# Contractive inequalities for mixed norm spaces and the Beta function

Adrián Llinares  Departamento de Matemáticas, Universidad Autónoma de Madrid,
28049 Madrid, Spain<EMAIL_ADDRESS>and  Dragan Vukotić  Departamento
de Matemáticas, Universidad Autónoma de Madrid, 28049 Madrid, Spain
<EMAIL_ADDRESS>
(Date: 2 December, 2021.)

###### Abstract.

For a wide range of pairs of mixed norm spaces such that one space is
contained in another, we characterize all cases when contractive norm
inequalities hold. In particular, this yields such results for many pairs of
weighted Bergman spaces. Some inequalities of this type are motivated by their
applications in Number Theory and in Mathematical Physics.

###### Key words and phrases:

Weighted Bergman spaces, mixed norm spaces, contractive norm inequalities,
Beta function.

###### 2010 Mathematics Subject Classification:

30H20

##  1\. Introduction

###  1.1. Preliminaries

Let $0<p$, $q\leq\infty$, $0<a<\infty$. The mixed norm space $H(p,q,a)$ is
defined as the set of all functions $f$ that are analytic in the unit disk
${\mathbb{D}}$ and satisfy the condition

(1)
$\|f\|_{p,q,a}=\left(aq\int_{0}^{1}2\rho(1-\rho^{2})^{aq-1}M_{p}^{q}(\rho;f)d\rho\right)^{1/q}<\infty\,,\quad
0<q<\infty\,,$ (2)
$\|f\|_{p,\infty,a}=\sup_{0\leq\rho<1}(1-\rho^{2})^{a}M_{p}(\rho;f)<\infty\,,$

where

(3) $M_{p}(\rho;f)=\left(\int_{0}^{2\pi}|f(\rho
e^{i\theta})|^{p}\frac{d\theta}{2\pi}\right)^{1/p}$

denotes the usual integral means of $f$ of order $p$ on the circle
$\\{z\,:\,|z|=\rho\\}$. An important special case is the standard weighted
Bergman space $A^{p}_{\alpha}=H(p,p,\frac{\alpha+1}{p})$, $-1<\alpha<\infty$,
with

$\|f\|_{A^{p}_{\alpha}}=\left(\int_{\mathbb{D}}(\alpha+1)(1-|z|^{2})^{\alpha}|f(z)|^{p}dA(z)\right)^{1/p}<\infty\,,$

where $dA(z)=\frac{1}{\pi}\,dx\,dy$ is the normalized Lebesgue area measure on
${\mathbb{D}}$. The classical Hardy space $H^{p}$ consisting of all functions
analytic in ${\mathbb{D}}$ for which the finite limit

$\|f\|_{H^{p}}=\lim_{r\to 1^{-}}M_{p}(r;f)=\sup_{0<r<1}M_{p}(r;f)$

exists can be understood as the limit case $H(p,\infty,0)$.

Integrals as in (1) had been considered already by Hardy and Littlewood but
the space $H(p,q,a)$ was only formally defined and systematically studied
later, first by Hardy’s student Thomas Flett [14, 15] and later in [1], [6],
among many other papers. Inclusions between different mixed normed spaces in
many cases have been known, the information being scattered in the literature.
The classification below was completed to include the missing cases in [2, 3].
In both theorems below, we assume that $0<a$, $b<\infty$ and $0<p$, $q$, $u$,
$v\leq\infty$.

######  Theorem A.

If $p\geq u$, then $H(p,q,a)\subset H(u,v,b)$ if and only if either $a<b$ or
$a=b$ and $q\leq v$.

######  Theorem B.

If $p<u$, then $H(p,q,a)\subset H(u,v,b)$ if and only if either
$a+\frac{1}{p}<b+\frac{1}{u}$ or $a+\frac{1}{p}=b+\frac{1}{u}$ and $q\leq v$.

As a corollary for the weighted Bergman spaces, we have the well-known results
(see, for example, [9, Theorem 1.3]): when $p\geq q$, the inclusion
$A^{p}_{\alpha}\subset A^{q}_{\beta}\/$ holds only in the trivial case $p=q$
and $\alpha=\beta$ or when $\frac{\alpha+1}{p}<\frac{\beta+1}{q}$. When $p<q$,
we have the inclusion $A^{p}_{\alpha}\subset A^{q}_{\beta}\/$ if and only if
$\frac{\alpha+2}{p}<\frac{\beta+2}{q}$.

###  1.2. Motivation and results

An important and natural question is: when does the contractive inequality:

$\|f\|_{u,v,b}\leq\|f\|_{p,q,a}$

hold for all $f\in H(p,q,a)$? Note that if it holds, it must be sharp since
the constant function one has unit norm in all mixed norm spaces. A more
specific question is when is the inclusion between two weighted Bergman spaces
contractive.

As the main result of this note, we prove that, if $p\geq u$, the inclusion
$H(p,q,a)\subset H(u,v,b)$ is contractive if and only if either (1) $q\leq v$
and $a\leq b$, or (2) $q>v$ and $aq\leq bv$.

As a corollary, whenever $p\geq q$, we obtain that the contractive inequality
for weighted Bergman spaces: $\|f\|_{A^{q}_{\beta}}\leq\|f\|_{A^{p}_{\alpha}}$
holds if and only if $\alpha\leq\beta$.

Some motivation for this study is in order. Several papers in the literature
have been devoted to the study of contractive inequalities under the
conditions of Theorem B. For example, a very natural question is whether the
following special class of inequalities as above for weighted Bergman norms

(4)
$\|f\|_{A^{p}_{cp-2}}\leq\|f\|_{A^{q}_{cq-2}}\,,\qquad\frac{1}{c}<q<p<\infty\,,$

holds for every fixed $f$ analytic in ${\mathbb{D}}$. This problem turns out
to be extremely difficult but its solution would be of interest for several
applications. For example, a conjecture of Lieb and Solovej [16] related to
certain inequalities for entropies can be reformulated for the disk as the
particular case $c=\alpha+\frac{1}{2}$ and $q=2$ of (4), that is:

(5)
$\|f\|_{A^{p}_{\frac{2\alpha+1}{2}p-2}}\leq\|f\|_{A^{2}_{2\alpha-1}}\,,\qquad
2\leq p<\infty\,,\quad 0<\alpha<\infty\,.$

This conjecture has so far been proved only in certain special cases, for
example, $p=n/2$, where $n$ is a positive integer. Different statements and
proofs can be found in the papers [10], [4] and in the most recent works [16]
and [5]. In the classical Fock (or Bargmann-Segal) spaces $F^{p}_{\alpha}$ of
entire functions which are $p$-integrable with respect to a Gaussian measure
in the plane with parameter $\alpha$, there is also a contractive inequality
for the spaces $F^{p}_{\alpha}$ and $F^{\infty}_{\alpha}$ (cf. [20, p. 40]).
Contractive inequalities for generalized Fock spaces in ${\mathbb{C}}^{n}$
were studied in [11], again in relation to the Wehrl entropy conjecture.

