Low-Latency Spatial-Provenance Recovery Methods for Privacy-Constrained Vehicular Networks

To balance the contrasting needs of the RSU and the vehicle’s privacy concerns, [24] proposed a multihop protocol where vehicles share their coarse-grained location information only with the RSU and not with intermediate vehicles that forward the packet. To achieve joint data- and spatial-provenance with such privacy constraints, each forwarding vehicle in the framework of [24] embeds the identity of the corresponding location information in the packet along the path traveled, thereby incurring a high end-to-end delay. As a result, such methods are not applicable when there are stringent deadlines on the end-to-end delay of the packets. In the context of reducing end-to-end delay in data-provenance methods, [17] suggests a skipping method, where some vehicles skip the provenance embedding process on the packets while the other vehicles cooperatively embed the provenance of their neighboring vehicles to reduce the end-to-end delay. While skipping-based methods to reduce end-to-end delay are available for recovering data-provenance, no such methods exist to provide benefits in end-to-end delay for joint data- and spatial-provenance. Inspired by this research gap, we ask whether skipping-based protocols can jointly recover data- and spatial-provenance under stringent delay, and what trade-offs they induce in reliability, privacy, overhead, and practical feasibility?

To meet the RSU’s localization requirements along with the privacy constraints of vehicles, we use the strategy suggested in [24], in which the RSU partitions its coverage area into uniform segments¹¹1This segmentation concept is relevant to complex road models [27], including bi-directional roads with numerous lanes and multi-layered roads, such as elevated roads and bridges. For the aforementioned generalized models, our concepts can be executed by assigning a dedicated RSU to each road or utilizing a single RSU to serve multiple roads through multiple-access techniques., subsequently directing vehicles to incorporate the identities (IDs) of their respective segments when transmitting packets.²²2This design is in line with regulatory standards such as IEEE 1609.2 [28] and ETSI Intelligent Transportation Systems (ITS) [29]. Due to non-disclosure of precise vehicle locations in this model, this privacy framework is referred as a relaxed-privacy model. For illustration, in Fig. 1, multiple scenarios are depicted in which the coverage area of the RSU is partitioned into distinct segments according to the privacy requirements of the vehicles. While we use the segmentation strategy of [24], we further relax the privacy model by requiring vehicles to explicitly share their segment information with neighboring vehicles. Fig. 1 captures our additional relaxation on the privacy requirement where vehicles share their coarse-level location information with their neighboring vehicles. Note that arrows in the figure indicate the direction of flow of segment IDs between vehicles. By exploiting the above mentioned relaxation in the privacy model, we make the following contributions, as outlined below:

1) To meet low-latency requirements, we propose two protocols, namely: Bi-Segment Embedding (BSE) and Tri-Segment Embedding (TSE). Both protocols are built on the principles of skipping and relaxed-privacy to reduce per-hop delays and use Bloom filters as a data structure to embed the data- and spatial-provenance information jointly. The terms bi-segment and tri-segment refer to the number of segment IDs a node embeds on the packet at a time in order to reduce end-to-end delays: two in BSE as shown in Fig. 1 (a), and three in TSE as depicted in Fig. 1 (b,c). For more details, refer to Sections II and III.

2) Although Bloom filters aid in low-latency recovery, they are accompanied by error rates owing to false positive events, which depend on the Bloom filter size and the number of Hash functions. To select Bloom filter parameters when employing BSE and TSE, we derive analytical expressions for error rates in retrieving spatial-provenance when the underlying wireless technology used in the vehicular network has an arbitrary transmission range (see Section IV and Section V).

3) We validate the evaluation of proposed analytical expressions by comparing them with experimental results, which reveal that the analytical expressions yield near-optimal Bloom filter configurations. After presenting a thorough analysis of the trade-off between privacy and error rates, we compare the performance of our proposed protocols with the baseline method in [24] and show that we get significant benefits in reliability as well as end-to-end delay (see Section VI).

4) In BSE and TSE, vehicles explicitly share their coarse-grained location information with the neighboring vehicles. To incorporate practical aspects, we explore physical-layer-based localization methods to indirectly infer the segment IDs of neighboring vehicles. Experiments reveal that the proposed methods continue to provide benefits over the baseline protocols (see Section VI-B).

