We address query-anonymity in the context of wireless sensor networks. Query-anonymity is the property that the destination of a client’s query is indistinguishable from other potential destinations. Prior work has established that this is an important issue, and has also pointed out that there appears to be a natural trade-off between query-anonymity and communication-cost. We explore what we call the limits of this trade-off: what is the communication-cost that is sufficient to achieve a certain query-anonymity, and what is the communication-cost that we must necessarily incur to achieve a certain query-anonymity? We adopt an unconditional notion of query-anonymity that we argue has intuitive appeal. We then establish the limits of the trade-off. In particular, we show that in wireless sensor
networks which are source-routed, the necessary and sufficient communication-cost for query-anonymity asymptotically smaller than the diameter of the network d is a function of d only, and the necessary and sufficient communication-cost for query-anonymity larger than d is a function of the desired query-anonymity only. Our result applies to any network topology that is an arbitrary connected undirected graph. We validate our analytical insights empirically, via simulations. In summary, our work establishes sound and interesting theoretical results for query-anonymity in wireless sensor networks, and validates them empirically.4 month
