Privacy Enforcement Research Articles

Context-Driven Granular Disclosure Control for Internet of Things Applications

The Internet of Things (IoT) represents a technology revolution transforming the current environment into a ubiquitous world, whereby everything that benefits from being connected will be connected. Despite the benefits, the privacy of these things becomes a great concern and therefore it is imperative to apply privacy preservation techniques to IoT data collection. One such technique is called data obfuscation in which data is deliberately modified to blur the sensitive information, while preserving the data utility. The current obfuscation techniques, however, focus on the privacy of published datasets shared with untrusted parties. The high connectivity and distributed nature of IoT, opens up the possibility of privacy compromise before obfuscation can take effect, and therefore privacy enforcement should be deployed at earlier stages. Additionally, classical privacy treatments are too restrictive for IoT, where coarser/finer data details should be revealed for different applications. Motivated by these challenges, we propose a framework for privacy preservation in IoT environments that is capable of multi-granular obfuscation by enforcing context-driven disclosure policies. Then, we customize our framework for a smart vehicle system and make use of data stream watermarking techniques to protect privacy at different stages of the data lifecycle. To address possible concerns about additional performance overhead, we show the burden to be very lightweight, thus validating the suitability of ubiquitous use of our framework for IoT settings.

A context-driven privacy enforcement system for autonomous media capture devices

The evolution of the Internet of Things and the related market has renewed the concept of media recording and sharing by means of a new kind of home-consumer devices, capable of continuous and autonomous media capture and upload. Such technologies have already begun to tamper with people’s privacy and discretion expectations, also raising many concerns about the potential legal implications. This work proposes an overall context-related privacy preserving system, based on context recognition. Our approach has been specifically developed considering contexts characterized by a high degree of similarity. The presented methodology has been devised in order to enforce privacy rules using image recognition techniques jointly with radio beacon technology. The reported results show that, in the peculiar environment considered in this paper, the use of radio beacon technology can help to increase the performances of image recognition techniques, both in terms of computational performances and elapsed time.

Device-Based Security to Improve User Privacy in the Internet of Things †.

The use of Internet of Things (IoT) is rapidly growing and a huge amount of data is being generated by IoT devices. Cloud computing is a natural candidate to handle this data since it has enough power and capacity to process, store and control data access. Moreover, this approach brings several benefits to the IoT, such as the aggregation of all IoT data in a common place and the use of cloud services to consume this data and provide useful applications. However, enforcing user privacy when sending sensitive information to the cloud is a challenge. This work presents and evaluates an architecture to provide privacy in the integration of IoT and cloud computing. The proposed architecture, called PROTeCt—Privacy aRquitecture for integratiOn of internet of Things and Cloud computing, improves user privacy by implementing privacy enforcement at the IoT devices instead of at the gateway, as is usually done. Consequently, the proposed approach improves both system security and fault tolerance, since it removes the single point of failure (gateway). The proposed architecture is evaluated through an analytical analysis and simulations with severely constrained devices, where delay and energy consumption are evaluated and compared to other architectures. The obtained results show the practical feasibility of the proposed solutions and demonstrate that the overheads introduced in the IoT devices are worthwhile considering the increased level of privacy and security.

Decentralizing privacy enforcement for Internet of Things smart objects

Internet of Things (IoT) is now evolving into a loosely coupled, decentralized system of cooperating smart objects, where high-speed data processing, analytics and shorter response times are becoming more necessary than ever. Such decentralization has a great impact on the way personal information generated and consumed by smart objects should be protected, because, without centralized data management, it is more difficult to control how data are combined and used by smart objects. To cope with this issue, in this paper, we propose a framework where users of smart objects can specify their privacy preferences. Compliance check of user individual privacy preferences is performed directly by smart objects. Moreover, acknowledging that embedding the enforcement mechanism into smart objects implies some overhead, we have extensively tested the proposed framework on different scenarios, and the obtained results show the feasibility of our approach.