Recently, in [4] a conjecture was formulated that (4) should hold for $c=1/2$;
this was already implicitly suggested in [8]. This would have some important
consequences. It is well known that, for $0<c<\infty$, the spaces
$A^{p}_{cp-2}$ become larger as $p\/$ increases. Also, the Hardy space
$H^{1/c}$ can be viewed as the limit case of these spaces as
$p\to\frac{1}{c}+$, in the sense that

$\|f\|_{H^{1/c}}=\lim_{p\to 1/c+}\|f\|_{p,\,cp-2}\,.$

Thus, if true, inequality (4) would also readily imply the following
contractive inequality mentioned in [17, Problem 2.1, p. 53]:

(6) $\|f\|_{A^{p}_{cp-2}}\leq\|f\|_{H^{1/c}}\,,\qquad\frac{1}{c}<p<\infty$

by taking the limit as $q\to 1/c+$. In [8], a conjecture was posed that

(7) $\|f\|_{A^{p}_{\frac{p}{2}-2}}\leq\|f\|_{H^{2}}\,,\quad 2<p<\infty\,,$

which is a special case of (6) with $c=1/2$. Important related inequalities
have been proved in [4]. Proving such inequality would have immediate
applications to the theory of Hardy spaces of Dirichlet series and, hence,
further direct consequences in Number Theory; cf. [7].

In summary, the case $p<u$ (scenario of Theorem B) seems to be very difficult
even in special cases. While some partial results on these cases will be
treated elsewhere, in Section 2 this note we devote our effort to
characterizing completely the cases when norm inclusions are contractive under
the condition of Theorem A: $p\geq u$. It is our belief that this case should
also be of some interest and that it seems appropriate to carry out a
systematic study of when the inclusions can be contractive in all cases.

We also list some direct consequences that might be of independent interest,
such as certain inequalities for the Beta function which we have not been able
to find elsewhere in the literature. This is done in Section 3.

##  2\. Contractive norm inequalities in the case $p\geq u$

In what follows, in simplify the notation, for a fixed function $f$ analytic
in the unit disk, we shall write throughout

$m_{p}(r)=M_{p}(\sqrt{r};f)\,,\qquad 0<r<1\,.$

Thus, the simple change of variable $\rho^{2}=r$ in (1) yields

(8)
$\|f\|_{p,q,a}=\left(\int_{0}^{1}aq(1-r)^{aq-1}m_{p}^{q}(r)dr\right)^{1/q}\,.$

This formula will be used frequently in the rest of this note. Hölder’s
inequality shows that $M_{p}(r;f)$, and hence also $m_{p}(r)$, is an
increasing function of of $p$ for each fixed $r$.

Also, by a well-known theorem of Hardy [12, Chapter 1], $M_{p}(r;f)$ is an
increasing function of $r$ for each fixed $p$. Moreover, it is strictly
increasing whenever $f$ is not constant. This additional fact, although not
explicit in [12], can be deduced immediately from the Hardy-Stein identity
[18, p. 174]. See also [19] for a proof in the unit ball and some
applications.

###  2.1. Positive results on contractive inclusions

In this subsection, we show that the inclusion under the conditions of Theorem
A is contractive in two large classes of cases.

We first address the case when $p\geq u$, $q\leq v$, and $a=b$.

######  Proposition 1.

Let $\infty\geq p\geq u>0$, $0<q\leq v\leq\infty$, $0<a<\infty$. Then
$\|f\|_{u,v,a}\leq\|f\|_{p,q,a}$.

###### Proof.

We first consider the case $v<\infty$. For $0\leq R<1$, consider the function

$\phi(R)=\left(\int_{R}^{1}aq(1-r)^{aq-1}m_{p}^{q}(r)dr\right)^{v/q}-\int_{R}^{1}av(1-r)^{av-1}m_{u}^{v}(r)dr$

In order to prove the desired inequality, it suffices to show that
$\phi(0)\geq 0$. Next, it is enough to check that $\phi$ is decreasing in
$[0,1)$ since $\lim_{R\to 1^{-}}\phi(R)=0$.

We first note that, since $m_{p}(r)$ is an increasing function of $r$, we have

$\int_{R}^{1}aq(1-r)^{aq-1}m_{p}^{q}(r)dr\geq
m_{p}^{q}(R)\int_{R}^{1}aq(1-r)^{aq-1}dr=m_{p}^{q}(R)(1-R)^{aq}\,.$

Taking into account this inequality and the fact that $v/q-1\geq 0$ by our
assumptions, the fundamental theorem of Calculus yields

$\displaystyle\phi^{\prime}(R)$ $\displaystyle=$ $\displaystyle
av(1-R)^{av-1}m_{u}^{v}(R)-av(1-R)^{aq-1}m_{p}^{q}(R)\left(\int_{R}^{1}aq(1-r)^{aq-1}m_{p}^{q}(r)dr\right)^{v/q-1}$
$\displaystyle\leq$ $\displaystyle
av(1-R)^{av-1}m_{u}^{v}(R)-av(1-R)^{aq-1}m_{p}^{q}(R)\cdot
m_{p}^{v-q}(R)(1-R)^{av-aq}$ $\displaystyle=$ $\displaystyle
av(1-R)^{av-1}m_{u}^{v}(R)-av(1-R)^{av-1}m_{p}^{v}(R)\leq 0\,,$

since $m_{u}(R)\leq m_{p}(R)$ for all $R\in[0,1)$ by the assumption $p\geq u$.
This completes the proof.

We now discuss the case $v=\infty$. There are two possibilities: $q=\infty$
and $q<\infty$.

If $q=\infty$, the corresponding estimates are quite obvious. For every
$\rho\in[0,1)$ we have

$(1-\rho^{2})^{a}M_{u}(\rho;f)\leq(1-\rho^{2})^{a}M_{p}(\rho;f)\leq\|f\|_{p,\infty,a}$

since $p\geq u$. This readily implies
$\|f\|_{u,\infty,a}\leq\|f\|_{p,\infty,a}$.

For $0<q<\infty$, recalling that the integral means $M_{p}(r;f)$ are
increasing in $p$ for a fixed $r$ and increasing in $r$ for a fixed $p$, for
every $r\in[0,1)$ we obtain

$\displaystyle(1-r^{2})^{aq}M_{u}^{q}(r;f)$ $\displaystyle\leq$
$\displaystyle(1-r^{2})^{aq}M_{p}^{q}(r;f)$ $\displaystyle=$ $\displaystyle
aq\int_{r}^{1}2\rho(1-\rho^{2})^{aq-1}d\rho\cdot M_{p}^{q}(r;f)$
$\displaystyle\leq$ $\displaystyle
aq\int_{r}^{1}2\rho(1-\rho^{2})^{aq-1}M_{p}^{q}(\rho;f)d\rho$
$\displaystyle\leq$ $\displaystyle\|f\|_{p,q,a}^{q}\,.$

It follows from here that $\|f\|_{u,\infty,a}\leq\|f\|_{p,q,a}$. ∎

We now consider a different class of cases.

######  Proposition 2.

Let $\infty\geq p\geq u>0$, $\infty>q\geq v>0$, $aq\leq bv$. Then
$\|f\|_{u,v,b}\leq\|f\|_{p,q,a}$.

###### Proof.

It is useful to apply the change of variable $s=(1-r)^{bv}$. Applying, in the
following order, Hölder’s inequality (note that $q\geq v$ and we have a unit
measure), the assumption that $aq\leq bv$ and the fact that the function
$F(t)=1-s^{1/t}$ decreases with $t$ for each fixed $s\in[0,1)$, recalling that
$m_{u}(\rho)\leq m_{p}(\rho)$ for each $\rho\in[0,1)$ (since $p\geq u$ by
assumption), and finally undoing the similar change of variable
$s=(1-r)^{aq}$, we obtain

$\displaystyle\|f\|_{u,v,b}^{q}$ $\displaystyle=$
$\displaystyle\left(\int_{0}^{1}bv(1-r)^{bv-1}m_{u}^{v}(r)dr\right)^{q/v}=\left(\int_{0}^{1}m_{u}^{v}(1-s^{1/(bv)})ds\right)^{q/v}$
$\displaystyle\leq$
$\displaystyle\int_{0}^{1}m_{u}^{q}(1-s^{1/(bv)})ds\leq\int_{0}^{1}m_{p}^{q}(1-s^{1/(bv)})ds\leq\int_{0}^{1}m_{p}^{q}(1-s^{1/(aq)})ds$
$\displaystyle=$
$\displaystyle\int_{0}^{1}aq(1-r)^{aq-1}m_{p}^{q}(r)dr=\|f\|_{p,q,a}^{q}\,.$

This proves the statement. ∎

The following trivial corollary will be useful later as an auxiliary step. The
case $q=\infty$ does not follow directly from Proposition 2 but is deduced
rather easily.

