Definition Of Privacy Research Articles

Secure Fully Homomorphic Authenticated Encryption

Homomorphic authenticated encryption allows implicit computation on plaintexts using corresponding ciphertexts without losing privacy, and provides authenticity of the computation and the resultant plaintext of the computation when performing a decryption. However, due to its special functionality, the security notions of the homomorphic authenticated encryption is somewhat complicated and the construction of fully homomorphic authenticated encryption has never been given. In this work, we propose a new security notion and the first construction of fully homomorphic authenticated encryption. Our new security notion is a unified definition for data privacy and authenticity of homomorphic authenticated encryption. Moreover, our security notion is simpler and stronger than the previous ones. To realize our new security notion, we also suggest a construction of fully homomorphic authenticated encryption via generic construction. We combine a fully homomorphic encryption and two homomorphic authenticators, one fully homomorphic and one OR-homomorphic, to construct a fully homomorphic authenticated encryption that satisfies our security notion. Our construction requires its fully homomorphic encryption to be indistinguishable under chosen plaintext attacks and its homomorphic authenticators to be unforgeable under selectively chosen plaintext queries. Our construction also supports multiple datasets and amortized efficiency. For efficiency, we also construct a multi-dataset fully homomorphic authenticator scheme, which is a variant of the first fully homomorphic signature scheme. Our multi-dataset fully homomorphic authenticator scheme satisfies the security requirement of our generic construction above and supports amortized efficiency.

Searchable Symmetric Encryption with Forward Search Privacy

Searchable symmetric encryption (SSE) has been widely applied in the encrypted database for queries in practice. Although SSE is powerful and feature-rich, it is always plagued by information leaks. Some recent attacks point out that forward privacy which disallows leakage from update operations, now becomes a basic requirement for any newly designed SSE schemes. However, the subsequent search operations can still leak a significant amount of information. To further strengthen security, we extend the definition of forward privacy and propose the notion of “forward search privacy”. Intuitively, it requires search operations over newly added documents do not leak any information about past queries. The enhanced security notion poses new challenges to the design of SSE. We address the challenges by developing the hidden pointer technique (HPT) and propose a new SSE scheme called Khons, which satisfies our security notion (with the original forward privacy notion) and is also efficient. We implemented Khons and our experiment results on large dataset (wikipedia) show that it is more efficient than existing SSE schemes with forward privacy.

Protecting the Moving User’s Locations by Combining Differential Privacy and k‐Anonymity under Temporal Correlations in Wireless Networks

The rapid development of the Global Positioning System (GPS) devices and location‐based services (LBSs) facilitates the collection of huge amounts of personal information for the untrusted/unknown LBS providers. This phenomenon raises serious privacy concerns. However, most of the existing solutions aim at locating interference in the static scenes or in a single timestamp without considering the correlation between location transfer and time of moving users. In this way, the solutions are vulnerable to various inference attacks. Traditional privacy protection methods rely on trusted third‐party service providers, but in reality, we are not sure whether the third party is trustable. In this paper, we propose a systematic solution to preserve location information. The protection provides a rigorous privacy guarantee without the assumption of the credibility of the third parties. The user’s historical trajectory information is used as the basis of the hidden Markov model prediction, and the user’s possible prospective location is used as the model output result to protect the user’s trajectory privacy. To formalize the privacy‐protecting guarantee, we propose a new definition, L&A‐location region, based on k‐anonymity and differential privacy. Based on the proposed privacy definition, we design a novel mechanism to provide a privacy protection guarantee for the users’ identity trajectory. We simulate the proposed mechanism based on a dataset collected in real practice. The result of the simulation shows that the proposed algorithm can provide privacy protection to a high standard.

