Privacy Patterns Research Articles

Designing Privacy-Aware IoT Applications for Unregulated Domains

Internet of Things (IoT) applications (apps) are challenging to design because of the heterogeneous systems on which they are deployed. IoT devices and apps may collect and analyse sensitive personal data, which is often protected by data privacy laws, some within highly regulated domains such as healthcare. Privacy-by-design (PbD) schemes can be used by developers to consider data privacy at the design stage. However, software developers are not widely adopting these approaches due to difficulties in understanding and interpreting them. There are currently a limited number of tools available for developers to use in this context. We believe that a successful PbD tool should be able to (i) assist developers in addressing privacy requirements in less regulated domains, as well as (ii) help them learn about privacy as they use the tool. The findings of two controlled lab studies are presented, involving 42 developers. We discuss how such a PbD tool can help novice IoT developers comply with privacy laws (e.g., GDPR) and follow privacy guidelines (e.g., privacy patterns). Based on our findings, such tools can help raise awareness of data privacy requirements at design. This increases the likelihood that subsequent designs will be more aware of data privacy requirements.

Efficient and Privacy-Preserving Spatial Keyword Similarity Query Over Encrypted Data

As a popular and practical query type in location-based services, the spatial keyword query has been extensively studied in both academia and industry. Meanwhile, with the growing demand for data privacy, many privacy-preserving spatial keyword query schemes have been proposed to deal with queries over encrypted data. However, none of the existing schemes preserve access pattern privacy, and the recent research illustrates that leaking such privacy may incur inference attacks and thus disclose sensitive information. In addition, most existing schemes only consider the boolean keyword search, which is not quite practical and flexible in real-world applications. To address the above issues, in this paper, we propose two privacy-preserving spatial keyword similarity query schemes that can preserve full and partial access pattern privacy, respectively. First, we present a basic privacy-preserving spatial keyword similarity query scheme (PPSKS) by integrating a secure set membership test (SSMT) technique with secure circuits. After that, to improve performance, we propose a tree-based scheme (PPSKS+) by employing a new index called FR-tree together with a predicate encryption technique that can encrypt FR-tree. Formal security analysis shows that: i) our proposed schemes can protect outsourced data, query requests, and query results; ii) our PPSKS scheme can hide full access patterns, while the PPSKS+ scheme preserves <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$m$</tex-math></inline-formula> -access pattern privacy. Extensive experiments are also conducted, and the results indicate that our tree-based PPSKS+ scheme is much more efficient, almost two orders of magnitude better than our linear search PPSKS scheme in performing queries.

Deep Reinforcement Learning-Based Joint Optimization of Delay and Privacy in Multiple-User MEC Systems

Mobile Edge Computing (MEC) enables mobile users to run various delay-sensitive applications via offloading computation tasks to MEC servers. However, the location privacy and the usage pattern privacy are disclosed to the untrusted MEC servers. In this paper, we propose a deep reinforcement learning based joint optimization of delay and privacy preservation during offloading for multiple-user wireless powered MEC systems, preserving users both location privacy and usage pattern privacy. The main idea is that, to protect both the two kinds of privacy, we propose to disguise users offloading decisions and deliberately offloading redundant tasks along with the actual tasks to the MEC servers. On this basis, we further formalize the task offloading as an optimization problem of computation rate and privacy preservation. Then, we design a deep reinforcement learning based offloading algorithm to solve such an non-convex problem, aiming to obtain the better tradeoff between the computation rate and the privacy preservation. Finally, extensive simulation results demonstrate that our algorithm can maintain a high level of computation rate while protecting users usage pattern privacy and location privacy, compared with two learning-based methods and two Baselines.