Fine-grained access control based on Trusted Execution Environment

With the wide adoption of mobile devices, it becomes increasingly a reality that mobile users use a variety of apps from various sources. Since the enforcement of strict privacy is difficult, the inappropriate access by malicious apps is a major concern for mobile users, and access control becomes a challenge. In order to prevent the leakage of sensitive information (such as the contact lists, or private pictures) by inappropriate or illegal access, we propose a fine-grained access-control scheme based on Ciphertext-Policy Attribute-Based Encryption (CPABE) and Trusted Execution Environment (TEE), which can effectively protect data. In the scheme, CPABE is adopted in a novel way to solve the important security problems by supporting fine-grained access control during the access period and by supporting the critical operations running in the trusted execution environment. The scheme can be used to mitigate the sensitive information attacks and enhance confidentiality. Moreover, it can reduce the risk in the case of one single authority. Compared to the traditional access-control mechanisms, our experimental results indicate that the proposed scheme satisfies the security requirements, and is superior to other existing schemes.

Pay for (Privacy) Performance

Social networking has proliferated over the past years and is now being utilized by a large percentage of the world’s population. Social networks substantially contribute to enhanced speech, creativity, and communication. Yet, their practices of collecting and monetizing personal data of users pose severe privacy risks. Compelling social networks to internalize these risks is crucial for the healthy evolution of social networking. In this Article I propose a novel approach to address this challenge: to link executive compensation in social networking firms to the quality of data-protection the company provides to its users. This proposal is different from other solutions that have been proposed in the context of social media privacy in two significant ways. First, the direct policy object is not the firm itself. Rather, I suggest to influence executives within the firm by manipulating their pay to achieve the desired results. Second, the proposal offers a dynamic solution, where privacy practices would adapt to changing privacy standards. This proposal would yield a number of key advantages. First, it would create a powerful incentive for executives of social networks to internalize users’ privacy interests. Second, the proposed model would provide first-hand and up to date information about users’ changing needs and interests. Third, this model would align the interests of social media executives with the long term interests of shareholders to maintain users’ trust in social media, in order for social networks to continue to attract a high volume of users and activity. Fourth, the model would reduce the government’s role as both an interpreter and enforcer of users’ interests, and would overall simplify the privacy enforcement process and reduce its costs. Finally, this model would allow social networks to develop and grow, by allowing all types of transactions to occur, as long as all privacy-related considerations are internalized.

Demonstration of Indoor Location Privacy Enforcement using Obfuscation

We apply discrete-event-control-theoretic techniques for opacity enforcement by insertion or deletion of output events to the problem of location privacy enforcement in an indoor environment where users are continuously monitored by IoT devices. We design an obfuscator of user trajectories in a grid model with obstacles. The obfuscator must preserve a secret (e.g., visits to secret cells of the grid), while at the same time enforce feasibility and utility constraints for obfuscated trajectories. We implement the obfuscator to map the true location of the user to an obfuscated location, in real time, using services provided by a data server called the Global Data Plane which records sensor readings from IoT devices and publishes them to subscribers. We explain how scalability of obfuscator synthesis (off-line) and instantiation (online) is achieved. We demonstrate the approach on a grid with over 1,500 cells modeling the first floor of a university building, where location estimation is achieved using the ALPS Acoustic Location Processing System.

Clustering uncertain graphs

An uncertain graph 𝒢 = (V, E, p : E → (0, 1]) can be viewed as a probability space whose outcomes (referred to as possible worlds ) are subgraphs of 𝒢 where any edge e ε E occurs with probability p ( e ), independently of the other edges. These graphs naturally arise in many application domains where data management systems are required to cope with uncertainty in interrelated data, such as computational biology, social network analysis, network reliability, and privacy enforcement, among the others. For this reason, it is important to devise fundamental querying and mining primitives for uncertain graphs. This paper contributes to this endeavor with the development of novel strategies for clustering uncertain graphs. Specifically, given an uncertain graph 𝒢 and an integer k , we aim at partitioning its nodes into k clusters, each featuring a distinguished center node, so to maximize the minimum/average connection probability of any node to its cluster's center, in a random possible world. We assess the NP-hardness of maximizing the minimum connection probability, even in the presence of an oracle for the connection probabilities, and develop efficient approximation algorithms for both problems and some useful variants. Unlike previous works in the literature, our algorithms feature provable approximation guarantees and are capable to keep the granularity of the returned clustering under control. Our theoretical findings are complemented with several experiments that compare our algorithms against some relevant competitors, with respect to both running-time and quality of the returned clusterings.