Eurus: Towards an Efficient Searchable Symmetric Encryption With Size Pattern Protection

To achieve efficiently search and update on outsourced encrypted data, dynamic searchable symmetric encryption (DSSE) was proposed by just leaking some well-defined leakages. Though small, many recent works show that an attacker can exploit these leakages to undermine the security of existing DSSE schemes. In particular, an attacker can exploit even seemingly harmless size pattern to perform severe attacks. Many exiting schemes resort to oblivious RAM (ORAM) to hide search/access pattern; however, even such powerful cryptographic primitive cannot protect size pattern leakage. In this article, we first show that size pattern can lead to more information leakages, which is not well studied or protected by existing schemes. We then extend the existing privacy notion for DSSE to capture the size pattern leakage, achieving a strong forward and backward privacy definition. Following the definition, we propose a new DSSE scheme Eurus. Eurus can eliminate search/access pattern by relying on a multi-server ORAM scheme, meanwhile reducing size pattern with reasonable efficiency. We show that Eurus can reduce leakage significantly with better efficiency, compared with state-of-the-art leakage reduction schemes.

Privacy in collapsed contexts of displacement

ABSTRACT The paper explores privacy in collapsed contexts of displacement. It makes a case against technocentric and universalizing definitions of privacy by exploring its relational and contextual dimensions, including cultural expectations and the political and economic conditions of seeking asylum. In particular, this paper discusses how displaced women seeking asylum in Germany employed the practice of hiding (e.g., physical movement and the use of digital devices) to engage with digital support networks. The women pushed for expanding and protecting their digital social relations, but this protection came at the cost of harassment and reinforced privacy norms, limiting their physical movement and digital communication. The paper highlights that those reinforced privacy norms are not just a reductive move to preserve collective values but should also be read as a protective response to legal and sociocultural uncertainty related to displacement.

Differential Privacy: The Pursuit of Protections by Default

First formalized in 2006, differential privacy is an approach based on a mathematically rigorous definition of privacy that allows formalization and proof of the guarantees against re-identification offered by a system. While differential privacy has been accepted by theorists for some time, its implementation has turned out to be subtle and tricky, with practical applications only now starting to become available. To date, differential privacy has been adopted by the U.S. Census Bureau, along with a number of technology companies, but what this means and how these organizations have implemented their systems remains a mystery to many.

Deep Learning with Gaussian Differential Privacy.

Deep learning models are often trained on datasets that contain sensitive information such as individuals' shopping transactions, personal contacts, and medical records. An increasingly important line of work therefore has sought to train neural networks subject to privacy constraints that are specified by differential privacy or its divergence-based relaxations. These privacy definitions, however, have weaknesses in handling certain important primitives (composition and subsampling), thereby giving loose or complicated privacy analyses of training neural networks. In this paper, we consider a recently proposed privacy definition termed f-differential privacy [18] for a refined privacy analysis of training neural networks. Leveraging the appealing properties of f-differential privacy in handling composition and subsampling, this paper derives analytically tractable expressions for the privacy guarantees of both stochastic gradient descent and Adam used in training deep neural networks, without the need of developing sophisticated techniques as [3] did. Our results demonstrate that the f-differential privacy framework allows for a new privacy analysis that improves on the prior analysis [3], which in turn suggests tuning certain parameters of neural networks for a better prediction accuracy without violating the privacy budget. These theoretically derived improvements are confirmed by our experiments in a range of tasks in image classification, text classification, and recommender systems. Python code to calculate the privacy cost for these experiments is publicly available in the TensorFlow Privacy library.

Perturbation-Hidden: Enhancement of Vehicular Privacy for Location-Based Services in Internet of Vehicles

