Morality-driven Data Forwarding with Privacy Preservation in Mobile Social Networks

Transcription

1 Morality-driven Data Forwarding with Privay Preservation in Mobile Soial Networks Xiaohui Liang, Student Member, IEEE, Xu Li, Tom. Luan, Rongxing Lu, Member, IEEE, Xiaodong Lin, Member, IEEE, and Xuemin (Sherman) Shen, Fellow, IEEE Department of Eletrial and Computer Engineering, University of Waterloo, Canada INRIA Lille - Nord Europe, Frane Faulty of Business and Information Tehnology, University of Ontario Institute of Tehnology, Canada {x27liang, hluan, rxlu, xshen}@bbr.uwaterloo.a; xu.li@inria.fr; xiaodong.lin@uoit.a Abstrat Effetive data forwarding is ritial for most mobile soial network appliations, suh as ontent distribution and information searhing. owever, it ould be severely interrupted or even disabled when privay preservation of users is applied, beause that users beome unreognizable to eah other and the soial ties and interations are no longer traeable to failitate ooperative data forwarding. Therefore, how to enable effiient user ooperation in mobile soial networks (MSNs) without intruding user privay is a hallenging issue. In this paper, we address this issue by introduing the soial morality a fundamental soial feature of human soiety to MSNs, and aordingly design a threestep protool suite to ahieve both privay preservation and ooperative data forwarding. Firstly, the developed protool adopts a novel privay-preserving route-based authentiation sheme whih notifies a user s anonymized mobility information to the publi. Seondly, it measures the proximity of the user s mobility information to a speifi paket s destination and evaluates the user s forwarding apaity for the paket. Thirdly, using a game theoretial approah, it determines the optimal data forwarding strategy aording to users morality level and payoff. Using analysis and examples, we show that the developed protool suite an effetively protet user personal information suh as identity and visited loations. Lastly, we ondut extensive trae-based simulations and show that the proposed protool suite is effetive to explore the user ooperation effiiently and attain near-optimal performane in data forwarding. Index Terms Mobile soial networks, data forwarding, privay preservation, soial theory, game theory I. INTRODUCTION MOBILE soial networks (MSNs) are emerging soial networking platforms over whih partiipants are able to ommuniate with eah other using Bluetooth or P2P WiFi enabled wireless handheld devies [] [5]. With MSNs, proximity servies an be supported to strengthen the soial interations of geographially-lose users. For example, by probing others in proximity through bluetooth ommuniation, PeopleNet [6] enables the human-like information searh among mobile phones. [7] failitates the arpool and ride sharing in proximity based on message relay among mobile soial users. A miro-blog system [8] is built on MSNs to enable users to loally reord multimedia blogs on-the-fly, enrihed with inputs from other physial sensors. In general, MSNs rely on the opportunisti ontats among users for ooperative data forwarding, and they are alternatively known as Poket Swithed Networks (PSNs). Unlike onventional wireless relay networks assuming enddevie to be insensate, MSNs onsider mobile devies to be pertained with human users and have speifi soial features. As suh, MSN appliations plae great emphasis on user soial behavior suh as selfishness and soial proximity, and explore the soial features of devies for effiient data forwarding protool design. In MSNs, allowing the exhange of personal information to some extent is inevitable to enable soial-related ooperative ommuniations. This, however, should be stritly ontrolled at the prerequisite of effetive user privay preservation. Of all the user privay requirements, the identity privay and loation privay [9] are of paramount importane. Speifially, Identity privay ditates that the identities of users as soure, relay or destination in ooperative data forwarding are not dislosed. Loation privay implies that a user s future mobility route annot be predited or inferred from its urrent and past route information. In other words, the exposed loation information of a user should not be linkable to its future loation. The state-of-the-art privay-preserving tehniques in MSNs inlude a multiple-pseudonym tehnique [], [] and a hotspot tehnique [2]. The former assigns eah user with a set of asymmetri key pairs, and uses the alternatively hanging publi keys as the user s pseudonyms for data ommuniation. The user identity an be proteted as only literally-meaningless pseudonyms are exposed to the publi. By frequently hanging its pseudonym for authentiation over time, the user ahieves loation privay due to the unlinkability of old and new pseudonyms. As a result, the multiple-pseudonym tehnique an guarantee both identity privay and loation privay by making the soial interations of users anonymous. The hotspot tehnique guarantees the reeiver loation privay while ahieving effiient data forwarding. Speifially, it defines some hotspots that are ommon and with high population, and then makes use of these hotspot information to assist the data forwarding without revealing sensitive loations of reeivers. In this paper, we address a fundamental tradeoff between the privay preservation and the data forwarding effiieny in MSNs. Speifially, with the multiple pseudonym tehnique applied for privay preservation, an unpleasant a- Copyright () 2 IEEE. Personal use is permitted. For any other purposes, permission

2 ompanying side-effet is that users are unable to identify their soial friends beause of the anonymity of users. This diretly impedes the ooperative data forwarding as soial ties among users are interrupted. Sine users are anonymous, the maliious behaviors (e.g., selfish and freeriding) an no longer be traked and punished on time using traditional mehanisms. This may disourage user ooperations and deteriorate the data forwarding effiieny. Therefore, privay preservation protets and hides the identities of users to the publi, whih, however, hinders the soial-based ooperative data forwarding. Our goal is to resolve the two onfliting goals in one framework by proposing a privay preserving soial-based ooperative data forwarding protool. We exploit the soial morality for ooperative data forwarding design. Speifially, the morality of human beings is a ommon soial phenomenon in real-world whih provides the rules for people to at upon and grounds the moral imperatives. It is the fundament of a ooperative and mutually benefiial soial life in the real-world soiety. Our main ontributions are three-fold: First, we identify the onfliting nature between privay preservation and ooperative data forwarding in MSNs. On addressing this issue, we are the first to leverage soial morality to inentivize the user ooperation and aordingly promote the ommuniation effiieny. Seond, we propose a three-step protool suite to attain the privay-preserving data forwarding. Firstly, we introdue a privay-preserving route-based authentiation sheme. It enables users to expose the mobility information to eah other for ooperation, yet with loation privay preserving. Based on the mobility of users, we evaluate the forwarding apability of individual users on a given paket. Lastly, a game-theoreti approah taking aount of both the morality and forwarding apability is designed to adaptively determine the optimal data forwarding strategy for individual users. The final optimal solution of the protool suite stands for a balane of moral peae and benefit maximization for all users. Third, we evaluate the performane of the proposed protools through extensive trae-based simulations. Our simulations validate the effiieny of the proposed data forwarding protool with loation privay preservation. The remainder of this paper is organized as follows: we introdue some related works in Setion II. We desribe the system model and provide an overview of the threestep protool suite in Setion III. We present a privaypreserving route-based authentiation sheme and proximity measurement as the first two steps in Setion IV, and use game-theoreti analysis to derive the optimal forwarding strategies for users as the third step in Setion V. We ondut trae-based simulations to evaluate the performane of the proposed protool in Setion VI. Finally, we draw our onlusion in Setion VII, respetively. Assume users are rational and selfish to maximize their own utility. II. RELATED WORK A. Data Forwarding Protool Data forwarding protools have been extensively investigated in delay-tolerant networks. Due to the sparse and dynami nature of delay-tolerant networks, user-to-user data forwarding often relies on the mobility and random ontats of users. For example, Lindgren et al. [3] evaluated the forwarding apability of a user by the histori ontat information. Under the similar framework, [4] [8] used soial metris alulated from the ontat information to evaluate the forwarding apability of a user. ui et al. [6] demonstrated that ommunity and entrality soial metris an be effetively used in data forwarding protool. Li et al. [7] introdued the soial-selfish effet into user behavior, i.e., a user gives preferene to pakets reeived from other users with stronger soial relations. Yuan et al. [8] proposed a data forwarding protool enabling two users to share their historial mobility information. Based on the opponent s past mobility information, a user is able to predit the future loation that the opponent will visit. Though signifiantly improving the data forwarding effetiveness, most ontat-based data forwarding protools require a ontat alulation phase in whih eah user must have a unique identity and reveal it to others. In this phase, user behaviors are very easy to be linked together and user s identity privay and loation privay are ompletely ompromised. In the ontat-based data forwarding protool, a sender must exhange the ontat and unique identity with a relay user. In [3], [4], [7], to improve the forwarding effetiveness, a sender an evaluate the forwarding apability of a relay user based on both the relay user s ontat probability and forwarding willingness. owever, the required ontat probability and unique identity information are privay-sensitive to the relay user and not available in a privay-preserving environment. The onventional ontat-based data forwarding protools do not provide effetive privay preservation and an hardly be aepted by the privay-aware mobile users. In this paper, we aim to solve the privay preservation and seurity issues of ooperative data forwarding in MSNs. Reently a rih body of literature [9] [24] addressed the ooperation stimulation issue from a game-theoreti perspetive. Yu and Liu [9] proposed a game-based approah to stimulate ooperation in mobile ad ho networks, where two partiipating users set a threshold on the number of forwarded pakets in eah forwarding round and they alternatively forward eah other s pakets. The setting of the threshold an stimulate ooperation and also limit the possible damage aused by the opponent s defetion. If the opponent defets, a user immediately terminates the interation and his maximum damage is bounded by the threshold setting in the previous round. Li and Shen [24] proposed an integrated system over an individual reputation system and a prie-based system whih demonstrates a superiority in terms of the effetiveness of ooperation inentives and selfish node detetion. owever, their works do not address user privay and are not appliable in the Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 2permission