SetRkNN: Efficient and Privacy-Preserving Set Reverse kNN Query in Cloud

The advance of cloud computing has driven a new paradigm of outsourcing large-scale data and data-driven services to public clouds. Due to the increased awareness of privacy protection, many studies have focused on addressing security and privacy issues in outsourced query services. Although many privacy-preserving schemes have been proposed for various query types, the set reverse k nearest neighbors (RkNN) query is still an unexplored area. Even if some existing schemes can be adapted to achieve privacy-preserving set RkNN queries, they will suffer from linear search efficiency. As a steppingstone, in this paper, we propose an efficient and privacy-preserving set RkNN query scheme over encrypted data with sublinear query efficiency. Specifically, we first design an inverted prefix index to organize the set dataset and propose an algorithm to traverse the index with sublinear search efficiency. Then, we propose two oblivious data comparison protocols based on a symmetric homomorphic encryption (SHE) scheme and design the private filter/refinement protocols to preserve the privacy of index searching. After that, we propose an access pattern privacy-preserving set RkNN query scheme by using private filter/refinement protocols. Rigorous security analysis demonstrates that our scheme can protect data privacy and access pattern privacy. Experimental results indicate that our scheme is more efficient than the available naive solution in terms of computational costs and communication overheads.

Semantics-based privacy by design for Internet of Things applications

As Internet of Things (IoT) technologies become more widespread in everyday life, privacy issues are becoming more prominent. The aim of this research is to develop a personal assistant that can answer software engineers’ questions about Privacy by Design (PbD) practices during the design phase of IoT system development. Semantic web technologies are used to model the knowledge underlying PbD measurements, their intersections with privacy patterns, IoT system requirements and the privacy patterns that should be applied across IoT systems. This is achieved through the development of the PARROT ontology, developed through a set of representative IoT use cases relevant for software developers. This was supported by gathering Competency Questions (CQs) through a series of workshops, resulting in 81 curated CQs. These CQs were then recorded as SPARQL queries, and the developed ontology was evaluated using the Common Pitfalls model with the help of the Protégé HermiT Reasoner and the Ontology Pitfall Scanner (OOPS!), as well as evaluation by external experts. The ontology was assessed within a user study that identified that the PARROT ontology can answer up to 58% of privacy-related questions from software engineers.

Foundations of Differentially Oblivious Algorithms

It is well-known that a program’s memory access pattern can leak information about its input. To thwart such leakage, most existing works adopt the technique of oblivious RAM (ORAM) simulation. Such an obliviousness notion has stimulated much debate. Although ORAM techniques have significantly improved over the past few years, the concrete overheads are arguably still undesirable for real-world systems — part of this overhead is in fact inherent due to a well-known logarithmic ORAM lower bound by Goldreich and Ostrovsky. To make matters worse, when the program’s runtime or output length depend on secret inputs, it may be necessary to perform worst-case padding to achieve full obliviousness and thus incur possibly super-linear overheads. Inspired by the elegant notion of differential privacy, we initiate the study of a new notion of access pattern privacy, which we call “ (ϵ , δ) -differential obliviousness”. We separate the notion of (ϵ , δ) -differential obliviousness from classical obliviousness by considering several fundamental algorithmic abstractions including sorting small-length keys, merging two sorted lists, and range query data structures (akin to binary search trees). We show that by adopting differential obliviousness with reasonable choices of ϵ and δ , not only can one circumvent several impossibilities pertaining to full obliviousness, one can also, in several cases, obtain meaningful privacy with little overhead relative to the non-private baselines (i.e., having privacy “with little extra overhead”). On the other hand, we show that for very demanding choices of ϵ and δ , the same lower bounds for oblivious algorithms would be preserved for (ϵ, δ) -differential obliviousness.

Typological Transformation of Individual Housing in Hail City, Saudi Arabia: Between Functional Needs, Socio-Cultural, and Build Polices Concerns

This research paper traces the evolution of housing typologies in five distinct periods of dwellings in Hail City, Saudi Arabia. The study reviews the formation and historical events of the Hail house by observing the significant changes on the layout, spatial form, and architectural form. The objective is to investigate the embedded socio-cultural and privacy patterns, in conjunction with economic and environmental factors, that influenced the development of housing in Hail City over the last several decades. The methodological approach is based on an ethnographic approach, users’ perception survey, and a review of multiple case studies representing local housing typologies from five distinct historic periods: traditional, transitional traditional, modern, transitional modern, and contemporary. The findings show that specific building policies and laws pertaining to house form, privacy, gender segregation, and hospitality influenced the spatial layout of Hail City dwellings and played a decisive role in determining the final built form. Conclusions are drawn to highlight current challenges while also providing projections for future housing typologies in Hail City, around Saudi Arabia, and similar countries.

