{"id":"https://openalex.org/W4387857625","doi":"https://doi.org/10.56553/popets-2024-0014","title":"Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure","display_name":"Why Privacy-Preserving Protocols Are Sometimes Not Enough: A Case Study of the Brisbane Toll Collection Infrastructure","publication_year":2023,"publication_date":"2023-10-22","ids":{"openalex":"https://openalex.org/W4387857625","doi":"https://doi.org/10.56553/popets-2024-0014"},"language":"en","primary_location":{"id":"doi:10.56553/popets-2024-0014","is_oa":true,"landing_page_url":"http://dx.doi.org/10.56553/popets-2024-0014","pdf_url":"https://petsymposium.org/popets/2024/popets-2024-0014.pdf","source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://petsymposium.org/popets/2024/popets-2024-0014.pdf","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5033706431","display_name":"Amirhossein Adavoudi Jolfaei","orcid":"https://orcid.org/0000-0003-0292-7320"},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":true,"raw_author_name":"Amirhossein Adavoudi Jolfaei","raw_affiliation_strings":["University of Luxembourg"],"affiliations":[{"raw_affiliation_string":"University of Luxembourg","institution_ids":["https://openalex.org/I186903577"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047549684","display_name":"Andy Rupp","orcid":"https://orcid.org/0000-0003-0439-3633"},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":false,"raw_author_name":"Andy Rupp","raw_affiliation_strings":["University of Luxembourg and KASTEL SRL"],"affiliations":[{"raw_affiliation_string":"University of Luxembourg and KASTEL SRL","institution_ids":["https://openalex.org/I186903577"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5033291024","display_name":"Stefan Schiffner","orcid":"https://orcid.org/0000-0003-2461-1482"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Stefan Schiffner","raw_affiliation_strings":["Berufliche Hochschule Hamburg (BHH)"],"affiliations":[{"raw_affiliation_string":"Berufliche Hochschule Hamburg (BHH)","institution_ids":[]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5009071576","display_name":"Thomas Engel","orcid":"https://orcid.org/0000-0002-7374-3927"},"institutions":[{"id":"https://openalex.org/I186903577","display_name":"University of Luxembourg","ror":"https://ror.org/036x5ad56","country_code":"LU","type":"education","lineage":["https://openalex.org/I186903577"]}],"countries":["LU"],"is_corresponding":false,"raw_author_name":"Thomas Engel","raw_affiliation_strings":["University of Luxembourg"],"affiliations":[{"raw_affiliation_string":"University of Luxembourg","institution_ids":["https://openalex.org/I186903577"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5033706431"],"corresponding_institution_ids":["https://openalex.org/I186903577"],"apc_list":null,"apc_paid":null,"fwci":0.3153,"has_fulltext":true,"cited_by_count":2,"citation_normalized_percentile":{"value":0.57406082,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":90,"max":95},"biblio":{"volume":"2024","issue":"1","first_page":"232","last_page":"257"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11344","display_name":"Traffic Prediction and Management Techniques","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/2215","display_name":"Building and Construction"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11344","display_name":"Traffic Prediction and Management Techniques","score":0.9966999888420105,"subfield":{"id":"https://openalex.org/subfields/2215","display_name":"Building and Construction"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10524","display_name":"Traffic control and management","score":0.9957000017166138,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10761","display_name":"Vehicular Ad Hoc Networks (VANETs)","score":0.9950000047683716,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/toll","display_name":"Toll","score":0.9569661021232605},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.6117041110992432},{"id":"https://openalex.org/keywords/death-toll","display_name":"Death toll","score":0.5479564070701599},{"id":"https://openalex.org/keywords/service-provider","display_name":"Service provider","score":0.5198962688446045},{"id":"https://openalex.org/keywords/electronic-toll-collection","display_name":"Electronic toll collection","score":0.5077375173568726},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.5065008401870728},{"id":"https://openalex.org/keywords/internet-privacy","display_name":"Internet privacy","score":0.4652036130428314},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.44752538204193115},{"id":"https://openalex.org/keywords/counterexample","display_name":"Counterexample","score":0.4328418970108032},{"id":"https://openalex.org/keywords/business","display_name":"Business","score":0.3961097002029419},{"id":"https://openalex.org/keywords/service","display_name":"Service (business)","score":0.37048739194869995},{"id":"https://openalex.org/keywords/engineering","display_name":"Engineering","score":0.21276968717575073},{"id":"https://openalex.org/keywords/economics","display_name":"Economics","score":0.09932944178581238},{"id":"https://openalex.org/keywords/marketing","display_name":"Marketing","score":0.08019426465034485}],"concepts":[{"id":"https://openalex.org/C2778025104","wikidata":"https://www.wikidata.org/wiki/Q408004","display_name":"Toll","level":2,"score":0.9569661021232605},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6117041110992432},{"id":"https://openalex.org/C2991839399","wikidata":"https://www.wikidata.org/wiki/Q96476851","display_name":"Death toll","level":2,"score":0.5479564070701599},{"id":"https://openalex.org/C116537","wikidata":"https://www.wikidata.org/wiki/Q2169973","display_name":"Service provider","level":3,"score":0.5198962688446045},{"id":"https://openalex.org/C522513456","wikidata":"https://www.wikidata.org/wiki/Q1191337","display_name":"Electronic toll collection","level":3,"score":0.5077375173568726},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5065008401870728},{"id":"https://openalex.org/C108827166","wikidata":"https://www.wikidata.org/wiki/Q175975","display_name":"Internet privacy","level":1,"score":0.4652036130428314},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.44752538204193115},{"id":"https://openalex.org/C162838799","wikidata":"https://www.wikidata.org/wiki/Q596077","display_name":"Counterexample","level":2,"score":0.4328418970108032},{"id":"https://openalex.org/C144133560","wikidata":"https://www.wikidata.org/wiki/Q4830453","display_name":"Business","level":0,"score":0.3961097002029419},{"id":"https://openalex.org/C2780378061","wikidata":"https://www.wikidata.org/wiki/Q25351891","display_name":"Service (business)","level":2,"score":0.37048739194869995},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.21276968717575073},{"id":"https://openalex.org/C162324750","wikidata":"https://www.wikidata.org/wiki/Q8134","display_name":"Economics","level":0,"score":0.09932944178581238},{"id":"https://openalex.org/C162853370","wikidata":"https://www.wikidata.org/wiki/Q39809","display_name":"Marketing","level":1,"score":0.08019426465034485},{"id":"https://openalex.org/C78519656","wikidata":"https://www.wikidata.org/wiki/Q101333","display_name":"Mechanical engineering","level":1,"score":0.0},{"id":"https://openalex.org/C86803240","wikidata":"https://www.wikidata.org/wiki/Q420","display_name":"Biology","level":0,"score":0.0},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C54355233","wikidata":"https://www.wikidata.org/wiki/Q7162","display_name":"Genetics","level":1,"score":0.0},{"id":"https://openalex.org/C45355965","wikidata":"https://www.wikidata.org/wiki/Q1643441","display_name":"Socioeconomics","level":1,"score":0.0},{"id":"https://openalex.org/C118615104","wikidata":"https://www.wikidata.org/wiki/Q121416","display_name":"Discrete mathematics","level":1,"score":0.0}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.56553/popets-2024-0014","is_oa":true,"landing_page_url":"http://dx.doi.org/10.56553/popets-2024-0014","pdf_url":"https://petsymposium.org/popets/2024/popets-2024-0014.pdf","source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},{"id":"pmh:oai:orbilu.uni.lu:10993/57563","is_oa":true,"landing_page_url":"https://orbilu.uni.lu/handle/10993/57563","pdf_url":"https://orbilu.uni.lu/bitstream/10993/57563/1/popets-2024-0014.pdf","source":{"id":"https://openalex.org/S4306401815","display_name":"Open Repository and Bibliography (University of Luxembourg)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I186903577","host_organization_name":"University of Luxembourg","host_organization_lineage":["https://openalex.org/I186903577"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Proceedings on Privacy Enhancing Technologies, 2024 (1), 232-257 (2024)","raw_type":"peer reviewed"}],"best_oa_location":{"id":"doi:10.56553/popets-2024-0014","is_oa":true,"landing_page_url":"http://dx.doi.org/10.56553/popets-2024-0014","pdf_url":"https://petsymposium.org/popets/2024/popets-2024-0014.pdf","source":{"id":"https://openalex.org/S4210183172","display_name":"Proceedings on Privacy Enhancing Technologies","issn_l":"2299-0984","issn":["2299-0984"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320322","host_organization_name":"De Gruyter Open","host_organization_lineage":["https://openalex.org/P4310320322","https://openalex.org/P4310313990"],"host_organization_lineage_names":["De Gruyter Open","De Gruyter"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings on Privacy Enhancing