3 privay-sensitive MSNs. B. Privay-preserving and Soial Perspetive The studies in MSNs mainly fous on exploring the human fators and behaviors for ommuniations in a distributed and autonomous environment. Privay preservation as a fundamental user requirement is however negleted in previous researh. Reent proposals [25] indiated that one or few snapshots of a user s loation over time might assist an adversary to identify the user s trae, and an effetive attak was presented to identify vitims with high probability. As a defense tehnique, the multiple-pseudonym tehnique providing both identity and loation privay is widely applied in literatures [9], [], [26]. Freudiger et al. [] developed a user-entri loation privay model to measure the evolution of loation privay over time, and they derive the equilibrium strategies on hanging pseudonyms for eah user from the game-theoreti perspetive. With the multiple-pseudonym tehnique applied, onventional ooperation stimulation mehanisms without privay preservation [9], [27] [29] are no longer appliable in the onsidered environment. This work is inspired by the extensive literature in soial theory related to human behaviors and their subjetive morality. From soial perspetive, Keterlaar and Au [3] introdued an affet-as-information model to investigate how the past human behaviors influene on the future behaviors of human aording to the internalized human rationalities. Based on this result, we develop the guilty model for ooperation stimulation in MSNs. In addition, some soial-related works exploited a soial graph of human to improve the protool effiieny. For example, Li et al. [7] observed that if two users have a soial relation in a soial graph, they have more ontats than those who do not have a relation. Based on this observation, they demonstrated that introduing a soial graph into the routing protool results in a better network performane. owever, the onstrution of suh a soial graph requires users to be fully ooperative without privay onerns whih is not feasible in MSNs. Other soial-related works [3] [32] onsidered the soial relations inluding not only inter-user relations in a soial graph but also the relations between users and established soial organizations. Following this idea, we introdued a soiality strength for eah user to model their ooperation behavior influened by the soial fator. Fig.. Offie building road Residential blok Supermarket road A mobile soial network road road Supermarket road Offie building road road Residential blok (TA) is available at the initialization phase for generating pseudonyms and seret keys for MSN users, but it will not be involved in the data forwarding. Users ontinuously hange their pseudonyms to preserve their identity and loation privay. The pseudonym hange breaks any relation previously established between two users and as a result they an no longer reognize eah other. A. User-to-Spot Data Forwarding We assume that there exists a set A = {a,, a l } of soial hotspots in the network. They are loated in regions suh as supermarkets, restaurants, offie buildings and residential bloks with high population density as shown in Fig.. Different users have different sets of favored hotspots that they frequently visit. The hotspots that a user visited in the past indiate the personal preferene of the user and thus may relate to the user s future loations [8]. In addition, the hotspots an be ategorized into sensitive hotspots, e.g., offie buildings, residential bloks, and nonsensitive hotspots, e.g., supermarkets, restaurants. Sensitive hotspots are tightly related to users private lives. The aess to sensitive hotspots needs to be proteted aording to users privay needs. In this work, we apply the hotspot tehnique [2] to preserve reeiver loation privay. We propose a user-to-spot data forwarding protool to ahieve privay preservation and user ooperative data forwarding. Speifially, eah hotspot is equipped with a non-ompromised and ommuniable storage devie whih buffers the pakets for reeivers to feth. A data sender/forwarder leaves pakets at seleted hotspots, and reeivers an feth the pakets upon their later aess to the same hotspots. Compared with the ontat-based III. SYSTEM MODEL We onsider a homogenous MSN omposed of a set V of mobile users with the network size V = N. Users follow the same behavior model: they are selfish, tending to maximize their individual utilities during data forwarding, and do not perform irrational attaks. A speifi utility funtion will be given in Setion IV. Users have equal ommuniation range, denoted by R t. The ommuniation between any two users i and j, i, j V, is bidiretional, i.e., user i an ommuniate to user j if and only if user j an also ommuniate to user i. A trusted authority Fig. 2. protool j t3 Relay user t 7 t8 t 4 otspot 2 otspot t t 2 i Reeiver Time axis t 5 t 6 t t 2 t 3 t 4 t 5 t 6 t 7 t 8 An illustration of effetive data forwarding by the proposed j i Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 3permission

4 data forwarding protools where users swap data upon their ontats, the user-to-spot data forwarding protool would have more suessful deliveries in speial ases as shown in Fig. 2. In this figure, relay user j has no ontat with reeiver i but they enter the ommon hotspots during different time periods. By making use of this property, the user-to-spot data forwarding protool enables j to deliver the paket to i. This user-to-spot data forwarding protool is pratial due to the following fats: Soial users often have speifi preferenes on ommon soial hotspots, suh as supermarkets, offie buildings, et. They are likely to hoose part of these hotspots and visit them frequently. In the MSN, data sender often has ertain soial relationship with reeiver. The sender is likely to be partially aware of the soial behaviors and frequentlyvisited hotspots of the reeiver. otspot buffers are low-ost and an be pervasively available data storage resoures [33]. They are not interonneted and will not be involved in ooperative data forwarding. They at as stati reeivers to temporarily store user data and allow authorized wireless aess of the data when users ome into their wireless ommuniation range. In this work, the identity of the reeiver is impliitly ontained (thus proteted) in the paket, and the reeiver an feth the paket from the hotspot buffer after a simple authentiation operation, e.g., using the sheme in [2]. B. Model of Soial Morality Soial theory [34] indiates that in a fully autonomous system users behave independently based on the rational alulation of expedieny. The deision on how to at in soial interations is viewed as either primarily eonomi and motivated by self-interest, or non-eonomi and motivated by olletive interest and moral obligation. Different norms govern users behavior in eonomi and non-eonomi spheres of ativity, and appropriate behavior varies aording to the ontext and the nature of the goods being exhanged. These norms are not just learned, but are inorporated by soial users into their personalities. In reality, if users violate a deeply internalized norm, they would feel guilty to ertain extent regardless of whether or not anyone else knew of their ations, and would likely punish themselves in some manner. This is known as soial morality. Soial study [3] also indiates that individuals who experiene feeling of guilt (ompared to individuals who feel no guilt) after pursuing a non-ooperative strategy in the first round of play, display higher levels of ooperation in the subsequent round of play. Experimental results demonstrate that non-ooperative individuals who experiene a ertain level of guilt in a soial bargaining game may use this feeling state as information about the future osts of pursuing a non-ooperative strategy. Their findings that the guilt manipulation interated with soial motives (e.g., guilt tended to have its intense effet on non-ooperative individuals) also suggest that these results do not our merely beause of pre-existing individual differenes in the tendeny to ooperate or defet. Instead, it would appear that guilt atually provokes non-ooperative individuals to depart from their typial strategy of nonooperative behavior. Observing the unique soial features in the MSN, we exploit the morality fator of the MSN by mimiking the morality-entri human soiety. We emphasize that the morality fator should be ounted into the alulation of users utility. To this end, we instantiate two forms of soial morality, i.e., guilt and high-mindedness, in the ontext of MSN-based data forwarding where ooperation is highly desirable: users feel guilty when they defet (i.e., refuse to forward a paket), and they feel high-minded when hoosing to ooperate (i.e., help to forward a paket). Guilt reates a feeling of indebtedness, whih direts them to ooperate, while high-mindedness alleviates the guilty feeling of users. A self-regulated morality fator g, internalized for eah user that quantitatively depits the internal moral fore, is based on two elements: Morality state x: The morality state reflets the behavior history of a user. It inreases by one level for a single ooperation behavior and dereases by one level due to a single defetion ondut. Soiality strength st: The soiality strength st is related to a user s personal experiene, suh as eduation and habitation. It is stabilized and less independent with short-term behavior hanges. If the soiality strength of a user is signifiant, the user feels a orrespondingly signifiant inrement of guilt towards a single defetion behavior and a orrespondingly signifiant inrement of high-mindedness towards a single ooperation behavior. Eah user i has a soiality strength denoted by st i, and a varying morality state x i. Following soial theory [3], [32], we depit the morality state x i by a Markov hain model with the state spae and non-null transitions shown in Fig. 3. Let P i (j, j + ) and P i (j, j ) denote the transition probabilities from the j-th state to the (j + )- th and the (j )-th states, respetively. The state j = is the initial neutral state (neither guilty nor high-minded). The states with a positive index are high-minded states, and those with a negative index are guilty states. Being in a high-minded state implies frequent ooperation behavior in the past; being in a guilty state indiates overwhelming defetion ondut in the past. The morality fator g i of user i is evaluated by a funtion f(x i, st i ) that inreases as x i dereases or st i inreases. Later, in Setion VI when we present our performane evaluation, we will define a speifi f(). C. Overview of the Proposed Protool With the user-to-spot data forwarding protool deployed, in the following setions, we onentrate on how to forward Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 4permission