######  Corollary 3.

Let $0<p\leq\infty$, $0<q\leq\infty$, $0<a$, $b<\infty$, with $a\leq b$. Then

$\|f\|_{p,q,b}\leq\|f\|_{p,q,a}\,.$

###  2.2. Counterexamples for the contractive property

We recall that the Euler Beta function, defined in the usual way as

$B(p,q)=\int_{0}^{1}r^{p-1}(1-r)^{q-1}dr\,,\qquad p\,,q>0\,,$

has the symmetry property that $B(p,q)=B(q,p)$. It also satisfies the well-
known identity

$B(p,q)=\frac{\Gamma(p)\Gamma(q)}{\Gamma(p+q)}\,,$

where

$\Gamma(p)=\int_{0}^{\infty}t^{p-1}e^{-t}\,dt\,,\qquad p>0\,,$

is the standard Euler Gamma function. The basic properties of these functions
can be found in a number of texts, e.g., in [13, Chapter 9].

Using some properties of the Euler integrals and appropriately chosen test
functions, we will now show that, under the assumptions of Theorem A, the
inclusions between our mixed norm spaces can only be contractive in the cases
covered in Subsection 2.1.

######  Proposition 4.

Let $\infty\geq p\geq u>0$, $\infty\geq q>v>0$ and $0<a<b<\infty$. If $aq>bv$,
then the inclusion $H(p,q,b)\subset H(u,v,b)$ is not contractive.

###### Proof.

It suffices to find a function $f\in H(p,q,a)$ such that

$\|f\|_{p,q,a}<\|f\|_{u,v,b}.$

We split the proof into two cases, depending on whether $q$ is finite or not.

In the case when $q=\infty$, it suffices to consider the function
$f(z)=(1+z^{2})^{a}$. Then

$(1-r^{2})^{a}M_{p}(r,f)\leq(1-r^{2})^{a}M_{\infty}(r,f)\leq
1=|f(0)|<\|f\|_{u,v,b},\quad\forall r\in[0,1).$

The last inequality follows from the fact mentioned earlier that $M_{p}(r;f)$
is a strictly increasing function whenever $f$ is not constant.

If $q<\infty$, without loss of generality we may assume that $p=\infty$ and
$H(u,v,b)$ is actually a weighted Bergman space. The reason is that, due to
Hölder’s inequality, for every analytic function $f$ we have

$\|f\|_{p,q,a}\leq\|f\|_{\infty,q,a}\quad\mbox{ and
}\quad\|f\|_{A^{\min\\{u,v\\}}_{bv-1}}\leq\|f\|_{u,v,b}\,,$

hence, choosing $w=\min\\{u,v\\}$, it suffices to find a function $f$ such
that

$\|f\|_{\infty,q,a}<\|f\|_{A^{w}_{bv-1}}\,.$

To this end, let $\gamma\in\left(0,\frac{a}{2}\right)$ and consider the
sequence of functions

$f_{n}(z)=\dfrac{1}{(1-z^{2n})^{2\gamma}},\quad n\geq 1.$

Using repeatedly the basic property of the Gamma function:
$\Gamma(p+1)=p\Gamma(p)$, the relationship between $B$ and $\Gamma$, and the
binomial expansion

$(1-x)^{-c}=\sum_{k=0}^{\infty}\binom{-c}{k}(-1)^{k}x^{k}=\sum_{k=0}^{\infty}\frac{\Gamma(c+k)}{k!\Gamma(c)}x^{k}\,,$

a routine computation shows that

$\|f_{n}\|_{\infty,q,a}^{q}=aq\int_{0}^{1}(1-r)^{aq-1}(1-r^{n})^{-2\gamma
q}dr=\dfrac{\Gamma(aq+1)}{\Gamma(2\gamma
q)}\sum_{k=0}^{\infty}\dfrac{\Gamma(k+2\gamma
q)}{k!}\dfrac{(nk)!}{\Gamma(nk+aq+1)},$

The Euler-Gauss formula for the $\Gamma$ function [13, § 9.6] states that

$\lim_{m\rightarrow\infty}\frac{(m-1)!m^{c}}{\Gamma(m+c)}=1,$

for every $c>0$ (actually, this holds even for complex values). Hence, we can
find a positive integer $m_{1}$ such that

$\|f_{n}\|_{\infty,q,a}^{q}\leq 1+\dfrac{3\Gamma(aq+1)}{2\Gamma(2\gamma
q)}\sum_{k=1}^{\infty}\dfrac{\Gamma(k+2\gamma
q)}{k!}\dfrac{1}{k^{aq}}\dfrac{1}{n^{aq}}=1+\dfrac{C_{1}(q,a,\gamma)}{n^{aq}}\,,$

for all $n\geq m_{1}$. On the other hand, there exists a positive integer
$m_{2}$ such that

$\displaystyle\|f_{n}\|_{A^{w}_{bv-1}}^{w}$ $\displaystyle=$ $\displaystyle
1+\dfrac{\Gamma(bv+1)}{\Gamma^{2}(\gamma
w)}\sum_{k=1}^{\infty}\dfrac{\Gamma^{2}(k+\gamma
w)}{k!^{2}}\dfrac{(2nk)!}{\Gamma(2nk+bv+1)}$ $\displaystyle\geq$
$\displaystyle 1+\dfrac{\Gamma(bv+1)}{2^{bv+1}\Gamma^{2}(\gamma
w)}\sum_{k=1}^{\infty}\dfrac{\Gamma^{2}(k+\gamma
w)}{k!^{2}}\dfrac{1}{k^{bv}}\dfrac{1}{n^{bv}}$ $\displaystyle=$ $\displaystyle
1+\dfrac{C_{2}(w,v,b,\gamma)}{n^{bv}}\,,$

for all $n\geq m_{2}$.

Since $q>v\geq w$ and $\|f_{n}\|_{A^{w}_{bv-1}}\geq 1$, it follows that

$n^{bv}\left(\|f_{n}\|_{A^{w}_{bv-1}}^{q}-\|f_{n}\|_{\infty,q,a}^{q}\right)\geq
n^{bv}\left(\|f_{n}\|_{A^{w}_{bv-1}}^{w}-\|f_{n}\|_{\infty,q,a}^{q}\right)\geq
C_{2}-\dfrac{C_{1}}{n^{aq-bv}},$

if $n\geq\max\\{m_{1},m_{2}\\}$. Therefore, in view of the assumption $aq>bv$,
for $n$ large enough we have

$\|f_{n}\|_{\infty,q,a}<\|f_{n}\|_{A^{w}_{bv-1}}\,,$

as claimed. ∎

###  2.3. Main result

We now collect all the results obtained and summarize them in our main result
below.

######  Theorem 5.

Let $q$ and $v$ be arbitrary with $0<q$, $v\leq\infty$, and $0<a$, $b<\infty$,
$\infty\geq p\geq u>0$, and either $a<b$ or $a=b$ and $q\leq v$. Then the norm
inequality for the corresponding inclusion $H(p,q,a)\subset H(u,v,b)$,
asserted by Theorem A, is contractive:

$\|f\|_{u,v,b}\leq\|f\|_{p,q,a}$

if and only if we have one of the following cases:

(1) $q\leq v$ and $a\leq b$, or (2) $q>v$ and $aq\leq bv$.

