Theme Article: Special Section on Emerging Paradigms in Vehicular Cybersecurity Using Map Matching for DeIdentification of Connected Vehicle Locations Jason M. Carter and Aaron E. Ferber Oak Ridge National Laboratory Abstract-We introduce a location deidentification procedure that uses road network structure to protect against certain types of inference-based attacks. Our target is large databases containing vehicle locations. Previous anonymization approaches are inappropriate because location generalization and perturbation of geopositions could negatively affect development of safety-critical applications that require precise position information. Furthermore, k-anonymity-based clustering approaches would lead to significant data suppression. Our algorithm attempts to balance privacy protection and data utility, while protecting against re-identification attacks. Our data is from the first connected vehicle model deployment in the United States. & THIS ARTICLE INTRODUCES a suppression-based control that uses road network structure and metadata to mitigate inference-based privacy attacks against sequences of locations. Our procedure has broad applicability, but it was designed to protect U.S. Department of Transportation (USDOT) vehicle-to-vehicle (V2V) communication data. The privacy control introduced in this article targets data for safety-critical application development. We analyze data before and after applying our procedure to assess how well it meets its objective to protect privacy and produce useful data. Data from the first V2V model deployment in the U.S. containing more than 460,000 vehicle trips (over 3.97 billion GPS points) were used. VEHICLE LOCATION PRIVACY PROBLEM Digital Object Identifier 10.1109/MCE.2019.2941354 Date of current version 25 October 2019. November/December 2019 Since 1996 when the U.S. President declared that Global Positioning Systems (GPS) could be Published by the IEEE Consumer Electronics Society 2162-2248 ß 2019 IEEE 111