5 ooperate ooperate ooperate ooperate... -k k... defet defet defet defet a 5 a 7 a 8 Fig. 3. Markov hain model for morality state pakets to the hotspots for effetive and effiient data forwarding with privay preservation. This delivery is enabled in three steps: ) privay-preserving route-based authentiation, 2) proximity measurement, 3) morality-driven data forwarding. In the first step, the privay-preserving route-based authentiation enables two enountered users to exhange partial route information. The route information an be onstruted in a privay-preserving struture determined by users themselves. The use of an authentiation sheme is to resist user manipulation attaks, i.e., users have to honestly tell about their hotspots. In the seond step, eah user measures a proximity sore between the destination and the route information provided by the relay user. The proximity sore reflets the forwarding apability of a relay node with respet to a speifi destination. The larger a proximity sore is, the more effetive a relay s forwarding is. In addition, the proximity sore also affets the morality fator of the relay node. The rationale is that a user would feel more guilty if he/she demonstrates more apability to deliver a paket (with a large proximity sore), and yet, drops the paket. In the third step, the morality fator is inorporated into the utility alulation of a data forwarding game in whih users at selfishly and preserve their privay. We elaborate these three steps in the subsequent setions. Note that, we do not onsider irrational attaks in this paper. Users tend to be rational and selfish to maximize their own utility. IV. AUTENTICATION AND PROXIMITY MEASUREMENT In this setion, we desribe the first two steps of the proposed protool, i.e., privay-preserving route-based authentiation and proximity measurement. The first step relies on a novel tree struture that provides limited user route information to the publi to boost the data forwarding effiieny. The seond step alulates the shortest distane between a destination and a hotspot that will be visited by a user. The distane implies the forwarding apability when this user attempts to forward pakets to the destination. A. Privay-Preserving Route-Based Authentiation We first show how to onstrut a privay-preserving routing tree whih desribes the route of user i between hotspots. At an initial stage, the TA assoiates user i to a subset of hotspots A i = {a y y = (2, 3, 6, 7)} A, whih represents the hotspots frequently visited by user i. We onsider that user i is loated at hotspot a and moving towards a 8, as shown in Fig. 4. Suppose that user i moves along the route a a 2 a 3 a 6 a 7 a 8. Users Fig. 4. Fig. 5. a 2 a 3 a 4 a Geographial view of user i s route 3 a 2 2 a 3 a 4 a 5 a 6 a 7 Tree struture of user i s route neighboring i have already known i s urrent loation a. But i has no intention to reveal a 8 to them for privay reason. In addition, it is unwilling to authentiate the entire hotspot set {a y y = (2, 3, 6, 7)}, whih ontains privaysensitive hotspots {a 3, a 6, a 7 }. Then i reates a tree for its mobility route T i as a 2 AND (a 3 OR a 4 ) AND (2 of (a 5, a 6, a 7 )) and only authentiates this tree to others. The authentiation reveals the following fuzzy information instead of the preise route: user i will visit a 2, one of (a 3, a 4 ), and at least two hotspots from (a 5, a 6, a 7 ). We present the routing tree struture T as shown in Fig. 5, where eah non-leaf node represents a threshold gate and eah leaf node represents a hotspot in A u. We use A T = {a z, a z2,, a zτ } A u to denote the hotspot set orresponding to all leaf nodes in T. Note that, if we assign or to the hotspots (a z, a z2,, a zτ ) of leaf nodes in T, T will be transformed into a Boolean funtion F (a z, a z2,, a zτ ). For example, in Fig. 5, F (a, a 2,, a 7 ) = a 2 (a 3 + a 4 )(a 5 a 6 + a 5 a 7 + a 6 a 7 ). We say that a hotspot set A i satisfies both T and funtion F (a z, a z2,, a zτ ) if and only if F (a z, a z2,, a zτ ) =, where for eah a y, y {z, z 2,, z τ }, {, if ay A a y = i,, if a y / A i. The routing tree preserves user privay by making sensitive hotspots anonymous, and at the same time it provides ertain information of the mobility route that an be used to evaluate the user s forwarding apability. We are now ready to present our privay-preserving route-based authentiation sheme whih supports a single threshold gate (maximum threshold value d) for a routing tree. A multiple-threshold tree an be semantially onverted to multiple singlethreshold trees. The proposed sheme is built on the bilinear pairing tehnique [35], [36]. INITIALIZATION: Let G and G T be two finite yli groups of the same large order n, where n = pq is a a 6 Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 5permission

