Download - Personalized Location Privacy in Mobile Networks: A Social ...webhome.auburn.edu/...SGUM_location_privacy_slides.pdf · mobile networks, location-based services (LBS) have become

Personalized Location Privacy in Mobile Networks: A Social Group

Utility Approach

Xiaowen Gong, Xu Chen, Kai Xing, Dong-Hoon Shin, Mengyuan Zhang, Junshan Zhang

School of Electrical, Computer, and Energy Engineering Arizona State University

School of Computer Science and Technology University of Science and Technology of China

Presenter: Kai XingINFOCOM 2015, Hong Kong

April 29th, 2015

Location-Based Service• Location-based services (LBSs) are pervasive ✓ Most mobile devices are capable of localization based on

GPS or APs ✓ Useful for various purposes: navigation, recommendation,

advertising, notification… ✓ Provided in numerous applications: Google map, Facebook,

Twitter, Weibo, WeChat…

Privacy Threat in LBS• Threat: Location traces can be leaked to adversary, e.g.

untrusted LBS provider ✓ Remedy: Use pseudonym instead of real identity

• Threat: Adversary can infer a user’s real identity by linking different locations visited by its pseudonym, e.g., home and work addresses ✓ Remedy: Change pseudonym from time to time

“Alice” “Jane”

t1 t2

Pseudonym Change for Location Privacy

• Threat: Adversary can link different pseudonyms if only one user changes its pseudonym ✓ Remedy: Users in physical proximity change their

pseudonyms simultaneously to eliminate spatial-temporal correlation in their locations, so that adversary cannot distinguish new pseudonyms from one to another

“Alice”

“Jane”

“David”

“Bob” ?

?

t1 t2

Personalized Location Privacy• Existing work: Each user’s anonymity set is the set of all users ✓ Anonymity set: the set of users that cannot be distinguished

from a particular user after pseudonym change

Personalized Location Privacy in Mobile Networks:A Social Group Utility Approach

Xiaowen Gong∗, Xu Chen∗, Kai Xing†, Dong-Hoon Shin∗, Mengyuan Zhang∗, and Junshan Zhang∗∗School of Electrical, Computer and Energy Engineering

Arizona State University, Tempe, AZ 85287Email: {xgong9, xchen179, donghon.shin.2, mzhang72, junshan.zhang}@asu.edu

†School of Computer Science and TechnologyUniversity of Science and Technology of China, Hefei, Anhui 230027, China

Email: [email protected]

Abstract—With increasing popularity of location-based ser-vices (LBSs), there have been growing concerns for locationprivacy. To protect location privacy in a LBS, mobile users inphysical proximity can work in concert to collectively changetheir pseudonyms, in order to hide spatial-temporal correla-tion in their location traces. In this study, we leverage thesocial tie structure among mobile users to motivate them toparticipate in pseudonym change. Drawing on a social grouputility maximization (SGUM) framework, we cast users’ decisionmaking of whether to change pseudonyms as a socially-awarepseudonym change game (PCG). The PCG further assumes ageneral anonymity model that allows a user to have its specificanonymity set for personalized location privacy. For the SGUM-based PCG, we show that there exists a socially-aware Nashequilibrium (SNE), and quantify the system efficiency of the SNEwith respect to the optimal social welfare. Then we develop agreedy algorithm that myopically determines users’ strategies,based on the social group utility derived from only the userswhose strategies have already been determined. It turns out thatthis algorithm can efficiently find a Pareto-optimal SNE withsocial welfare higher than that for the socially-oblivious PCG,pointing out the impact of exploiting social tie structure. Wefurther show that the Pareto-optimal SNE can be achieved in adistributed manner.

I. INTRODUCTION

The proliferation of mobile devices is predicted to continuein the foreseeable future. In 2014, mobile phone shipmentsare projected to reach 1.9 billion units, about 7 times thatof desktop and laptop combined [1]. With rapid growth ofmobile networks, location-based services (LBS) have becomeincreasingly popular recently (e.g., location-based navigationand recommendation). However, the providers of LBSs areoften considered not trustworthy, due to the risk of leakingusers’ location information to other parties (e.g., sell users’location data). As a result, mobile users are exposed to poten-tial privacy threats when using a LBS. Although a user can usea pseudonym for the LBS, an adversary can infer the user’sreal identity from its location traces (e.g., from the user’s homeand work addresses). To protect location privacy, an effectiveapproach is to “confuse” the adversary using the notion ofanonymity [2]: mobile users in physical proximity can change

This research was supported in part by the U.S. NSF grants CNS-1422277,ECCS-1408409, CNS-1117462, DTRA grant HDTRA1-13-1-0029, and NSFCgrants 61332004, 61170267.

1 2 3 1 1 1 2 1 3

physical graph

Fig. 1. Illustration of the general anonymity model: each user specifies itsanonymity set for personalized location privacy by defining an anonymityrange, e.g., a disk centered at the user’s location. User 1 and 2 are out of user3’s anonymity range and thus are not in user 3’s anonymity set (representedby no direct edge from user 1 or 2 to user 3); user 1 and 3 are within user2’s anonymity range and thus are in user 2’s anonymity set (represented bydirected edges from user 1 and 3 to user 2).

their pseudonyms simultaneously to form an anonymity set,so that the adversary cannot distinguish any of them from theothers.

Clearly, as mobile devices are carried and operated byhuman beings, pseudonym change hinges heavily on humanbehavior. In particular, altruistic behaviors are widely observedamong people with social ties1. It is then natural to ask “Isit possible to leverage social ties for pseudonym change toenhance location privacy?” The past few years have witnessedexplosive growth of online social networks. In 2013, thenumber of online social network users worldwide has crossed1.73 billion, nearly one quarter of the world’s population [3].As a result, social relationships influence people’s interactionswith each other in an unprecedented manner. This motivatesus to exploit social ties among users for pseudonym change toimprove their location privacy. Since pseudonym change typ-ically incurs considerable overhead (e.g., service interruption,resource consumption [4]), users need strong incentives (e.g.,adequate privacy gain) to participate in pseudonym change.We caution that secure protocols are needed to hide users’real identities when social information is used (which will beelaborated further in Section IV-E).

A basic assumption commonly used in existing studies [4]–[6] is that all users participating in pseudonym change havethe same anonymity set. However, from an individual user’sperspective, the set of users that can obfuscate its pseudonym

1In this paper, “social tie” refers to “positive social tie” for brevity.

• Our motivation: Users can have different anonymity sets defined by anonymity ranges due to personalized needs, e.g., different beliefs of adversary power ✓ Anonymity range: A physical area (e.g., a disk) within which

the users constitute the anonymity set

Pseudonym Change Model• A physical graph represents whether a user is in another’s

anonymity set • Each user makes a decision whether to participate in

pseudonym change • Privacy gain depends on how many participating users in

the anonymity set • Pseudonym change incurs a cost due to, e.g., service

interruption • Individual utility

ci > 0

framework is developed in [7], [14], which captures the impactof users’ diverse social ties on the interactions of their devicessubject to diverse physical coupling. A primary merit of thisframework is that it provides rich modeling flexibility andspans the continuum between non-cooperative game and net-work utility maximization, two traditionally disjoint paradigmsfor network optimization.

III. MODEL AND PROBLEM FORMULATION

A. Privacy Threat in Location-based ServicesWe consider a mobile network where users obtain their

locations via mobile devices that are capable of localization(e.g., by GPS or wireless access points based localization).Users send their locations to a LBS provider for a certain LBS(e.g., location-based navigation or recommendation), and theLBS provider feedbacks the desired results to the users basedon their reported locations. To protect privacy, each user usesa pseudonym as its identity for the LBS.

As in [2], [6], [8], we assume that the LBS provideris untrusted, i.e., it may leak users’ location traces to anadversary. For example, the adversary may steal the locationdata by hacking into the LBS system. The adversary aimsto learn the real identity of a user by analyzing the locationsvisited by the user’s pseudonym. We also assume that users arehonest-but-curious in the sense that each user honestly followsthe protocols with others (which will be discussed in SectionIV-E), but is curious about others’ private information. Wefurther assume that the adversary may collude with a limitednumber of users to gain useful information for inferring auser’s real identity.

The use of pseudonym allows short-term reference to auser (e.g., one pseudonym can be used for the navigationof an entire trip between two locations), which is usefulfor many LBSs and does not disclose private information.However, long-term linking among a user’s locations should beprevented, as it may reveal sufficient information for inferringthe user’s real identity [9], [16], [17]. Although a user mayhide explicit linking among its locations by changing itspseudonym, the adversary can still link different pseudonymsof the user by exploiting the spatial-temporal correlation of itslocations. For example, consider a user that visits location l1with pseudonym Alice at time t1, and then visits location l2which is close to location l1 with pseudonym Bob at time t2.If the adversary observes from the location traces that no otheruser changes its pseudonym between time t1 and t2, or thereexists such a user but it does not visit any location close tolocation l1 or l2, then the adversary can infer that pseudonymAlice and Bob must refer to the same user, since only thesame user can visit both location l1 and l2 within the limitedperiod between time t1 and t2.

B. Pseudonym Change for Personalized Location PrivacyTo protect location privacy from inference attacks, an effec-

tive approach is based on the notion of anonymity: users inphysical proximity can coordinate their pseudonym changesto happen simultaneously [2], so that the adversary cannotlink their pseudonyms before the changes to their respective

pseudonyms after the changes. Existing studies [4]–[6] assumethat all users participating in pseudonym change have the sameanonymity set. However, based on an individual user’s beliefof the adversary’s power against its location privacy (e.g.,the adversary’s side information about that user), the set ofusers that it believes can obfuscate its pseudonym (i.e., itsanonymity set) can be different from that of another user. Thusmotivated, we consider a general anonymity model that canmeet users’ needs for personalized location privacy, dependingon users’ physical locations. In particular, each user specifiesan anonymity range (a physical area) such that the set of userswithin the anonymity range constitute that user’s potentialanonymity set. For example, a user’s anonymity range canbe a disk centered at the user’s location, with a large radiusindicating a low level of privacy sensitivity (as illustratedin Fig. 1). Note that for two users at different locations,their anonymity ranges are different even when they havethe same shape (e.g., two disks with the same radius butdifferent centers), and thus their potential anonymity sets canbe different.

Formally, consider a set of users N ! {1, · · · , N} whereeach user i makes a decision ai on whether or not to participatein pseudonym change, denoted by ai = 1 and ai = 0,respectively. Based on users’ physical locations, the privacygain perceived by a user participating in pseudonym changedepends on which users also participate. Each user i incursa cost of ci > 0 to participate in pseudonym change. Thiscost is due to a number of factors, e.g., the participating usersshould stop using the LBS for a period of time. Based onthe general anonymity model, the physical coupling amongusers can be captured by a physical graph (N , EP ), whereuser j is connected by a directed edge ePji ∈ EP to user iif user j is in user i’s potential anonymity set, denoted byNP

i− (i.e., j ∈ NPi−). Note that the physical coupling between

two users can be asymmetric. The privacy gain perceived by aparticipating user i is defined as its anonymity set size, i.e., thenumber of participating users in NP

i−. Note that the anonymityset size is a widely adopted privacy metric2 for anonymity-based approaches. For example, k-anonymity is used as theprivacy metric in [6], [8], where a user achieves locationprivacy if its pseudonym cannot be distinguished among kusers. Then the individual utility of user i, denoted by ui, isgiven by

ui(ai,a−i) ! aij∈NP

i−

aj − ci (1)

where a−i denotes the vector of the strategies of all usersexcept user i. If a user participates, its individual utility is itsprivacy gain minus its participation cost; otherwise, it is zero.Note that ci is a relative cost compared to privacy gain.

