Privacy Attacks Research Articles

Enhanced Clustering Based OSN Privacy Preservation to Ensure k-Anonymity, t-Closeness, l-Diversity, and Balanced Privacy Utility

Online Social Networks (OSN) sites allow end-users to share a great deal of information, which may also contain sensitive information, that may be subject to commercial or non-commercial privacy attacks. As a result, guaranteeing various levels of privacy is critical while publishing data by OSNs. The clustering-based solutions proved an effective mechanism to achieve the privacy notions in OSNs. But fixed clustering limits the performance and scalability. Data utility degrades with increased privacy, so balancing the privacy utility trade-off is an open research issue. The research has proposed a novel privacy preservation model using the enhanced clustering mechanism to overcome this issue. The proposed model includes phases like pre-processing, enhanced clustering, and ensuring privacy preservation. The enhanced clustering algorithm is the second phase where authors modified the existing fixed k-means clustering using the threshold approach. The threshold value is determined based on the supplied OSN data of edges, nodes, and user attributes. Clusters are k-anonymized with multiple graph properties by a novel one-pass algorithm. After achieving the k-anonymity of clusters, optimization was performed to achieve all privacy models, such as k-anonymity, t-closeness, and l-diversity. The proposed privacy framework achieves privacy of all three network components, i.e., link, node, and user attributes, with improved utility. The authors compare the proposed technique to underlying methods using OSN Yelp and Facebook datasets. The proposed approach outperformed the underlying state of art methods for Degree of Anonymization, computational efficiency, and information loss.

Designing a Location Trace Anonymization Contest

For a better understanding of anonymization methods for location traces, we have designed and held a location trace anonymization contest that deals with a long trace (400 events per user) and fine-grained locations (1024 regions). In our contest, each team anonymizes her original traces, and then the other teams perform privacy attacks against the anonymized traces. In other words, both defense and attack compete together, which is close to what happens in real life. Prior to our contest, we show that re-identification alone is insufficient as a privacy risk and that trace inference should be added as an additional risk. Specifically, we show an example of anonymization that is perfectly secure against re-identification and is not secure against trace inference. Based on this, our contest evaluates both the re-identification risk and trace inference risk and analyzes their relationship. Through our contest, we show several findings in a situation where both defense and attack compete together. In particular, we show that an anonymization method secure against trace inference is also secure against re-identification under the presence of appropriate pseudonymization. We also report defense and attack algorithms that won first place, and analyze the utility of anonymized traces submitted by teams in various applications such as POI recommendation and geo-data analysis.

I-GWAS: Privacy-Preserving Interdependent Genome-Wide Association Studies

Genome-wide Association Studies (GWASes) identify genomic variations that are statistically associated with a trait, such as a disease, in a group of individuals. Unfortunately, careless sharing of GWAS statistics might give rise to privacy attacks. Several works attempted to reconcile secure processing with privacy-preserving releases of GWASes. However, we highlight that these approaches remain vulnerable if GWASes utilize overlapping sets of individuals and genomic variations. In such conditions, we show that even when relying on state-of-the-art techniques for protecting releases, an adversary could reconstruct the genomic variations of up to 28.6% of participants, and that the released statistics of up to 92.3% of the genomic variations would enable membership inference attacks. We introduce I-GWAS, a novel framework that securely computes and releases the results of multiple possibly interdependent GWASes. I-GWAS continuously releases privacy-preserving and noise-free GWAS results as new genomes become available.

A critical review of internet of things communication environment: Privacy and security constraints

The recent past has experienced a steady increase in the adoption of Internet of Things (IoT) in a number of areas such as smart cities, smart homes, smart transportation and smart health. Due to the message exchanges among IoT devices over the public internet, the transmitted data is vulnerable to many security and privacy attacks. Therefore, many schemes have been presented over the recent past to address these challenges. However, many security holes still exist in most of the current techniques. It was also noted that the resource limited nature of most IoT devices renders traditional authentication schemes for main-powered systems with high processing power and large memory infeasible and inapplicable. To address this performance issue, numerous lightweight authentication schemes have been put forward. However, this paper discovered numerous security and privacy gaps in these schemes. Based on these shortcomings, recommendations are given towards the end of this paper which are very critical for security enhancements in this pervasive computing environment.