5) Finally, to understand the practical insights on implementing proposed protocols in realistic vehicular networks, we perform timing analysis using the radio characteristics of ZigBee and 5G stack, and as a takeaway point, we demonstrate that our proposed protocols offer significant benefits in latency as compared to existing techniques in [25, 26] when implemented over 5G stack. We also evaluate the performance of our proposed protocols under mobility and dynamic changing topology scenarios, and the results confirm their robustness in realistic V2X networks.

Contributions most relevant to our study on data-provenance are [8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18], those on spatial-provenance are [19, 20, 21, 22, 23], and those on joint data- and spatial-provenance are [24, 25, 26]. Data-provenance techniques suggested in [8, 9, 10, 11, 12, 13, 14, 15, 16] are not suitable for multihop networks, whereas[17, 18] do not capture the spatial location in multihop networks. Spatial-provenance techniques in [19, 20, 21, 22] focus solely on learning the spatial location of the source node. The joint data- and spatial-provenance technique in [24, 25, 26] incurs a high end-to-end delay while attempting to provide relaxed-privacy features with respect to the RSU and the other vehicles. Overall, while [10, 17, 18] and [24, 25, 26] use Bloom filters for capturing provenance, none of them address a skipping-based joint data- and spatial-provenance technique, which reduces end-to-end delay without sacrificing traceability in privacy-constrained multihop networks. Comparative aspects of our work with existing techniques are summarized in Table I.

Since our work addresses joint data- and spatial-provenance, [24] serves as a natural baseline for comparison. Henceforth, throughout this paper, we refer to this baseline as location node embedding (LNE), as provenance information is embedded by every forwarding node. Based on Table I, our proposed framework differs from LNE [24] primarily in terms of low-latency, while sharing several high-level design aspects. To compare other common features in detail, Table II provides a detailed comparison across computation overhead, error rates, privacy, and end-to-end delay. The results indicate improvements in computation cost at forwarding nodes, error rates, and end-to-end delay, while trading off privacy with respect to neighboring vehicles.

We assume that a vehicle entering the coverage area of the RSU authenticates itself with a gateway node using a pre-shared root key known to the core network. Upon successful authentication, each vehicle derives a unique secret key $K_{y},~y\in[N-1]$ using standard key derivation functions. The RSU maintains the credentials of all the authenticated vehicles within its coverage area. However, the individual secret keys $K_{y}$ remain private to each vehicle. Subsequently, each vehicle performs neighbor discovery and authenticates with neighboring nodes using a public-key cryptosystem. Only vehicles that have completed this authentication procedure and possess a valid $K_{y}$ are allowed to participate in multihop communication. For more details on authentication and neighbor discovery mechanisms, the reader may refer to [17, Section 2] and [18, Section 2.2].

To enhance network security and provide advanced network diagnostics, the RSU wants to determine the path traveled by the packets and the precise GPS locations of all network nodes that have relayed them. However, considering privacy concerns, nodes may refrain from disclosing their precise GPS coordinates to either the RSU or other registered nodes in the network [31, Section 1]. To cater to these requirements, the following section formally outlines the privacy requirements and threat model adopted in this work.

As described above, our network contains $N-1$ authenticated mobile nodes along with the RSU, and may also include other non-authenticated nodes within the coverage area. In our threat model, all entities are assumed to be honest-but-curious, passively observing network traffic to infer vehicle locations. All entities follow the protocol faithfully but may attempt to infer the exact GPS coordinates of other vehicles from observed packets. We assume that no entity modifies packets or launches active attacks. In particular, these entities are classified into three types based on their roles and observation capabilities: forwarding nodes, non-forwarding nodes, and the RSU. Forwarding nodes are authenticated vehicles participating in the packet forwarding. They have access to relayed packets and embedded Bloom filters. Non-forwarding nodes are passive observers with no role in packet delivery and are further divided into two subtypes. Authenticated non-forwarding nodes are registered vehicles within the RSU coverage area. They are not participating in the ongoing packet-forwarding process; however, they have full protocol knowledge and can observe network traffic. Non-authenticated nodes have not registered with the RSU and therefore fall outside the system’s trust boundary. They can overhear wireless packets within their communication range; however, they lack knowledge of the protocols. The RSU is a trusted infrastructure node that collects all transmitted packets to recover provenance information, potentially inferring exact vehicle locations.

As discussed above, vehicles are unwilling to reveal their exact GPS coordinates; however, they are willing to share coarse-level location information to avail the benefits of LBS. To reconcile the demands of the RSU with the location privacy of the nodes, we take the approach mentioned in [24, 25], where the RSU partitions its coverage area into $r$ geographical areas, where $r\in\mathbb{N}$, and instructs the nodes to disclose the identities of their region while relaying the packet. In this context, $r$ is an arbitrary quantity, which is a priori determined through a conciliatory agreement between the privacy needs of the nodes and the precision demands of the RSU.