C. Social Group Utility Maximization (SGUM)

Social relationships play an increasingly important role inpeople’s interactions with each other. One important attribute

2Another privacy metric is the entropy of the adversary’s uncertainty of auser’s pseudonym. However, it is usually difficult to compute since it requiresprobability distribution which is difficult to attain.

NPi�

ai 2 {0, 1}

Pj2NP

i�aj

Social Group Utility Maximization• A social group utility maximization (SGUM) framework [Chen et al,

INFOCOM’14] ✓ Motivation: People are altruistic to their social “friends”, i.e., friends,

family, colleagues, etc ✓ Main idea: Capture diverse social ties among mobile users and

diverse physical relationships among mobile devices

Social Domain 1

2

3

4 5

Social Tie

Physical Domain

1 2

3

5 Physical Relationship 4

Fig. 2. Illustration of the social group utility maximization (SGUM)framework: a mobile network can be viewed as a virtual social networkunderlying a physical communication network. Mobile users have diversesocial ties in the social domain, while mobile devices have diverse physicalrelationships in the physical domain.

(i.e., its anonymity set) can be different from that of anotheruser, depending on users’ physical locations. For example,a user with a higher level of privacy sensitivity can have asmaller anonymity set than others. It is thus desirable to meetusers’ needs for personalized location privacy. To this end, weconsider a general anonymity model where a user can defineits specific anonymity set different from others’ (as illustratedin Fig. 1).

In this paper, we leverage the social tie structure amongmobile users to motivate them to participate in pseudonymchange. Drawing on a social group utility maximization(SGUM) framework recently developed in [7], we cast users’decision making of whether to participate in pseudonymchange as a socially-aware pseudonym change game (PCG).The SGUM framework captures the impact of users’ diversesocial ties on the interactions of their mobile devices subjectto diverse physical relationships (as illustrated in Fig. 2). ThePCG is based on a general anonymity model that allows eachuser to have its specific anonymity set. In the SGUM-basedPCG, each user aims to maximize its social group utility,defined as the sum of its individual utility and the weightedsum of its social friends’ individual utilities. For the SGUM-based PCG, we are interested in answering the followingimportant questions: Does the game admit a socially-awareNash equilibrium (SNE)? What is the system efficiency ofthe SNE? How can we efficiently find a SNE with desirablesystem efficiency?

The main contributions of this paper can be summarized asfollows.

• We propose a framework where the social tie structureamong mobile users is leveraged to motivate them toparticipate in pseudonym change, based on a generalanonymity model that allows each user to have its spe-cific anonymity set for personalized location privacy.Taking a social group utility approach, we cast users’decision making of whether to change pseudonyms as apseudonym change game.

• For the SGUM-based PCG, we first show that therealways exists a socially-aware Nash equilibrium. Then wequantify the system efficiency of the SNE by boundingthe gap between the optimal social welfare and the socialwelfare of the “best” SNE, which is the SNE that achieves

the maximum social welfare among all SNEs. We observethat the best SNE is difficult to compute in general, andthe often used best response updates would converge to aSNE with lower social welfare. We then develop a greedyalgorithm that myopically determines users’ strategies,based on the social group utility derived from only theusers whose strategies have already been determined. Itturns out that this algorithm can efficiently find a Pareto-optimal SNE with social welfare no less than that ofthe best SNE for the socially-oblivious PCG. We alsoshow that the social welfare of the Pareto-optimal SNEincreases as social ties increase, and its performance gapwith respect to the optimal social welfare is boundedabove. We further show that the Pareto-optimal SNE canbe achieved in a distributed manner.

• We evaluate the performance of the Pareto-optimal SNEby numerical results, which demonstrate that social wel-fare can be significantly improved by exploiting socialties.

The rest of this paper is organized as follows. Related workare reviewed in Section II. In Section III, we formulate thesocially-aware pseudonym change game based on a generalanonymity model for personalized location privacy, underthe social group utility maximization framework. Section IVfocuses on the analysis of the SGUM-based PCG. Numericalresults are presented in Section V. Section VI concludes thispaper.

II. RELATED WORK

With growing concerns for location privacy arising frompervasive mobile communication and computing, a great dealof research have been done to protect mobile users’ locationprivacy. This work falls in the category of anonymity-basedapproaches [2], [4]–[6], [8]. Earlier studies [2], [9] show thatan adversary can infer the real identity of a mobile user byanalyzing the spatial-temporal correlation of its location traces.To overcome this vulnerability, pseudonyms should not onlybe changed over time but also be obfuscated across spaceto prevent inference attacks. Inspired by the notion of k-anonymity, Beresford and Stajano [2] introduced the notionof mix zone. By changing pseudonyms within a mix zone,users can make their new pseudonyms undistinguishable to theadversary. While the mix zone model assumes that all usershave the same anonymity set, the general anonymity modelproposed in this paper allows each user to define its specificanonymity set different from others’. A few work have studiedusers’ interactions in pseudonym change based on game-theoretic models. The mix zone based pseudonym change hasbeen studied in [4] as a non-cooperative game with complete orincomplete information. Auction-based mechanisms have beendesigned in [6] to incentive users to participate in pseudonymchange. To our best knowledge, this paper is the first to exploitsocial relationships to improve location privacy by pseudonymchange.

The social aspect of mobile networking is an emergingparadigm for network design and optimization [7], [10]–[15]. Recently, a social group utility maximization (SGUM)

Social Group Utility Maximization✓ Social tie quantifies how much a user cares about another ✓ Social group utility

✓ Merit: Capture non-cooperative game (NCG) and network utility maximization (NUM) as special cases and span the continuum in between

of social relationship is that people are altruistic to their social“friends” (including friends, family, colleagues, etc.), as theycare about their social friends’ welfare. As a result, a userwould take into account the effect of its behavior on its socialfriends. Recently, a social group utility maximization frame-work has been developed in [7], which captures the impact ofmobile users’ diverse social ties on the interactions of theirmobile devices subject to diverse physical relationships.

Appealing to the SGUM framework [7], we model the socialtie structure among the users in N by a social graph (N , ES),where user i is connected by a directed edge eSij ∈ ES to userj if user i has a social tie with user j. We denote the socialtie (level) from user i to user j as sij . We assume that eachuser i’s social tie to itself is sii = 1, and we normalize useri’s social tie to user j = i as sij ∈ (0, 1], which quantifiesthe extent to which user i cares about user j relative to user icares about itself. We also assume that sij = 0 if no social tieexists from user i to user j. We define user i’s social groupN S

i+ as the set of users that user i has social ties with (i.e.,N S

i+ ! {j ∈ N|eSij ∈ ES}).To take into account the social ties among users, each user

i aims to maximize its social group utility, defined asfi(ai,a−i) ! ui(ai,a−i) +

j∈NSi+

sijuj(aj ,a−j). (2)

Note that a user’s social group utility consists of its own utilityand the weighted sum of the individual utilities of the usersin its social group. Therefore, the social group utility capturesboth physical coupling and social coupling among users in aunified way. Also note that a user does not need to know theindividual utilities of its social friends (which may be theirprivate information) to make the decision (as will be shownin equation (3)). In Section IV-E, we will discuss how socialinformation can be used while preserving the privacy of users’real identities with each other.

D. SGUM based Pseudonym Change GameBased on the SGUM framework, users’ socially-aware

decision making for pseudonym change boils down to asocial group utility maximization game. Specifically, each useri ∈ N is a player and its strategy3 is ai ∈ {0, 1}. Leta = (a1, · · · , an) denote the strategy profile consisting of allusers’ strategies. The payoff function of a user is defined asits social group utility function. Given the strategies of otherusers, each user i aims to choose the best response strategythat maximizes its social group utility:

maximizeai

fi(ai,a−i), ∀i ∈ N .

Similar in spirit to the Nash equilibrium of a standardnon-cooperative game, the notion of socially-aware Nashequilibrium (SNE) applies to the SGUM game.

Definition 1 (Socially-aware Nash Equilibrium [7]): Astrategy profile asne = (asne1 , · · · , asnen ) is a socially-awareNash equilibrium of the SGUM-based PCG if no user canimprove its social group utility by unilaterally changing itsstrategy, i.e.,

asnei = argmaxai


3As we focus on pure strategies in this work, we use “strategy” and “action”interchangeably.

Due to the rational and autonomous nature of users, a SNE isa stable outcome that is acceptable by all users.

For the sake of system efficiency, a natural objective is tomaximize the social welfare of the system, which is the totalindividual utility of all users denoted by v(a) ! i∈N ui(a).A strategy profile a∗ = (a∗1, · · · , a∗n) is social optimal [18]if it achieves the maximum social welfare among all profiles,i.e., v(a∗) ≥ v(a), ∀a. Although the social optimal profileis the best outcome in terms of system efficiency, it is oftennot acceptable by all users. Then, it is desirable to achieve the“best” SNE, i.e., the SNE that achieves the maximum socialwelfare among all SNEs (referred to as “the best SNE”).

Another desirable property for system efficiency is Pareto-optimality. A strategy profile apo = (apo1 , · · · , apon ) is Pareto-optimal [18] if there does not exist a Pareto-superior profilea′ = (a′1, · · · , a′n) such that no user achieves a worseindividual utility while at least one user achieves a betterindividual utility, i.e.,

ui(a′i,a

′−i) ≥ ui(a

poi ,apo

−i), ∀i ∈ Nwith at least one strict inequality.

For the SGUM-based PCG, we are interested in answeringthe following important questions:

• Does the game admit any SNE? If yes, what is the systemefficiency of the best SNE?

• How can we efficiently find a SNE? What is the systemefficiency of this SNE? Is it Pareto-optimal?

To answer these questions, in Section IV we will focus onthe analysis of the SGUM-based PCG.

IV. SOCIAL GROUP UTILITY MAXIMIZATION BASEDPSEUDONYM CHANGE GAME

A. Benchmark: Socially-oblivious Pseudonym Change GameAs the benchmark, we start with a basic case of the PCG:

the PCG for socially-oblivious users (SO-PCG), i.e., sij = 0,∀eSij ∈ N S . In this case, each user is selfish and the socialgroup utility degenerates to the individual utility.

For SO-PCG, there can exist multiple SNEs4 with differentvalues of social welfare (as illustrated in Fig. 3). For systemefficiency, it is desirable to achieve the best SNE, which isthe SNE that achieves the maximum social welfare among allSNEs. To find this SNE, we can use best response updatesas follows: with all users’ actions initially set to 1, each userasynchronously updates its action as its best response to otherusers’ actions (no two users update at the same time). Weillustrate how it works by an example in Fig. 3. We useN1(a) ! {i ∈ N|ai = 1} to denote the set of participatingusers. The above result is formally stated below.

Proposition 1: For SO-PCG, the best response updates canfind the SNE that achieves the maximum social welfare amongall SNEs.

Due to space limitation, the proof is given in our onlinetechnical report [19]. As the best SNE achieves the maximumsystem efficiency among all SNEs, we will use the best SNEfor SO-PCG as the benchmark for the general case of the PCG:the PCG for socially-aware users (SA-PCG).