6 produt of two large primes p and q. Suppose G and G T are equipped with a pairing, i.e., a non-degenerated and effiiently omputable bilinear map e : G G G T suh that i) g, h G, a, b Z n, e(g a, h b ) = e(g, h) ab ; and ii) g G, e(g, g) has order n in G T. TA hooses a redundant hotspot set A r = {a l+, a l+d }, two generators (g, u) of G, a generator h of G q (G q is a subgroup of G with order q), a seure ryptographi hash funtion : {, } Z n, and random number δ Z n. For all y l + d, TA hooses random numbers t y Z n and omputes T y = g ty. TA also omputes = e(g, u) δ. With these settings, TA keeps the master key (δ, (t y ) y l+d ) seretly, and publishes the publi parameter pub = (n, g, u, h, G, G T, e,,, T y ( y l + d ), A A r ). USER REGISTRATION: TA hooses a unique random number t Z n and a random polynomial q(x) = κ d x d + κ d 2 x d κ x + δ, and generates E i = k d, (d y ) ay A i A r, where k d = t and d y = u q(y) t+ty. It informs the registering user i about the seret key E i. Let users i and j denote the signer and verifier respetively. Denote user i s routing tree (with a single threshold) by T i. Let k be the threshold value of the root of T i and Θ i a hotspot set orresponding to T i s leaf nodes. Φ i A i Θ i is a hotspot set of size k. SIGNING BY USER i: User i first hooses a subset A r A r ( A r = d k). Let A r be {a l+,, a l+d k }. Then, for eah hotspot a y Ψ = Φ i A r, user i omputes the Lagrange oeffiient ω y = w a w Ψ,w y w y w. It randomly selets r t, r p, r y Z n for a y Θ i A r and omputes S y for a y Θ i A r as { d ω y y h r y, if a y Ψ S y = () h ry, if a y Θ i \ Φ i It outputs the signature σ i = T i, S t, S p, (S y ) ay Θ i A r, π, π 2, where S t = g kd h r t k, S p = g d +(pid i) h r p, π = S r t p (g (pidi) g k d ) r p, and π 2 = (d ω y) r t (S t T y ) r y. a y Ψ y a y Θ i A r VERIFICATION BY USER j: User j reeives σ i and heks e(s t g (pidi), S p ) =? e(g, g) e(h, π ) e(s y, S t T y ) =? e(h, π 2 ), a y Θ i A r If the above equations hold, user j onfirms that user i has pseudonym pid i and a hotspot set satisfying T i. The orretness of the verifiation is from the following mathematial manipulation: e(s t g (pidi), S p ) = e(g t h rt g (pidi) t+(pid, g i) h r p ) t+(pid =e(g, g) e(h, (g i) h r p ) rt (g t g (pidi) ) r p ) =e(g, g) e(h, S r t p (g (pid i) g t ) r p ) = e(g, g) e(h, π ) a y Θ i A r = a y Ψ = a y Ψ =e(g, u) δ e(s y, S tt y) e(d ω y y, S t T y ) a y Θ i A r ωy q(y) k e(u d +ty, g k d h r t g t y ) a y Ψ = e(h, a y Ψ r t ωy q(y) e(u k d +ty, h) (d ω y y ) r t a y Θ i A r e(h ry, S t T y ) a y Θ i A r a y Θ i A r e(h r y, S t T y ) e(h r y, S t T y ) (S tt y) ry ) = e(h, π 2) Privay disussion: For user privay preservation, the route-based authentiation sheme mixes the hotspot a y Ψ that user i has with the hotspot a y / Ψ that user i does not have from the equation () by multiplying a subgroup element h. This ahieves full-anonymity, i.e., any other user annot trae the hotspots whih are used to generate the signature, beause the element h annot be distinguished from either G p or G q without p or q known as a priori. The theoretial proof an be found in [35], [36]. Consider that an adversarial user may use the authentiated route information to identify the signer s trae. Without preaution, suh misbehavior may violate loation privay. An effetive defense mehanism against this privay violation is to let eah user hange the routing tree strutures of their route information as frequently as the hange of their pseudonyms, and also inlude redundant hotspots into their routing tree. As a result, different users may generate the same routing tree, and the signature annot be used to link the past/future loations and behaviors of any speifi user. B. Proximity Measurement In this setion, we develop a novel proximity measurement for implementing the user-to-spot data forwarding protool. Consider a paket originated from user j and destined to D j, whih is a hotspot that its intended reeiver frequently visits. When j meets a user i, it omputes a forwarding sore e j,i. This sore implies i s forwarding apability of bringing the paket to D j. It is subjet to multiple fators suh as the time-to-live period of the paket, the probability that i drops the paket due to limited storage buffer, how lose that i an be to D j, when the losest distane will our, and so on. owever, the more fators used, the more personal information revealed, and the less privay preserved. To avoid any additional privay leakage, we define that e j,i = ψ(r j,i ), where r j,i is the smallest distane between D j and the hotspots that i will visit and ψ() is a monotonially dereasing funtion of r j,i. The smaller r j,i, the more losely i an deliver the paket to D j, the larger e j,i by this definition. A partiular ase is shown in Fig. 6. Even if user h appears to move away from D j, its forwarding, when used, will still be effetive sine it is going to enounter user i who will visit D j afterwards. Given that no global knowledge is available and any user an be an effetive forwarder, ψ() always returns a positive value. Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 6permission

7 i ontat i h h ontat j Destination Fig. 6. A user moving towards opposite diretion of the destination an still provide effetive forwarding Algorithm Smallest radius alulation by user j : Input: T i and D j. 2: Transform T i to F i (a z, a z2,, a zτ ). 3: Calulate F i (a z, a z2,, a zτ ) = F i (a z, a z2,, a zτ ). 4: Calulate D s = {d z, d z2,, d zi }, where d y is the distane between D j and a y for y {z, z 2,, z τ }. 5: Sort D s in an asending order {d z, d z 2,, d z τ } orresponding to spots {a z, a z 2,, a z }. i 6: Initialize à = {a z }, µ =. 7: while (à does not satisfy F i (a z, a z2,, a zτ )) do 8: µ = µ +, 9: à = à {a zµ }. : end while : Let rj,i = d zµ and A D j,r j,i = Ã. 2: Output rj,i. Fig. 7. a2 a a3 r j,i a4 D An example of the smallest radius alulation a5 a6 r j,i a7 D2 a8 otspots Destinations Sine user i only exposes partial information T i of its mobility route to user j during route-based authentiation, user j annot ompute r j,i aurately. We devise an approximation algorithm for user j to obtain an approximate value rj,i with the inputs T i and D j. In this algorithm, we first transform T i to a Boolean funtion F i (a z, a z2,, a zτ ). We denote a self dual funtion of F i as F i (a z, a z2,, a zτ ) = F i (a z, a z2,, a zτ ). Let A Dj,r denote a set of hotspots loated in a irular area entered at the destination D j with radius r. For a user i neighboring user j, we an find the smallest radius rj,i suh that A Dj,rj,i satisfies funtion F i (a z, a z2,, a zi ). The algorithm finally outputs an approximate value rj,i. The algorithmi detail is given in Algorithm. User j will then use this value rj,i to alulate the forwarding sore of user i. We use an example to illustrate how proximity sore is omputed, in aordane with the senario given in Fig. 7. User i enounters user j. User i generates a routing tree T i and the orresponding Boolean funtion F i (a 2, a 3,, a 7 ) = a 2 AND (a 3 OR a 4 ) AND (2 of (a 5, a 6, a 7 )). User j has two pakets with destinations D and D 2, respetively. We have F i (a 2, a 3,, a 7 ) = a 2 OR (a 3 AND a 4 ) OR (2 of (a 5, a 6, a 7 )). Aording to the Algorithm, with T i and D as inputs, à is initialized to {a 3 } sine a 3 is the hotspot losest to D. Then, {a 4 } will be added into à sine {a 3} does not satisfy F i (a 2, a 3,, a 7 ) and a 4 is the seond losest to D. à = {a 3, a 4 } now satisfies F i (a 2, a 3,, a 7 ). The algorithm finally outputs the distane r j,i between a 4 and D. Similarly, with T i and D 2 as inputs, the algorithm outputs the distane r j,i between a 5 and D 2, where à = {a 5, a 7 } satisfying T i. V. MORALITY-DRIVEN DATA FORWARDING After finishing the first two steps, users an perform morality-driven data forwarding. Note that the mobile soial users are autonomous and intelligent individuals. It is reasonable to assume that they are rational and their behaviors are driven by personal profit and morality. On one hand, they tend to at defetion in order to redue their forwarding osts. On the other hand, they offer ooperation from time to time so as to ounterat the guilty feelings brought by the past selfish deeds. During MSN-based data forwarding, soial users implement the best strategy to balane ost and payoff. In this setion, we apply game theory to model individual user behavior and obtain the optimal data forwarding strategy. Consider a senario where users move along independently and randomly determined mobility routes. Upon the ontat with another user, a user would either ooperate or defet for data forwarding. We assume that, for two users that both have pakets to send, ooperation is reiproal. Due to the random mobility and privay preservation, users future ontats are unpreditable. A user thus derives the optimal data forwarding strategy based on its self-related information, inluding its own mobility route, destination of its own paket, and morality fator, as well as the opponent information, inluding the morality fator, mobility route and paket destination of the enountered user. From a user s perspetive, among a series of ooperations with different enountered opponents, due to the privay preservation, the opponent information of urrent ontat is always independent from that of previous ontats, and thus the deision on ooperation or defetion depends only on the self-related information and the opponent information of the urrent ontat. We thus model the interplay upon eah ontat, namely ooperation game, as a nonzero sum two-player game. A. Basi/Extended Cooperation Games We first define a basi ooperation game, alled B-game (B stands for Basi), as a 3-tuple (N, S, P), where N is a pair of users, S is a set of strategies and P is a set of payoff funtions. Aording to Setion III, users ontinuously hange their pseudonyms to preserve their privay. Pseudonym hange breaks any relation previously established between two users and as a result they no longer Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 7permission

