Incentivizing Private Data Sharing in Vehicular Networks: A Game-Theoretic Approach

The concept of data sharing in vehicular networks has been explored in various studies, each proposing unique solutions to address the challenges of privacy, security, and efficiency.

Several studies have proposed different methods to enhance data privacy and security in vehicular networks. Kaiser et al. [17] proposed an Open Vehicle Data Platform that uses Blockchain technology to ensure the privacy of vehicle owners and drivers during the exchange of vehicle and driving data. Kong et al. [18] proposed an efficient and location privacy-preserving sensory data sharing scheme with collision resistance in IoV. Their scheme uses the modified Paillier Cryptosystem to achieve location privacy-preserving multi-dimensional sensory data aggregation. Fan et al. [19] proposed a cloud-based mutual authentication protocol aiming at ensuring efficient privacy preserving in IoV system.

A few studies have proposed incentive mechanisms to encourage data sharing. Zhang and Xu [20] proposed a mechanism that combines certificateless message authentication and blockchain incentives to provide anonymity and non-repudiation for traffic-related message reporters. Yeh et al. [21] proposed a fair and privacy-preserving data query system for vehicle networks based on blockchain technology. Their scheme provides features of sustainable data accessibility and a large amount of data storage and also provides an incentive mechanism to encourage users to share their traffic information.

Game theory, though not extensively prevalent, has found niche applications within the realm of vehicular networks, catering to specific use cases and scenarios. One such application is in the field of data security; Gupta et al. [22] proposed a blockchain-enabled game theory-based authentication mechanism to secure Internet of Vehicles (IoV) settings.

Another application of game theory in vehicular networks is in the area of computation offloading. Liwang et al. [23] developed an opportunistic Vehicle-to-Vehicle (V2V) computation offloading scheme based on game theory. They formulated the computation offloading scheme and pricing strategy as a Stackelberg game, taking into account various factors such as vehicular mobility models, V2V contact durations, computational capabilities, channel conditions, and service costs. Similarly, Hassija et al. [24] used a game theoretic approach to map service providers and consumers for performing offloading services in a cost-optimal way in V2V communication.

In the realm of vehicular networks, the application of game theory has been primarily focused on areas such as data security, computation offloading, and resource allocation. However, our research diverges from these established paths by leveraging the Stackelberg game theory to incentivize private data sharing within the network. While previous studies, such as that of Liwang et al. [23], have also utilized the Stackelberg game, our work uniquely applies it to the challenge of balancing data sharing incentives with privacy preservation. Furthermore, the introduction of monetary incentives in our model represents a novel approach in the field, distinguishing our research from existing literature.

Secure Multi-Party Computation (SMPC) is a protocol that enables distributed parties to jointly compute an arbitrary functionality without revealing their own private inputs and outputs [14]. SMPC has been used for various security applications, including privacy-preserving machine learning with multiple sources [25], private set operations [26], and genome sequence comparison for secure genomic computation [27]. SMPC is commonly constructed with cryptographic schemes such as homomorphic encryption, which is an encryption technique that allows applying computations on the encrypted data without having to decrypt it [28].

In the realm of vehicular networks, Song et al. [29] proposed an anonymous authentication scheme based on SMPC to solve securrity and privacy problems for VANETs. Raja et al. [30] combined blockchain technology with AI to overcome security challenges in IoV, speed up transaction verification, and optimizes energy consumption. The authors of [31] proposed a cooperative control strategy involving SMPC that performs computations while increasing resillience towards latency and adversaries. Gupta et al. [32] have combined SMPC with homomorphic encryption and proposed a scheme that provides real-time location tracking using GPS without divulging the actual location of the user.

Our research builds upon these existing works by proposing the use of SMPC for secure data aggregation between servers within vehicular networks. While previous studies have focused on applications such as anonymous authentication and location tracking, our work introduces a novel application of SMPC for preserving privacy during data aggregation. Therefore, our research not only extends the application of SMPC in vehicular networks but also contributes a unique solution to the challenge of privacy-preserving data aggregation.