4For SO-PCG, an SNE is equivalent to a NE for a standard non-cooperativegame. For consistency of terminology, we still call it “SNE” in this case.






j∈NSi+





maximizeai




asnei = argmaxai






ui(a′i,a

′−i) ≥ ui(a

poi ,apo













References 9

NCG NUM

Socially-Aware Socially-Oblivious Fully Altruistic

SGUM

Fig. 2.3 The social group utility maximization (SGUM) framework spans the continuum betweennon-cooperative game (NCG) and network utility maximization (NUM).

achieved by cooperating with other users). Furthermore, while each user in a coali-tional game can only participate in one coalition, a user in the SGUM game can bein multiple social groups of different users.

The SGUM is a general framework that can be applied for a wide range of wire-less networking applications. To get a more concrete sense of the framework, in therest of this brief, we will study its application in a number of specific contexts.

References

1. M. Osborne and A. Rubinstein, A course in game theory. MIT Press, 1994.

8 2 Social Group Utility Maximization Framework

1 2

3 4

SGUM

1 2

3 4 NCG

selfish 1 2

3 4

NUM

altruistic

Fig. 2.2 The social group utility maximization (SGUM) game captures non-cooperative game(NCG) and network utility maximization (NUM) as special cases.

Definition 2.1. A strategy profile x∗ = (x∗1, ...,x∗N) is a socially-aware Nash equi-

librium of the SGUM game if no player can improve its social group utility byunilaterally changing its strategy, i.e.,

x∗n = arg maxxn∈Xn

fn(xn,x−n),∀n ∈N .

It is worth noting that under different social graphs, the proposed SGUM gameformulation can provide rich flexibility for modeling network optimization prob-lems (as illustrated in Fig. 2.2). When the social graph consists of isolated nodeswith snm = 0 for any n,m ∈ N (i.e., all users are socially-oblivious), the SGUMgame degenerates to a standard non-cooperative game. When the social graph isfully meshed with edge weight snm = 1 for any n,m ∈N (i.e., all users are fully al-truistic), the SGUM game becomes a network utility maximization problem, whichaims to maximize the system-wide utility. The SGUM framework can be appliedwith general social graphs and thus can bridge the gap between non-cooperativegame and network utility maximization – two traditionally disjoint paradigms fornetwork optimization (as illustrated in Fig. 2.3). These two paradigms are capturedunder the SGUM framework as two special cases where no social tie exists amongusers, and all users are connected by strongest social ties, respectively.

We emphasize that the SGUM game is quite different from a coalitional game [9],since each user in the latter aims to maximize its individual benefit (although it is

• Each user aims to maximize its social group utility






j∈NSi+





maximizeai




asnei = argmaxai






ui(a′i,a

′−i) ≥ ui(a

poi ,apo













• Socially-aware Nash equilibrium (SNE): No user can improve its social group utility by unilaterally changing its strategy






j∈NSi+





maximizeai




asnei = argmaxai






ui(a′i,a

′−i) ≥ ui(a

poi ,apo













Questions: Does there exist a SNE? What is the efficiency of the SNE? How to find an efficient SNE?

SGUM based Pseudonym Change Game

✓ SNE is mutually acceptable for all users

• Benchmark: Socially-oblivious pseudonym change game (SO-PCG) ✓ Users are selfish: social group utility = individual utility ✓ Best response updates: With all users’ actions initially set to 1, each

user asynchronously updates its action to 0 if it increases its social group utility

Theorem: The best response updates finds the best SNE for SO-PCG.

✓ Best SNE: The SNE with the maximum social welfare among all SNEs

Socially-Oblivious Pseudonym Change Game

6

Algorithm 1: Compute the best SNE for SO-PCG1 a← (1, · · · , 1);2 while ∃i ∈ N such that ai = 1 and ui(1,a−i) < 0 do3 ai ← 0;4 end5 return ao ← a;



A. Benchmark: Socially-oblivious Pseudonym Change GameAs a benchmark, we start with a basic case of the PCG:

the PCG for socially-oblivious users (SO-PCG), i.e., sij = 0,∀i = j. In this case, each user is selfish and the social grouputility degenerates to the individual utility.

For SO-PCG, there can exist multiple SNEs4 with differentvalues of social welfare. For system efficiency, it is desirable toachieve the best SNE (i.e., the SNE that achieves the maximumsocial welfare among all SNEs). Let N1(a) ! {i ∈ N|ai = 1}and N0(a) ! {i ∈ N|ai = 0} denote the set of participatingusers and non-participating users under strategy profile a,respectively. For example, in Fig. 3, there are three SNEs a1,a2, and a3 with N1(a1) = {1, 2, 4, 5}, N1(a2) = {4, 5},and N1(a3) = ∅, respectively. We can see that a1 is Pareto-superior to a2, a3, and hence is the best SNE. To find thebest SNE, we can use best response updates as described inAlgorithm 1: with all users’ actions initially set to 1, eachuser asynchronously updates (i.e., no two users update at thesame time) its action from 1 to 0 if it increases its individualutility. For the example in Fig. 3, using Algorithm 1, we haveu6 = 2 − 2.2 < 0 ⇒ a6 = 0 ⇒ u3 = 0 − 0.5 < 0 ⇒a3 = 0 ⇒ a = (1, 1, 0, 1, 1, 0) is an SNE. We show that thealgorithm indeed finds the best SNE as follows.

Proposition 1: For SO-PCG, Algorithm 1 computes thebest SNE which achieves the maximum social welfare amongall SNEs.

Proof: For any user i with aoi = 0, let a′ be the strategyprofile right before user i’s action is changed from 1 to 0during the execution of Algorithm 1. Since ao

−i ≤ a′−i, we

have ui(1,ao−i) ≤ ui(1,a′

−i) < 0 due to the condition inline 2. Therefore, aoi = 0 is the best response strategy foruser i. According to the condition in line 2, aoj = 1 is thebest response strategy for any user j with aoj = 1. Thus thestrategy profile ao is an SNE.

Next we show that ao achieves the maximum social welfareamong all SNEs. It suffices to show that ao is Pareto-superiorto any other SNE. To this end, we first show that a profilea′ is not an SNE if N1(a′) \ N1(ao) = ∅. Suppose sucha′ is an SNE. Let i ∈ N1(a′) \ N1(ao) be the first useramong N1(a′) \ N1(ao) whose action is changed to 0, and


1 2

4 5

3

60.6 0.4 2.2

0.51.81.2

physical graph

Fig. 3. An example of SO-PCG. The number beside a user is its cost.

a be the profile right before that change. Since a′ ≤ a, wehave ui(a′) ≤ ui(a) < 0 = ui(0,a′

i−) due to that 0 is the bestresponse strategy. This shows that a′ is not an SNE. Therefore,for any SNE a′ other than ao, we must have a′ < ao. Thenfor each i ∈ N1(a′), we have ui(a′) ≤ ui(ao). For eachi ∈ N0(a′), since ao is an SNE, we have ui(a′) = 0 =ui(0,ao

−i) ≤ ui(ao). Therefore ao is Pareto-superior to a′.Thus we show that ao is the best SNE. "

As the best SNE achieves the maximum system efficiencyamong all SNEs, we will use the best SNE for SO-PCG asthe benchmark for the general case of the PCG: the PCG forsocially-aware users (SA-PCG), i.e., ∃i = j such that sij > 0.

B. Existence and Efficiency of SNEIn this subsection we study the existence and efficiency of

SNE for SA-PCG. We first establish the existence of SNE.Using (1) and (2), we have

fi(1,a−i)− fi(0,a−i)

= ui(1,a−i)− ui(0,a−i) +j∈Ni+

sij (uj(1,a−i)−uj(0,a−i))

=j∈Ni−

aj − ci +j∈Ni+

sijaj . (3)

It is clear from (3) that no user participating is always an SNE.Then we have the following result.

Theorem 1: For SA-PCG, there exists at least one SNE.Next we show an important property of the social group

utility function. It follows from (3) that

fi(1,a−i)− fi(0,a−i)− fi(1,a′−i)− fi(0,a

′−i)

=j∈Ni−

aj − ci+j∈Ni+

sijaj −j∈Ni−

a′j − ci+j∈Ni+

sija′j

=j∈Ni−

(aj − a′j) +j∈Ni+

sij(aj − a′j). (4)

Let a ≤ a′ denote entry-wise inequality (i.e., ai ≤ a′i, ∀i ∈N ). Using (4), we have the following result.

Lemma 1: If a−i ≤ a′−i, then fi(1,a−i) − fi(0,a−i) ≤

fi(1,a′−i)− fi(0,a′

−i).Remark 1: Pseudonym change is a behavior with network

effect such that each participating user benefits more whenmore users participate. As a result, Lemma 1 shows that auser’s social group utility is a supermodular function: themarginal gain of social group utility by participating increaseswhen more users participate. This implies that if a user’s best

An Example

3

4

1

5

2

6

physical graph1.2 1.8 0.5

0.6 0.4 2.2

i : ai = 0 i : ai = 1

An Example

3

4

1

5

2

6


0.6 0.4 2.2

i : ai = 0 i : ai = 1

u6 = 2� 2.2 < 0 ) a6 = 0

An Example

4

1

5

2

6

3


0.6 0.4 2.2

i : ai = 0 i : ai = 1

u6 = 2� 2.2 < 0 ) a6 = 0

u3 = 0� 0.5 < 0 ) a3 = 0

An Example

4

1

5

2

6

3


0.6 0.4 2.2

i : ai = 0 i : ai = 1

u6 = 2� 2.2 < 0 ) a6 = 0

u3 = 0� 0.5 < 0 ) a3 = 0

u1 = 2� 1.2 > 0

u2 = 2� 1.8 > 0

u4 = 1� 0.6 > 0

u5 = 2� 0.4 > 0

(1, 1, 0, 1, 1, 0) is an SNE

(1, 1, 0, 1, 1, 0) has a larger social welfare than the other SNEs:

(0, 0, 0, 1, 1, 0) and (0, 0, 0, 0, 0, 0)

Socially-Aware Pseudonym Change Game

Proposition: a�i a0�i ) fi(1,a�i)� fi(0,a�i) fi(1,a0�i)� fi(0,a

0�i).

• SNE always exists: No user participating (0,0,…,0) is always an SNE

• Insight: The social group utility function is supermodular since participating in pseudonym change presents network effect ✓ Implication: If the best response action is to participate, it remains so when more users participate; if the best response action is to not participate, it remains so when less users participate

Theorem: The performance gap between the best SNE and the optimal social welfare is upper bounded by .

1 2

4 5

3

60.6 0.4 2.2

0.51.81.2

physical graph

Fig. 3. An example of SO-PCG. The number beside a user is its cost. Usingbest response updates, we have u6 = 2 − 2.2 < 0 → a6 = 0 → u3 =0 − 0.5 < 0 → a3 = 0 → N1 = {1, 2, 4, 5}, which is a SNE. It is alsoPareto-superior to the other two SNEs with N1 = {4, 5} and N1 = ∅, andhence is the best SNE.

B. Existence and Efficiency of SNEWe next study SA-PCG. We first establish the existence of

SNE. Using (1) and (2), we havefi(1,a−i)− fi(0,a−i)

= ui(1,a−i)− ui(0,a−i) +j∈NS

i+


=j∈NP

i−

aj − ci +j∈NS

i+

sijaj . (3)

It is clear from (3) that no user participating is always a SNE.We thus conclude that at least one SNE exists.