Scalable CCA-secure public-key authenticated encryption with keyword search from ideal lattices in cloud computing

Public-key authenticated encryption with keyword search (PAEKS) is an important cryptographic primitive for realizing effective and confidential searches on encrypted data in cloud computing. Several PAEKS schemes with various appealing functionalities have been proposed in the literature. Nevertheless, most of them are based on the classical number-theoretic assumptions and are impossible to resist quantum attacks. Their security is only proven against chosen-keyword attacks and is considered insufficient. Fortunately, ring-LWE and ring-ISIS problems reduced from the worst-case ideal lattices are believed to be post-quantum secure and could be improved computational efficiency in constructions. In this paper, we propose a scalable PAEKS scheme based on ring-LWE and ring-ISIS by adopting the ring analog of lattice algorithms of both digital signature and searchable encryption schemes, in which signature algorithms are used to authenticate ciphertext, making our PAEKS resistant to insider keyword guessing attacks. The scheme is also proved secure against chosen-ciphertext attacks and token privacy attacks. In addition, we extend the PAEKS scheme to conjunctive keywords and multi-user settings to allow for realistic promotion. We finally implement our schemes and compare them with related counterparts, which shows that our constructions are efficient in practical applications.

ZkChain: A privacy‐preserving model based on zk‐SNARKs and hash chain for efficient transfer of assets

AbstractAs a distributed public ledger technology in a peer‐to‐peer network, blockchain has been widely used in a variety of Internet interaction systems in recent years, such as market supervision, property rights protection, and digital identity. However, in blockchain environment, all historical transaction data are open and transparent, and adversaries may illegally access private transaction data, which makes privacy attacks a core issue that hinders the popularization and application of blockchain. Different privacy‐preserving technologies such as zerocoin and zerocash have been proposed. However, the large amount of proofs and the slow verification speed hinder the effective application of zero‐knowledge proofs (ZKPs) in blockchain. This article proposes a privacy‐preserving model based on zk‐SNARKs and hash chain for efficient transfer of assets, called zkChain. Different from traditional privacy‐preserving schemes, this scheme constructs a smaller proof based on hash chain, and the verification speed of the proof is faster. This scheme constructs ZKP based on the one‐way hash function and zk‐SNARKs. The proof is publicly recorded in the ledger after being verified by miners, and users use the proof to send privacy‐preserving transactions. In the above process, the zkChain scheme can achieve effective privacy protection of account balance and account address. We evaluated the computational and storage costs of the zkChain scheme based on libsnark, and establish a test network to evaluate the processing performance of the zkChain scheme.

A Survey on Security Attacks and Intrusion Detection Mechanisms in Named Data Networking

Despite the highly secure content sharing and the optimized forwarding mechanism, the content delivery in a Named Data Network (NDN) still suffers from numerous vulnerabilities that can be exploited to reduce the efficiency of such architecture. Malicious attacks in NDN have become more sophisticated and the foremost challenge is to identify unknown and obfuscated malware, as the malware authors use different evasion techniques for information concealing to prevent detection by an Intrusion Detection System (IDS). For the most part, NDN faces immense negative impacts from attacks such as Cache Pollution Attacks (CPA), Cache Privacy Attacks, Cache Poisoning Attacks, and Interest Flooding Attacks (IFA), that target different security components, including availability, integrity, and confidentiality. This poses a critical challenge to the design of IDS in NDN. This paper provides the latest taxonomy, together with a review of the significant research works on IDSs up to the present time, and a classification of the proposed systems according to the taxonomy. It provides a structured and comprehensive overview of the existing IDSs so that a researcher can create an even better mechanism for the previously mentioned attacks. This paper discusses the limits of the techniques applied to design IDSs with recent findings that can be further exploited in order to optimize those detection and mitigation mechanisms.