In the special case of weighted Bergman spaces, this means that for $p\geq q$,
the contractive inequality

$\|f\|_{A^{q}_{\beta}}\leq\|f\|_{A^{p}_{\alpha}}$

holds if and only if $\alpha\leq\beta$.

###### Proof.

To prove the result in the case $0<q\leq v\leq\infty$ and $a\leq b$, it
suffices to apply Corollary 3 and then Proposition 1 to obtain

$\|f\|_{u,v,b}\leq\|f\|_{u,v,a}\leq\|f\|_{p,q,a}\,.$

The case $\infty>q>v$ and $aq\leq bv$ is covered by Proposition 2. It follows
from Proposition 4 that the inclusion is non-contractive in the remaining
cases.

For the special case of weighted Bergman spaces, recall that
$A^{p}_{\alpha}=H(p,p,\frac{\alpha+1}{p})$. ∎

The following remark is in order. The main case of interest for contractive
inequalities is that of weighted Bergman spaces; however, our results are
stated in greater generality. It should be noted that this is not done just
for the sake of generalizing. An inspection of various proofs shows that we
have actually used genuine mixed norm spaces which are not weighted Bergman
spaces in order to derive our results. Thus, the more general point of view
has actually helped to obtain relatively simple proofs while at the same time
yielding more general results.

##  3\. Some inequalities for the Beta function

In this section we formulate some consequences of the results of Subsection
2.1 separately, in view of their possible independent interest. Namely, the
contractive inequalities proved there yield certain (seemingly new)
inequalities for the Beta function. First, as a consequence of Proposition 1,
we obtain the following property.

######  Corollary 6.

Let $a>0$ and let a positive integer $n$ be fixed. Then
$F(q)=(aqB(aq,nq+1))^{\frac{1}{q}}$ is a decreasing function of $q$.

###### Proof.

Apply Proposition 1 to the function $f(z)=z^{2n}$, observing that

(9)
$\|z^{2n}\|_{p,q,a}=\left(\int_{0}^{1}aq(1-r)^{aq-1}r^{nq}dr\right)^{1/q}=\left(aqB(aq,nq+1)\right)^{\frac{1}{q}}\,.$

∎

Next, from Proposition 2, we obtain the following inequality which we have not
been able to find in the literature. It does not seem to follow in the usual
way from the convexity of the logarithm of the Gamma function and we have not
been able to deduce it in an elementary way without essentially repeating the
procedure employed in the proof of Proposition 1.

######  Corollary 7.

Let $x>1$, $y>0$, and $\delta\geq 0$. Then

$y^{n\delta}B\left(x,y\right)^{x-1+n\delta}\leq
B\left(x+n\delta,y\right)^{x-1}\,.$

for all positive integers $n$.

###### Proof.

We apply Proposition 2 to the function $f(z)=z^{2n}$, using again formula (9).
This yields

$\left(bvB(bv,nv+1)\right)^{\frac{1}{v}}\leq\left(aqB(aq,nq+1)\right)^{\frac{1}{q}}\,.$

assuming that $\infty\geq p\geq u>0$, $\infty>q\geq v>0$, $aq\leq bv$. Let
$x=nv+1$, $q=v+\delta$ and choose $a$, $b>0$ in such a way that $aq=bv(=y)$.
By the symmetry property of $B$, it follows that

$\left(yB(x,y)\right)^{1/(x-1)}\leq\left(yB(x+n\delta,y)\right)^{1/(x-1+n\delta)}\,,$

and simplifications yield the desired inequality. ∎

Acknowledgments. The authors are partially supported by the grant
PID2019-106870GB-I00 from MICINN, Spain. The first author is supported by the
MU Predoctoral Fellowship FPU/00040.

## References

  * [1] P. Ahern and M. Jevtić, Duality and multipliers for mixed norm spaces, Michigan Math. J. 30 (1983), 53–64.
  * [2] I. Arévalo, A characterization of the inclusions between mixed norm spaces, J. Math. Anal. Appl. 429 (2015), 942–955. Corrigendum: J. Math. Anal. Appl. 433 (2016), 1904–1905.
  * [3] I. Arévalo, Weighted composition operators on spaces and classes of analytic functions, Doctoral Thesis, Universidad Autónoma de Madrid, 2017.
  * [4] F. Bayart, O.F. Brevig, A. Haimi, J. Ortega-Cerdà, K.-M. Perfekt, Contractive inequalities for Bergman spaces and multiplicative Hankel forms, Trans. Amer. Math. Soc. 371 (2019), no. 1, 681–707.
  * [5] D. Békollè, J. Gonessa, B.F. Sehba, About a conjecture of Lieb-Solovej, preprint, November 2020, https://arxiv.org/abs/2010.14809.
  * [6] O. Blasco, Multipliers on spaces of analytic functions, Canad. J. Math. 47 (1995), 44–64.
  * [7] A. Bondarenko, W. Heap, K. Seip, An inequality of Hardy-Littlewood type for Dirichlet polynomials, J. Number Theory 150 (2015), 191–-205.
  * [8] O.F. Brevig, J. Ortega-Cerdà, K. Seip, J. Zhao, Contractive inequalities for Hardy spaces,  Funct. Approx. Comment. Math. 59 (2018), no. 1, 41–-56.
  * [9] S.M. Buckley, P. Koskela, D. Vukotić, Fractional integration, differentiation, and weighted Bergman spaces, Math. Proc. Cambridge Philos. Soc. 126 (1999), no. 2, 369–-385.
  * [10] J. Burbea, Sharp inequalities for holomorphic functions, Illinois J. Math. 31 (1987), no. 2, 248–-264.
  * [11] E.A. Carlen, Some integral identities and inequalities for entire functions and their application to the coherent state transform, J. Funct. Anal. 97 (1991), no. 1, 231–249.
  * [12] P.L. Duren, Theory of $H^{p}$ Spaces, Pure and Applied Mathematics, Vol. 38, Second edition, Dover, Mineola, New York 2000.
  * [13] P.L. Duren, Invitation to Classical Analysis, AMS, Providence, RI 2012.
  * [14] T.M. Flett, The dual of an inequality of Hardy and Littlewood and some related inequalities, J. Math. Anal. Appl. 38, (1972), 746–765.
  * [15] T.M. Flett, Lipschitz spaces of functions on the circle and the disk, J. Math. Anal. Appl. 39 (1972), 125–158.
  * [16] E.H. Lieb J.Ph. Solovej, Wehrl-type coherent state entropy inequalities for $SU(1,1)$ and its $AX+B$ subgroup, Partial Differential Equations, Spectral Theory, and Mathematical Physics, EMS Series of Congress Reports, June 2021, pp. 301–314.
  * [17] M. Pavlović, Function Classes on the Unit Disc. An introduction, De Gruyter Studies in Mathematics, 52, De Gruyter, Berlin 2014.
  * [18] Ch. Pommerenke, Boundary Behaviour of Conformal Maps, Springer-Verlag, Berlin 1992.
  * [19] J. Xiao, K. Zhu, Volume integral means of holomorphic functions, Proc. Amer. Math. Soc.139 (2011), no. 4, 1455–-1465.
  * [20] K. Zhu, Analysis on Fock Spaces, Springer, New York 2012.


4 gray 90 arXiv: some other text goes here -1.5,-10  Submitted to a journal
for publication.