Then we show an important property of the social grouputility function. It follows from (3) that


′−i)

=j∈NP

i−

aj − ci+j∈NS

i+

sijaj −j∈NP

i−

a′j − ci+j∈NS

i+

sija′j

=j∈NP

i−

(aj − a′j) +j∈NS

i+

sij(aj − a′j). (4)

Let a ≤ a′ denote entry-wise inequality (i.e., ai ≤ a′i, ∀i ∈N ). The property below follows from (4).

Property 1 (Supermodularity): If a−i ≤ a′−i, then

fi(1,a−i)− fi(0,a−i) ≤ fi(1,a′−i)− fi(0,a′

−i).Property 1 implies that if a user’s best response strategy

is to participate, then it remains the best response strategy ifmore users participate; if a user’s best response strategy is tonot participate, then it remains the best response strategy ifless users participate.

To quantify the system efficiency of the SNE, we provide abound of the gap between the social welfare of the best SNEand the optimal social welfare in the following result.

Theorem 1: The performance gap between the maximumsocial welfare among all SNEs and the optimal social welfareis upper bounded by i∈N j∈NS

i+(1− sij).

The proof is given in our online technical report [19].Theorem 1 shows that the performance gap decreases as socialties increase. In particular, when users are socially-oblivious(i.e., sij = 0, ∀eSij ∈ N S), the performance gap reaches themaximum, and the best SNE for SA-PCG degenerates to thebest SNE for SO-PCG; when users are fully altruistic (i.e.,sij = 1, ∀eSij ∈ N S), the performance gap becomes 0, andthe best SNE degenerates to the social optimal profile. Thisdemonstrates that the SNE spans the continuum between a NEfor a standard non-cooperative game and the optimal solutionfor network utility maximization, two traditionally disjointparadigms for network optimization.

1 20.81.51.5

1 20.8

physical graph social graph

Fig. 4. Using best response updates, we have f1(1, 1) − f1(0, 1) = 1 −1.5 + 0.8 > 0, f2(1, 1) − f2(1, 0) = 1 − 1.5 + 0.8 > 0, and henceN1 = {1, 2} is a SNE. However, it is not Pareto-optimal, since it is Paretoinferior to N1 = ∅ as u1(0, 0) = u2(0, 0) = 0 > 1 − 1.5 = u1(1, 1) =u2(1, 1). Furthermore, its social welfare is less than that with N1 = ∅ asv(1, 1) = −1 < 0 = v(0, 0), where N1 = ∅ is also a SNE for SO-PCG.

C. Computing Pareto-Optimal SNEIn this subsection, we turn our attention to finding a SNE

with desirable system efficiency.For the PCG for fully altruistic users (i.e., sij = 1, ∀eSij ∈

N S), it is clear that the social optimal profile a∗ is a SNE,and is the solution to the following problem:

maximizea

i∈Nai

j∈NPi−

aj − ci

subject to ai ∈ {0, 1}, ∀i ∈ N . (5)Observe that problem (5) is an integer quadratic programming,which is difficult to solve in general5. Since the PCG forfully altruistic users is a special case of SA-PCG, it is alsodifficult to compute the best SNE for SA-PCG. Based on thisobservation, our objective below is to efficiently compute aSNE with desirable system efficiency.

To compute a SNE of SA-PCG, a naive approach is to usebest response updates in a similar way as with SO-PCG: withall users’ actions initially set to 1, each user asynchronouslyupdates its action as its best response to other users’ actions.Due to Property 1, a user who changes its strategy from 1 to0 will never change it back to 1, and thus the best responseupdates always converges to a SNE. However, it has drawbacksas illustrated by an example in Fig. 4: the SNE may not bePareto-optimal and its social welfare may be worse than thatof a SNE for SO-PCG. Thus motivated, our objective belowis to efficiently find a SNE such that 1) it is Pareto-optimaland 2) its social welfare is no less than that of the best SNEfor SO-PCG, which is the benchmark.

1) Algorithm Design: To this end, we design an algorithmas described in Algorithm 1. The main idea of the algorithm isto greedily determine users’ strategies, depending on the socialgroup utility derived from the users whose strategies have beendetermined (referred to as “determined users”), denoted by

f ′i(ai,a−i) ! ui(ai,a−i) +

j∈NSi+\N

sijuj(ai,a−i)

where N denotes the set of users whose strategies have notbeen determined (referred to as “undetermined users”). An un-determined user’s action is fixed once it becomes determined.

Specifically, the algorithm proceeds in rounds and eachround consists of phase I and phase II. In phase I, with allundetermined users’ actions initially set to 1, an undetermineduser’s action is changed from 1 to 0 if that improves its socialgroup utility derived from the determined users, i.e.,f ′i(1,a−i)− f ′

i(0,a−i) = ui(1,a−i) +

j∈NSi+\N

sijaj < 0

5We conjecture that problem (5) is an NP-hard problem.

• Main idea of proof: Construct an SNE from the social optimal profile using best response updates and quantify the decrease in social welfare

• Observation: The bound decreases when social ties increases: it reaches maximum when users are selfish and becomes 0 when users are fully altruistic ✓ Implication: SNE spans the continuum between Nash equilibrium for NCG and social optimal solution for NUM

Socially-Aware Pseudonym Change Game

Computing SNE

• When users are fully altruistic, the social optimal profile is an SNE and is the solution to

1 2

4 5

3

60.6 0.4 2.2

0.51.81.2

physical graph




= ui(1,a−i)− ui(0,a−i) +j∈NS

i+


=j∈NP

i−

aj − ci +j∈NS

i+

sijaj . (3)




′−i)

=j∈NP

i−

aj − ci+j∈NS

i+

sijaj −j∈NP

i−

a′j − ci+j∈NS

i+

sija′j

=j∈NP

i−


i+

sij(aj − a′j). (4)








i+(1− sij).


1 20.81.51.5

1 20.8






maximizea

i∈Nai

j∈NPi−

aj − ci





j∈NSi+\N

sijuj(ai,a−i)



i(0,a−i) = ui(1,a−i) +

j∈NSi+\N

sijaj < 0


✓ Conjecture: This integer programming problem is NP-hard ✓ Difficulty: It is also NP-hard to find the best SNE

• Existence of the best SNE we can find it efficiently6=

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph

Fig. 5. An example that illustrates how Algorithm 1 works: The numberbeside a user is its cost; the number beside a social edge is its social tie.

until no such user exists. Then the undetermined users whoseactions remain 1 become determined and their actions are fixedto 1. In phase II, with all undetermined users’ actions initiallyset to 0, an undetermined user becomes determined and itsaction is fixed to 1 if that improves its social group utilityderived from the determined users, until no such user exists.The algorithm terminates when no undetermined user becomesdetermined during either phase I or phase II of a round.

Algorithm 1: Compute the Pareto-optimal SNE for SA-PCG

1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I

N ;5 while 9i 2 N such that

ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII

?;11 while 9i 2 N such that

ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;

We use an example in Fig. 5 to illustrate how Algorithm 1works and outline the steps as follows.

• Phase I of 1st round: u1 = 1 � 1.2 < 0 ! a1 = 0;u5 = 1� 1.5 < 0! a5 = 0; u4 = 0� 1.2 < 0! a4 =

0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I

= {2, 6}.• Phase II of 1st round: u5 + s56 = 1 � 1.5 + 0.6 > 0 !

a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II

= {1, 5}.• Phase I of 2nd round: u4 = 0 � 1.2 < 0 ! a4 = 0 !

u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI

= {3, 7, 8}.• Phase II of 2nd round: u4 + s43 + s48 = 0� 1.2+ 0.6+

0.8 > 0! a4 = 1; NII

= {4}.Since the size of the set of undetermined users N is upper

bounded by N , the computational complexity of phase I andphase II of a round is bounded by O(N2

). Since at leastone user is determined during a round, the algorithm mustterminate within N rounds. Therefore, the running time ofthe algorithm is bounded by O(N3

). In Section V, numericalresults will demonstrate that the computational complexity ofAlgorithm 1 is nearly a quadratic function of the number ofusers. In Section IV-D, we will discuss a distributed versionof Algorithm 1.

Theorem 2: For SA-PCG, the strategy profile ae

=

(ae1, · · · , aen) computed by Algorithm 1 is a Pareto-optimalSNE.

The proof is given in the Appendix. As the SNE computedby Algorithm 1 is Pareto-optimal, it is desirable for systemefficiency. Next we show that its social welfare is no less thanthat of the best SNE for SO-PCG. To this end, we first showthat the Pareto-optimal SNE is monotonically “increasing”with respect to social ties.

Theorem 3: For SA-PCG, when social ties increase (i.e.,s0ij

� sij

, 8i, j 2 N ), the corresponding Pareto-optimal SNEae

0satisfies that ae

0 � ae and v(ae

0) � v(ae

).The proof is given in our online technical report [19].

Intuitively, with larger social ties to other users, a user ismore likely to participate in favor of its social group utility,even at the cost of reducing its individual utility. Theorem 3confirms this intuition: as social ties become larger, more usersparticipate at the Pareto-optimal SNE. Furthermore, the socialwelfare of the Pareto-optimal SNE also increases.

When Algorithm 1 is used for SO-PCG, we can see that itworks exactly the same as the best response updates used tofind the best SNE for SO-PCG, and thus they find the sameprofile. Based on this observation, using Theorem 3, we havethe following result.

Corollary 1: The social welfare of the Pareto-optimal SNEfor SA-PCG is no less than that of the best SNE for SO-PCG.

Corollary 1 guarantees that the social welfare of the Pareto-optimal SNE is no less than the benchmark SNE for SO-PCG. In Section V, numerical results will demonstrate thatthe Pareto-optimal SNE is efficient, with a performance gainup to 20% over the benchmark.

2) Efficiency of Pareto-Optimal SNE: Next we investigatethe social welfare of the Pareto-optimal SNE compared to theoptimal social welfare. To this end, we first show that the setof participating users at the Pareto-optimal SNE is a subset ofthat at the social optimal profile.

Lemma 1: For SA-PCG, the Pareto-optimal SNE ae satisfiesthat ae a⇤.

The proof is given in our online technical report [19]. LetN� , N1(a⇤

)\N1(ae

) denote the set of users that participateunder the social optimal profile but not under the Pareto-optimal SNE. Using Lemma 1, we have the following result.

Theorem 4: The performance gap between the socialwelfare of the Pareto-optimal SNE and the optimal so-cial welfare is upper bounded by

Pi2N�

Pj2NP

i�\N�1 +

• A plausible approach: Use best response updates as for SO-PCG ✓ It always finds an SNE but the SNE can be inefficient: 1) it may be not Pareto-optimal; 2) its social welfare may be less than that of an SNE for SO-PCG ✓ Pareto-optimal: No other action profile can increase at least one

user’s individual utility without decreasing any user’s individual utility

1 2

4 5

3

60.6 0.4 2.2

0.51.81.2

physical graph




= ui(1,a−i)− ui(0,a−i) +j∈NS

i+


=j∈NP

i−

aj − ci +j∈NS

i+

sijaj . (3)




′−i)

=j∈NP

i−

aj − ci+j∈NS

i+

sijaj −j∈NP

i−

a′j − ci+j∈NS

i+

sija′j

=j∈NP

i−


i+

sij(aj − a′j). (4)








i+(1− sij).