8 TABLE I PAYOFF MATRIX (a) Payoff matrix of two-player B-game i \ j Cooperate (C) Defet (D) Cooperate (C) (b, b ) (, b) Defet (D) (b, ) (, ) (b) Payoff matrix of two-player E-game i \ j C D C (b, b ) (, b g j ) D (b g i, ) ( g i, g j ) () Payoff matrix of two-player S-game i \ j C D C (e i,j b, e j,i b ) (, e j,i b e i,j g j ) D (e i,j b e j,i g i, ) ( g i, g j ) reognize eah other. Therefore, B-game is a non-repeated game whih an be desribed as follows: Players: Two users i and j belong to the universal user set V. User j an also be denoted as i. The two users are within the transmission range of eah other, and they deide to ooperate or defet, aiming at maximizing their individual payoff. Strategy: Upon the forwarding request of the opponent user, eah user has two strategies: Cooperate (C) and Defet (D). Denote user i s strategy by s i. Then s i = C means that user i forwards user j s paket, and s i = D that user i drops user j s paket. Payoffs: The ost of forwarding on one paket is a value, the same for both users. If user i s data is forwarded by user j, the profit aquired by user i is b, whih is also a onstant. We set b > sine the profit aquired from eah forwarding should be at least equal to the inurred ost. The user payoffs under different strategies are shown in Table I(a). From the payoff matrix in Table I(a), it is observed that the B-game is a typial prisoner-dilemma game, where the only Nash Equilibrium (NE) is (D, D) for non-repeated version. In other words, no matter what the opponent s strategy is, the best strategy for a user is to defet. This is beause that b > b, >. Next, we introdue an E-game (E stands for Extended), where the payoff matrix is shown in Table I(b). This game onsiders users i and j s behaviors affeted by morality fators g i and g j. The morality fators are introdued as the osts of defetion behaviors into the payoff funtions. The best strategy of the E-game for user i is: ooperate if g i > ; defet if g i. Based on the Markov hain model given in Setion III-B, there exists a morality state x < suh that f(st i, x + ) < < f(st i, x ). After a finite series of defetions, user i will reah state x, and then alternatively hooses to ooperate. B. Soial Cooperation Game In the following, we extend the E-game to a omplex S-game (S stands for Soial), whih is also denoted by a 3-tuple (N, S, P). S-game further inorporates the forwarding sores e i,j and e j,i omputed in the previous two steps (see Setion IV) into the payoff funtion. Players: Two users i and j with different soiality strength st i, st j and urrent morality fators g i, g j. Strategy: The strategy is the same as that of the B- game. User i s strategy is denoted by s i. Payoffs: The payoff of user i is evaluated by p s i = e i,j b, if s i = C, s j = C,, if s i = C, s j = D, e i,j b e j,i g i, if s i = D, s j = C, g i, if s i = D, s j = D. In payoff formula (2), the forwarding sores e i,j and e j,i are used to measure user i s profit and morality fator. If user j forwards user i s data, the profit that user i aquires is e i,j b instead of b. If user i drops user j s data, depending on user j s strategy, user i aquires different morality fators, e j,i g i or g i. Note that, when users i and j both drop eah other s pakets, the morality fator on user i s payoff is independent of the forwarding sore e j,i. This is beause users i and j treat eah other equally and do not further onsider their forwarding apability. ) S-game with omplete information: We first analyze the S-game in the ase that two players have omplete information inluding the soiality strength and morality state of eah other. Eah player an alulate the morality fator by ψ() as defined in Setion III-B and determine the payoff before deiding whether to ooperate or defet, aording to Table I(). We use Theorem to identify the NE strategies of the S-game. Theorem : When the two players have omplete information of eah other in the S-game, there are multiple purestrategy NE in different ases and one mixed-strategy NE g θ e θ, θ g θ g θ (x i, x j ), where x i = is the probability that user n θ hooses to ooperate, as shown in Fig. 8(b). Proof: For θ = i or j, we have the following three ases to onsider. g θ < e θ,θ : We have e θ, θ b e θ,θ g θ > e θ, θ b and g θ > e θ,θ due to e θ,θ. As a result, when g θ <, (s θ = D, s θ = D) is a NE; and when g θ >, (s θ = D, s θ = C) is a NE. g θ > : We have g θ < and e θ, θ b e θ,θ g θ < e θ, θ b due to e θ,θ. As a result, when g θ > (2) e θ, θ, e θ, θ, (s θ = C, s θ = C) is a NE; when g θ < (s θ = C, s θ = D) is a NE. e θ,θ < g θ < : Let x θ denote the forwarding probability of user n θ. For s θ = C or s θ = D, we separately alulate the payoff for n θ as follows: p s θ C = x θ (e θ,θ b ) + ( x θ ) ( ) p s θ D = x θ (e θ,θ b e θ, θ g θ ) + ( x θ ) ( g θ ) If x θ is the best strategy of n θ, we have p s θ C = ps θ D g whih gives x θ = θ e θ, θ g θ g θ. 2) S-game with inomplete information: We onsider the ase that the two players have inomplete information of eah other. Speifially, user i obtains soiality strength st i, morality state g i, forwarding sores e i,j and e j,i, but it does not obtain the soiality strength st j and morality fator g j of user j. As a supplementary information, we Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 8permission

9 (D,C) (D,C) (D,D) (C,C) (C,D) (a) The best strategy of E-game Fig. 8. (D,C) (D,D) The best strategy for different games Mixedstrategy (C,C) (C,D) (b) The best strategy of S-game assume that user i obtains the probability distribution ϱ of the morality fator of all users. Based on this, user i an estimate the morality fator g j of user j. Then, user i follows the following steps aording to the best strategy shown in Fig. 8(b): If g i < e j,i, then user i hooses to defet regardless of user j s strategy. If g i, then user i hooses to ooperate regardless of user j s strategy. If e j,i g i <, then there exists a pure-strategy NE (D, D) for g j < e i,j, a pure-strategy NE (C, C) for g j >, and a mixed-strategy NE for e i,j < g j <. For the pure strategy NE, we alulate the defetion probability Pr and ooperation probability Pr 2 : Pr = Pr( g j < ) = e i,j Pr 2 = Pr( g j ) = + e i,j ϱ(α)dα. ϱ(α)dα, In addition, user i makes a mixed-strategy NE with probability Pr 3, whih is given by Pr 3 = Pr( e j,i g i < ) = e j,i ϱ(α)dα. For the mixed-strategy NE with probability Pr 3, Theorem indiates the best strategy of user i is to forward g the data with probability j e i,j g j g j if g j is known by user i. In this ase, the probability that user i hooses to ooperate is Pr 4 = ( e j,i α )ϱ(α)dα. (3) e i,j α α Overall, user i deides to ooperate with probability Pr F = Pr 2 +Pr 4 and to defet with probability Pr D = Pr F. C. S-Game Based Data Forwarding Notie that the S-game with inomplete information emulates MSN environments in reality, where the opponent s morality fator annot be diretly obtained. We use the optimal strategy of this game in our protool for users to make the optimal data forwarding strategies. As we defined in Setion III-B, user morality fator would vary with both soiality strength and morality state. owever, revealing suh information violates user privay sine other adversarial users an utilize the information to trak user behavior. In this ase, we do not require an aurate alulation of morality fator in the S-game. Instead, we examine the proposed strategy by using a probability distribution funtion ϱ of morality fator. This funtion ϱ an be either observed by a trusted authority or reported by individual users. Further analysis is presented in Setion VI-B3. A user who has pakets to forward starts the data forwarding protool with a randomly seleted neighbor. Consider two neighboring users i and j that are running the protool, i.e., they are both able to provide ooperative data forwarding to eah other and any forwarding/defetion deision in the two-user game will impat their soial morality. Let S i = {p i, p i2,, p iα } and S j = {p j, p j2,, p jβ } be the paket sets held by i and j, respetively. We summarize the protool as follows. User i first randomly selets a paket p x (destined to D i ) from its loal repository. It then alulates the digest of the paket d i = (p x ), where is the ryptographi hash funtion. Lastly, it sends d i to j. In the meantime, user j exeutes a similar proedure loally and sends i the digest d j of a paket of p y (destined to D j ). Aording to d i (d j ), if j (resp., i) finds that it already has p x (resp., p y ), it will inform i (resp., j) to re-selet p x (resp., p y ). Through exhaustive paket re-seletion, if they annot find any exlusively owned paket, the protool will terminate. Otherwise, they proeed to exhange (p x, D i ) and (p y, D j ), together with their own routing trees T i and T j. Then, they validate eah other s routing trees (see Setion IV-A). After that, they evaluate eah other s forwarding sores (see Setion IV-B), and finally make the forwarding strategy for eah other (see Setion V-B2). VI. PERFORMANCE EVALUATION In this setion, we ondut trae-based ustom simulations of the MSN to evaluate the proposed data forwarding protool. A. Simulation Settings ) User mobility, hotspots, and paket generation: We generate user mobility model aording to the real-world trae of pedestrian runners provided in [37]. In the real trae set, N = mobile users are randomly deployed in a m 2 square region with the veloity randomly distributed with a mean value of m/s. The ommuniation range R t of users is set to 5 m. The log ontains the user loations in suessive T = 9 time slots. We divide the network field into grids, where eah grid is a square with side length m. We reate a irle of radius R t around eah grid point, and there are totally 2 irles. The areas enlosed by these irles are alled spots and denoted by (a, a 2,, a 2 ) as shown in Fig. 9; no any two spots overlap. We aggregate user route information to determine the most popular spots as follows. Let d m,n denote the number Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 9permission