The vehicles share private, signed information such as location data to a random receiving server. In exchange, the vehicles are compensated based on the amount of data they transmit. However, the higher the volume of data transmitted, the greater the privacy risk, given that the information sent includes time-stamped location data.

We model the utility of the vehicle by:

where $c_{1}$ is the payment provided to the vehicle, $f_{d}$ is the frequency of data transmission, and $s$ is the number of servers. We assume that all vehicles share data at the same frequency $f_{d}$. $L(f_{d},s)$ is a function that says the privacy loss increases with $f_{d}$ and decreases with $s$. This loss function will be explained in greater detail in Section IV-B.

Because of this trade-off, not every vehicle would be willing to contribute its data to the network; the utility gained would have to exceed the perceived privacy loss of sharing its data for the vehicle to have positive utility and therefore agree to contribute its data.

This will create a supply curve because as $c_{1}$ increases, more vehicles would be willing to provide data for a given $f_{d}$. Let’s model a function $v(c_{1},f_{d},s,V)$ as the number of vehicles that provide data to the network when the vehicles are paid $c_{1}$, each vehicle sends data at a frequency of $f_{d}$, there are $s$ servers, and a maximum of $V$ vehicles registered in the system.

To find $v(c_{1},f_{d},s,V)$, we consider that the privacy sensitivity of each individual owning a vehicle can be modeled by a random variable $e_{i}$, with a given cdf $F_{e_{i}}(\cdot)$. For an individual with sensitivity $e_{i}$, the utility due to privacy is given as:

If $w_{i}>0$, the individual would provide their data. The probability that this happens depends on $e_{i}$. Using eq. 2, we have that for positive $w_{i}$ values, the probability of an individual agreeing to share their data would be:

For our simulations, we use a log-normal distribution for $F_{e_{i}}(\cdot)$. If we have $V$ total vehicles in the system, the expected number of vehicles that would participate in the network would be:

We assume that each server in our network is responsible for collecting and processing the data shared by the vehicles. Each server incurs a cost proportional to the amount of data it processes, in addition to a fixed maintenance or upkeep cost. In our proposed framework, one or more third parties could be in charge of server management. This keeps the data consumer separate from server administration, enhancing user privacy and trust. By distributing control, we make sure no single entity can access all the raw data, reinforcing our dedication to data privacy. The key assumption we make, however, is that the data consumer shoulders the cost for the use of these servers. The total cost incurred per server would be:

where $c_{2}$ and $c_{3}$ are the server computation and upkeep costs respectively.

The data consumer is the entity that provides the payments to the vehicles and servers and receives the final aggregated data. The data consumer’s total utility is therefore modeled as:

Equation 7 represents the utility gained from the vehicles’ data minus the total cost to run the servers and the total payment made to the participating vehicles. This is the profit equation that we will optimize in this paper. The data consumer determines the compensation allocated to the participating vehicles and servers, as well as the total number of servers in the network. Once the data consumer establishes the servers’ payments ($c_{2}$ and $c_{3}$), the optimization process delivers the optimal values for vehicle compensation ($c_{1}$), server count ($s$), and data transmission frequency ($f_{d}$) that maximize the data consumer’s overall utility.

The data consumer’s utility gained from vehicle data can be expressed as $U(v(c_{1},f_{d},s),f_{d})$. It depends on the number of vehicles providing data, which in turn depends on the payment made to each vehicle for providing their data $c_{1}$, the frequency in which these vehicles are sharing their data $f_{d}$, and the total number of servers in the network $s$.

We model the data consumer’s utility in a given area as an increasing function related to the number of vehicles contributing data, with diminishing utility as that number increases:

In eq. 8, $n$ is the number of vehicles contributing data, and $a$ is a variable parameter determining the limit to which the utility function converges. When $a$ increases, this convergence tends towards 1. The specific value of $a$ is less significant as long as it is sufficiently large. If $a$ becomes too small, the function will converge to a lesser value. For our demonstration, we choose $a$ to be equal to 100.

