Generating K-Anonymous Logs of People-Tracing Systems in Surveilled Environments Francesco Buccafurri, Gianluca Lax, Serena Nicolazzo, and Antonino Nocera DIIES, University of Reggio Calabria, Loc. Feo di Vito, 89122 Reggio Calabria, Italy {bucca,lax,s.nicolazzo,a.nocera}@unirc.it Discussion Paper Abstract. In surveilled environments, physical access of individuals can be achieved by a human through mechanical means such as locks and keys, or through technological means such as access control systems based on magnetic stripe, barcode, smart cards, biometric devices, RFID, cam- eras, and so on. Besides the importance of monitoring people accessing these places, another relevant issue concerns the possibility of tracking them inside the environment. Indeed, in this way, we can have infor- mation about the movements of people at any time and, in case of an incident, the analysis of these logs can be decisive to have a complete and fast reconstruction of this event. However, privacy right typically makes this solution unrealizable. In this paper, we discuss this topic and propose a technique to generate logs that allows us to trace people with a certain degree of uncertainty, in such a way that privacy is fully pre- served. From this point of view, logs are generated according to a new k-anonymity property, for which we are able to guess the location of an individual, at a given time, with probability k -1 . A number of experi- ments show that the proposed method reaches the target in a good way, thus validating the approach. An important aspect of our technique is that it is implementable via very cheap devices, which is a relevant issue in pervasive environments where wireless devices with limited processing capability and power have to be utilized. 1 Introduction In surveilled environments, where the physical access of individuals is controlled, a high level of security is reached if people can be traced everywhere, using for ex- ample RFID-based technology, in such a way that we have logs reporting at any time people localization. Consider, for example, the case of a museum, an airport, a railways station, etc. The (a-posteriori) analysis of logs, can provide decisive information in case of a security incident. There are realistic possibilities to apply a similar approach because, usually, physical access to surveilled environments requires people registration. Unfortunately, in most cases, a similar solution is intolerable for privacy reasons, often not compliant with law requirements. In