In the context of vehicular networks, we assume that the RSU defines its coverage area along a linear path, partitioning it into smaller parts of uniform regions, henceforth termed as segments. The collection of segments is represented as $\Delta\triangleq\{A_{1},A_{2},\ldots,A_{r}\}$, as seen in Fig. 1 for $r=2,5$ and $10$. We assume that the RSU is located in segment $A_{1}$, specifically at one corner of the coverage area, whereas the remaining mobile nodes are scattered randomly throughout $\Delta$. We also assume that the segments farther away from the RSU are allotted higher index numbers. The farthest segment from the RSU inside the coverage area is $A_{r}$. The segmentation of the coverage area of the RSU balances the relaxed-privacy requirements of the nodes with the RSU’s need for learning the location of the nodes. We assume that the RSU has high transmit power compared to other nodes in the network; therefore, its broadcast messages can propagate to the farthest segment, namely $A_{r}$, on the downlink. To aid the nodes in learning the segment ID, the RSU disseminates a dictionary that delineates the GPS boundaries corresponding to various segments. As the nodes possess GPS devices, they can independently ascertain their segment ID utilizing the disseminated dictionary. For more information about privately sharing the dictionary via a broadcast message, we refer the reader to [32].

To explain the spatial-provenance embedding process, the identity of the source node is marked as $I_{s}$, the identity of the RSU is marked as $I_{N}$, and the identities of the other mobile nodes are represented as $I_{n}$, where $n\in[1,~N-2]$. Furthermore, to establish the correspondence between $\Delta$ and the GPS coordinates of the nodes, we utilize the function $g:\{I_{1},I_{2},\ldots,I_{N-2},I_{s}\}\rightarrow\Delta$ to convert node identities into segment identities based on their current locations. We assume that the function $g$, which defines the segment mapping based on the privacy preferences agreed upon by the participating vehicles, remains constant over a sufficiently long duration. This assumption is motivated by the fact that vehicles typically do not alter their privacy preferences at millisecond time scales during ongoing communication.³³3The frequency of dictionary broadcasts, possible updates to $g$, and their impact on system performance are discussed in Section VI-D. Nonetheless, the function $g$ may alter at a subsequent coherence time when another packet is transmitted. The following section highlights the constraints on the routing protocols used by nodes for uplink communication with the RSU.

When packets are sent from the source node $I_{s}$ to the RSU, we assume that the network complies with the following routing and communication constraints.

1) Routing Constraint: A routing protocol, such as Ad-hoc On-Demand Distance Vector (AODV) [33], is utilized to facilitate minimum-hop packet delivery from the source node to the RSU. As a result, the routing protocol prevents the formation of any loops or back-hops. Formally, the packet flow ensures that a node in segment $A_{i}$, for $i\in[r]$, does not pass a packet to a node in segment $A_{j}$, where $j\in[r]$ and $i<j$.

2) Communication Constraints: We assume that nodes can communicate only within a specific distance, and all nodes have a uniform transmission range. We utilize the parameter $\beta$, where $\beta\in\mathbb{N}$, to represent the maximum number of contiguous segments a mobile node can communicate with. For instance, a node is in segment $A_{4}$ and $\beta=3$, it can transmit packets only to nodes inside segments $A_{4}$, $A_{3}$, $A_{2}$, or $A_{1}$, and correspondingly, it can directly receive packets from nodes in segments $A_{4}$, $A_{5}$, $A_{6}$, or $A_{7}$. We represent this communication constraint mathematically using the function $S:\Delta\rightarrow[r]$, which maps the segment identity $A_{i}$ into its numerical identity $i$, for $i\in[r]$. For any two consecutive nodes with identities $I_{i}$ and $I_{j}$ in a $h$-hop path; then they must adhere to the communication constraint $|S(g(I_{i}))-S(g(I_{j}))|\leq\beta$, where $i\neq j$ and $i,j\in[N]\backslash\{N-1\}\cup\{s\}$.

3) Relaxed-Privacy Constraints: We assume that the nodes have relaxed-privacy constraints with respect to their neighbors, i.e., nodes can explicitly share their segment IDs with their neighbors in contrast to the network model in [24, 25], where the nodes do not share their segment IDs with their neighbors.