Software-Defined Location Privacy Protection
for Vehicular Networks

Abdelwahab Boualouache, Ridha Soua, and Thomas Engel

SnT, University of Luxembourg, Luxembourg
Email: {abdelwahab.boualouache, ridha.soua<EMAIL_ADDRESS>
###### Abstract

While the adoption of connected vehicles is growing, security and privacy
concerns are still the key barriers raised by society. These concerns mandate
automakers and standardization groups to propose convenient solutions for
privacy preservation. One of the main proposed solutions is the use of
Pseudonym-Changing Strategies (PCSs). However, ETSI has recently published a
technical report which highlights the absence of standardized and efficient
PCSs [1]. This alarming situation mandates an innovative shift in the way that
the privacy of end-users is protected during their journey. Software Defined
Networking (SDN) is emerging as a key 5G enabler to manage the network in a
dynamic manner. SDN-enabled wireless networks are opening up new programmable
and highly-flexible privacy-aware solutions. We exploit this paradigm to
propose an innovative software-defined location privacy architecture for
vehicular networks. The proposed architecture is context-aware, programmable,
extensible, and able to encompass all existing and future pseudonym-changing
strategies. To demonstrate the merit of our architecture, we consider a case
study that involves four pseudonym-changing strategies, which we deploy over
our architecture and compare with their static implementations. We also detail
how the SDN controller dynamically switches between the strategies according
to the context.

Keywords: 5G, Vehicular Networks, Software Defined Networking, Location
privacy,
Pseudonym-Changing

##  1 Introduction

As part of the vision of 5G, connected vehicles will be an important pillar of
Intelligent Transportation Systems (ITS), with the aim to ensure road safety,
avoid traffic congestion and provide a better driving experience for users
during their journey. Although the deployment stage for connected vehicles is
imminent, many security and privacy issues are still unsolved. Location
privacy is one of the main issues that may impede the wide acceptance of
vehicular networks. Indeed, location tracking of vehicles may reveal every
place visited by drivers. This is because there is generally a one-to-one
relationship between the vehicle and its driver. The visited locations may
include very personal places like hospitals, banks, insurance companies, etc.
and hence can reveal sensitive information about the end-user.

On the other hand, the main wireless communication technologies for connected
vehicles, such as IEEE802.11p, present several privacy concerns. Indeed,
IEEE802.11p mandates that each connected vehicle should frequently send a
safety message, called CAM (Cooperative Awareness Message), to ensure
cooperative awareness among neighboring vehicles. These messages include
sensitive information such as identifiers, positions, speeds, etc, and are
sent in clear text; hence vehicles could be tracked on the basis of the
information transmitted by the Vehicle to Vehicle (V2V) and Vehicle to
Infrastructure (V2I) communications. To mitigate this privacy risk, the use of
pseudonym schemes has received significant interest from the research
community and standardization authorities. For instance, both the European
standard ETSI TS 102 941 [1] and the American standard SAE J2735 [2] have
adopted a pseudonym scheme. However, several studies have shown that the use
of a simple pseudonym-changing is insufficient to provide unlinkability
between the pseudonyms and have suggested using strategies for changing the
pseudonyms. Although, there is a significant number of proposed Pseudonym-
Changing Strategies (PCSs), there are no recommendations by standardization
bodies for PCSs to apply. The main reasons for this can be summarized as
follows: (i) several proposed strategies are strongly topology-dependent i.e.
they could only be applied in a given situation or area such as signalized
intersections, parking lots, and gas stations; (ii) some strategies propose
the use of radio silence without considering its critical impact on the
exchange of safety messages, or dynamically readjusting radio silence
duration; (iii) each PCS is evaluated with individual privacy metrics that may
not be suitable for another PCS. This absence of unified evaluation metrics
complicates the comparison between existing strategies; (iv) The scarcity of
scientific studies focusing on the non-cooperation behavior of vehicles.
Selfish vehicles could significantly decrease the efficiency of PCSs; (v) most
of the existing PCSs assume a strong global passive adversary. However, this
assumption is not realistic, since the global presence of the adversary is
difficult to achieve due to the large scale of deployment of connected
vehicles, and the high cost of ensuring complete coverage; and (vi) pseudonyms
could be easily used to perform Sybil attacks. This vulnerability is not taken
into the account by most of the strategies proposed in the literature.

One possible solution for dealing with these various PCSs is to propose a
comprehensive architecture that is able to encompass all of them and their
intrinsic features. This architecture should be forward-looking in the sense
that it should support future PCS solutions. With this in mind, we propose a
software-defined architecture for location privacy in vehicular networks. This
architecture extends and leverages the concepts of SDN to PCSs and ensures the
selection of the appropriate PCS according to the context of vehicles and
other factors, as will be detailed later. The SDN control plane orchestrates
the selection and adjusts the parameters of the selected strategy dynamically,
based on information received from the data plane. The SDN strategy rules are
also forwarded from the control plane to the data plane to ensure the correct
execution of the selected PCS. In the next section, we discuss in detail the
standardization efforts related to pseudonym-changing strategies, their open
issues, and explain how our proposed architecture cope with these issues.

##  2 Pseudonym-Changing Strategies: Standardization Efforts and Open Issues

Security standardization bodies have agreed to adopt PCS to protect the
location privacy of connected vehicles. However, while in the US, the Society
of Automotive Engineers (SAE) suggests that vehicles change their pseudonym
every five minutes [2], the European telecommunications standardization
organization, ETSI, does not suggest the adoption of any PCS [1]. In the light
of this, many PCSs are proposed in the literature. In [3], we presented a
comprehensive survey and classification of these strategies. This paper also
highlights open issues and presents recommendations, including the importance
of developing a dynamic system to select the applying PCS according to the
vehicular context. Recently, ETSI published a technical report (ETSI TR 103
415) [1] that presents a pre-standardization study of PCS. This document
surveys the existing categories of strategies. It also discusses and describes
the suggestions of the European projects (PRESERVE, SCOOP@F, and C2C-CC)
regarding PCS. The document identifies the open issues of PCSs and proposes a
set of recommendations addressing these issues. In the following, we discuss
the open issues highlighted in [1, 3] and the related recent advances

  * •

Impact on road safety: as shown in [3], strategies using radio silence are the
most efficient solutions. However, their major drawback is their significant
negative impact on safety-related applications. This was first investigated in
[4], where the authors recommend that the silent period should be shorter than
two seconds and that long silent periods can result in hazardous situations,
since many safety messages will not be transmitted due to radio silence. The
ETSI technical report [1] also discusses the problems of “missing vehicles”
and “guest vehicles”. Missing vehicles are those that put radio silence into
effect after changing their pseudonyms; at the end of this period, these
vehicles suddenly appear in the LDMs (Local Dynamic Map) of neighboring
vehicles. This may generate unpredictable reactions as highlighted in [1]. In
contrast, the problem of the guest vehicle is observed when a vehicle changes
its pseudonym while his old pseudonym still populates the LDMs of its
neighboring vehicles [5]. Subsequently, LDM messages contain two entries that
correspond to the same vehicle, leading to a misinterpretation of the
surrounding environment by neighboring vehicles. Unlike the missing vehicle
problem, the ghost vehicle problem is not only linked to radio silence based
strategies, but to PCSs in general.

  * •

Non-cooperative behavior: by triggering the change of their pseudonyms at the
same time slot, cooperative vehicles ensure a high level of anonymity and
create confusion for the attacker. Consequently, the existence of non-
cooperative vehicles will significantly hinder the efficiency of the PCS
specifically under lower vehicular density. The authors of [6] study PCSs
under a non-cooperative environment. They propose a game theory model and find
a Nash equilibrium of the PCS under different types of games (static/dynamic,
with and without complete information). Other works such as [7] and [8]
propose incentive mechanisms to motivate non-cooperative vehicles to
participate in the PCS.