10 m β(2,5) β(5,2) m m Fig. 9. (a) otspots (denoted by ) otspots and population density (b) Population density β(2,2) (a) Soiality strength Fig.. Preliminary results Full ooperation % ooperation Non ooperation (b) Cooperation effet of users in hotspot a m at time slot n, where integers m [, 2] and n [, 9]. We sort the spots in an desending order aording to d m = T n= d m,n, and hoose the top-ten spots as hotspots (i.e., l = ). Figure 9(a) shows the seleted hotspots, and Fig. 9(b) shows the population density of spots aording to d m. At the middle of eah hotspot, we plae a wireless storage devie whih has a ommuniation range equal to R t. One a user enters a hotspot, it an aess the storage devie of the hotspot via wireless ommuniation. For eah simulation run, there are totally pakets generated for transmissions, pakets per eah user, with uniformly seleted hotspots as the paket destinations. In eah time slot, a user i randomly selets a neighboring user j to play a two-player ooperation game. In the ooperation game, we onsider the ommuniation ost of data forwarding to be muh greater than the omputational ost of the assoiated authentiation. As suh, the authentiation sheme imposes negligible influene on user behavior. Upon eah ontat, users uniformly selet one available paket from their buffers to transmit. In order to fous on the impat of ooperation on the data forwarding effetiveness, we onsider pakets do not expire during the simulations and hotspot buffers and user devie buffers are not limited in size. 2) Soiality Strength and Morality Funtion: The soiality strength st i of user i ( i ) is seleted from the range of [, ]. The greater st i is, the more intense soial morality impat on user i s ooperation. In this setion, we adopt different models of soiality strength represented by three beta distributions β(2, 5), β(2, 2), β(5, 2) shown in Fig.(a), respetively, to evaluate the performane of the proposed protool in the ases of low, medium and high users soiality strength, respetively. The morality funtion f is used to alulate the morality fator of eah user i using the user s soiality strength st i and urrent morality state x. From Setion III-B, we define three morality funtions: linear funtion f, natural logarithm funtion f e and ommon logarithm funtion f. They outputs if x, and otherwise, f (st i, x) = k st i ( x) f e (st i, x) = k ln( + st i ( x)) f (st i, x) = k log ( + st i ( x)) where k is a tunable oeffiient in the range of (, + ). For simpliity, we fix k = in our simulation. The three morality funtions represent three different levels of morality fore affeting user ooperation behavior, respetively. They always output a non-negative value. The ommon logarithm funtion f generates a smaller morality fator, ompared with the other two funtions. If it is adopted, we an expet to see more defetion behaviors. 3) Routing tree and forwarding apability: Reall that a user s routing tree preserves user privay by making the sensitive hotspots anonymous, and in the meantime provides partial information of user mobility route in order to failitate ooperative data forwarding. With hotspots in simulations, eah user i may have at most hotspots and at least hotspot in A i. We generate a simplified routing tree struture T in the following way: if A i =, the tree annot be reated; if < A i < 5, we set the threshold as A i, and the leaf nodes as all the hotspots of A i and other 5 A i ones from A u \ A i ; if A i 5, we set the threshold as 4, and the leaf nodes as four randomly seleted hotspots from A i and another different hotspot. In short, for every user, the tree struture an be written as t of 5, where t 4. In Setion IV-B, a funtion ψ is used to ompute the forwarding apability of a given user i for a paket with a speifi destination. We set the lower bound of ψ as. In the network grid, r i,j an be 2 = 45 meters at most and at least. Intuitively, if r i,j = 45, the forwarding apability e i,j reahes the minimum value; and if r i,j =, e i,j reahes the maximum value. We define ψ(r i,j ) = ek k r i,j /45 and set k = 3 as an example to illustrate the effet of forwarding apability. B. Simulation Results The performane metris used in the simulation are: i) the delivery ratio, whih is the fration of pakets that are orretly delivered to the hotspots as their destinations; and ii) the average morality state, whih reflets the intention of users to ooperate over time. The delivery ratio examines the overall ooperation of users in the MSN, while the average morality state denotes the long-term ooperation strategies for a single user. For eah simulation, we ondut 5 simulation runs and report the average results. ) B-game: We first examine the B-game, where users always hoose defetion as the best strategy as disussed Copyright () 2 IEEE. Personal use is permitted. For any other purposes, permission

11 β(2,5), =.5 β(2,5), =.5 β(2,2), =.5 β(2,2), =.5 β(5,2), =.5 β(5,2), =.5 non ooperation full ooperation (a) E-game with f β(2,5), =.5 β(2,5), =.5 β(2,2), =.5 β(2,2), =.5 β(5,2), =.5 β(5,2), =.5 non ooperation full ooperation (b) E-game with f e β(2,5), =.5 β(2,5), =.5 β(2,2), =.5 β(2,2), =.5 β(5,2), =.5 β(5,2), =.5 non ooperation full ooperation () E-game with f β(2,5), =.5 β(2,5), =.5 β(2,2), =.5 β(2,2), =.5 β(5,2), =.5 β(5,2), =.5 non ooperation full ooperation (d) S-game with f β(2,5), =.5 β(2,5), =.5 β(2,2), =.5 β(2,2), =.5 β(5,2), =.5 β(5,2), =.5 non ooperation full ooperation (e) S-game with f e β(2,5), =.5 β(2,5), =.5 β(2,2), =.5 β(2,2), =.5 β(5,2), =.5 β(5,2), =.5 non ooperation full ooperation (f) S-game with f Fig.. in E-game and S-game with omplete information in Setion V-A. Fig. (b) shows three delivery ratios in the following three ases: a) users do not ooperate (i.e., B-game); b) users stohastially ooperate to forward paket with the probability of %; and ) users fully ooperate. It an be seen that at time slot 9, the fullooperation strategy ahieves 99% delivery ratio while the non-ooperation strategy ahieves only 3%. Furthermore, Fig. (b) indiates that the probabilisti ooperation strategy provides a signifiant improvement to the delivery ratio up to 74%. owever, without effetive inentive and appropriate exploration of their soial feature, users will not take ooperation due to the selfishness. Suessful delivery happens only when the data senders arrive at their seleted hotspots. This inevitably results in a low delivery ratio in the B-game. 2) E-game and S-game: The E-game extends the B- game by embedding the morality fator into the payoff funtion as shown in Table I(b), while the S-game further onsiders the forwarding apability into the payoff of the E- game. Fig. shows the delivery ratio of both the E-game and the S-game with omplete information, with red lines representing the performane of forwarding ost =.5, blue lines representing that of =.5, and blak lines depiting those of full-ooperation and non-ooperation as the best and worst ase. It is learly observed that the strategies with =.5 an ahieve higher delivery ratio than the strategies with =.5. The rationale is that a large forwarding ost =.5 hinders the ooperation performed by users who have limited resoures and thus limits guilty inentive. In partiular, when f is adopted, the ooperation ondition in ase of =.5 approahes to the worst ase. This is beause that the guilty funtion f returns the smallest morality fator resulting in the least inentive to ooperate, ompared to the funtion f e and f. Fig. shows that the strategies with the soiality strength β(5, 2) perform muh better than those with β(2, 2) and β(2, 5) in terms of delivery ratio. This is beause that, ompared to ases β(2, 2) and β(2, 5), users will be initialized with larger soiality strength in ase β(5, 2) as shown in Fig. (a), and as disussed in Setion III-B, more users feel intense guilt towards their defetion and hoose to ooperate, whih leads to a better performane. Fig. shows the performane omparisons between the E-game and the S-game under the same parameters. It an be seen that the delivery ratio an be further improved by enabling privay-preserving route-based authentiation. But sine the route information is limited due to the privay preservation, the improvements are not signifiant, e.g., when hoosing β(2, 5) and =.5, the delivery ratio inreases from.39 as shown in Fig. () to.327 as shown in Fig. (f). To further investigate the impat of the route information on the data forwarding ooperation, we randomly selet users in the network and examine their average morality states. Fig. 2 shows the average morality state of eah seleted user in terms of the user soiality strength in three settings of soial strength β(2, 5), β(2, 2), and β(5, 2), respetively. The blue irle represents a user whih adopts the best strategy from the S-game, and the red star represents a user whih adopts the best strategy from the E-game. It an be seen that with the same soiality strength, the users represented by the red star have smaller Copyright () 2 IEEE. Personal use is permitted. For any other purposes, permission