To model this function, we used a dataset containing timestamped coordinates of 2927 taxis in Beijing over a 24-hour time period¹¹1This dataset was obtained from University of Southern California’s Autonomous Networks Research Group (https://anrg.usc.edu/www/downloads/). Since the dataset provides data points for every minute, the $f_{d}$ term will be described in units of samples per minute.

Our objective is to discern the data consumer’s average utility if they had a sub-sample of this dataset. We begin by sectioning the entire dataset into spatio-temporal grids. Within each grid, we use the number of vehicle samples along with eq. 8 to calculate the utility. We then compute the average utility across all grids to determine the average utility of the dataset’s region. We repeat this process with various $V$ and $f_{d}$ values to create a 3D plot as shown in Fig. 2. This plot illustrates how the average utility for the data consumer changes as the number of vehicles and the frequency of data transmission increase. Next, we use the curve fitting function shown in eq. 9 to establish an equation that expresses the utility gained from the vehicles’ data $U(v(c_{1},f_{d},s),f_{d})$.

After curve fitting, our $\alpha$ and $\beta$ constants came out to be 0.99 and 0.45 respectively. We show how sensitive our results are to these parameters in Section V.

The vehicle’s privacy loss function, denoted as $L(f_{d},s)$, depends on the frequency in which the vehicle is sharing its data and the number of servers it is sharing its data to. We provide a model to quantify this loss in terms of how accurately a potential adversary can reconstruct a vehicle’s driving path given a certain number of samples. Given a set of locations on a vehicle’s path, an adversary’s best estimate of the path traversed by the vehicle would be the shortest path routes between each pair of those points. Our measure of privacy would be how different this reconstructed path would be compared to the vehicle’s original path.

Figure 3 presents an example of an original trip represented in blue, along with two sub-trips, shown in green, that contain a subset of the data points from the original trip. It is evident that paths are less similar when fewer data points are available. Consequently, paths with less similarity offer greater privacy to the user.

First, we find how much privacy is lost to one server that receives $f_{d}/s$ samples per minute from a given vehicle. To do this, we measure our privacy metric empirically using our dataset. We sample one trip from the dataset, which will have a $f_{d}$ of one sample per minute, and compare that same trip to subtrips with less frequent samples, ranging from $f_{d}=1/2$ to $f_{d}=1/10$. We use the similarity library within the TensorBay package [33] to determine the path similarity between our initial trip and all subtrips. This library utilizes the Fréchet distance [34] as a measure of comparing two curves. Finally, we repeat this process for all the vehicles in the dataset to find the average similarity scores as the value of $f_{d}$ changes.

Fig 4 shows that when the frequency of data sharing increases, it becomes easier for a potential adversary to reconstruct a user’s path, leading to higher privacy loss. We can also see the curve-fitted equation that gives us the privacy loss as a function of $\frac{f_{d}}{s}$. The loss function takes values from 0 to 1, with 1 being 100% privacy loss. However, the network’s privacy is also influenced by the total number of servers and the frequency of data transmission as well. The total loss equation is therefore:

Equation 10 contains three terms: privacy loss from $\frac{f_{d}}{s}$, $f_{d}$, and $s$. Each term independently influences the overall loss function. The first term represents the privacy loss per server, the second term indicates that the loss function approaches 1 as $f_{d}$ approaches infinity, and the third term confirms that the loss function tends to zero when $s$ approaches infinity. The constants $p$ and $q$ are selected to ensure that both the $f_{d}$ and $s$ variables contribute adequately. Although it would have been possible to set both constants as equal, we opted to weigh the influence of adding another server to the privacy loss more heavily than that of adding another sample per minute, in the context of our optimization. In demonstrating this, we have set $p$ and $q$ at 0.1 and 10 respectively.