1 20.81.51.5

1 20.8






maximizea

i∈Nai

j∈NPi−

aj − ci





j∈NSi+\N

sijuj(ai,a−i)



i(0,a−i) = ui(1,a−i) +

j∈NSi+\N

sijaj < 0


f1(1, 1)� f1(0, 1) = 1� 1.5 + 0.8 > 0,

f2(1, 1)� f2(1, 0) = 1� 1.5 + 0.8 > 0

) (1, 1) is an SNE

Computing SNE

(1, 1) is Pareto-inferior to another SNE (0, 0),

which is also an SNE for SO-PCG

Computing SNE

• Objective: Design a computationally efficient algorithm to find an SNE such that 1) it is Pareto-optimal; 2) it has a larger social welfare than the best SNE for the socially-oblivious case

• Main idea: Greedily determine users’ actions as 1 based on their social group utilities derived from the users whose actions have been determined

1 2

4 5

3

60.6 0.4 2.2

0.51.81.2

physical graph




= ui(1,a−i)− ui(0,a−i) +j∈NS

i+


=j∈NP

i−

aj − ci +j∈NS

i+

sijaj . (3)




′−i)

=j∈NP

i−

aj − ci+j∈NS

i+

sijaj −j∈NP

i−

a′j − ci+j∈NS

i+

sija′j

=j∈NP

i−


i+

sij(aj − a′j). (4)








i+(1− sij).


1 20.81.51.5

1 20.8






maximizea

i∈Nai

j∈NPi−

aj − ci





j∈NSi+\N

sijuj(ai,a−i)



i(0,a−i) = ui(1,a−i) +

j∈NSi+\N

sijaj < 0


N : set of undetermined users

✓ The running time of the algorithm is

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

Algorithm Design

NI : set of users that become

determined in phase I

NII : set of users that become

determined in phase II

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

✓ Phase I: An undetermined user’s action is changed to 0 if it increases ; The remaining undetermined users become determined with action 1

✓ Phase II: An undetermined user’s action is changed to 1 if it increases

7

response strategy is to participate, then it remains so if moreusers participate; if a user’s best response strategy is to notparticipate, then it remains the so if less users participate.


Theorem 2: The performance gap between the maximumsocial welfare among all SNEs and the optimal social welfareis upper bounded by i∈N j∈Ni+

(1− sij).Proof: We first show that we can construct an SNE from

the social optimal profile a∗ using best response updates: withall users’ actions initially set according to the social optimalprofile, a user’s action is changed from 1 to 0 if that canimprove its social group utility. To this end, we first show thatthis algorithm can terminate. Without loss of generality, weassume that there does not exist a′ with a′ > a∗ such thatv(a′) ≥ v(a∗). Suppose there exists i ∈ N0(a∗) such thatfi(1,a∗

−i) ≥ fi(0,a∗−i). Then we have

v(1,a∗−i)− v(0,a∗

−i) = ui(1,a∗−i) +

j∈Ni+

aj

≥ ui(1,a∗−i) +

j∈Ni+

sijaj = fi(1,a∗−i)− fi(0,a

∗−i) ≥ 0

where the first equality follows a similar manipulation as in(3), and the second equality follows from (3). This contradictsthe previous assumption. Therefore we must have fi(1,a∗

−i) <fi(0,a∗

−i) for each i ∈ N0(a∗). Then, according to Lemma 1,the algorithm must terminate and results in a profile ab, whichis an SNE and satisfies that a∗ ≥ ab.

Next we show an upper bound on v(a∗) − v(ab). For anyi ∈ N1(a∗) \ N1(ab), let a be the profile right before ai ischanged to 0 in the algorithm. Then we have

v∆i ! v(1, a−i)− v(0, a−i) = ui(1, a−i) +j∈Ni+

aj

= ui(1, a−i) +j∈Ni+

sij aj +j∈Ni+

(1− sij)aj

= fi(1, a−i)− fi(0, a−i) +j∈Ni+

(1− sij)aj

<j∈Ni+

(1− sij)aj ≤j∈Ni+

(1− sij)

where the last equality follows from (3), and the first inequalityis due to that 0 is the best response strategy. Therefore we have

v(a∗)− v(ab) =i∈N1(a∗)\N1(ab)

v∆i ≤i∈N j∈Ni+

(1− sij).

"Remark 2: Theorem 2 shows that the performance gap

decreases as social ties increase. In particular, when users aresocially-oblivious (i.e., sij = 0, ∀i = j), the performancegap reaches the maximum, and the best SNE for SA-PCGdegenerates to the best SNE for SO-PCG; when users arefully altruistic (i.e., sij = 1, ∀i = j), the performance gapbecomes 0, and the best SNE degenerates to the social optimalstrategy profile. This demonstrates that the best SNE spans thecontinuum between a NE for a standard non-cooperative game

1 20.81.51.5

1 20.8


Fig. 4. An example of SA-PCG shows that best response updates can findan SNE that is not Pareto-optimal and has a lower social welfare than an SNEfor SO-PCG.

and the optimal solution for network utility maximization, twotraditionally disjoint paradigms for network optimization.

C. Computing SNE

In this subsection, we turn our attention to finding an SNEwith desirable properties.

For the PCG for fully altruistic users (i.e., sij = 1, ∀i = j),we can see that the social optimal strategy profile a∗ is anSNE, and is the solution to the following problem:

maximizea

i∈Nai

j∈Ni−

aj − ci

subject to ai ∈ {0, 1}, ∀i ∈ N . (5)

Note that problem (5) is an integer quadratic programming,which is in general difficult to solve5. Since the PCG forfully altruistic users is a special case of SA-PCG, it is alsodifficult to compute the best SNE for SA-PCG. Based on thisobservation, our objective below is to efficiently compute anSNE with other desirable properties.

To compute an SNE for SA-PCG, a plausible approach is touse best response updates in a similar way as Algorithm 1 forSO-PCG: with all users’ actions initially set to 1, each userasynchronously updates its action from 1 to 0 if it increases itssocial group utility. Using Lemma 1, we can show that suchbest response updates always converge to an SNE. However,it has drawbacks: the SNE may not be Pareto-optimal and itssocial welfare may be worse than that of an SNE for SO-PCG.For example, in Fig. 4, using best response updates, we havef1(1, 1)− f1(0, 1) = 1− 1.5 + 0.8 > 0, f2(1, 1)− f2(1, 0) =1 − 1.5 + 0.8 > 0, and hence a1 with N1(a1) = {1, 2} isan SNE. However, it is not Pareto-optimal, since it is Paretoinferior to a2 with N1(a2) = ∅ as u1(0, 0) = u2(0, 0) = 0 >1−1.5 = u1(1, 1) = u2(1, 1). Furthermore, the social welfareof a1 is less than that of a2 as v(1, 1) = −1 < 0 = v(0, 0),where a2 is also an SNE for SO-PCG. Thus motivated, ourobjective below is to efficiently find an SNE such that 1) it isPareto-optimal and 2) its social welfare is no less than that ofthe best SNE for SO-PCG, which is the benchmark.



j∈Ni+\N

sijuj(ai,a−i)


7

response strategy is to participate, then it remains so if moreusers participate; if a user’s best response strategy is to notparticipate, then it remains the so if less users participate.


Theorem 2: The performance gap between the maximumsocial welfare among all SNEs and the optimal social welfareis upper bounded by i∈N j∈Ni+

(1− sij).Proof: We first show that we can construct an SNE from

the social optimal profile a∗ using best response updates: withall users’ actions initially set according to the social optimalprofile, a user’s action is changed from 1 to 0 if that canimprove its social group utility. To this end, we first show thatthis algorithm can terminate. Without loss of generality, weassume that there does not exist a′ with a′ > a∗ such thatv(a′) ≥ v(a∗). Suppose there exists i ∈ N0(a∗) such thatfi(1,a∗

−i) ≥ fi(0,a∗−i). Then we have

v(1,a∗−i)− v(0,a∗

−i) = ui(1,a∗−i) +

j∈Ni+

aj

≥ ui(1,a∗−i) +

j∈Ni+

sijaj = fi(1,a∗−i)− fi(0,a

∗−i) ≥ 0

where the first equality follows a similar manipulation as in(3), and the second equality follows from (3). This contradictsthe previous assumption. Therefore we must have fi(1,a∗

−i) <fi(0,a∗

−i) for each i ∈ N0(a∗). Then, according to Lemma 1,the algorithm must terminate and results in a profile ab, whichis an SNE and satisfies that a∗ ≥ ab.

Next we show an upper bound on v(a∗) − v(ab). For anyi ∈ N1(a∗) \ N1(ab), let a be the profile right before ai ischanged to 0 in the algorithm. Then we have

v∆i ! v(1, a−i)− v(0, a−i) = ui(1, a−i) +j∈Ni+

aj

= ui(1, a−i) +j∈Ni+

sij aj +j∈Ni+

(1− sij)aj

= fi(1, a−i)− fi(0, a−i) +j∈Ni+

(1− sij)aj

<j∈Ni+

(1− sij)aj ≤j∈Ni+

(1− sij)

where the last equality follows from (3), and the first inequalityis due to that 0 is the best response strategy. Therefore we have

v(a∗)− v(ab) =i∈N1(a∗)\N1(ab)

v∆i ≤i∈N j∈Ni+

(1− sij).

"Remark 2: Theorem 2 shows that the performance gap

decreases as social ties increase. In particular, when users aresocially-oblivious (i.e., sij = 0, ∀i = j), the performancegap reaches the maximum, and the best SNE for SA-PCGdegenerates to the best SNE for SO-PCG; when users arefully altruistic (i.e., sij = 1, ∀i = j), the performance gapbecomes 0, and the best SNE degenerates to the social optimalstrategy profile. This demonstrates that the best SNE spans thecontinuum between a NE for a standard non-cooperative game

1 20.81.51.5

1 20.8


Fig. 4. An example of SA-PCG shows that best response updates can findan SNE that is not Pareto-optimal and has a lower social welfare than an SNEfor SO-PCG.

and the optimal solution for network utility maximization, twotraditionally disjoint paradigms for network optimization.

C. Computing SNE

In this subsection, we turn our attention to finding an SNEwith desirable properties.

For the PCG for fully altruistic users (i.e., sij = 1, ∀i = j),we can see that the social optimal strategy profile a∗ is anSNE, and is the solution to the following problem:

maximizea

i∈Nai

j∈Ni−

aj − ci

subject to ai ∈ {0, 1}, ∀i ∈ N . (5)

Note that problem (5) is an integer quadratic programming,which is in general difficult to solve5. Since the PCG forfully altruistic users is a special case of SA-PCG, it is alsodifficult to compute the best SNE for SA-PCG. Based on thisobservation, our objective below is to efficiently compute anSNE with other desirable properties.