  * •

Attacker model: It is not trivial to estimate the power of tracking attackers
that may exist in the future deployment of vehicular networks. Attacker power
can be expressed in terms of tracking capabilities (strong or weak sniffing
stations, efficiency of the tracking algorithm, etc.) and the coverage area.
In addition, it is critical to properly define a realistic attacker model. For
this reason, most of proposed PCSs have assumed the extreme case of the
attacker model (global attacker full of capabilities); however, this
assumption is not realistic, because global coverage entails a significant
surveillance cost. Consequently, the authors of [9] propose a mid-sized
attacker whose power is in between that a local attacker and a global one.
They also distinguish three tracking periods (i.e short-term, mid-term, and
long-term) and two levels of surveillance granularity (i.e Road-level and
Zone-level).

  * •

Evaluation metrics: many metrics are proposed to assess the performance of
PCSs. The recent study carried out by Zhao et al. [10] show that there is no
single privacy metric that outperforms all others under different contexts
(mobility, traffic conditions, road section, etc.). For this reason, it is
recommended to combine all metrics to obtain a fair performance evaluation of
a PCS.

  * •

Privacy model: the privacy level depends mainly on the considered attacker
model and the evaluation metrics. The authors of [6] proposed a linear model
to quantify the loss of privacy after the last change of pseudonym. In this
model, the privacy level of vehicles linearly decreases according to a
sensitivity parameter, which characterizes the power of the adversary.
However, this model has two major drawbacks: (i) it does not specify how the
sensitivity parameter is measured. (ii) the linearity of this model is not
justified.

  * •

Sybil attacks: In this attack, vehicles use multiple identities, called
Sybils, which can be exploited to create a fake traffic jam and hence to alter
other vehicles’ perceptions. Pseudonyms could be exploited to launch Sybil
attacks. The ETSI technical report [1] gives some recommendations on thwarting
Sybil attacks, such as setting the maximum number of pseudonyms that can be
used simultaneously and the minimum duration for which the pseudonyms should
be used. The technical report also recommends the use of misbehavior detection
systems.

  * •

Pseudonym lock: ETSI standards specify that the PCS could be locked on-demand
for a maximum of $255$s, in particular when a critical safety situation
occurs. The priority levels of such a situation are respectively “0” or “1”
[11]. PCS locking is also proposed by the SAE. However, the conditions when
the pseudonyms are locked are not yet defined.

  * •

Pseudonym reuse: Although the reuse of pseudonyms minimizes the storage
capacity and facilitates the management of pseudonyms, it can decrease the
level of privacy. This is why the reuse of pseudonyms is not recommended as a
privacy best practice. However, the Car2car consortium considers the reuse of
pseudonym while defining some KPI to increase the privacy level [3].

It is obvious that several issues are still unsolved and need the attention of
the research community to ensure the deployment of PCS in connected vehicles.
This urgent need motivates us to propose a forward-looking architecture that
can encompass existing PCSs as well as future ones. Leveraging Software-
Defined Networking (SDN), the proposed architecture is flexible and enables
the efficient integration of new proposed solutions and new functions of the
PCS. The contributions of this work can be summarized as follows:

  * •

Integration of SDN into vehicular networks, allowing new PCSs to be deployed,
easily updated and dynamically reconfigured.

  * •

Introduction of novel pseudonym-changing modules in the control plane and the
definition of their different interactions to ensure a context-aware PCS.

  * •

Introduction of novel complementary pseudonym-changing modules in the data
plane and the definition of their interactions.

  * •

Definition of SDN rules (which can be modified dynamically at the controller)
to establish a set of actions that will handle the PCS.

  * •

Definition of a Sybil attack agent to interact with the external misbehavior
system controller.

  * •

Definition of self-learning module that is able to analyze and learn from its
immediate context while autonomously adapting the PCS accordingly to ensure a
high level of privacy protection. This module is crucial, as it guarantees
network intelligence and leads to a network that is self-privacy-preserving.

##  3 Proposed Architecture: Building blocks

Our self-privacy-preserving architecture leverages the SDN paradigm and thus
follows its main principle, which is the separation between the data and the
control plane. The control plane is responsible for dynamically selecting the
PCS, adjusting the parameters of strategy, and planning the strategy rules. On
the other hand, the data plane translates the defined rules into actions to
apply the PCS. The communications between the control plane and the data plane
are secure.

###  3.1 Control Plane

Figure 1 shows the logical modules of the control plane in our architecture.
The PCS module receives a demand from the application layer to provide the
location privacy service. This module chooses the most convenient PCS to be
executed based on the information received from two modules: the Mobility and
Topology module and Attacker Model module. Once the strategy is selected, the
PCS module invokes (i) the Parameter Settings module to request the parameters
of the strategy; (ii) the Incentive Model module to request the appropriate
incentive method to motivate non-cooperative vehicles; and (iii) the Privacy
Metric module to request indicators and KPIs for the evaluation of PCS
performance. In the following, we detail these modules.

Figure 1: The logical modules of the control plane and the interactions
between them.

  * •

Road Safety Monitoring: this module monitors road conditions and its impact on
traffic safety. Based on this assessment, the module develops appropriate SDN
rules which are sent to the data plane. In addition, this module provides the
necessary information to the Parameter Settings module to tune the PCS
parameters, such as the duration of radio silence and the lock period.

  * •

Misbehavior Detection System Controller: this is an external component, which
detects misbehaving attacks such as message injection, denial of service (DoS)
and Sybil attacks. The SDN controller of our self-privacy-preserving
architecture uses the information received from the Misbehavior Detection
System Controller to update its parameters in order to limit Sybil attacks and
returns information to help in detecting Sybil attacks and accurately
evaluating the trust levels of vehicles.

  * •

Sybil Attack Agent: this interface is used to interact with the Misbehavior
Detection System Controller, receiving information from it and forwarding it
to the Pseudonym Management module to adjust some PCS parameters. It also
receives information from the Learning module and forwards this to the
Misbehavior Detection System Controller to enhance the attack detection ratio.

  * •

Pseudonym Management: this module plans the rules that orchestrate the use of
pseudonyms: the reuse of pseudonyms, the frequency of changing of pseudonyms,
the number of pseudonyms that can be used in parallel, etc. This module
receives information from both the Sybil Attack Agent and learning modules and
sends the resulting rules to the Parameter Settings module.

  * •

Privacy Model: This is used to model the loss of privacy of vehicles over
time. As explained in the previous section, the loss of privacy mainly depends
on the strength of the attacker model. For this reason, this module receives
input from the Attacker Model module. The Privacy Model provides input to the
Parameter Settings module, which in return specifies the parameters of the
Privacy Model.

  * •

Mobility and Topology: this module monitors the mobility pattern of vehicles
and the road topology in real time.

  * •

Parameter Settings: this module sets the different parameters of the PCS, such
as the duration of the radio silence period and the minimum duration of the
use of pseudonyms. The definition of these parameters is made according to the
information received from the Road Safety, Pseudonym Management, and the
Privacy Model modules.

  * •

Attacker Model: this module evaluates the power of the attacker. As discussed
in the previous section, the attacker can be internal or external, local or
mid-sized, long-term. It can perform simple syntactic linking of pseudonyms,
but can also carry out more advanced semantic linking of pseudonyms. This
module gets regular updates from the learning model and sends feedback to the
Pseudonym-Changing Strategy module.

  * •

Incentive Model: this module defines the incentive model, which is used to
motivate selfish vehicles to participate in the PCS.

  * •

Privacy Metric: this module defines the privacy metrics used to evaluate the
PCS. It worth mentioning that the privacy metrics can be selected by the PCS
to evaluate its own performance.