12 Average morality state E game S game Average morality state E game S game Average morality state E game S game Soiality strength (a) Soiality strength β(2, 5) Soiality strength (b) Soiality strength β(2, 2) Soiality strength () Soiality strength β(5, 2) Fig. 2. Average morality states of all users in E-game and S-game with omplete information, =.8, and ommon logarithm Exponential distribution λ = λ = 2 λ = λ = α [,+ ) (a) Morality fator λ = λ = 2 λ = λ = 2 E game (b), f, =.5, st i β(2, 5) seen that when λ = 2, from user i s perspetive, the opponent user j has a morality fator g j < e i,j with a large probability. In this ase, user i hooses to ooperate if g i and defet if g i <. The best strategy of the S-game with inomplete information is thus almost equal to that of the E-game; both games indiate users to ooperate or defet mostly based on user self morality fators. owever, the S-game with inomplete information outperforms the E- game sine it has an additional mixed-strategy spae shown in Fig. 8(b) to enourage user ooperation. Fig. 3. S-game with inomplete information VII. CONCLUSION morality states than users represented by the blue irle. This is to say, the inentive to defet in the ooperation game an be further redued by enabling privay-preserving route-based authentiation. 3) S-game with Inomplete Information: For the S-game with inomplete information, the morality fator annot be obtained diretly in our morality model due to the lak of soiality strength and morality state information about the opponent user. As suh, the morality fator will be estimated by a probability distribution funtion ϱ. In our simulation, we use exponential distribution with parameter λ = {, 2,, 2} to generate the morality fators for all users. The probability distribution funtion ϱ is shown in Fig. 3(a). Fig. 3(a) shows that most users in ase of λ = may have relatively large morality fator. As we make st i β(2, 5), most users would have the weak soiality strength. Thus, the large morality fators of users indiate that they have already adopted a large amount of defetions. Aordingly, they would have intense guilty feeling so that their following behaviors are probably ooperative. Besides that, it an be seen that when λ = 2 most users with the weak soiality strength have smaller morality fators, and without enough guilt as ooperation inentives their future behaviors would likely be defetions. The performane results from Fig. 3(b) validate the above analysis, where the delivery ratio largely dereases if λ hanges from to 2. By investigating the proposed strategy, it an be In mobile soial networks (MSNs), the two fundamental design goals privay preservation and ooperative data forwarding would severely onflit with eah other if arelessly designed. This is beause that onealing and proteting user information may prohibit traking the soial behavior of users, whih impedes the ooperative data forwarding and effetive inentive mehanism. In this paper, we have attained the two onfliting design goals in one framework by exploiting soial morality. Speifially, we first have proposed a novel user-to-spot data forwarding protool where eah paket is destined to a hotspot assoiated with the reeiver and then retrieved by the reeiver upon its aess to the hotspot. With this protool, not only an reeiver loation privay be preserved, but the paket delivery ratio is also enhaned. In addition, a privay-preserving route-based authentiation sheme has been integrated to allow users to reveal anonymized route information to the publi. Based on the information, a user is able to evaluate the data forwarding apability of eah relay for a given paket with a speifi destination. Gametheoreti models then have been adopted to derive the best data forwarding strategy for users, with respet to user morality fator, interest and forwarding apability. Through extensive trae-based simulations, we have demonstrated the data forwarding effetiveness of the proposed protool in terms of paket delivery ratio. Partiularly, the embedded privay-preserving route-based authentiation sheme makes important ontribution to the protool performane. For the future work, we will extend this work by studying Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 2 permission

13 a more general and ompliated situation in whih mobile soial users may have diverse behavior models. REFERENCES [] A. Miklas, K. Gollu, K. Chan, S. Saroiu, P. Gummadi, and E. Lara, Exploiting soial interations in mobile systems, in Ubiomp, 27, pp [2] S. Ioannidis, A. Chaintreau, and L. Massoulié, Optimal and salable distribution of ontent updates over a mobile soial network, in Pro. IEEE INFOCOM, 29, pp [3] R. Lu, X. Lin, and X. Shen, Spring: A soial-based privaypreserving paket forwarding protool for vehiular delay tolerant networks, in Pro. IEEE INFOCOM, 2, pp [4] W. e, Y. uang, K. Nahrstedt, and B. Wu, Message propagation in ad-ho-based proximity mobile soial networks, in PERCOM workshops, 2, pp [5] D. Niyato, P. Wang, W. Saad, and A. jørungnes, Controlled oalitional games for ooperative mobile soial networks, IEEE Transations on Vehiular Tehnology, vol. 6, no. 4, pp , 2. [6] M. Motani, V. Srinivasan, and P. Nuggehalli, Peoplenet: engineering a wireless virtual soial network, in MobiCom, 25, pp [7] M. Brereton, P. Roe, M. Foth, J. M. Bunker, and L. Buys, Designing partiipation in agile ridesharing with mobile soial software, in OZCI, 29, pp [8] S. Gaonkar, J. Li, R. R. Choudhury, L. P. Cox, and A. Shmidt, Miro-blog: sharing and querying ontent through mobile phones and soial partiipation. in ACM MobiSys, 28, pp [9] M. Li, K. Sampigethaya, L. uang, and R. Poovendran, Swing & swap: user-entri approahes towards maximizing loation privay, in WPES, 26, pp [] J. Freudiger, M. Manshaei, J.-P. ubaux, and D. Parkes, On nonooperative loation privay: a game-theoreti analysis, in ACM CCS, 29, pp [] R. Lu, X. Lin,. Luan, X. Liang, and X. Shen, Pseudonym hanging at soial spots: An effetive strategy for loation privay in vanets, IEEE Transations on Vehiular Tehnology, vol. 6, no., pp , 22. [2] X. Lin, R. Lu, X. Liang, and X. Shen, Stap: A soial-tier-assisted paket forwarding protool for ahieving reeiver-loation privay preservation in vanets, in Pro. IEEE INFOCOM, 2, pp [3] A. Lindgren, A. Doria, and O. Shelén, Probabilisti routing in intermittently onneted networks, in SAPIR, 24, pp [4] E. M. Daly and M. aahr, Soial network analysis for routing in disonneted delay-tolerant manets, in Mobio, 27, pp [5] W. Gao, Q. Li, B. Zhao, and G. Cao, Multiasting in delay tolerant networks: a soial network perspetive, in Mobio, 29, pp [6] P. ui, J. Crowroft, and E. Yoneki, Bubble rap: Soial-based forwarding in delay-tolerant networks, IEEE Transations on Mobile Computing, vol., no., pp , 2. [7] Q. Li, S. Zhu, and G. Cao, Routing in soially selfish delay tolerant networks, in Pro. IEEE INFOCOM, 2, pp [8] Q. Yuan, I. Cardei, and J. Wu, Predit and relay: an effiient routing in disruption-tolerant networks, in Mobio, 29, pp [9] W. Yu and K. J. R. Liu, Game theoreti analysis of ooperation stimulation and seurity in autonomous mobile ad ho networks, IEEE Transations on Mobile Computing, vol. 6, no. 5, pp , 27. [2]. Zhu, X. Lin, R. Lu, Y. Fan, and X. Shen, Smart: A seure multilayer redit-based inentive sheme for delay-tolerant networks, IEEE Transations on Vehiular Tehnology, vol. 58, no. 8, pp , 29. [2] M.. Manshaei, Q. Zhu, T. Alpan, T. Basar, and J.-P. ubaux, Game theory meets network seurity and privay, Eole Polytehnique Fédérale de Lausanne (EPFL), Teh. Rep., September 2, epfl-report [22] M. Raya, R. Shokri, and J.-P. ubaux, On the tradeoff between trust and privay in wireless ad ho networks, in WISEC, 2, pp [23] M. Mahmoud and X. Shen, Pis: A pratial inentive system for multihop wireless networks, IEEE Transations on Vehiular Tehnology, vol. 59, no. 8, pp , 2. [24] Z. Li and. Shen, Game-theoreti analysis of ooperation inentive strategies in mobile ad ho networks, IEEE Transations on Mobile Computing, 2, preprint. [25] C. Y. T. Ma, D. K. Y. Yau, N. K. Yip, and N. S. V. Rao, Privay vulnerability of published anonymous mobility traes, in MobiCom, 2, pp [26] D. Chaum, Untraeable eletroni mail, return addresses, and digital pseudonyms, Commun. ACM, vol. 24, no. 2, pp , 98. [27] K. offman, D. Zage, and C. Nita-Rotaru, A survey of attak and defense tehniques for reputation systems, ACM Comput. Surv., vol. 42, no., 29. [28] S. Zhong, E. L. Li, Y. G. Liu, and Y. R. Yang, On designing inentive-ompatible routing and forwarding protools in wireless ad-ho networks: an integrated approah using game theoretial and ryptographi tehniques, in MobiCom, 25, pp [29] R. Lu, X. Lin,. Zhu, X. Shen, and B. Preiss, Pi: A pratial inentive protool for delay tolerant networks, IEEE Transations on Wireless Communiations, vol. 9, no. 4, pp , 2. [3] T. Ketelaar and W. T. Au, The effets of feelings of guilt on the behaviour of unooperative individuals in repeated soial bargaining games: An effet-as-information interpretation of the role of emotion in soial interation, Cognition and Emotion, vol. 7, no. 3, pp , 23. [3] A. Colman, Cooperation, psyhologial game theory, and limitations of rationality in soial interation, Behavioral and Brain Sienes, vol. 26, no. 2, pp , 23. [32] M. Wubben, Soial Funtions of Emotions in Soial Dilemmas. Rotterdam, 2. [33]. Luan, L. Cai, J. Chen, X. Shen, and F. Bai, Vtube: Towards the media rih ity life with autonomous vehiular ontent distribution, in SECON, 2, pp [34] F. Fukuyama, Trust: Soial Virtues and the Creation of Prosperity. NY: Free Press, 995. [35] X. Boyen and B. Waters, Full-domain subgroup hiding and onstant-size group signatures, in Publi Key Cryptography (PKC), 27, pp. 5. [36] X. Liang, Z. Cao, J. Shao, and. Lin, Short group signature without random orales, in International Conferene on Information and Communiations Seurity (ICICS), 27, pp [37] X. Li, N. Mitton, and D. Simplot-Ryl, Mobility predition based neighborhood disovery for mobile ad ho networks, in IFIP International Conferene on Networking (NETWORKING), 2, pp Xiaohui Liang urrently working toward a Ph.D. degree with the Department of Eletrial and Computer Engineering, University of Waterloo, Canada. e is urrently a researh assistant with the Broadband Communiations Researh (BBCR) Group, University of Waterloo. is researh interests inlude seurity and privay for e-healthare system and mobile soial networks. Copyright () 2 IEEE. Personal use is permitted. For any other purposes, 3 permission