Privacy-Preserving Data Integrity Verification for Secure Mobile Edge Storage

Mobile edge computing (MEC) is proposed as an extension of cloud computing in the scenarios where the end devices desire better services in terms of response time. Because the edges are usually owned by individuals or small organizations with limited operation capabilities, the data on the edges are easily corrupted (due to external attacks or internal hardware failures). Therefore, it is essential to verify data integrity in the MEC. We propose two Integrity Checking protocols for the mobile Edge storage, called ICE-basic and ICE-batch. Our protocols allow a third-party verifier to check the data integrity on the edges without violating users data privacy and query pattern privacy. We rigorously prove the security and privacy guarantees of the protocols. In addition, we have investigated how to let the end devices cache some verification tags such that the communication cost between end devices and the cloud can be further reduced when a user connects to multiple edges in sequence. We have implemented a proof-of-concept system that runs ICE, and extensive experiments are conducted to evaluate the performance of the proposed protocols. The theoretical analysis and experimental results demonstrate the proposed protocols are efficient both in computation and communication.

Achieving Efficient and Privacy-Preserving (,)-Core Query over Bipartite Graphs in Cloud

Bipartite graphs have been widely adopted in applications such as e-healthcare thanks to their ability to model various real-world relationships. Meanwhile, (,)-core query services over bipartite graphs are recognized as a promising approach for finding communities, i.e., closely related sets of vertices in a bipartite graph. As the bipartite graph grows, service providers tend to outsource the services to the cloud. However, there are privacy concerns related to the dataset, queries, and results. Although many schemes have been proposed for privacy-preserving graph analysis, they cannot be directly adopted to handle accurate (,)-core queries. Aiming at the challenges, under the two-server setting, this paper constructs two privacy-preserving schemes with different security levels to handle (,)-core queries. In the proposed schemes, a graph is represented as an index containing two tables and further encrypted by a symmetric homomorphic encryption scheme, and then the servers securely traverse the index. Detailed security analysis shows that both schemes can achieve access pattern privacy, while the security-enhanced one can further protect the structure of the query requests and results. In addition, extensive performance evaluations are conducted to indicate the efficiency of our proposed schemes.

SPPS: A Search Pattern Privacy System for Approximate Shortest Distance Query of Encrypted Graphs in IIoT

In recent years, Industrial Internet of Things (IIoT) has gradually attracted the attention of the industry owing to its accurate time synchronization, communication accuracy, and high adaptability. As an important data structure, graphs are widely used in IIoT applications, where entities and their relationships can be expressed in the form of graphs. With the widespread adoption of IIoT and cloud computing, an increasing number of individuals or organizations are outsourcing their IIoT graph data to cloud servers to enjoy the unlimited storage space and fast computing service. To protect the privacy of graph data, graphs are usually encrypted before being outsourced. In this article, we propose a search pattern privacy system for approximate shortest distance query of encrypted graphs in IIoT. To realize search pattern privacy, we adopt two noncolluded cloud servers to accomplish different tasks. We leverage the first server to store the encrypted data and perform query operations, and use the second one to rerandomize the contents and shuffle the locations of the queried records. Before queries, we generate the trapdoors by using different random numbers. After queries, we ask the second server to rerandomize the contents of the records that the first server touched. In addition, we shuffle the physical locations of original records by inserting some fake records. In this way, all contents and physical locations of the touched records change, so that the first server cannot distinguish whether two queries are the same or not. To enhance the efficiency on the user side, we further improve this system by moving some heavy workloads from the user to the cloud. The security analysis and the performance evaluation show that our work is secure and efficient.