To compute an SNE for SA-PCG, a plausible approach is touse best response updates in a similar way as Algorithm 1 forSO-PCG: with all users’ actions initially set to 1, each userasynchronously updates its action from 1 to 0 if it increases itssocial group utility. Using Lemma 1, we can show that suchbest response updates always converge to an SNE. However,it has drawbacks: the SNE may not be Pareto-optimal and itssocial welfare may be worse than that of an SNE for SO-PCG.For example, in Fig. 4, using best response updates, we havef1(1, 1)− f1(0, 1) = 1− 1.5 + 0.8 > 0, f2(1, 1)− f2(1, 0) =1 − 1.5 + 0.8 > 0, and hence a1 with N1(a1) = {1, 2} isan SNE. However, it is not Pareto-optimal, since it is Paretoinferior to a2 with N1(a2) = ∅ as u1(0, 0) = u2(0, 0) = 0 >1−1.5 = u1(1, 1) = u2(1, 1). Furthermore, the social welfareof a1 is less than that of a2 as v(1, 1) = −1 < 0 = v(0, 0),where a2 is also an SNE for SO-PCG. Thus motivated, ourobjective below is to efficiently find an SNE such that 1) it isPareto-optimal and 2) its social welfare is no less than that ofthe best SNE for SO-PCG, which is the benchmark.



j∈Ni+\N

sijuj(ai,a−i)


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8

social graph0.5 0.8 0.6

0.6 0.5 0.2

0.2 0.3 0.3 0.8

• Phase I of 1st round1.2 0.6 2.5 1.2

1.5 0.8 2.2 0.8

i : ai = 0 i : ai = 1 i : user i is determined

An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u1 = 1� 1.2 < 0 ) a1 = 0


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u1 = 1� 1.2 < 0 ) a1 = 0

u5 = 1� 1.5 < 0 ) a5 = 0


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u1 = 1� 1.2 < 0 ) a1 = 0

u5 = 1� 1.5 < 0 ) a5 = 0

u4 = 0� 1.2 < 0 ) a4 = 0


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u1 = 1� 1.2 < 0 ) a1 = 0

u5 = 1� 1.5 < 0 ) a5 = 0

u4 = 0� 1.2 < 0 ) a4 = 0

u3 = 2� 2.5 < 0 ) a3 = 0


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u1 = 1� 1.2 < 0 ) a1 = 0

u5 = 1� 1.5 < 0 ) a5 = 0

u4 = 0� 1.2 < 0 ) a4 = 0

u3 = 2� 2.5 < 0 ) a3 = 0

u7 = 2� 2.2 < 0 ) a7 = 0


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u1 = 1� 1.2 < 0 ) a1 = 0

u5 = 1� 1.5 < 0 ) a5 = 0

u4 = 0� 1.2 < 0 ) a4 = 0

u3 = 2� 2.5 < 0 ) a3 = 0

u7 = 2� 2.2 < 0 ) a7 = 0

u8 = 0� 0.8 < 0 ) a8 = 0


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u1 = 1� 1.2 < 0 ) a1 = 0

u5 = 1� 1.5 < 0 ) a5 = 0

u4 = 0� 1.2 < 0 ) a4 = 0

u3 = 2� 2.5 < 0 ) a3 = 0

u7 = 2� 2.2 < 0 ) a7 = 0

u8 = 0� 0.8 < 0 ) a8 = 0

u2 = 1� 0.6 > 0

u6 = 1� 0.8 > 0

NI = {2, 6}


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8

• Phase II of 1st round1.2 0.6 2.5 1.2

1.5 0.8 2.2 0.8


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u5 + s56 = 1� 1.5 + 0.6 > 0 ) a5 = 1


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u5 + s56 = 1� 1.5 + 0.6 > 0 ) a5 = 1

u1 + s12 = 1� 1.2 + 0.5 > 0 ) a1 = 1


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u5 + s56 = 1� 1.5 + 0.6 > 0 ) a5 = 1

u1 + s12 = 1� 1.2 + 0.5 > 0 ) a1 = 1

u3 + s32 = 1� 2.5 + 0.8 < 0

u7 + s76 = 1� 2.2 + 0.5 < 0

u4 = 0� 1.2 < 0

u8 = 0� 0.8 < 0

NII = {1, 5}


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8

• Phase I of 2nd round1.2 0.6 2.5 1.2

1.5 0.8 2.2 0.8


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u4 = 0� 1.2 < 0 ) a4 = 0


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8


1.5 0.8 2.2 0.8

u4 = 0� 1.2 < 0 ) a4 = 0

u3 + s32 = 2� 2.5 + 0.8 > 0

u7 + s76 = 2� 2.2 + 0.5 > 0

u8 = 1� 0.8 > 0

NI = {3, 7, 8}


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8

• Phase II of 2nd round1.2 0.6 2.5 1.2

1.5 0.8 2.2 0.8


An Example

3 4

5

1

6

2

7 8

physical graph

3 4

5

1

6

2

7 8


0.6 0.5 0.2

0.2 0.3 0.3 0.8

• Phase II of 2nd round1.2 0.6 2.5 1.2

1.5 0.8 2.2 0.8

u4 + s43 + s48 = 0� 1.2 + 0.6 + 0.8 > 0 ) a4 = 1

NII = {4}


Property of the SNE

Theorem: The action profile computed by Algorithm 1 is an SNE and is Pareto-optimal.

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

Theorem: When social ties increase, the new SNE satisfies that and .

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

• Observation: The set of participating users is monotonically expanding and the social welfare is increasing with social ties ✓ Insight: A user with larger social ties to others is more likely to

participate for its social group utility even it reduces its individual utility ✓ Insight: The social group utility function is supermodular ✓ Insight: Each additional participating user increases social welfare

Property of the SNE• Observation: When Algorithm 1 is used for SO-PCG, it is equivalent to

the best response updates that find the best SNE for SO-PCG

Corollary: The social welfare of is no less than that of the best SNE for SO-PCG.

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

6

Algorithm 1: Compute the best SNE for SO-PCG1 a← (1, · · · , 1);2 while ∃i ∈ N such that ai = 1 and ui(1,a−i) < 0 do3 ai ← 0;4 end5 return ao ← a;



A. Benchmark: Socially-oblivious Pseudonym Change GameAs a benchmark, we start with a basic case of the PCG:

the PCG for socially-oblivious users (SO-PCG), i.e., sij = 0,∀i = j. In this case, each user is selfish and the social grouputility degenerates to the individual utility.

For SO-PCG, there can exist multiple SNEs4 with differentvalues of social welfare. For system efficiency, it is desirable toachieve the best SNE (i.e., the SNE that achieves the maximumsocial welfare among all SNEs). Let N1(a) ! {i ∈ N|ai = 1}and N0(a) ! {i ∈ N|ai = 0} denote the set of participatingusers and non-participating users under strategy profile a,respectively. For example, in Fig. 3, there are three SNEs a1,a2, and a3 with N1(a1) = {1, 2, 4, 5}, N1(a2) = {4, 5},and N1(a3) = ∅, respectively. We can see that a1 is Pareto-superior to a2, a3, and hence is the best SNE. To find thebest SNE, we can use best response updates as described inAlgorithm 1: with all users’ actions initially set to 1, eachuser asynchronously updates (i.e., no two users update at thesame time) its action from 1 to 0 if it increases its individualutility. For the example in Fig. 3, using Algorithm 1, we haveu6 = 2 − 2.2 < 0 ⇒ a6 = 0 ⇒ u3 = 0 − 0.5 < 0 ⇒a3 = 0 ⇒ a = (1, 1, 0, 1, 1, 0) is an SNE. We show that thealgorithm indeed finds the best SNE as follows.

Proposition 1: For SO-PCG, Algorithm 1 computes thebest SNE which achieves the maximum social welfare amongall SNEs.

Proof: For any user i with aoi = 0, let a′ be the strategyprofile right before user i’s action is changed from 1 to 0during the execution of Algorithm 1. Since ao

−i ≤ a′−i, we

have ui(1,ao−i) ≤ ui(1,a′

−i) < 0 due to the condition inline 2. Therefore, aoi = 0 is the best response strategy foruser i. According to the condition in line 2, aoj = 1 is thebest response strategy for any user j with aoj = 1. Thus thestrategy profile ao is an SNE.

Next we show that ao achieves the maximum social welfareamong all SNEs. It suffices to show that ao is Pareto-superiorto any other SNE. To this end, we first show that a profilea′ is not an SNE if N1(a′) \ N1(ao) = ∅. Suppose sucha′ is an SNE. Let i ∈ N1(a′) \ N1(ao) be the first useramong N1(a′) \ N1(ao) whose action is changed to 0, and


1 2

4 5

3

60.6 0.4 2.2

0.51.81.2

physical graph

Fig. 3. An example of SO-PCG. The number beside a user is its cost.

a be the profile right before that change. Since a′ ≤ a, wehave ui(a′) ≤ ui(a) < 0 = ui(0,a′

i−) due to that 0 is the bestresponse strategy. This shows that a′ is not an SNE. Therefore,for any SNE a′ other than ao, we must have a′ < ao. Thenfor each i ∈ N1(a′), we have ui(a′) ≤ ui(ao). For eachi ∈ N0(a′), since ao is an SNE, we have ui(a′) = 0 =ui(0,ao

−i) ≤ ui(ao). Therefore ao is Pareto-superior to a′.Thus we show that ao is the best SNE. "

As the best SNE achieves the maximum system efficiencyamong all SNEs, we will use the best SNE for SO-PCG asthe benchmark for the general case of the PCG: the PCG forsocially-aware users (SA-PCG), i.e., ∃i = j such that sij > 0.

B. Existence and Efficiency of SNEIn this subsection we study the existence and efficiency of

SNE for SA-PCG. We first establish the existence of SNE.Using (1) and (2), we have

fi(1,a−i)− fi(0,a−i)

= ui(1,a−i)− ui(0,a−i) +j∈Ni+


=j∈Ni−

aj − ci +j∈Ni+

sijaj . (3)

It is clear from (3) that no user participating is always an SNE.Then we have the following result.

Theorem 1: For SA-PCG, there exists at least one SNE.Next we show an important property of the social group

utility function. It follows from (3) that


′−i)

=j∈Ni−

aj − ci+j∈Ni+

sijaj −j∈Ni−

a′j − ci+j∈Ni+

sija′j

=j∈Ni−

(aj − a′j) +j∈Ni+

sij(aj − a′j). (4)

Let a ≤ a′ denote entry-wise inequality (i.e., ai ≤ a′i, ∀i ∈N ). Using (4), we have the following result.

Lemma 1: If a−i ≤ a′−i, then fi(1,a−i) − fi(0,a−i) ≤

fi(1,a′−i)− fi(0,a′

−i).Remark 1: Pseudonym change is a behavior with network

effect such that each participating user benefits more whenmore users participate. As a result, Lemma 1 shows that auser’s social group utility is a supermodular function: themarginal gain of social group utility by participating increaseswhen more users participate. This implies that if a user’s best

vs.

Algorithm 1

Best response updates for SO-PCG

8

Algorithm 2: Compute the SNE for SA-PCG1 N ← N ;2 repeat3 // Phase I;4 a← (1, · · · , 1), NI ← N ;5 while ∃i ∈ N such that

ui(1,a−i) + j∈Ni+\N sijaj < 0 do6 ai ← 0, NI ← NI \ {i};7 end8 // Phase II;9 N ← N \ NI , NII ← ∅;

10 while ∃i ∈ N such thatui(1,a−i) + j∈Ni+\N sijaj ≥ 0 do

11 ai ← 1, N ← N \ {i}, NII ← NII ∪ {i};12 end13 until NI ∪NII = ∅;14 return ae ← a;


Specifically, the algorithm proceeds in rounds and eachround consists of phase I and phase II. In phase I, with allundetermined users’ actions initially set to 1, an undetermineduser’s action is changed from 1 to 0 if it increases its socialgroup utility derived from the determined users, i.e.,

f ′i(1,a−i)− f ′

i(0,a−i) = ui(1,a−i) +

j∈Ni+\N

sijaj < 0

until no such user exists. Then the undetermined users whoseactions remain 1 become determined and their actions arefixed to 1. In phase II, with all undetermined users’ actionsinitially set to 0, an undetermined user becomes determinedand its action is fixed to 1 if it increases its social group utilityderived from the determined users, until no such user exists.The algorithm terminates when no undetermined user becomesdetermined during either phase I or phase II of a round.