  * •

PCS Module: this module defines the strategy to be executed based on the
information received from the Mobility and Topology module and the Attacker
Model module. Once the strategy is selected, this module invokes the Parameter
Settings module to obtain the most appropriate parameters of the selected
strategy. This module also invokes the Privacy Metric module and the Incentive
Model module to select the evaluation metric and the incentive method
respectively.

  * •

Learning: this module periodically receives privacy-related information from
the data plane (i.e the privacy levels of vehicles, the presence of an
attacker, and the set of selfish vehicles). This information is analyzed and
forwarded to the corresponding modules: (i) the Attacker Model module to
adjust the attacker model being used; (ii) the PCS module to tune the strategy
parameters, and the Incentive Model module, and to select an additional
potential privacy metric. (ii) the Pseudonym Management module to adjust
pseudonym management related parameters, and finally (iv) the Sybil Attack
Agent, which forwards pseudonym-changing information to the Misbehavior
Detection System Controller. The purpose is to support this controller in the
accurate detection of Sybil attacks and trust assessment of vehicles.

Figure 2: The logical components of the data plane and the interactions
between them.

###  3.2 Data Plane

The data plane is composed of the different vehicles that are involved in the
PCS. Figure 2 depicts the modules of the data plane, which are responsible of
the execution of the PCS. The data plane uses the vehicles’ communication
interfaces to collect pertinent information concerns the surrounding vehicular
environment. The data plane sends mobility, safety, and privacy information to
the control plane, while it receives safety and strategy rules. In the
following, we describe the modules and the databases of the data plane:

  * •

Safety Message Management: this module sends and receives pseudonymous safety
messages. It also receives instructions from the Strategy Engine. These
instructions vary according to the applied strategy. In addition, this module
provides the status of the surrounding environment and the impact of the
applied PCS to the Road Safety Engine, the Topology and the Mobility engine,
and finally to the Strategy Engine.

  * •

Mobility and Topology Engine: Equipped with a map and GPS, this module sends
the mobility information of the vehicle such as position, speed, and
acceleration and the topology information to the Road Safety Engine and to the
control plane.

  * •

SDN Safety Rules: This is a database, which contains the safety rules that are
used to assess road conditions. The rules data is received from the control
plane.

  * •

Road Safety Engine: this module receives, stores and updates the safety rules
received from the control plane. These rules are used to evaluate road safety
based on the information received from the Topology and Mobility Engine and
the Safety Message Management module. This module periodically sends road
safety information to the control plane.

  * •

SDN Strategy Rules: This is a database that contains the rules related to PCS.
These rules describe where, when and how pseudonyms change. The database is
regularly updated by the Strategy Inspector module; based on the information
received from the control plane.

  * •

Strategy Settings: This is a database that contains the settings of the
applied strategy such as the duration of radio silence period after the
changing of pseudonym. This database is also regularly updated by the Strategy
Inspector module according to the information received from the control plane.

  * •

Strategy Inspector: this module represents an interface, which communicates
with the PCS module of the control plane. It receives information from the SDN
controller(s) and stores them in two databases: the SDN Strategy rules and the
Strategy Settings databases. This module also forwards these PCS rules and
settings to the Strategy Engine module.

  * •

Strategy Engine: this module executes the PCS according to the rules and
settings received from the Strategy Inspector module. To execute the strategy,
the module continuously monitors and sends instructions to the Safety Message
Management module. This module provides privacy protection related information
to the driver from whom it receives privacy level recommendations. This module
also sends privacy-related information to the control plane.

##  4 Case Study

To demonstrate the merit of our proposed architecture, we conducted the
following case study. As shown in Figure 3 (1), we populated a Software-
Defined Location Privacy Controller (SDLP) with four state-of-the-art PCSs:
UPCS [12], TAPCS [13], PRIVANET [8] and SocialSpots [14]. In this section, we
first show how these strategies are integrated into our architecture. Then, we
illustrate how the SDLP performs a context-aware PCS selection. The context is
mainly defined by mobility and topology, as well as the attacker model.
Finally, we conduct a simulation-based study to demonstrate how our proposed
architecture dynamically updates the security parameters of each strategy.

###  4.1 PCSs Deployment

Table 1: The deployments of PCSs in the self-privacy-preserving architecture

| Mobility and topology | Parameter setting | Attacker model | Privacy model | Privacy metric | Incentive model
---|---|---|---|---|---|---
UPCS [12] | Signalized intersection |  | Red traffic light duration:
---
30s, 60s
Global external passive and local internal passive (Semantic and syntactic linking) | No | The entropy of the annonymity set | No
SocialSpots [14] | Signalized intersection | Red traffic light turns green |  Global external passive (Syntactic linking) | No | The size of the anonymity set | Yes
TAPCS [13] | Traffic congestion | Speed threshold |  Global external passive and local internal passive (Semantic and syntactic linking) | No | The entropy of the anonymity set | No
PRIVANET [8] |  Roadside Infrastructure e.g. Gas station |  | The capacity of RI
---
The threshold of privacy
Global external passive and local internal passive (Semantic and syntactic linking) | Yes | The size of the anonymity set | Yes

Figure 3: The selection of pseudonym changing strategy

Our proposed architecture is flexible enough to support any state-of-the-art
PCS. Table 1 shows how the considered strategies are mapped to our
architecture. This table has six columns: (i) Mobility and topology: specifies
the topology where the strategy can be used; (ii) Parameter Setting: specifies
the parameters of the strategy; (iii) Attacker model: specifies that attacker
model from which the strategy provides protection; (iv) Privacy model:
specifies if the strategy uses a privacy model or not; (v) Privacy metric:
specifies the metric used to evaluate the strategy; (vi) Incentive model:
specifies if the strategy uses an incentive model or not.

Control plane modules are activated or deactivated according to the
requirements of each PCS. For example, the Incentive Model module is disabled
for UPCS and TAPCS since these strategies do not propose any mechanism to
motivate non-cooperative vehicles to change their pseudonyms; while the
Privacy Model module is only activated for PRIVANET strategy.

Figure 3 (2) illustrates different steps for the selection of a PCS. The SDLP
first checks information received from the Mobility and Topology module. For
instance, if the vehicle is entering a signalized intersection, two PCSs could
be applied to this context: UPCS and SocialSpots. To decide which of the two
strategies to apply, SDLP checks information received from the Attacker Model
module. If the attacker model can perform both syntactic and semantic
pseudonym linking attacks, then UPCS is selected. Otherwise, if the attacker
can perform only syntactic attacks, SocialSpots is selected. More details on
syntactic and semantic pseudonym linking attacks can be found in [3].

Table 2: The configuration of pseudonym-changing strategies Strategy | Changed context | Configuration | Action | Results
---|---|---|---|---
|  |  | 10% of vehicles
---
in dangerous situation
Pseudonym lock |  | Low safety risk
---
Acceptable privacy level
SDN-based UPCS [12] | Road safety |  | 20% of vehicles
---
are in dangerous situation
Pseudonym lock |  | Low safety risk.
---
Acceptable privacy level
|  | Simple attacker | Select privacy metric | The size of the anonymity set
|  | Medium attacker | Change the privacy metric | The entropy of the anonymity set
SDN-based TAPCS [13] | Attacker model | Advanced attacker | Keep the privacy metric | The entropy of the anonymity set
|  | Sensitivity parameter = 0.1 | Update privacy model | High privacy level
SDN-based PRIVANET [8] | Privacy model | Sensitivity parameter = 0.2 | Update privacy model | Low privacy level

###  4.2 Simulation Setup

We carried out a simulation-based analysis to demonstrate the merit of our
SDN-based and self-learning architecture and how it dynamically adapts PCS
security parameters to the context. This simulation-based analysis was
performed using Veins Simulation Framework [15]. The considered scenario is
similar to that proposed in [8]. Three strategies are simulated: UPCS, TAPCS,
and PRIVANET. SocialSpots was excluded, as it has the same application context
(signalized intersections) as UPCS.