The market's response toward privacy and mass surveillance: The Snowden aftermath

In June 2013, numerous top-secret documents were disclosed, revealing shocking evidence about mass surveillance methods and projects that were undergoing in global scale. These revelations had deep impact in political and industrial level and they sparked huge debates over surveillance, security mechanisms and privacy enforcement. Simultaneously, these revelations led to the introduction of many strong cryptographic mechanisms and the rise of many security and privacy related startups.Undoubtedly, the Snowden case revealed the largest privacy incidents to on-profit data-controlling entities in modern history. The first reports about the economic impact of these revelations were devastating, nonetheless, they strongly relied on questionnaires and personal speculations and conceptions. In this work, we try to quantify the impact of these revelations, based on the impact that they had on the stock market value of the involved companies. To this end, we apply the event study methodology using both the well-known CAPM and the Fama–French three-factor model for the estimation of the abnormal returns. We compare our results with findings of other studies for the impact of security and privacy incidents and discuss the outcomes of the analysis. Contrary to the intuition and previous related work, our study shows that these revelations did not have an actual impact on the firms' stock prices. The latter can have different interpretations regarding the momentum, the locality, the markets and people's attitude toward them, which are discussed in this work.

Synthesis of Obfuscation Policies to Ensure Privacy and Utility

We consider the problem of privacy enforcement for dynamic systems using the technique of obfuscation. Our approach captures the trade-off between privacy and utility, in a formal reactive framework. Specifically, we model a dynamic system as an automaton or labeled transition system with predefined secret behaviors. The system generates event strings for some useful computation (utility). At the same time, it must hide its secret behaviors from any outside observer of its behavior (privacy). We formally capture both privacy and utility specifications within the model of the system. We propose as obfuscation mechanism for privacy enforcement the use of edit functions that suitably alter the output behavior of the system by inserting, deleting, or replacing events in its output strings. The edit function must hide secret behaviors by making them observationally equivalent to non-secret behaviors, while at the same time satisfying the utility requirement on the output strings. We develop algorithmic procedures that synthesize a correct-by-construction edit function satisfying both privacy and utility specifications. The synthesis procedure is based on the solution of a game where the edit function must react to the system moves by suitable output editing. After presenting an explicit algorithm for solving for the winning strategies of the game, we present two complementary symbolic implementations to address scalability of our methodology. The first symbolic implementation uses a direct encoding of the explicit algorithm using binary decision diagrams (BDDs). The second symbolic implementation reframes the synthesis of edit functions as a supervisory control problem and then applies a recently-developed tool for solving supervisory control problems using BDDs. Experimental results comparing the two symbolic implementations are provided.

Impact of Neighbors on the Privacy of Individuals in Online Social Networks

Abstract The problem of user privacy enforcement in online social networks (OSN) cannot be ignored and, in recent years, Facebook and other providers have improved considerably their privacy protection tools. However, in OSN’s the most powerful data protection “weapons” are the users themselves. The behavior of an individual acting in an OSN highly depends on her level of privacy attitude: an aware user tends not to share her private information, or the private information of her friends, while an unaware user could not recognize some information as private, and could share it without care to her contacts. In this paper, we experimentally study the role of the attitude on privacy of an individual and her friends on information propagation in social networks. We model information diffusion by means of an extension of the Susceptible-Infectious-Recovered (SIR) epidemic model that takes into account the privacy attitude of users. We employ this diffusion model in stochastic simulations on a synthetic social network, designed for miming the characteristics of the Facebook social graph.