4) Delay Constraints: To support low-latency constraints on the vehicular network, the underlying protocol desires to achieve low end-to-end delay while the packet traverses from $I_{S}$ to the RSU. Although the method in [24, 25] also achieves low end-to-end delay, we assume that delay constraints are more stringent in our network model.

Given the aforementioned network constraints, the nodes aim to encode information regarding their segment IDs and the path traversed by the packet, enabling spatial-provenance recovery at the RSU upon packet reception. In the next section, we introduce a Bloom filter [34] based data structure to accomplish the aforementioned objectives.

From the set of $N$ nodes in the network, a packet travels through a set of $h$ nodes, where $h\leq N$, before reaching the RSU. Assume in a $h$-hop path, nodes $I_{x}$, $I_{y}$, and $I_{z}$, where $x,y,z\in[N]\backslash\{N-1\}\cup\{s\}$, are directly connected neighbors within transmission range and the packet is forwarded from node $I_{z}$ to node $I_{y}$ and from $I_{y}$ to node $I_{x}$, forming $I_{z}\rightarrow I_{y}\rightarrow I_{x}$ packet flow as per the routing protocol defined in Section II-D. For the DDE embedding process onto $\textbf{BF}_{1}$, we assume that each node $I_{y}$, where $y\in[N]\backslash\{N-1\}\cup\{s\}$, is equipped with a pre-shared key with the RSU, denoted as $K_{y}$. As part of the packet forwarding process through a $h$-hop path, node $I_{y}$ dynamically generates a distinct double-edge ID denoted as $DEID_{(x,y,z)}$ using the node ID of its neighbors, i.e., $I_{x}$ and $I_{z}$. One such approach to produce $DEID_{(x,y,z)}$ involves utilizing $I_{x}$, $I_{y}$ and $I_{z}$ in conjunction with the key $K_{y}$ to derive a string $DEID_{(x,y,z)}=(I_{x}||I_{y}||I_{z}||K_{y})$, where $||$ represents a string concatenation operation. Note that the function $DEID_{(\cdot,\cdot,\cdot)}$, is not symmetric, i.e., $DEID_{(x,y,z)}$ is not equal to $DEID_{(z,y,x)}$, where $DEID_{(z,y,x)}=(I_{z}||I_{y}||I_{x}||K_{y})$ is the double-edge ID derived at node $I_{y}$ for the double-edge link from node $I_{x}$ to node $I_{y}$ and from node $I_{y}$ to node $I_{z}$. This double-edge ID creation happens on the fly during the packet transmission along the $h$-hop path. We assume that the RSU has access to the IDs and secret keys of all the nodes, allowing it to obtain a set of all double-edge IDs in the network, represented as $\mathcal{DE}=\{DEID_{(x,y,z)}~|~\forall~x,y,z\in[N]\backslash\{N-1\}\cup\{s\};~x\neq y,~y\neq z,~x\neq z\}$. Next, we will explain the ingredients for embedding segment IDs onto $\textbf{BF}_{2}$.

We assume that every node in the network knows its segment ID using the dictionary that the RSU broadcasts. To support low-latency, we assume that some intermediate nodes skip embedding their segment IDs on $\textbf{BF}_{2}$ to reduce end-to-end delay. The nodes that skip the embedding of their segment ID directly on $\textbf{BF}_{2}$ are termed forwarding nodes, and the nodes that embed their segment ID on $\textbf{BF}_{2}$ are termed embedding nodes. The forwarding nodes share their segment IDs explicitly with the embedding nodes. Subsequently, the embedding node will jointly perform the insertion operation of its own segment ID and the segment IDs of its neighbors on $\textbf{BF}_{2}$. BSE and TSE methods are also termed perfect neighbor location embedding methods because neighbors explicitly share their segment ID with an embedding node. Next, we will proceed towards the ingredients for embedding segment IDs in BSE and TSE.

To explain the provenance embedding process, we assume that the packets are forwarded from the source node $I_{s}$ through a $h$-hop path $I_{s}\rightarrow I_{j_{1}}\rightarrow I_{j_{2}}\rightarrow\ldots\rightarrow I_{j_{h-2}}\rightarrow I_{j_{h-1}}$, where $j\in[N]\backslash\{N-1\}$, before reaching the RSU. To start with, both Bloom filters are initialized to all-zero vectors, and the counter is also initialized to zero. Now, we will explain the embedding process of BSE followed by TSE.

