c = [.n,.5n]. The x-axi how true traffic flow ize, and the y-axi how the correponding eaured traffic flow ize. Firt Plot: = ; Second Plot: ; Third Plot: =. Table I VALUES FOR TO ACHIEVE OPTIMAL p UNDER DIFFERENT. 5 optial.7n.7n 3.8n optial p i choen to achieve the optial privacy p, a deterined in Section IV-D. Table I lit the value for to achieve optial p under different value of. Figure, 3, and 4 how our iulation reult when n = 5,,,, and 5,, repectively. For each figure, there are three plot, correponding to the reult of three et of iulation controlled by paraeter, where =, 5, and. Each plot how the eaured traffic flow ize ˆn c y-axi) with repect to different true traffic flow ize n c x-axi) under a given etting of n,, and, where i choen a decribed in Table I o that the optial privacy i achieved. We alo draw the equality line y = x in each plot for reference. Clearly, the cloer a point i to the equality line, the ore accurate the eaureent reult. Fro the figure, one can ee that given other paraeter, our MLE etiator produce alot perfect reult when = the firt plot in Figure, 3, and 4). When becoe larger, the variant for our etiator alo becoe larger, producing ore point not cloe to the equality line the third plot in Figure, 3, and 4). Recall that a larger value of bring better privacy Table I). For exaple, the optial privacy i.766 when =, better than the optial

8 privacy of.758 when =. Thi iplie a tradeoff between the preerved privacy and eaureent accuracy. Fro Section IV-D, we know when i large, there alway exit a ooth interval of near it extree point that can achieve coparable privacy a the optial. In reality, one can chooe a relatively large value for e.g., 5 or ), and adjut the value of to achieve better eaureent reult while till preerving coparable privacy a the optial. Finally, the reult are ore accurate with larger value of n, which i a natural phenoenon given that the eaureent reult i obtained through an MLE etiator. VI. RELATED WORK A. Tranportation Traffic Meaureent In the area of tranportation traffic eaureent, variou prediction odel have been propoed to eaure point traffic tatitic, uing data recorded by autoatic traffic recorder ATR) intalled at road ection. For exaple, the ultiple linear regreion odel in [], and the artificial neural network in [3], etc. Thoe olution, though elegant, are not appropriate for point-to-point tranportation traffic eaureent. While oe point-to-point tatitic ay be inferred fro point data [4], we prefer a ore accurate direct-eaureent approach that hould alo addre the privacy concern. Although Google recently announced to provide real-tie traffic data ervice in Google ap [], their approach cannot aure vehicle privacy ince it ue GPS and Wi-Fi in phone to track location [3]. B. Network Traffic Meaureent Another branch of reearch that relate to but i alo ignificantly different fro) our i network traffic eaureent, where reearcher have propoed variou ethod for traffic flow eaureent. Though having the ae nae, their proble i different fro our: to eaure the network traffic between two network router. The olution can be uarized into two categorie. One i indirect etiation baed on link load, and network routing, by eploying tatitical technique [4] [5]. Thee ethod cannot achieve high accuracy ince their etiation are baed on the unknown traffic volue. The other i direct eaureent by different counting ethod [6] [7]. In particular, Li et al. [7] develop a bitap-baed counting ethod for traffic flow eaureent, which i ot related to our work. However, all thee olution are not appropriate for our proble, ince they eaure traffic in network environent where the privacy of packet i not a concern, o counting can be done directly baed on the packet ID. In our proble, the privacy of vehicle i the ajor concern. Therefore, the olution ut incorporate randoization and de-identification technique to protect vehicle privacy, and do counting baed on inforation that look totally rando. VII. CONCLUSION In thi paper, we focu on the proble of privacypreerving point-to-point tranportation traffic onitoring in intelligent cyber-phyical road yte. We foralize point-to-point traffic a traffic flow, and quantify privacy a a probability. We propoe a novel chee which allow the collection of aggregate traffic flow data while preerving the optial privacy of individual vehicle. The propoed chee utilize bit array to collect data and adopt axiu likelihood etiation MLE) to obtain the eaureent reult. The feaibility and calability of our chee are hown by both atheatical proof and iulation. VIII. ACKNOWLEDGMENT Thi work i upported in part by the National Science Foundation under grant CPS and by a grant fro the Center for Multiodal Solution for Congetion Mitigation ponored by the US Departent of Tranportation. REFERENCES [] USDOT, Traffic Monitoring Guide, [] D. Mohaad, K. C. Sinha, T. Kuczek, and C. F. Scholer, Annual Average Daily Traffic Prediction Model for County Road, Journal of the Tranportation Reearch Board, vol. 67/998, pp , 998. [3] W. La and J. Xu, Etiation of AADT fro Short Period Count in Hong Kong A Coparion Between Neural Network Method and Regreion Analyi, Journal of Advanced Tranportation,. [4] Y. Lou and Y. Yin, A Decopoition Schee for Etiating Dynaic Origin-detination Flow on Actuation-controlled Signalized Arterial, Tranportation Reearch Part C, vol. 8,. [5] J. Erikon, H. Balakrihnan, and S. Madden, Cabernet: Vehicular Content Delivery Uing WiFi, Proc. of MOBICOM, 8. [6] U. Lee, J. Lee, J. Park, and M. Gerla, FleaNet: A Virtual Market Place on Vehicular Network, IEEE Tran. on Vehicular Technology,. [7] [Online]. Available: [8] [Online]. Available: [9] G. Caella and R. L. Berger, Statitical Inference, nd edition, Duxbury Pre,. [] W. Newey and D. McFadden, Large Saple Etiation and Hypothei Teting, Dan. Handbook of Econoetric, vol. 4, pp. 45, 994. [] W. Bryc, The noral ditribution: characterization with application, Springer-Verlag, 995. [] Google ap tie-in-traffic feature. [Online]. Available: [3] T. Jeke, Floating Car Data fro Sartphone: What Google and Waze Know About You and How Hacker Can Control Traffic, Proc. of the BlackHat Europe, 3. [4] Y. Zhang, M. Roughan, C. Lund, and D. Donoho, An inforation-theoretic approach to traffic atrix etiation, Proc. of SIGCOMM, 3. [5] Y. Zhang, M. Roughan, N. Duffield, and A. Greenberg, Fat accurate coputation of large-cale IP traffic atrice fro link load, Proc. of SIGMETRICS, 3. [6] J. Cao, A. Chen, and T. Bu, A Quai-Likelihood Approach for Accurate Traffic Matrix Etiation in a High Speed Network, Proc. of INFOCOM, 8. [7] T. Li, S. Chen, and Y. Qiao, Origin-Detination Flow Meaureent in High-Speed Network, Proc. of INFOCOM,.