The great development of smart networks enables Internet of Vehicles (IoV) as a promising paradigm to provide pervasive services, where privacy issues for location-based services (LBSs) have attracted considerable attention. In terms of location privacy, inspired by differential privacy, geo-indistinguishability (Geo-Ind) has recently become a prevalent privacy model for LBSs. Although Geo-Ind guarantees the location privacy, users’ other privacy concerns are still at risk if the location perturbation behavior is exposed due to implausible reported locations. Through experiments we find the probability that the classical Geo-Ind mechanism perturbs the true location to implausible areas can be more than 50%. To address it, we first propose an enhanced privacy definition beyond Geo-Ind, called Perturbation-Hidden, to prevent location perturbation behaviors of users from being recognized by guaranteeing their pseudo-locations plausible. Then we design a mechanism to achieve this definition by transplanting the differential private exponential mechanism to our approach. Furthermore, we propose a method for determining the retrieval area utilizing dynamic programming to ensure the accuracy of LBSs. Finally, we theoretically prove that our mechanism satisfies the privacy definition. Extensive experiments on simulations and a real-world dataset show that our proposal achieves 100% plausible pseudo-locations while ensuring high query precision and recall.

On the behavioral implications of differential privacy

Differential privacy is commonly used in the computer science literature as a mathematical definition of privacy for the purpose of quantifying and bounding privacy loss. It induces a preference order over the set of privacy-jeopardizing mechanisms which, in turn, adhere to some properties of this order. We show that a set of five such properties uniquely captures the ordinal implications of prioritizing the alternatives in agreement with differential privacy. The model can also be applied to evaluate the appropriateness of differential privacy in different settings.

Culture and Multiple Firm–Bank Relationships: A Matter of Secrecy and Trust?

This study examines the impact of trust and a national culture of secretiveness on the number of bank relationships per firm. We hypothesize that the degree of openness of a firm and trust between economic agents may influence the willingness of the firm to release sensitive information to its lenders, as well as the decision between maintaining single or multiple bank relationships. Using a sample of over 8000 non-financial firms operating in 12 countries from the eurozone we provide evidence that a national culture of secrecy enhances the number of bank relationships, while trust has the opposite effect. Results are robust to the use of various estimation techniques, alternative definitions of secrecy and trust, controls for firm-level and country-level characteristics, and instrumental variables. The main implication of this finding is that the financial decisions of firms cannot be effectively examined without considering deep-rooted national cultural elements. We also find that the results are mainly driven by small and medium enterprises, implying that the higher informational opaqueness of these firms enhances the role of secrecy and trust.

Introduction to Privacy and Compliance for Consumers (v2)

This article is the first of several sections of the IDPro Body of Knowledge that address Privacy and Compliance for Consumers. This introductory section sets the foundation for subsequent sections on privacy within the IDPro Body of Knowledge, providing an overview of a variety of topics, including definitions of privacy, different approaches to privacy in the consumer sector versus the workforce environment, and more.

PAPU: Pseudonym Swap With Provable Unlinkability Based on Differential Privacy in VANETs

Nowadays, the pseudonym swap has become the mainstream technology for protecting vehicles’ trajectory privacy in vehicle ad hoc networks. However, the existing pseudonym swap methods cannot strictly provide the unlinkability between the new pseudonym and old pseudonym of the vehicle due to the lack of theoretical privacy guarantee, resulting in severe leakages of vehicles’ trajectory privacy. Our experiment also proves this point and we find that existing works may cause vehicle’s pseudonyms to be linked with a probability higher than 60% because they always choose two vehicles with very different driving states (e.g., speeds, directions, and positions) to swap their pseudonyms. To solve this issue, we first give a formal privacy definition based on generalized differential privacy, called pseudonym indistinguishability, to provide a strict unlinkability for pseudonym swap. Then, we design an appropriate utility metric and a new pseudonym swap mechanism, which selects a pseudonym for a vehicle by adapting a differential privacy exponential mechanism to satisfy pseudonym indistinguishability. Abstracting from attackers’ prior knowledge, we can strictly guarantee that if two vehicles have a high similarity of driving states, it is impossible for attackers to link the vehicles and their pseudonyms after the swap. Theoretical analyses prove that our mechanism satisfies the proposed privacy definition, thus ensuring the unlinkability between the new pseudonym and the old pseudonym. Extensive experiments on a real data set show that our work only requires about 50% of pseudonym quantities compared to other works and can make the vehicle successfully complete the swap process with a probability of more than 90%, which is higher than any of existing works.