• Phase I of 1st round: u1 = 1 − 1.2 < 0 ⇒ a1 = 0;u5 = 1− 1.5 < 0⇒ a5 = 0; u4 = 0− 1.2 < 0⇒ a4 =0 ⇒ u3 = 2 − 2.5 < 0 ⇒ a3 = 0; u7 = 2 − 2.2 < 0 ⇒a7 = 0⇒ u8 = 0−0.8 < 0⇒ a8 = 0; u2 = 1−0.6 > 0;u6 = 1− 0.8 > 0; NI = {2, 6}.

• Phase II of 1st round: u5 + s56 = 1 − 1.5 + 0.6 > 0 ⇒a5 = 1 ⇒ u1 + s12 = 1 − 1.2 + 0.5 > 0 ⇒ a1 = 1;u3+s32 = 1−2.5+0.8 < 0; u7+s76 = 1−2.2+0.5 < 0;u4 = 0− 1.2 < 0; u8 = 0− 0.8 < 0; NII = {1, 5}.

• Phase I of 2nd round: u4 = 0 − 1.2 < 0 ⇒ a4 = 0 ⇒u3+s32 = 2−2.5+0.8 > 0; u7+s76 = 2−2.2+0.5 > 0;u8 = 1− 0.8 > 0; NI = {3, 7, 8}.

• Phase II of 2nd round: u4 + s43 + s48 = 0− 1.2+ 0.6+0.8 > 0⇒ a4 = 1; NII = {4}.

Since the size of the set of undetermined users N is upper

1 2

5 6

3

71.5 0.8 2.2

2.50.61.24

8

0.8

1.2

1 2

5 6

3

7

4

80.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph


bounded by N , the computational complexity of phase I andphase II of a round is bounded by O(N2). Since at leastone user is determined during a round, the algorithm mustterminate within N rounds. Therefore, the running time ofthe algorithm is bounded by O(N3). In Section V, numericalresults will demonstrate that the computational complexity ofAlgorithm 2 is nearly a quadratic function of the number ofusers. In Section IV-D, we will propose a distributed versionof Algorithm 2.

2) Properties of the SNE: We first show that Algorithm 2can find an SNE.

Theorem 3: For SA-PCG, Algorithm 2 computes an SNE.Proof: We consider three cases of each user i as follows.Case 1: i ∈ N1(ae) and i ∈ NI,k

Let a′ be the profile right after phase I during which iremains in NI . Since ae ≥ a′, using (3) we have

fi(1,ae−i)− fi(0,a

e−i) ≥ ui(1,a

′−i) +

j∈Ni+\N

sija′j ≥ 0

where the second inequality is due to the condition in line 5.Case 2: i ∈ N1(ae) and i ∈ NII,k

Let a′ be the profile right after i becomes determined inphase II. Since ae ≥ a′, using (3) we have


e−i) ≥ ui(1,a

′−i) +

j∈Ni+\N

sija′j ≥ 0

where the second inequality is due to the condition in line 10.Case 3: i ∈ N0(ae)Since i is not included in NII in phase II of the last round,

using (3) we have


e−i) = ui(1,a

′−i) +

j∈Ni+\N

sija′j < 0

where the inequality is due to the condition in line 10. !As the strategy profile computed by Algorithm 2 is an

SNE, it is acceptable for all users. We give another desirableproperty as follows.

Definition 4 (Socially-aware Coalition-Proof): Astrategy profile ascp = {ascp1 , · · · , ascpn } is socially-awarecoalition-proof if no set of users N ′ ⊆ N can change

Efficiency of the SNE

• Observation: The bound decreases when social ties increase: When users are fully altruistic, the second part becomes 0, while the first part can be greater than 0 ✓ Insight: The first part of the bound is due to the fact that we trade the optimality of the SNE (in terms of social welfare among all SNEs) for computational tractability

Theorem: The performance gap between the social welfare of and the optimal social welfare is upper bounded by .

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

Pi2N�

Pj2NS

i+\N�(1 � s

ij

). Furthermore, this bound de-creases as social ties increase.

The proof is given in our online technical report [19].Theorem 4 shows that the performance gap decreases as socialties increase. The first part of the performance bound is dueto the fact that we trade the social welfare optimality of thecomputed SNE (among all SNEs) for computational efficiency.As a result, when users are fully altruistic (i.e., s

ij

= 1,8i, j 2 N ), the second part becomes 0, while the first partcould be greater than 0. In Section V, numerical results willdemonstrate that the Pareto-optimal SNE is efficient, with aperformance gap less than 10% on average compared to theoptimal social welfare for real social dataset.

D. Distributed Computation of Pareto-Optimal SNEThe Pareto-optimal SNE computed by Algorithm 1 can be

achieved in a distributed manner. To this end, each user firstobtains its potential anonymity set and its social ties withothers (which will be discussed in Section IV-E). FollowingAlgorithm 1, each user checks if it should change its strategyaccording to the condition in line 5 or 10 based on other users’strategies, and if yes, announces the change to all users. Withtime divided into slots, a random backoff mechanism can beused so that at most one user announces a change of strategy ina time slot. If no user announces a change, it indicates the endof phase I or phase II of a round. Therefore, all users keep trackof the current state of the algorithm as it proceeds, and thus canact correctly according to the algorithm. The computationalcomplexity of the distributed version of Algorithm 1 is almostthe same as the centralized version, and is upper boundedby O(N3

). Note that each user only knows the strategies ofother users during the execution the algorithm, and thus users’privacy is preserved. After reaching the Pareto-optimal SNE,the users who decide to change their pseudonyms implementtheir pseudonym changes.

E. Further DiscussionsWe assume that there is a third party platform where users

interact with each other to make pseudonym change decisionsand coordinate their pseudonym changes. The platform onlyserves to allow users to exchange information. We assume thatthe platform is honest-but-curious in the sense that it honestlydelivers messages among users, but is curious about users’private information. To protect privacy, each user also usesa pseudonym as its identity on the platform (which can bedifferent from that used for the LBS). To make a socially-aware pseudonym change decision, each users needs to knowits potential anonymity set and its social ties with others. Thiscan be achieved in a privacy-preserving manner using secureprotocols as discussed below. Note that the platform is notinvolved in the computing tasks of these protocols.

A user can learn whether another user is within itsanonymity range using a certain private proximity detectionprotocol [20], [21]. For example, the protocol proposed in [20]can be used if the anonymity range is a disk. Specifically, theprotocol involves several message exchanges between the twousers, including one message that contains encrypted values

that are functions of a user’ location or the radius of theanonymity range. The protocol guarantees that both userscan only learn the binary result of whether or not one isin another’s anonymity range, and neither user can learn theother’s location or anonymity range. In addition, since locationinformation is encrypted in the messages, the platform cannotlearn any user’s location information. Similarly, the protocol in[21] can be used if the anonymity range is a convex polygon.Therefore, each user can learn its potential anonymity setwithout revealing its location information.

A user can also learn its social tie with another user withoutdisclosing one’s real identity to the other. To this end, eachuser keeps a social profile consisting of the social communitiesthat it belongs to (e.g., a community of colleagues at thesame workplace), and sets a single social tie level for eachcommunity based on its social relationships with those inthe community. Each community is identified by a predefinedkey that is only known to the community’s members. Usinga certain private matching protocol such as [22], [23], twousers can learn whether they have a community in common,and if yes, which community6 it is. In particular, the protocolinvolves several message exchanges between the two users,including one message that contains encrypted values thatare functions of the keys of a user’s social communities.The protocol ensures that both users can only know thecommunity they have in common (if it exists), and neitheruser can learn any additional social information of the other,or pretend to have a community in common with the other.Since a community typically has many members, neither usercan know the other’s real identity even when they knowthe community they both belong to. In addition, since socialinformation is encrypted in the messages, the platform cannotlearn any user’s social information. Therefore, each user canlearn its social ties with those in its potential anonymity setwhile keeping their real identities private. Note that althoughthe adversary might collude with multiple users, it is almostinfeasible for the adversary to find a sufficient number ofcolluding users who have social ties with a specific user, inorder to infer the user’s real identity.

In this paper we leverage users’ positive social ties (betweenfamily, friends, etc.) to motivate their altruistic behaviors inpseudonym change so as to improve their location privacy. Aninteresting direction for future research is to take into accountnegative social ties (between enemies, opponents, etc.) withwhich users intend to damage others’ welfare.

V. SIMULATION RESULTS

In this section, we provide numerical results to illustratethe system efficiency of the Pareto-optimal SNE computed byAlgorithm 1. We compare the Pareto-optimal SNE with thebest SNE for SO-PCG, and the social optimal solution whichis found by exhaustive search.

We consider N mobile users randomly located in a squarearea with side length 500 m. We assume that the anonymityrange of each user is a disk centered at the user’s location

6To protect privacy, only one community in common is revealed if theyhave multiple communities in common.

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

: set of users participating under a⇤ but not under ae

Lemma: The social optimal profile satisfies that .

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

1 2

5 6

3

7

1.5

0.8

2.2

2.5

0.6

1.2

4

8

0.8

1.2

1 2

5 6

3

7

4

8

0.6

0.5

0.2 0.3

0.8

0.5

0.3

0.6

0.8

0.2

physical graph

social graph




1 N N ;2 repeat

3 // Phase I;4 a (1, · · · , 1), N

I


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

< 0 do

6 ai

0, NI

NI

\ {i};7 end

8 N N \NI

;9 // Phase II;

10 NII


ui

(1,a�i

) +

Pj2NS

i+\N sij

aj

� 0 do

12 ai

1, N N \ {i}, NII

NII

[ {i};13 end

14 until NI

[NII

= ?;15 return ae a;



0 ! u3 = 2 � 2.5 < 0 ! a3 = 0; u7 = 2 � 2.2 < 0 !a7 = 0! u8 = 0�0.8 < 0! a8 = 0; u2 = 1�0.6 > 0;u6 = 1� 0.8 > 0; N

I


a5 = 1 ! u1 + s12 = 1 � 1.2 + 0.5 > 0 ! a1 = 1;u3+s32 = 1�2.5+0.8 < 0; u7+s76 = 1�2.2+0.5 < 0;u4 = 0� 1.2 < 0; u8 = 0� 0.8 < 0; N

II


u3+s32 = 2�2.5+0.8 > 0; u7+s76 = 2�2.2+0.5 > 0;

u8 = 1� 0.8 > 0; NI


0.8 > 0! a4 = 1; NII






=




� sij


0satisfies that ae

0 � ae and v(ae

0) � v(ae









)\N1(ae



Pi2N�

Pj2NP

i�\N�1 +

Simulation Results• Simulation setup ✓ Social graph: Erdos-Renyi model (each pair of users have a social tie with the same probability); Real social network data from Brightkite ✓ Physical graph: Users are randomly located in an area; Each user’s anonymity range is a disk

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 10.9

1

1.1

1.2

1.3

1.4

1.5

Probability of Social Edge

Norm

aliz

ed S

oci

al W

elfa

re

Socially−ObliviousSocially−AwareSocial Optimal

Fig. 6. Impact of PS .

2 2.2 2.4 2.6 2.8 3 3.2 3.4 3.60.9

1

1.1

1.2

1.3

1.4

1.5

1.6

1.7

Range of Participation Cost

Norm

aliz

ed S

oci

al W

elfa

re


Fig. 7. Impact of C.

10 11 12 13 14 15 16 17 180.9

1

1.1

1.2

1.3

Number of Users

Norm

aliz

ed S

oci

al W

elfa

re


Fig. 8. Impact of N .