Table 2 details the configurations of the simulated strategies. This table has
four columns: (i) Changed context: specifies the context we change during the
simulation; (ii) Configuration: specifies the values we assign to the context’
parameters; (iii) Action: specifies the action to perform when the parameter
is changed; (iv) Results: specifies the obtained results when the action is
applied. To demonstrate the dynamic changing of PCS parameters according to
context, three different scenarios are considered.

  1. 1.

Scenario 1: uses UPCS strategy in a road safety context, where the number of
vehicles in a dangerous situation can be 10% or 20%. The pseudonym changing in
such a situation can generate traffic collisions and accidents.

  2. 2.

Scenario 2: uses TAPCS strategy, where we study how this strategy adapts the
privacy metric to the attacker model. Three configurations of the attacker
model are considered: simple, medium, and advanced.

  3. 3.

Scenario 3: uses PRIVANET focusing on the privacy model. We consider two
configurations of this model by varying the sensitivity parameter value, which
characterizes the power of the adversary.

###  4.3 Simulation Results

Figure 4: Static UPCS vs SDN-based UPCS

Figure 4 compares the static implementation UPCS (static UPCS) to its SDN-
based variant (SDN-based UPCS). Two performance indicators are considered: the
privacy level and safety. As shown in Figure 4, static UPCS provides a higher
level of privacy protection compared to SDN-based UPCS. However, SDN-based
UPCS has a lower safety risk than static UPCS. The reason for this, as
described in Table 2, is that SDLP takes an action to lock pseudonym-changing
processes of vehicles in a dangerous situation. This lock slightly decreases
the privacy protection level, while reducing the safety risk.

Figure 5: Static TAPCS vs SDN-based TAPCS

Figure 5 makes a comparison between Static TAPCS and SDN-based TAPCS. In
Static TAPCS, the entropy of anonymity set is used as a performance metric,
whatever attacker model is used. However, the SDN-based TAPCS varies the
performance metric according to the power of the attacker. For instance, the
size of the anonymity set is chosen when the attacker is simple, while the
entropy of the anonymity set is selected when the attacker is medium or
advanced. In the former case, the probabilities of distinguishing between
vehicles are equal and hence the measuring size of the anonymity set performs
well. In the latter case, the distinguishing probabilities are not equal;
hence the need to take the entropy into account.

Figure 6: Static PRIVANET vs. SDN-based PRIVANET

Finally, we compare the static implementation of PRIVANET and the SDN-based
PRIVANET. As illustrated in Figure 6, the sensitivity parameter ($\alpha$),
which characterizes the power of the attacker, remains unchanged in Static
PRIVANET and is equal to $0.3$. However, for SDN-based PRIVANET, the
sensitivity parameter is updated according to the information received from
the data plane. The change in the power of the attacker (the sensitivity
parameter) has a direct impact on the privacy level obtained by vehicles.
Indeed, as illustrated in Figure 6, the high values of the average of privacy
are obtained when the sensitivity parameter equals 0.1. However, the lower
values of the average of privacy are obtained when the sensitivity parameter
equals 0.3.

##  5 Conclusion

The imminent deployment of connected vehicles requires significant attention
to the security and privacy aspects. Privacy protection is a critical issue
that influences the user acceptance of this technology. Pseudonym-changing
strategies are considered as the key solution to overcome this acute need.
However, the absence of recommended pseudonym-changing strategies (PCSs)
represents an obstacle to achieving this objective. To this end, we propose an
innovative architecture that exploits Software-Defined Networking (SDN), one
of the key technologies for 5G networks. Our proposed architecture is flexible
and self-learning and hence can encompass PCSs proposed so far in the
literature and even upcoming PCSs. The selection of the appropriate PCS and it
security settings are context-aware. The control plane is modular and includes
the main building-blocks of PCSs which can support any future solution.

## Acknowledgment

This work was supported by the H2020 5G-DRIVE project (ID: 814956) and the
H2020 5G-MOBIX project (ID: 825496).

## References

  * [1] ETSI TR 103 415, “Intelligent Transport Systems (ITS); security; pre-standardization study on pseudonym change management,” _ETSI standards_ , 2018.
  * [2] J2945/1, “On-board system requirements for V2V safety communications,” _SAE Standards_ , 2016.
  * [3] A. Boualouache, S.-M. Senouci, and S. Moussaoui, “A survey on pseudonym changing strategies for vehicular ad-hoc networks,” _IEEE Communications Surveys & Tutorials_, vol. 20, no. 1, pp. 770–790, 2017.
  * [4] S. Lefevre, J. Petit, R. Bajcsy, C. Laugier, and F. Kargl, “Impact of v2x privacy strategies on intersection collision avoidance systems,” in _Vehicular Networking Conference (VNC), 2013 IEEE_ , Dec 2013, pp. 71–78.
  * [5] I. B. Jemaa, A. Kaiser, and B. Lonc, “Study of the impact of pseudonym change mechanisms on vehicular safety,” in _2017 IEEE Vehicular Networking Conference (VNC)_. IEEE, 2017, pp. 259–262.
  * [6] J. Freudiger, M. H. Manshaei, J.-P. Hubaux, and D. C. Parkes, “Non-cooperative location privacy,” _Dependable and Secure Computing, IEEE Transactions on_ , vol. 10, no. 2, pp. 84–98, 2013.
  * [7] B. Ying, D. Makrakis, and Z. Hou, “Motivation for protecting selfish vehicles’ location privacy in vehicular networks,” _Vehicular Technology, IEEE Transactions on_ , vol. 64, no. 12, pp. 5631–5641, 2015.
  * [8] A. Boualouache, S.-M. Senouci, and S. Moussaoui, “PRIVANET: An efficient pseudonym changing and management framework for vehicular ad-hoc networks,” _IEEE Transactions on Intelligent Transportation Systems_ , 2019.
  * [9] J. Petit, D. Broekhuis, M. Feiri, and F. Kargl, “Connected vehicles: Surveillance threat and mitigation.”
  * [10] Y. Zhao and I. Wagner, “On the strength of privacy metrics for vehicular communication,” _IEEE Transactions on Mobile Computing_ , vol. 18, no. 2, pp. 390–403, 2018.
  * [11] ETSI TS 101 539-1 (V1.1.1), “Intelligent Transport Systems (ITS); V2X applications; part 1:Road Hazard Signalling (RHS) application requirements specification,” _ETSI standards_ , 2013.
  * [12] A. Boualouache and S. Moussaoui, “Urban pseudonym changing strategy for location privacy in VANETs,” _International Journal of Ad Hoc and Ubiquitous Computing_ , vol. 24, no. 1-2, pp. 49–64, 2017.
  * [13] ——, “TAPCS: Traffic-aware pseudonym changing strategy for VANETs,” _Peer-to-Peer Networking and Applications_ , vol. 10, no. 4, pp. 1008–1020, 2017.
  * [14] R. Lu, X. Lin, T. H. Luan, X. Liang, and X. Shen, “Pseudonym changing at social spots: An effective strategy for location privacy in VANETs,” _IEEE transactions on vehicular technology_ , vol. 61, no. 1, pp. 86–96, 2011\.
  * [15] C. Sommer, R. German, and F. Dressler, “Bidirectionally coupled network and road traffic simulation for improved IVC analysis,” _IEEE Transactions on Mobile Computing_ , vol. 10, no. 1, pp. 3–15, Jan 2011.