A differentially private greedy decision forest classification algorithm with high utility

The rapid development of data analysis technologies and the easily accessible datasets have enabled the construction of a comprehensive analytics model, which can facilitate the decision makings involved in services. Meanwhile, the individual privacy preservation is of great necessity. Decision tree is a common method in medical prediction and diagnose, known for its simplicity of understanding and interpreting. However, the process of building a decision tree might cause individual privacy disclosure. Differential privacy provides a rigorous mathematical definition of privacy by controlling the risk of privacy leakage in a manageable range while maintaining the statistical characteristics. In this paper, we propose a Differentially Private Greedy Decision Forest with high utility (DPGDF) to build a privacy-preserving decision forest. In DPGDF, we design a novel budget allocation strategy that allows the nodes in greater depth get more privacy budgets in the decision tree construction process, which can, to some extent, mitigate the problem of excessive noises introduced to the leaf nodes. To aggregate multiple trees into a forest, we propose a selective aggregation method based on the prediction accuracy of the decision forest. In addition, we develop an iterative method to speed up the process of selective aggregation. Finally, we experimentally prove that the proposed DPGDF can achieve a better performance on two practical datasets compared with other algorithms.

Mass Surveillance: A Private Affair?

Abstract Mass surveillance is a more real threat now than at any time in history. Digital communications and automated systems allow for the collection and processing of private information at a scale never seen before. Many argue that mass surveillance entails a significant loss of privacy. Others dispute that there is a loss of privacy if the information is only encountered by automated systems. This paper argues that automated mass surveillance does not involve a significant loss of privacy. Through providing a definition of informational privacy as a matter of actual access of private information by one who can understand the meaning of that information, it follows that automated systems which lack understanding cannot of themselves diminish privacy. This is not to say that mass surveillance is unproblematic, though: it is deeply problematic. It is just that privacy is not the most significant of these problems.

Right to Privacy of Public Figures and Freedom of Expression in the Jurisprudence of the European Court of Human Rights: Searching for Balance

The right to privacy of public figures which falls under the scope of Article 8 (right to private and family life) and the freedom of expression of the media which is protected by Article 10 conflict in many situations. The definition of privacy varies depending on the context and environment. It is often claimed to be the right to be left alone, and to determine for a human being when, how and to what extent personal information about them is communicated to others. Privacy includes personal medical records, expenditure, correspondence, home, relationships, physical and emotional autonomy. Freedom of expression is considered to be one of the important features of a democratic society. It entails to receive, impart and seek information as well as ideas, even if they are shocking and offensive to a particular group of persons. European Court of Human Rights pointed out that “journalistic freedom also covers possible recourse to a degree of exaggeration, or even provocation”. A publication that reveals intimate details of family life of a public official or a politician running for office may or may not serve the purpose of public debate. Some authors argue that a genuine conflict between Articles 8 and 10 European Convention on Human Rights only arises in a narrow range of cases, such as ‘where publication relates to the personal life of a particular figure, but there is a serious argument that it serves a valuable purpose in revealing a matter relevant to that person’s fitness for office’. The absence of protection against press intrusions or the disclosure in the media of highly intimate, non-defamatory details of private life has not yet been subject to significant challenge in Strasbourg. The scope of public figures in this paper is narrowed to the ones whose functions are connected to public duties and political matters, without touching upon the situation of celebrities since their role in the society has a function of entertainment. This paper researches the problem by analyzing four judgments of the Court and offers possible direction for balancing these two important but not absolute rights.

Quantum steganography over noiseless channels: Achievability and bounds

Quantum steganography is the study of hiding secret quantum information by encoding it into what an eavesdropper would perceive as an innocent-looking message. Here we study an explicit steganographic encoding for Alice to hide her secret message in the syndromes of an error-correcting code, so that the encoding simulates a given noisy quantum channel. We calculate achievable rates of steganographic communication over noiseless quantum channels using this encoding. We give definitions of secrecy and reliability for the communication process, and with these assumptions derive upper bounds on the amount of steganographic communication possible, and show that these bounds match the communication rates achieved with our encoding. This gives a steganographic capacity for a noiseless channel emulating a given noisy channel.

