Developing A Privacy Risk Analysis Framework for Heterogeneous IoT Network

Abstract

The Internet of Things (IoT) collects a massive amount of data that raises several privacy concerns, such as inconsistency between an IoT device’s requirements and its privacy policy or non-compliance with different privacy regulations. Additionally, due to IoT devices’ inadequate user interface, providing a detailed and real-time notification is one of the significant privacy challenges in the IoT. To address these challenges, this thesis proposes a privacy risk analysis framework called Protected Heterogeneous IoT Network (PHIN). PHIN has the following two goals. First, it aims at identifying privacy risks from four perspectives: i) magnitude of the inconsistency between an IoT device and its privacy policy, ii) inference risk of PII, iii) non-compliance with multiple privacy regulations, and iv) incompatibility between users’ privacy preferences and the device’s default privacy settings. Second, PHIN provides users with a detailed two-layered privacy risk report associated with installing a new IoT device. The thesis aims to evaluate the framework by assessing its functionalities in a real heterogeneous IoT network as well as conducting several user studies.