A performance tunable CPIR-based privacy protection method for location based service

Location-based service has become one of the essential parts of our daily lives, which raises a problem: how to preserve location privacy. Computational Private Information Retrieval (CPIR) protocol, which does not need a trusted third party, allows users to retrieve data from a service provider without revealing users’ query information. However, the CPIR protocol scans the entire data space, which causes high costs and limits the scale of CPIR-based applications. To address this problem, we propose a performance tunable Computational Private Information Retrieval (PTCPIR) model. We divide data space into subspaces and scan a subset of subspaces to achieve better performance while sacrificing some privacy. By tuning the percentage of scanned subspaces, we can achieve a tradeoff between performance and privacy. We design a hierarchical encrypted secure index to support data users to retrieve subspace information safely and efficiently, which facilitates privacy-preserving subspace information retrieval. Furthermore, we propose a novel subspace information retrieval method where the confused query keyword sequence makes servers unable to count query probability. Hence access pattern privacy is protected. Experiments on Sequoia and synthetic datasets demonstrate that our PTCPIR model provides a tunable tradeoff between performance and privacy with high efficiency and good scalability.

UAV-Assisted Privacy-Preserving Online Computation Offloading for Internet of Things

Unmanned aerial vehicle (UAV) plays a more and more important role in Internet of Things (IoT) for remote sensing and device interconnecting. Due to the limitation of computing capacity and energy, the UAV cannot handle complex tasks. Recently, computation offloading provides a promising way for the UAV to handle complex tasks by deep reinforcement learning (DRL)-based methods. However, existing DRL-based computation offloading methods merely protect usage pattern privacy and location privacy. In this paper, we consider a new privacy issue in UAV-assisted IoT, namely computation offloading preference leakage, which lacks through study. To cope with this issue, we propose a novel privacy-preserving online computation offloading method for UAV-assisted IoT. Our method integrates the differential privacy mechanism into deep reinforcement learning (DRL), which can protect UAV’s offloading preference. We provide the formal analysis on security and utility loss of our method. Extensive real-world experiments are conducted. Results demonstrate that, compared with baseline methods, our method can learn cost-efficient computation offloading policy without preference leakage and a priori knowledge of the wireless channel model.

Privacy-aware Character Pattern Matching over Outsourced Encrypted Data

Providing a method to efficiently search into outsourced encrypted data, without forsaking strong privacy guarantees, is a pressing concern rising from the separation of data ownership and data management typical of cloud-based applications. While several existing solutions allow a client to look up the occurrences of a substring in an outsourced document collection, the practical application requirements in terms of privacy and efficiency call for the improvement of such solutions. In this work, we present a privacy-preserving substring search protocol with a polylogarithmic communication cost and a limited computational effort on the server side. The proposed protocol provides search pattern and access pattern privacy, for both exact string search and character-pattern search with wildcards. Its extension to a multi-user setting shows significant savings in terms of outsourced storage w.r.t. a baseline solution where the whole dataset is replicated. The performance figures of an optimized implementation of our protocol, searching into a remotely stored genomic dataset, validate the practicality of the approach exhibiting a data transfer of less than 50 kiB to execute a query over a document of 40 MiB, with execution times on client and server in the range of a few seconds and a few minutes, respectively.

Synthesising Privacy by Design Knowledge Toward Explainable Internet of Things Application Designing in Healthcare

Privacy by Design (PbD) is the most common approach followed by software developers who aim to reduce risks within their application designs, yet it remains commonplace for developers to retain little conceptual understanding of what is meant by privacy. A vision is to develop an intelligent privacy assistant to whom developers can easily ask questions to learn how to incorporate different privacy-preserving ideas into their IoT application designs. This article lays the foundations toward developing such a privacy assistant by synthesising existing PbD knowledge to elicit requirements. It is believed that such a privacy assistant should not just prescribe a list of privacy-preserving ideas that developers should incorporate into their design. Instead, it should explain how each prescribed idea helps to protect privacy in a given application design context—this approach is defined as “Explainable Privacy.” A total of 74 privacy patterns were analysed and reviewed using ten different PbD schemes to understand how each privacy pattern is built and how each helps to ensure privacy. Due to page limitations, we have presented a detailed analysis in Reference [3]. In addition, different real-world Internet of Things (IoT) use-cases, including a healthcare application, were used to demonstrate how each privacy pattern could be applied to a given application design. By doing so, several knowledge engineering requirements were identified that need to be considered when developing a privacy assistant. It was also found that, when compared to other IoT application domains, privacy patterns can significantly benefit healthcare applications. In conclusion, this article identifies the research challenges that must be addressed if one wishes to construct an intelligent privacy assistant that can truly augment software developers’ capabilities at the design phase.