The Social Media Privacy Model: Privacy and Communication in the Light of Social Media Affordances

AbstractPrivacy has been defined as the selective control of information sharing, where control is key. For social media, however, an individual user’s informational control has become more difficult. In this theoretical article, I review how the term control is part of theorizing on privacy, and I develop an understanding of online privacy with communication as the core mechanism by which privacy is regulated. The results of this article’s theoretical development are molded into a definition of privacy and the social media privacy model. The model is based on four propositions: Privacy in social media is interdependently perceived and valued. Thus, it cannot always be achieved through control. As an alternative, interpersonal communication is the primary mechanism by which to ensure social media privacy. Finally, trust and norms function as mechanisms that represent crystallized privacy communication. Further materials are available at https://osf.io/xhqjy/

A differential privacy-based privacy-preserving data publishing algorithm for transit smart card data

This manuscript is focused on transit smart card data and finds that the release of such trajectory information after simple anonymization creates high concern about breaching privacy. Trajectory data is large-scale, high-dimensional, and sparse in nature and, thus, requires an efficient privacy-preserving data publishing (PPDP) algorithm with high data utility. This paper describes the investigation of the publication of non-interactive sanitized trajectory data under a Differential Privacy (DP) definition. To this end, a new prefix tree structure, an incremental privacy budget allocation model, and a spatial-temporal dimensionality reduction model are proposed to enhance the sanitized data utility as well as to improve runtime efficiency. The developed algorithm is implemented and applied to real-life metro smart card data from Shenzhen, China, which includes a total of 2.8 million individual travelers and over 220 million records. Numerical analysis finds that, compared with previous work, the proposed model outputs sanitized dataset with higher utilities, and the algorithm is more efficient and scalable.

Protecting Your Shopping Preference With Differential Privacy

Online banks may disclose consumers’ shopping preferences due to various attacks. With differential privacy, each consumer can disturb his consumption amount locally before sending it to online banks. However, directly applying differential privacy in online banks will incur problems in reality because existing differential privacy schemes do not consider handling the noise boundary problem. In this paper, we propose an Optimized Differential prIvate Online tRansaction scheme (O-DIOR) for online banks to set boundaries of consumption amounts with added noises. We then revise O-DIOR to design a RO-DIOR scheme to select different boundaries while satisfying the differential privacy definition. Moreover, we provide in-depth theoretical analysis to prove that our schemes are capable to satisfy the differential privacy constraint. Finally, to evaluate the effectiveness, we have implemented our schemes in mobile payment experiments. Experimental results illustrate that the relevance between the consumption amount and online bank amount is reduced significantly, and the privacy losses are less than 0.5 in terms of mutual information.

Social Media and the Scourge of Visual Privacy

Online privacy has become immensely important with the growth of technology and the expansion of communication. Social Media Networks have risen to the forefront of current communication trends. With the current trends in social media, the question now becomes how can we actively protect ourselves on these platforms? Users of social media networks share billions of images a day. Whether intentional or unintentional, users tend to share private information within these images. In this study, we investigate (1) the users’ perspective of privacy, (2) pervasiveness of privacy leaks on Twitter, and (3) the threats and dangers on these platforms. In this study, we incorporate techniques such as text analysis, analysis of variance, and crowdsourcing to process the data received from these sources. Based on the results, the participants’ definitions of privacy showed overlap regardless of age or gender identity. After looking at the survey results, most female participants displayed a heightened fear of dangers on social media networks because of threats in the following areas: assets and identity. When the participants were asked to rank the threats on social media, they showed a high concern for burglary and kidnapping. We find that participants need more education about the threats of visual content and how these privacy leaks can lead to physical, mental, and emotional danger.