When the packet reaches the RSU, the RSU recovers the path traveled by the packet and the corresponding segment IDs of the forwarding nodes. The recovery procedure has two stages: initially, the RSU retrieves the path traversed by the packet from the received $\textbf{BF}_{1}$, followed by the extraction of segment IDs from the received $\textbf{BF}_{2}$.

Utilizing $\textbf{BF}_{1}$, the RSU evaluates all prospective double-edges in the network, represented by $\mathcal{DE}$, to compile a set of recovered double-edges represented as $\hat{\mathcal{DE}}$, where $\hat{\mathcal{DE}}\subseteq\mathcal{DE}$. For retrieving the double-edges from $\textbf{BF}_{1}$, the RSU has all the necessary components, including node IDs $\{I_{y}\}$, packet ID $pid$, keys $\{K_{y}\}$, and double-edge IDs $\{DEID_{(x,y,z)}~|~x,y,z\in[N]\backslash\{N-1\}\cup\{s\}\}$. In this context, a recovered double-edge from node $I_{z}$ to node $I_{y}$ and from node $I_{y}$ to node $I_{x}$ fulfills the requirement of $\textbf{BF}_{1}[p_{x,y,z}^{(a)}]=1$ for all $k_{1}$ indices, defined by $\{p_{x,y,z}^{(a)}\in[1,m_{1}]~|~1\leq a\leq k_{1}\}$, which are subsequently created at the RSU utilizing the double-edge IDs and all other credentials in a manner analogous to (1). After that, the RSU employs a depth-first search algorithm on the retrieved set of double-edges $\hat{\mathcal{DE}}$ to derive a candidate set of $h$-hop paths from the source node $I_{s}$ to the RSU, denoted as $\mathcal{C}\triangleq\{\mathbf{c}_{1},\mathbf{c}_{2},\ldots,\mathbf{c}_{|\mathcal{C}|}\}$, where each $\mathbf{c}_{i}$ represents a $h$-hop path and $|\mathcal{C}|\in\mathbb{N}$.

From each candidate $h$-hop path $\mathbf{c}_{i}$ consisting of double-edges $\mathbf{c}_{i}=\{(I_{s},I_{i_{1}},I_{i_{2}}),(I_{i_{2}},I_{i_{3}},I_{i_{4}})\ldots(I_{i_{h-2}},I_{i_{h-1}},I_{N})\}$, the RSU extracts the set of unique node IDs, which are represented as $\mathcal{V}_{i}=\{I_{s},I_{i_{1}},I_{i_{2}},\ldots,I_{i_{h-1}}\}$. The set of unique node ID $\mathcal{V}_{i}$ is the ordered set of node IDs, where the cardinality of the set ${V}_{i}$ is $h$.

Recall that both BSE and TSE embed DDE in $\textbf{BF}_{1}$, incurring identical embedding cost $\mathcal{O}(\left\lfloor h/2\right\rfloor k_{1})$ along an $h$-hop path. The two schemes differ only in their use of $\textbf{BF}_{2}$, the embedding cost along an $h$-hop path is $\mathcal{O}(\left\lfloor h/2\right\rfloor k_{2})$ for BSE and $\mathcal{O}(\left\lfloor(h+1)/3\right\rfloor k_{2})$ for TSE. In contrast, the baseline LNE [24, Section III-B] incurs a embedding cost of $\mathcal{O}(hk_{1})$ for $\textbf{BF}_{1}$ and $\mathcal{O}(hk_{2}))$ for $\textbf{BF}_{2}$.

During recovery, both schemes first reconstruct the traversed path from $\textbf{BF}_{1}$, incurring a computation cost of $\mathcal{O}(N^{3}k_{1})$ at the RSU [17, Table 1]. Subsequently, the RSU verifies segment information using $\textbf{BF}_{2}$, which incurs a cost of $\mathcal{O}(hr\beta k_{2})$ for BSE (refer to Section III-D1) and $\mathcal{O}(hr\beta^{2}k_{2})$ for TSE (refer to Section III-D2). In contrast, the baseline LNE [24, Section III-B] incurs a cost of $\mathcal{O}(N^{2}k_{1})$ for $\textbf{BF}_{1}$ and $\mathcal{O}((h+1)rk_{2})$ for $\textbf{BF}_{2}$. Compared to LNE [24], BSE and TSE trade a modest increase in computation at the RSU for a substantial reduction in node-level computation. Given that the RSU is computationally more powerful, this additional overhead has a marginal impact on overall performance. At the RSU, transient storage per received packet is also $m_{1}+m_{2}$ bits. If the RSU stores all matching tuples for verification, the temporary storage requirement is $\mathcal{O}(hr\beta)$ for BSE and $\mathcal{O}(hr\beta^{2})$ for TSE. Before proceeding to find the optimal parameters for our network model, we evaluate the relaxed-privacy attributes of our proposed methodology in the next section.