Privacy Laws and Privacy by Design Schemes for the Internet of Things

Internet of Things applications have the potential to derive sensitive information about individuals. Therefore, developers must exercise due diligence to make sure that data are managed according to the privacy regulations and data protection laws. However, doing so can be a difficult and challenging task. Recent research has revealed that developers typically face difficulties when complying with regulations. One key reason is that, at times, regulations are vague and could be challenging to extract and enact such legal requirements. In this article, we have conducted a systematic analysis of the privacy and data protection laws that are used across different continents, namely (i) General Data Protection Regulations, (ii) the Personal Information Protection and Electronic Documents Act, (iii) the California Consumer Privacy Act, (iv) Australian Privacy Principles, and (v) New Zealand’s Privacy Act 1993. Then, we used framework analysis method to attain a comprehensive view of different privacy and data protection laws and highlighted the disparities to assist developers in adhering to the regulations across different regions, along with creating a Combined Privacy Law Framework (CPLF). After that, the key principles and individuals’ rights of the CPLF were mapped with Privacy by Design (PbD) schemes (e.g., privacy principles, strategies, guidelines, and patterns) developed previously by different researchers to investigate the gaps in existing schemes. Subsequently, we have demonstrated how to apply and map privacy patterns into IoT architectures at the design stage and have also highlighted the complexity of doing such mapping. Finally, we have identified the major challenges that should be addressed and potential research directions to take the burden off software developers when applying privacy-preserving techniques that comply with privacy and data protection laws. We have released a companion technical report [3] that comprises all definitions, detailed steps on how we developed the CPLF, and detailed mappings between CPLF and PbD schemes.

FSDS: A practical and fully secure document similarity search over encrypted data with lightweight client

In this paper, we propose a highly accurate, fully secure document similarity search (FSDS) scheme that makes use of both a novel variant of the secure K-NN algorithm and somewhat homomorphic encryption (SWHE). The scheme provides data, query and search pattern privacy and is amenable to access pattern privacy. We provide formal security analyzes of both the original and the new secure K-NN algorithms and show the latter is IND-CPA secure. We also rely on IND-CPA security of the SWHE scheme to meet the strong privacy claims. The scheme provides a speedup of about two orders of magnitude over the schemes using only SWHE while its overall performance is comparable (and faster for certain cases) to other schemes in the literature with weaker forms of privacy claims. We present implementation results including those from the literature pertaining to response times, storage and bandwidth requirements and show that the proposed scheme facilitates a lightweight client implementation.

Towards a Collection of Security and Privacy Patterns

Security and privacy (SP)-related challenges constitute a significant barrier to the wider adoption of Internet of Things (IoT)/Industrial IoT (IIoT) devices and the associated novel applications and services. In this context, patterns, which are constructs encoding re-usable solutions to common problems and building blocks to architectures, can be an asset in alleviating said barrier. More specifically, patterns can be used to encode dependencies between SP properties of individual smart objects and corresponding properties of orchestrations (compositions) involving them, facilitating the design of IoT solutions that are secure and privacy-aware by design. Motivated by the above, this work presents a survey and taxonomy of SP patterns towards the creation of a usable pattern collection. The aim is to enable decomposition of higher-level properties to more specific ones, matching them to relevant patterns, while also creating a comprehensive overview of security- and privacy-related properties and sub-properties that are of interest in IoT/IIoT environments. To this end, the identified patterns are organized using a hierarchical taxonomy that allows their classification based on provided property, context, and generality, while also showing the relationships between them. The two high-level properties, Security and Privacy, are decomposed to a first layer of lower-level sub-properties such as confidentiality and anonymity. The lower layers of the taxonomy, then, include implementation-level enablers. The coverage that these patterns offer in terms of the considered properties, data states (data in transit, at rest, and in process), and platform connectivity cases (within the same IoT platform and across different IoT platforms) is also highlighted. Furthermore, pointers to extensions of the pattern collection to include additional patterns and properties, including Dependability and Interoperability, are given. Finally, to showcase the use of the presented pattern collection, a practical application is detailed, involving the pattern-driven composition of IoT/IIoT orchestrations with SP property guarantees.