14 This artile has been aepted for publiation in a future issue of this journal, but has not been fully edited. Content may hange prior to final publiation. Xu Li is a researh sientist at Inria, Frane. Prior to joining Inria, he worked as postdo fellow at several loations: the University of Waterloo, Canada; Inria/CNRS, Frane; and the University of Ottawa, Canada. e reeived a PhD (28) degree from Carleton University, Canada, an MS (25) degree from the University of Ottawa, Canada, and a BS (998) degree from Jilin University, China, all in omputer siene. During 24.-8, he held a visiting researher position at National Researh Counil Canada (NRC). is researh interests are in the areas of mahineto-mahine ommuniations and mobile soial networks, with over 5 different works published in refereed journals, onferene proeedings and books. e is on the editorial boards of the Wiley Transations on Emerging Teleommuniations Tehnologies, Ad o & Sensor Wireless Networks, and Parallel and Distributed omputing and Networks. e is/was a guest editor of the IEEE Transations on Parallel and Distributed Systems, Mobile Networks and Appliations, Peer-to-Peer Networking and Appliations, Journal of Communiations, Computer Communiations, and Ah o & Sensor Wireless Networks. e was a reipient of NSERC PDF awards and a number of other awards. Tom. Luan reeived the B.E. degree in Xi an Jiaotong University, China in 24 and the M.Phil. degree in Eletroni and Computer Engineering from the ong Kong University of Siene and Tehnology, Kowloon, ong Kong in 27. e is now pursuing the Ph.D. degree at the University of Waterloo, ON, Canada. is urrent researh interests fous on wired and wireless multimedia streaming and ontent distribution in vehiular networks. Xuemin (Sherman) Shen reeived the BS degree from Dalian Maritime University, China, in 982 and the MS and PhD degrees from Rutgers University, New Jersey, in 987 and 99, all in eletrial engineering. e is a professor and a university researh hair in the Department of Eletrial and Computer Engineering, University of Waterloo, Canada. is researh fouses on resoure management in interonneted wireless/wired networks, UWB wireless ommuniations networks, wireless network seurity, wireless body area networks, and vehiular ad ho and sensor networks. e is a o-author of three books and has published more than 4 papers and book hapters in wireless ommuniations and networks, ontrol, and filtering. e is the Editor-in-Chief of IEEE Network, and will serve as a Tehnial Program Committee Co-Chair for 24 IEEE Infoom. e is the Chair for IEEE ComSo Tehnial Committee on Wireless Communiations, and P2P Communiations and Networking, and a voting member of GITC. e was a Founding Area Editor for IEEE Transations on Wireless Communiations, and a Guest Editor for IEEE JSAC, IEEE Wireless Communiations, and IEEE Communiations Magazine. e also served as the Tehnial Program Committee Chair for Globeom 7, the Tutorial Chair for ICC 8, and the Symposia Chair for ICC. Dr. Shen reeived the Exellent Graduate Supervision Award in 26, and the Outstanding Performane Award in 24, 27 and 2 from the University of Waterloo, the Premier s Researh Exellene Award (PREA) in 23 from the Provine of Ontario, Canada. e is a registered Professional Engineer of Ontario, Canada, an IEEE Fellow, a Fellow of the Engineering Institute of Canada, a Fellow of Canadian Aademy of Engineering and was a ComSo Distinguished Leturer. Rongxing Lu reeived the Ph.D. degree in omputer siene from Shanghai Jiao Tong University, Shanghai, China in 26 and the Ph.D. degree in eletrial and omputer engineering from the University of Waterloo, Waterloo, ON, Canada, in 28. e is urrently a Postdotoral Fellow with the Broadband Communiations Researh (BBCR) Group, University of Waterloo. is researh interests inlude wireless network seurity, applied ryptography, and trusted omputing. Xiaodong Lin reeived the Ph.D. degree in information engineering from Beijing University of Posts and Teleommuniations, Beijing, China, in 998 and the Ph.D. degree (with Outstanding Ahievement in Graduate Studies Award) in eletrial and omputer engineering from the University of Waterloo, Waterloo, ON, Canada, in 28. e is urrently an assistant professor of information seurity with the Faulty of Business and Information Tehnology, University of Ontario Institute of Tehnology, Oshawa, ON, Canada. is researh interests inlude wireless network seurity, applied ryptography, omputer forensis, software seurity, and wireless networking and mobile omputing. Dr. Lin was the reipient of a Natural Sienes and Engineering Researh Counil of Canada (NSERC) Canada Graduate Sholarships (CGS) Dotoral and the Best Paper Awards of the 8th International Conferene on Computer Communiations and Networks (ICCCN 29), the 5th International Conferene on Body Area Networks (BodyNets 2), and IEEE International Conferene on Communiations (ICC 27). Copyright () 2 IEEE. Personal use is permitted. For any other purposes,4 permission