Privacy-Preserving Outsourced Media Search

This work proposes a privacy-protection framework for an important application called outsourced media search . This scenario involves a data owner, a client, and an untrusted server, where the owner outsources a search service to the server. Due to lack of trust, the privacy of the client and the owner should be protected. The framework relies on multimedia hashing and symmetric encryption. It requires involved parties to participate in a privacy-enhancing protocol. Additional processing steps are carried out by the owner and the client: (i) before outsourcing low-level media features to the server, the owner has to one-way hash them, and partially encrypt each hash-value; (ii) the client completes the similarity search by re-ranking the most similar candidates received from the server. One-way hashing and encryption add ambiguity to data and make it difficult for the server to infer contents from database items and queries, so the privacy of both the owner and the client is enforced. The proposed framework realizes trade-offs among strength of privacy enforcement, quality of search, and complexity, because the information loss can be tuned during hashing and encryption. Extensive experiments demonstrate the effectiveness and the flexibility of the framework.

US Regulatory Values and Privacy Consequences

Europeans have long faced a regulatory challenge: how can the human rights and dignitary values that animate data protection law be protected in transborder data flows? With the proposal of the EU-US Privacy Shield, part of the challenge will be answered by the US Federal Trade Commission (FTC). The FTC is a small but powerful US agency established in 1914 to address problems of monopoly and trust. Shortly after its creation, the FTC turned its attention to consumer issues. Over the years, Congress has repeatedly empowered the FTC, and the agency has accomplished much on privacy matters. In a recent book, I recount the FTC’s privacy successes. But this article focuses on the limits of the FTC’s powers. The American business community has eschewed dignity as a privacy value in favour of economistic conceptions of privacy interests. This article explains how the FTC’s focus on economic liberty constrains how it can protect Europeans’ normative interests in privacy. First, this article recounts why the FTC has to find economic pretences to extend its reach to normative, dignity-based affronts to personality. The article then discusses the structural limits of the FTC and how these limits constrain privacy enforcement. The article concludes with a discussion of instruments that could bridge the gap between the FTC’s economistic conceptions of privacy and the values Europeans place on data protection.

The Global Enforcement Privacy Network: A Growing Network But How Much Enforcement?

This brief discussion paper was presented to the Asia-Pacific section of the Global Privacy Enforcement Network (GPEN) via teleconference on August 5, 2015. It reviews the recent forms of international collaboration by data protection authorities (DPAs), and assesses the extent to which GPEN can collaborate on further international enforcement activities. The paper also reviews the various legal, economic, organizational and cultural constraints that need to be overcome if there is to be more widespread and frequent enforcement activities by DPAs.

AppSec

Malicious OS kernel can easily access user's private data in main memory and pries human-machine interaction data, even one that employs privacy enforcement based on application level or OS level. This paper introduces AppSec, a hypervisor-based safe execution environment, to protect both the memory data and human-machine interaction data of security sensitive applications from the untrusted OS transparently. AppSec provides several security mechanisms on an untrusted OS. AppSec introduces a safe loader to check the code integrity of application and dynamic shared objects. During runtime, AppSec protects application and dynamic shared objects from being modified and verifies kernel memory accesses according to application's intention. AppSec provides a devices isolation mechanism to prevent the human-machine interaction devices being accessed by compromised kernel. On top of that, AppSec further provides a privileged-based window system to protect application's X resources. The major advantages of AppSec are threefold. First, AppSec verifies and protects all dynamic shared objects during runtime. Second, AppSec mediates kernel memory access according to application's intention but not encrypts all application's data roughly. Third, AppSec provides a trusted I/O path from end-user to application. A prototype of AppSec is implemented and shows that AppSec is efficient and practical.

