Anonymizing Web Services Through a Club Mechanism With Economic Incentives

1. Anonymizing Web Services Through a Club Mechanism With Economic Incentives Mamata Jenamani Leszek Lilien Bharat Bhargava Department of Computer Sciences and Center for Education and Research in Information Assurance and Security (CERIAS) Purdue University, West Lafayette, Indiana

2. Motivation • Preserving privacy during Web transactions - a major concern • Failure of most commercial services in providing such services • Besides technical, many economic and social factors contribute to the failures • Anonymizing Web services – a solution for preserving privacy on the Web • Game theory – for economic analysis

3. Proposed Club Mechanism • Anonymity through group co-operation – An anonymity club • A trustworthy central authority • Randomly matching any two club members • Can resolve conflict among club members • Each member tries to maximize her profit • Cheating – most rational alternative in each single transaction • Cooperating – most rational alternative in repeated sequential transactions

4. Rules for the Sequential Strategy • Becoming a club member by paying a one time initiation fee F to the central authority • Two members partner for an anonymizing Web transaction during the time periodt • Two members receive a benefit Pteach by maintaining anonymity and using each other’s service • Two strategies: cooperate or defect • If Alice feels that Bob cheats her, she reports it to the central authority - Pclaim the loss suffered by the complainant • The central authority investigates the fraud If fraud is confirmed, Bob pays a fine f and Pclaim, Alice gets compensation Pclaim and the central authority gets fine f. Otherwise, Alice is charged with a false complaint and pays fine g to the central authority. • The culprit who does not pay a fine or a compensation is expelled from the club.

5. Assumptions Both partners have symmetric privacy needs They have equal number of requests for anonymizing Benefit from privacy protection is higher than the benefits received by sacrificing the partner’s privacy (i.e. Pt > lt) At each stage each agent has two choices: either to defect (D) or to cooperate (C). The only Nash equilibrium for both players in this game is to defect Prisoner’s Dilemma Played at Each Stage

6. PD Played at Each Stage – cont. Payoff structure of the Prisoner’s Dilemma game • Pt be the benefit from privacyprotection received by an agent within time period t • ‑Ptas the cost of privacy violation if it is suffered by an agent during that period • Pt’s are independently identically distributed random variables with a common distribution P • Pmaxa value beyond which distribution P has no positive probability density, • E(P) is the expectation of P • lt be the benefitfromdisclosing the privacy of another agent • a similar assumption for the random variable lt • lmax as an estimate of the maximum possible benefit received by a defecting agent

7. An Agent’s Time-Weighted Average Payoff • Discount factor , • For interest rate i, • Time weighted average payoff • Payoff stream for time period t • Total (Lifetime) Payoff • using the relationship: • and the formula for geometric series • we get: • Maximizing time weighted average payoff is equivalent to maximizing total payoff • Incentive for cooperation in a time period even though defection is a dominant strategy at each stage

8. Analysis of the Economic Incentives • Conditions such as paying initiation fee and fine occur at time period t0 • The total payoff starting from period t0 is: • The total payoff starting from period t1 is: • Exploring conditions under which the proposed sequential strategy motivates the agents to cooperate

9. Proposition 1 An agent will join the proposed anonymizing club, if the initiation fee (given at time period t0) is less than the difference between his total future payoff from this service (starting from time period t1) and the maximum future payoff from adopting any other privacy preserving technology, i.e. if the following inequality is satisfied: where is the maximum of all expected payoffs from any other privacy-preserving technology available at that time period. Proof

10. Proposition 2 An agent will cooperate at every stage in the sequential repeated game, if the maximum value of the benefit from the cheating behavior is less than the total future payoff (from t0) minus the maximum payoff achievable in the current transaction, i.e. if the following condition is satisfied: Proof

11. Proposition 3 A defector who is proven guilty is willing to pay the fine, if it is lower than the difference between his total future payoff (starting from t1) and the compensation claimed by his partner, i.e. if the following condition is satisfied: Proof

12. Proposition 4 If a player’s complaint is proven false, he is willing to pay the fine imposed on him, if it is lower than his total future payoff (starting from t1), i.e. if the following condition is satisfied: Proof

13. Theorem The proposed sequential strategy is an equilibrium strategy if the fine is imposed following conditions in Propositions 3 and 4, i.e., if: and The average payoff for an agent in this strategy is: Proof

14. Future Work • Consideration of agent’s belief in the fairness of the central authority • Consideration of the fixed costs associated with starting the service • Defining the minimum number of participants starting a club • Considering the cost involved in running the matching algorithm - another variable cost, such as annual club membership • The probabilistic modeling of cheating behavior of individual agents • Consideration of unequal privacy concerns of individual agents • Consideration of unequal number of anonymizing transactions

15. Proof of Proposition 1 Back

16. Proof of Proposition 2 Back

17. Proof of Proposition 3 Back

18. Proof of Proposition 4 Back

19. Proof of the Theorem Back