Readjusting the privacy goals in Vehicular Ad-Hoc Networks: A safety-preserving solution using non-overlapping time-slotted pseudonym pools

Current proposals for privacy measures in vehicular networking commonly suffer from either of three limitations: Many are so drastic that they compromise road traffic safety, a primary goal of vehicular networks. Others are more compliant, but (despite adding substantial overhead) are ineffective at protecting users' privacy against state-of-the-art attackers. The last group suffers from neither limitation, but undermine accountability and are thus in conflict with the requirements of future vehicular networks. As a consequence, workable privacy protection is often thought unattainable and privacy protection simply disregarded in the many field experiments, proposals, and standardization documents to date. In this work, we start fresh with a readjusted view on privacy goals and the capacities of a state-of-the-art attacker in mind, taking a structured approach to deriving a holistic solution for location privacy protection in Vehicular Ad-Hoc Networks (VANETs): We show that local privacy protection cannot be attained without compromising road traffic safety - nor does it have to be. Our approach is based on synchronized time-slotted pseudonym pools and the local announcing of pseudonym changes. By this, we overcome the privacy-safety problem while at the same time increasing privacy for all users. Our system is fully compatible with the requirements of vehicular networks and current standardization efforts.