Access and privacy control enforcement in RFID middleware systems: Proposal and implementation on the fosstrak platform

Radio Frequency IDentification (RFID) technology offers a new way of automating the identification and storing of information in RFID tags. The emerging opportunities for the use of RFID technology in human centric applications like monitoring and indoor guidance systems indicate how important this topic is in term of privacy. Holding privacy issues from the early stages of RFID data collection helps to master the data view before translating it into business events and storing it in databases. An RFID middleware is the entity that sits between tag readers and database applications. It is in charge of collecting, filtering and aggregating the requested events from heterogeneous RFID environments. Thus, the system, at this point, is likely to suffer from parameter manipulation and eavesdropping, raising privacy concerns. In this paper, we propose an access and privacy controller module that adds a security level to the RFID middleware standardized by the EPCglobal consortium. We provide a privacy policy-driven model using some enhanced contextual concepts of the extended Role Based Access Control model, namely the purpose, the accuracy and the consent principles. We also use the provisional context to model security rules whose activation depends on the history of previously performed actions. To show the feasibility of our privacy enforcement model, we first provide a proof-of-concept prototype integrated into the middleware of the Fosstrak platform, then evaluate the performance of the integrated module in terms of execution time.

A roadmap towards improving managed security services from a privacy perspective

This paper proposes a roadmap for how privacy leakages from outsourced managed security services using intrusion detection systems can be controlled. The paper first analyses the risk of leaking private or confidential information from signature-based intrusion detection systems. It then discusses how the situation can be improved by developing adequate privacy enforcement methods and privacy leakage metrics in order to control and reduce the leakage of private and confidential information over time. Such metrics should allow for quantifying how much information that is leaking, where these information leakages are, as well as showing what these leakages mean. This includes adding enforcement mechanisms ensuring that operation on sensitive information is transparent and auditable. The data controller or external quality assurance organisations can then verify or certify that the security operation operates in a privacy friendly manner. The roadmap furthermore outlines how privacy-enhanced intrusion detection systems should be implemented by initially providing privacy-enhanced alarm handling and then gradually extending support for privacy enhancing operation to other areas like digital forensics, exchange of threat information and big data analytics based attack detection.

The Puzzle of Japanese Data Privacy Enforcement

Japan’s data privacy laws have been in force since 2003, sufficient time for evidence of their enforcement to become apparent and be assessed. This article first explains the legislative and administrative structure of Japanese data privacy law, and then examines each aspect of enforcement of the law, and such evidence of the effectiveness of enforcement as is available. The public sector, and the private sector, and the co-regulatory systems are considered. This examination shows that the enforcement mechanisms in the Japanese system are not used to any significant extent. it also shows that the ways in which thy work are not transparent enough. We reject claims made by government bodies and academics that Japanese businesses comply with the legislation without being required to do so. The extent of compliance is a separate enquiry outside the scope of this article. The result is that the Japanese system asks observers to take it on trust that it is effective. The absence of evidence is in itself a deficiency, a failure to provide transparency of the enforcement system. Put politely, the effectiveness of Japanese data privacy law remains a puzzle. Major reforms are proposed by the government which may provide much more effective means of enforcement, but are only likely to succeed if they also make that enforcement more transparent.

Consumer privacy in oligopolistic markets: Winners, losers, and welfare

Motivated by the unprecedented availability of consumer information on the Internet, we characterize the winners and losers from potential privacy regulation in the context of four commonly-used oligopoly models: a linear city model, a circular city model, a vertical differentiation model, and a multi-unit symmetric demand model. We show that while there are winners and losers as a result of privacy enforcement, the parties who stand to benefit and the parties who stand to lose, as well as whether social welfare is enhanced or diminished, largely depends on the specific economic setting under consideration.

Privacy query rewriting algorithm instrumented by a privacy-aware access control model

In this paper we present an approach to instrument a SPARQL query rewriting algorithm enforcing privacy preferences. The term instrument is used to mean supplying appropriate constraints. We show how to design a real and effective instrumentation process of a rewriting algorithm using an existing privacy aware access control model like PrivOrBAC. We take into account various dimensions of privacy preferences through the concepts of consent, accuracy, purpose and recipient. We implement and evaluate our process of privacy enforcement based on a healthcare scenario.