In this section, we quantify the relaxed-privacy attributes of our method using entropy-based measures. In our model, vehicles reveal the segment ID deterministically, where GPS coordinates are mapped to segment IDs, thereby concealing fine-grained locations. Unlike approaches such as differential privacy and geo-indistinguishability [35], which add noise to location data, our framework implicitly introduces uncertainty since a vehicle’s exact GPS position remains uniformly distributed within a segment. We quantify this privacy using entropy-based methods and relate it to geo-indistinguishability.

Let the RSU coverage area of $y$ square meters be divided into $M\triangleq\frac{y}{\delta}$ Voronoi regions (as depicted in Fig. 1), where $\delta$ is the GPS resolution in square meters. When a vehicle shares its exact GPS location, the RSU resolves an uncertainty of $\log_{2}(M)$ bits. In our proposed framework, the coverage area is partitioned into $r$ segments, each containing $M/r$ Voronoi regions. Therefore, the RSU recovers only $\log_{2}(r)$ bits, leaving a residual uncertainty of $\log_{2}(M/r)$ bits. This residual uncertainty is the measure of relaxed-privacy adopted in this work.

Privacy is quantified as the residual uncertainty of an observer about the precise GPS location of a vehicle after packet observation, and the information gain is denoted as $\Delta H$ bits. Any forwarding node knows only that a packet originated from one of the $\beta$ upstream segments, giving a general prior uncertainty of $H^{prior}=\log_{2}(\beta M/r)$ bits. In LNE [24], no node explicitly shares its location with any neighbor. Therefore, $\Delta H=0$ bits at every forwarding node. In BSE (refer to Section III-C1), only $\lfloor h/2\rfloor$ embedding nodes out of $h$ forwarding nodes explicitly receive a segment ID from an immediate neighbor, reducing their posterior uncertainty to $H^{post}=\log_{2}(M/r)$ bits, resulting $\Delta H=\log_{2}(\beta)$ bits at embedding node. The remaining $\lceil h/2\rceil$ non-embedding nodes gain no information, i.e., $\Delta H=0$ bits. A similar analysis can be carried out for TSE, and the resulting uncertainties are summarized in Table IV. Across all three schemes, the RSU is able to recover only the segment IDs of forwarding nodes, resulting in $\Delta H=\log_{2}(r)$ bits. Non-authenticated nodes, which may act as eavesdroppers, have a wireless range assumed to be approximately $2\beta$ segments. Since segment IDs are embedded in Bloom filters and these nodes do not have $K_{y}$, their $\Delta H=0$ bits across all three schemes. As observed from Row 3 of Table IV, the privacy loss with respect to the neighboring nodes in TSE is twice that of BSE, while BSE incurs $\log_{2}(\beta)$ bits privacy loss with respect to the neighboring nodes compared to LNE [24].

Our privacy framework can also be interpreted through the lens of geo-indistinguishability [35]. Each GPS Voronoi area, denoted by $x$, is deterministically mapped to its corresponding segment $A_{i}$, for $i\in[r]$, and upon observing $A_{i}$, the RSU’s posterior becomes a uniform distribution over all GPS Voronoi areas within that segment. Consequently, for any two locations $x,x^{\prime}$ within the same segment $A_{i}$, their posterior distributions are identical which results in zero Kullback–Leibler (KL) divergence; hence there is zero loss of geo-indistinguishability within the segment. However, for $x\in A_{i}$ and $x^{\prime}\in A_{j}$ for $i\neq j$, the KL divergence is infinite, leading to maximum loss of geo-indistinguishability. In this case, the RSU accurately learns the segment IDs of the vehicles, without knowing the precise GPS Voronoi areas of the vehicles inside each segment. The binary behavior of the KL divergence, i.e., taking only values of zero or infinity, can be easily modeled using entropy-based uncertainty measures, which are sufficient to fully capture the privacy properties of the proposed framework, without loss of generality.

In the following section, we comprehensively study the false-positive events linked to our methodology and discuss optimizing the Bloom filter parameters for BSE and TSE.