Towards a Collection of Security and Privacy Patterns

Towards a Collection of Security and Privacy Patterns

SeDID: An SGX-enabled decentralized intrusion detection framework for network trust evaluation

In order to evaluate network trust, different intrusion detection methods have been proposed. However, it is difficult for a single detection node to collect massive data and perform detection and evaluation in a large-scale network. In addition, disclosure of security-related data and detection pattern might weaken data provision incentives due to privacy concern, which could result in deliberately forging data to evade detection. Current literature still lacks a general framework to conduct decentralized intrusion detection towards network trust evaluation with privacy preservation. In this paper, we propose SeDID, a Software Guard Extension (SGX)-enabled decentralized intrusion detection framework for network trust evaluation based on blockchain. We design a novel consensus mechanism to avoid forking and guarantee high efficiency and real decentralization, where block creation is uniquely consented by miners and block creation difficulty is determined by the number of blocks previously created by a relative miner within a time window. The smaller the number, the easier the miner creates a new block. SeDID also offers incentives according to node contributions for motivating security-related data collection, intrusion detection and network trust evaluation. Additional employment of Intel SGX makes SeDID preserve both data and pattern privacy. We analyze SeDID’s efficacy in terms of incentive, privacy preservation and security. Its performance is further evaluated through simulations. In specific settings, its block creation time, task completion time and throughput are 19.61s, 44.55s and 224.47 transactions/s, respectively. Compared with state-of-the-art systems, SeDID offers better performance, which implies its potential to be applied in practice.

Multilevel Privacy Controlling Scheme to Protect Behavior Pattern in Smart IoT Environment

Traditional approaches generally focus on the privacy of user’s identity in a smart IoT environment. Privacy of user’s behavior pattern is an important research issue to address smart technology towards improving user’s life. User’s behavior pattern consists of daily living activities in smart IoT environment. Sensor nodes directly interact with activities of user and forward sensing data to service provider server (SPS). While availing the services provided by a server, users may lose privacy since the untrusted devices have information about user’s behavior pattern and it may share data with adversary. In order to resolve this problem, we propose a multilevel privacy controlling scheme (MPCS) which is different from traditional approaches. MPCS is divided into two parts: (i) behavior pattern privacy degree (BehaviorPrivacyDeg), which works as follows: firstly, frequent pattern mining‐based time‐duration algorithm (FPMTA) finds the normal pattern of activity by adopting unsupervised learning. Secondly, patterns compact algorithm (PCA) is proposed to store and compact the mined pattern in each sensor device. Then, abnormal activity detection time‐duration algorithm (AADTA) is used by current triggered sensors, in order to compare the current activity with normal activity by computing similarity among them; (ii) multilevel privacy design model: we have divided privacy of users into four levels in smart IoT environment, and by using these levels, the server can configure privacy level for users according to their concern. Multilevel privacy design model consists of privacy‐level configuration protocol (PLCP) and activity design model. PLCP provides fine privacy controls to users while enabling users to set privacy level. In PLCP, we introduce level concern privacy algorithm (LCPA) and location privacy algorithm (LPA), so that adversary could not damage the data of user’s behavior pattern. Experiments are performed to evaluate the accuracy and feasibility of MPCS in both simulation and real‐case studies. Results show that our proposed scheme can significantly protect the user’s behavior pattern by detecting abnormality in real time.