10 11 12 13 14 15 16 17 18 19 2055

60

65

70

75

80

85

Number of Users

Num

ber

of Itera

tions

Fig. 9. Computational complexity versus N .

12 13 14 15 16 17 18 19 200.2

0.3

0.4

0.5

Number of Users

Ave

rage N

um

ber

of S

oci

al E

dges

Fig. 10. Average number of social edges peruser versus N for the real dataset based socialnetwork.

12 13 14 15 16 17 18 19 200.9

1

1.1

1.2

1.3

1.4

Number of Users

Norm

aliz

ed S

oci

al W

elfa

re


Fig. 11. Impact of N for the real dataset basedsocial network.

with radius randomly chosen from {200 m, 300 m, 400 m}.Based on users’ physical locations and anonymity ranges, thereexists a physical edge from user i to user j if user i is in theanonymity range of user j. We assume that a user’s cost ofchanging pseudonym is uniformly distributed in [0, C]. Wesimulate the social graph using two methods as follows.

A. Erdos-Renyi Model Based Social Graph

We simulate the social graph based on the Erdos-Renyi (ER)graph model [24], where a social edge exists between any twousers with probability P

S

. We assume that the social tie is 1 ifit exists. We set the default values of parameters as N = 10,PS

= 0.5, C = 3. For each parameter setting, we average theresults over 1000 runs.

We illustrate the impact of PS

, C, and N on the normalizedsocial welfare in Fig. 6, 7, and 8, respectively. We observefrom these figures that socially-aware users significantly out-performs socially-oblivious users, especially when P

S

or C islarge, or N is small. This is because more users participatein pseudonym change when they are socially-aware, whichimproves the social welfare. On the other hand, the socialwelfare of socially-aware users is close to the optimal socialwelfare. Fig. 6 shows that the performance of socially-awareusers improves when P

S

increases, with a performance gainup to 20% over socially-oblivious users and a performancegap about 10% on average from the optimal social welfare.This is because larger social ties further encourage users toparticipate. Fig. 7 and 8 show that the performance gaps fromsocially-oblivious users to socially-aware users and the socialoptimal solution decrease as C and N increase, respectively.This is because with a lower participation cost, or a higherprivacy gain of participation due to the increased total number

of users, more users would participate even when they aresocially-oblivious. Therefore, the performance gap decreasesas it depends on the users that participate only when theyare socially-aware. We plot the number of iterations forrunning Algorithm 1 versus N in Fig. 9. We observe that thecomputational complexity increases nearly quadratically as thenumber of users increases. This shows that the algorithm isscalable for a large number of users.

B. Real Data Trace Based Social GraphWe simulate the social graph according to the real dataset

from Brightkite [25], which is a online social network based onmobile phones. We plot the average number of social edges ofa user versus the total number of users in Fig. 10. We illustratethe impact of N on the social welfare in Fig. 11, where we setthe range of participation cost as C = 3. We can see that theperformance gain of socially-aware users can achieve up to15% over socially-aware users, and its performance gap fromthe optimal social welfare is less than 10% on average. Thisverifies the effectiveness of exploiting social ties for improvinglocation privacy based on real social dataset.

VI. CONCLUSION

In this paper, we have studied a socially-aware pseudonymchange game for personalized location privacy, based on ageneral anonymity model with user-specific anonymity sets.The game is based on a social group utility maximiza-tion framework that captures diverse social ties and diversephysical relationships among mobile users. For the SGUM-based PCG, we show that there exists a socially-aware Nashequilibrium, and quantify the performance gap of the SNEwith respect to the optimal social welfare. Then we develop

• Insight: SNE migrates monotonically from NE for NCG to social optimal solution for NUM

Simulation Results

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 10.9

1

1.1

1.2

1.3

1.4

1.5


Norm

aliz

ed S

oci

al W

elfa

re



2 2.2 2.4 2.6 2.8 3 3.2 3.4 3.60.9

1

1.1

1.2

1.3

1.4

1.5

1.6

1.7


Norm

aliz

ed S

oci

al W

elfa

re



10 11 12 13 14 15 16 17 180.9

1

1.1

1.2

1.3

Number of Users

Norm

aliz

ed S

oci

al W

elfa

re



10 11 12 13 14 15 16 17 18 19 2055

60

65

70

75

80

85

Number of Users

Num

ber

of Itera

tions


12 13 14 15 16 17 18 19 200.2

0.3

0.4

0.5

Number of Users

Ave

rage N

um

ber

of S

oci

al E

dges


12 13 14 15 16 17 18 19 200.9

1

1.1

1.2

1.3

1.4

Number of Users

Norm

aliz

ed S

oci

al W

elfa

re






S





S


S





VI. CONCLUSION


• Insight: More users participate with a lower participation cost or a larger number of users, which reduces the gain of social optimal and socially-aware over socially-oblivious

ER model based social graph

Simulation Results0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

0.9

1

1.1

1.2

1.3

1.4

1.5


No

rma

lize

d S

oci

al W

elfa

re



2 2.2 2.4 2.6 2.8 3 3.2 3.4 3.60.9

1

1.1

1.2

1.3

1.4

1.5

1.6

1.7


No

rma

lize

d S

oci

al W

elfa

re



10 11 12 13 14 15 16 17 180.9

1

1.1

1.2

1.3

Number of Users

No

rma

lize

d S

oci

al W

elfa

re



10 11 12 13 14 15 16 17 18 19 2055

60

65

70

75

80

85

Number of Users

Nu

mb

er

of

Ite

ratio

ns


12 13 14 15 16 17 18 19 200.2

0.3

0.4

0.5

Number of Users

Ave

rag

e N

um

be

r o

f S

oci

al E

dg

es


12 13 14 15 16 17 18 19 200.9

1

1.1

1.2

1.3

1.4

Number of Users

No

rma

lize

d S

oci

al W

elfa

re






S





S


S





VI. CONCLUSION


Real data based social graph

• Similar insight as for ER model based social graph; Lower gain of socially-aware due to smaller social tie density

Related Work

• Mobile users’ interactions in pseudonym change ✓ [Freudiger et al, CCS’09]: Non-cooperative game for mix zone based

pseudonym change ✓ [Yang et al, INFOCOM’13]: Auction-based mechanisms for mix zone

based pseudonym change • Mobile social networking ✓ Social contact based forwarding: [Gao et al, MOBIHOC’09], etc ✓ Socially altruistic behavior: [Chen et al, INFOCOM’14], etc

Conclusion• Contributions ✓ Formulated social group utility maximization based

pseudonym change game where mobile users’ social ties are leveraged to improve personalized location privacy

✓ Showed that socially-aware Nash equilibrium exists and quantified the efficiency of SNEs

✓ Developed an efficient algorithm to find an SNE that is Pareto-optimal and has a larger social welfare than that of the best SNE for the socially-oblivious case; quantified the efficiency of this SNE

• Highlights ✓ Novelty: Leverage social ties for personalized location privacy ✓ Importance: Users need incentives to participate in pseudonym

change ✓ Challenge: NP-hard to find the best SNE due to social coupling

60 6 Conclusion and Future Work

1 2

3 4

1 2

3 4

selfish 1 2

3 4

altruistic

1 2

3 4

ZSG

selfish

malicious

SGUM

NCG NUM

Fig. 6.1 The extended social group utility maximization (SGUM) game captures zero-sum game(ZSG), non-cooperative game (NCG), and network utility maximization (NUM) as special cases.

• We study the SGUM-based pseudonym change for personalized location pri-vacy. The SGUM-based pseudonym change game (PCG) is based on a generalanonymity model that allows each user to have its specific anonymity set. Forthe SGUM-based PCG, we show that there exists a SNE. Then we develop analgorithm that greedily determines users’ strategies, based on the social grouputility derived from only the users whose strategies have been determined. Weshow that this algorithm can efficiently find a Pareto-optimal SNE with socialwelfare higher than that corresponding to the socially-oblivious PCG. Numericalresults demonstrate that social welfare can be significantly improved by exploit-ing users’ social ties.

6.2 Future Work

In Chap. 2, we develop the SGUM framework which leverage user’s “positive” so-cial ties to stimulate their cooperative behaviors. In general, depending on the na-ture of social relationship, the social tie between two users can be “negative” (e.g.,between opponents or enemies) such that one user intends to damage the other’swelfare. It is thus natural to extend the SGUM framework to capture negative socialties. Similar to positive social ties, negative social ties can also be diverse such thata user intends to damage others at different levels.

To capture both positive and “negative” social ties, we can extend the SGUMframework by defining the social group utility fi as

• An extended SGUM framework that captures both “positive” and “negative” social ties (between opponents, enemies, etc) ✓ Captures zero-sum game (ZSG) as a special case and spans

the continuum between ZSG, NCG, and NUM

Future Work

6.2 Future Work 61

Positive Social Tie

Fully Malicious Fully Altruistic Negative Social Tie

Socially-Oblivious

ZSG SGUM NCG NUM SGUM

Fig. 6.2 The social group utility maximization (SGUM) game framework spans the continuumspace from zero-sum game (ZSG) to non-cooperative game (NCG) to network utility maximization(NUM).

fi(xi,x−i)!N

∑j=1

si jui(xi,x−i)

where si j ∈ (−∞,1]: when si j ∈ (0,1], it represents the extent to which user i caresabout user j’s utility, and it reaches the maximum when si j = 1 (i.e., user i caresabout user j’s utility as much as its own utility); when si j ∈ (−∞,0), it pinpoints tohow much user i intends to damage user j’s utility, and reaches the extreme as si jgoes to −∞ (i.e., user i would sacrifice its utility to damage user j’s utility).

For the extended SGUM game, if the total social tie level to each user is 0, i.e.,

∑j∈N

s ji = 0, ∀i ∈N ,

then the SGUM game degenerates to a zero-sum game (ZSG), where each userviews the total gain of other users as its loss. Formally, a game is a ZSG if allusers’ payoff functions are summed up to 0. For example, an SGUM game of twousers with f1 = u1− u2 and f2 = u2− u1, or f1 = u1 and f2 = −u1, is a zero-sumgame. Note that we obtain an equivalent game when a user’s payoff function ismultiplied by a number or added by a function independent of that user’s strategy.For example, an SGUM game of two users with f1 = u1 and f2 = u2− s21u1 wheres21 → ∞ is equivalent to that with f1 = u1 and f2 = −u1, and thus is a zero-sumgame. Therefore, the extended SGUM framework encompasses not only NCG andNUM but also ZSG as special cases (as illustrated in Fig. 6.1). Furthermore, it spansthe continuum from ZSG to NCG to NUM (as illustrated in Fig. 6.2).

The integration of “negative” social ties under the SGUM framework offers asocial perspective on network security: the “adversary” in the context of networksecurity can be viewed as a malicious user who has “negative” social ties with otherusers. As the malicious user can have diverse “negative” social ties with other users,an interesting future direction is to investigate how the diverse social tie structurewould impact the malicious user’s behavior. Furthermore, the rich modeling flexi-bility provided by the extended SGUM framework allows us to study the tradeoffbetween security and utility. As a malicious user’s attack would result in other users’utility loss, an important question is how it would depend on the malicious user’s“negative” social tie levels with other users.

Thank you!

Questions?

Download - Personalized Location Privacy in Mobile Networks: A Social ...webhome.auburn.edu/...SGUM_location_privacy_slides.pdf · mobile networks, location-based services (LBS) have become

Top Related