Technologies","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.6200000047683716}],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":false},"content_urls":{"pdf":"https://content.openalex.org/works/W4387857625.pdf"},"referenced_works_count":32,"referenced_works":["https://openalex.org/W162860360","https://openalex.org/W1487048116","https://openalex.org/W1509562192","https://openalex.org/W1571087346","https://openalex.org/W1808668261","https://openalex.org/W1825165655","https://openalex.org/W1929168187","https://openalex.org/W1933000719","https://openalex.org/W1968594877","https://openalex.org/W1987406106","https://openalex.org/W1989043288","https://openalex.org/W2012580531","https://openalex.org/W2028125464","https://openalex.org/W2076775688","https://openalex.org/W2076844787","https://openalex.org/W2103839502","https://openalex.org/W2114781044","https://openalex.org/W2120911939","https://openalex.org/W2139701376","https://openalex.org/W2150780437","https://openalex.org/W2154826709","https://openalex.org/W2202939154","https://openalex.org/W2272053597","https://openalex.org/W2293509485","https://openalex.org/W2955438736","https://openalex.org/W3040118720","https://openalex.org/W3045297481","https://openalex.org/W3080727287","https://openalex.org/W3126803829","https://openalex.org/W3177253431","https://openalex.org/W3183881215","https://openalex.org/W4366378762"],"related_works":["https://openalex.org/W594781134","https://openalex.org/W573346334","https://openalex.org/W574045738","https://openalex.org/W3122402760","https://openalex.org/W1504970182","https://openalex.org/W1708184894","https://openalex.org/W612594187","https://openalex.org/W3135176332","https://openalex.org/W582981267","https://openalex.org/W575632998"],"abstract_inverted_index":{"The":[0,187],"use":[1],"of":[2,76,148,161,185,197,221,239,256,271,322,329,334],"Electronic":[3],"Toll":[4,23],"Collection":[5],"(ETC)":[6],"systems":[7,14],"is":[8,42,103,274],"on":[9,19],"the":[10,74,106,145,156,162,169,183,201,218,236,259,320,327,332,338],"rise,":[11],"as":[12,112,131,180,182,247,249,289,326],"these":[13,277],"have":[15,69],"a":[16,121,142,159,174,177,190,205,268,296,314,343],"significant":[17],"impact":[18,342],"reducing":[20],"operational":[21],"costs.":[22],"service":[24,299],"providers":[25],"(TSPs)":[26],"access":[27],"various":[28,323],"information,":[29,129],"including":[30],"drivers'":[31,53,59],"IDs":[32],"and":[33,134,211,213,227,303,337],"monthly":[34,113],"toll":[35,114,170,198,241,330,335],"fees,":[36,115],"to":[37,57,72,83,94,105,167,194,209,295],"bill":[38],"drivers.":[39,257],"While":[40],"this":[41,63],"legitimate,":[43],"such":[44,91,111,130,325],"information":[45,77,109,288],"could":[46],"be":[47,84,246,282],"misused":[48],"for":[49],"other":[50],"purposes":[51],"violating":[52],"privacy,":[54],"most":[55],"prominent,":[56],"infer":[58],"movement":[60],"patterns.":[61],"To":[62,137],"end,":[64],"privacy-preserving":[65],"ETC":[66,96,150,231],"(PPETC)":[67],"schemes":[68,93],"been":[70],"designed":[71],"minimize":[73],"amount":[75],"leaked":[78],"while":[79],"still":[80],"allowing":[81],"drivers":[82],"charged.":[85],"We":[86,152,216],"demonstrate":[87],"that":[88,276],"merely":[89],"applying":[90],"PPETC":[92],"current":[95],"infrastructures":[97],"may":[98],"not":[99],"ensure":[100],"privacy.":[101],"This":[102,251],"due":[104],"(inevitable)":[107],"minimal":[108,287],"leakage,":[110],"which":[116,291],"can":[117,245,266,281],"potentially":[118],"result":[119],"in":[120],"privacy":[122,345],"breach":[123],"when":[124],"combined":[125],"with":[126],"additional":[127],"background":[128],"road":[132],"maps":[133],"statistical":[135],"data.":[136],"show":[138],"this,":[139],"we":[140,317],"provide":[141],"counterexample":[143],"using":[144,224,286],"case":[146],"study":[147],"Brisbane's":[149,230],"system.":[151,232],"present":[153],"two":[154],"attacks:":[155],"first,":[157],"being":[158,189],"variant":[160],"presence":[163],"disclosure":[164,243,264],"attack,":[165,192],"tries":[166],"disclose":[168],"stations":[171,199],"visited":[172],"by":[173,284,304],"driver":[175],"during":[176,204],"billing":[178,339],"period":[179,340],"well":[181],"frequency":[184],"visits.":[186],"second,":[188],"stronger":[191],"aims":[193],"discover":[195],"cycles":[196],"(e.g.,":[200],"ones":[202],"passed":[203],"commute":[206],"from":[207,229],"home":[208],"work":[210],"back)":[212],"their":[214],"frequencies.":[215],"evaluate":[217],"success":[219,237,269,279],"rates":[220,280],"our":[222,240,262,348],"attacks":[223],"real":[225],"parameters":[226],"statistics":[228],"In":[233,258],"one":[234],"scenario,":[235,261],"rate":[238,270],"station":[242],"attack":[244,265,308],"high":[248,278],"94%.":[250],"scenario":[252],"affects":[253],"about":[254],"61%":[255],"same":[260],"cycle":[263],"achieve":[267],"51%.":[272],"It":[273],"remarkable":[275],"achieved":[283],"only":[285],"input,":[290],"is,":[292],"e.g.,":[293],"available":[294],"driver's":[297,344],"payment":[298],"provider":[300],"or":[301],"bank,":[302],"following":[305],"very":[306],"simple":[307],"strategies":[309],"without":[310],"exploiting":[311],"optimizations.":[312],"As":[313],"further":[315],"contribution,":[316],"analyze":[318],"how":[319],"choice":[321],"parameters,":[324],"set":[328],"rates,":[331],"number":[333],"stations,":[336],"length,":[341],"level":[346],"regarding":[347],"attacks.":[349]},"counts_by_year":[{"year":2025,"cited_by_count":1},{"year":2024,"cited_by_count":1}],"updated_date":"2026-03-12T08:34:05.389933","created_date":"2025-10-10T00:00:00"}