The optimization problem for the data consumer involves selecting the optimal values for the number of servers ($s$), frequency of data transmission ($f_{d}$), and the payment provided to the vehicle ($c_{1}$) in order to maximize the total profit, as expressed in eq. 7. Each of these three parameters is crucial to optimize, as they each involve specific trade-offs. Increasing the number of servers enhances overall privacy but also raises the network’s operating costs. A higher $f_{d}$ yields greater utility for the data consumer, but may deter vehicles from sharing their data due to privacy concerns. Lastly, raising $c_{1}$ could attract more vehicles to participate in the network, thus increasing utility, but this also incurs higher costs for the data consumer.

To optimize eq. 7, we must first choose acceptable values for the server computation cost ($c_{2}$), the server upkeep cost ($c_{3}$), the total number of vehicles $V$, and the mean and variance of our log-normal distribution function. We set the number of total vehicles to be 2928, which is the number of independent vehicles in our dataset. We use a mean of 0 and standard deviation of 0.5 for our log-normal distribution to have a positive-shaped bell curve.

The following set of equations guides our choices for $c_{2}$ and $c_{3}$. As depicted in eq. 11a, $c_{3}$ should be on the order of the payment distributed to each vehicle per server. Equation 11b emphasizes that $c_{3}$ must stay below the computational expense the server bears for each vehicle that shares data. Lastly, eq. 11c suggests that $c_{2}$ should be less than the reciprocal of the total number of vehicles in the network. It is important for our chosen values to comply with these equations, as the relative values of the parameters are more significant than their absolute values. For this reason, we choose 1e-6 and 1e-4 for $c_{2}$ and $c_{3}$ respectively and perform sensitivity analysis on these constants in the subsequent subsection.

We used the scipy.optimize package [35] to solve our optimization problem. We observe from Table I that the optimized values are 3.57e-6 paid to the vehicle, 7.31 samples per minute shared to the servers by the vehicles, and 15.12 total servers.

In this section, we discuss the sensitivity analysis performed to determine the effects of varying specific constants on our optimization results. The variables analyzed include the server computation cost ($c_{2}$), server upkeep cost ($c_{3}$), total number of vehicles ($V$), standard deviation of individuals’ privacy sensitivity, and the constant $\beta$ found in eq. 9. We’re particularly interested in how these changes influence the three optimized parameters: the vehicle payment ($c_{1}$), frequency of data transmission ($f_{d}$), and the number of servers ($s$).

Altering the total number of vehicles ($V$) does not considerably affect $c_{1}$, $f_{d}$, or $s$. However, it impacts the number of vehicles participating in the network, as these are a subset of the total vehicles. Therefore, an increase in the total number of vehicles leads to more vehicles participating in the network.

When we increase the standard deviation of individuals’ privacy sensitivity, we observe a slight increase in the number of servers required, a slight increase in the frequency of data sharing, and a decrease in the vehicle payment. This result aligns with the understanding that a larger variability in privacy sensitivity necessitates more servers and reduced data sharing frequency to enhance privacy. Consequently, the vehicles demand less payment due to the lowered privacy risk posed by the network.

Figure 5 illustrates the sensitivity of our results when parameters $c2$, $c3$, and $\beta$ are adjusted. This figure shows that the various parameters are largely robust to values of $c_{2}$, $c_{3}$, and $\beta$, with the exception of particular values that show sharp changes that could be attributed to numerical instability of the non-linear optimization. However, even where these sharp changes occur, we observe that $f_{d}$ and $s$ exhibit the same trends, increasing and decreasing in unison. Conversely, $c1$ behaves differently, showing a sharp increase whenever $f_{d}$ and $s$ experience drops. This particular surge is in line with expectations since the model needs to be balanced due to sudden drops in $f_{d}$ and $s$. The key insight from these graphs is that the absolute values of these parameters are less significant than their values in relation to the other parameters.