New challenges in reinforcement learning: a survey of security and privacy

Reinforcement learning is one of the most important branches of AI. Due to its capacity for self-adaption and decision-making in dynamic environments, reinforcement learning has been widely applied in multiple areas, such as healthcare, data markets, autonomous driving, and robotics. However, some of these applications and systems have been shown to be vulnerable to security or privacy attacks, resulting in unreliable or unstable services. A large number of studies have focused on these security and privacy problems in reinforcement learning. However, few surveys have provided a systematic review and comparison of existing problems and state-of-the-art solutions to keep up with the pace of emerging threats. Accordingly, we herein present such a comprehensive review to explain and summarize the challenges associated with security and privacy in reinforcement learning from a new perspective, namely that of the Markov Decision Process (MDP). In this survey, we first introduce the key concepts related to this area. Next, we cover the security and privacy issues linked to the state, action, environment, and reward function of the MDP process, respectively. We further highlight the special characteristics of security and privacy methodologies related to reinforcement learning. Finally, we discuss the possible future research directions within this area.

Edge Intelligence: Federated Learning-Based Privacy Protection Framework for Smart Healthcare Systems.

Federated learning methods offer secured monitor services and privacy-preserving paradigms to end-users and organisations in the Internet of Things networks such as smart healthcare systems. Federated learning has been coined to safeguard sensitive data, and its global aggregation is often based on a centralised server. This design is vulnerable to malicious attacks and could be breached by privacy attacks such as inference and free-riding, leading to inefficient training models. Besides, uploaded analysing parameters by patients can reveal private information and the threat of direct manipulation by the central server. To address these issues, we present a three-fold Federated Edge Aggregator, the so-called Edge Intelligence, a federated learning-based privacy protection framework for safeguarding Smart Healthcare Systems at the edge against such privacy attacks. We employ an iteration-based Conventional Neural Network (CNN) model and artificial noise functions to balance privacy protection and model performance. A theoretical convergence bound of Edge Intelligence on the trained federated learning model's loss function is also introduced here. We evaluate and compare the proposed framework with the recently established methods using model performance and privacy budget on popular and recent datasets: MNIST, CIFAR10, STL10, and COVID19 chest x-ray. Finally, the proposed framework achieves 90% accuracy and a high privacy rate demonstrating better performance than the baseline technique.

Secure Task Offloading in Blockchain-Enabled Mobile Edge Computing With Deep Reinforcement Learning

Mobile Edge Computing (MEC) is a promising and fast-developing paradigm that provides cloud services at the edge of the network. MEC enables IoT devices to offload and execute their real-time applications at the proximity of these devices with low latency. Such applications include efficient manufacture inspection, virtual/augmented reality, image recognition, Internet of Vehicles (IoV), and e-Health. However, task offloading experiences security and privacy attacks such as data tampering, private data leakage, data replication, etc. To this end, in this paper, we propose a new blockchain-based framework for secure task offloading in MEC systems with guaranteed performance in terms of execution delay and energy consumption. First, blockchain technology is introduced as a platform to achieve data confidentiality, integrity, authentication, and privacy of task offloading in MEC. Second, we formulate an integration model of resource allocation and task offloading for a multi-user with multi-task MEC systems to optimize the energy and time cost. This is an NP-hard problem because of the curse-of-dimensionality and dynamic characteristics challenges of the considered scenario. Therefore, a deep reinforcement learning-based algorithm is developed to derive the close-optimal task offloading decision efficiently. Theoretical analysis and experimental results demonstrate that the proposed framework is resilient to several task offloading security attacks and it can save about 22.2% and 19.4% of system consumption with respect to the local and edge execution scenarios. Moreover, the benchmark analysis proves that the framework consumes few resources in terms of memory and disk usage, CPU utilization, and transaction throughput.

GOF-TTE: Generative Online Federated Learning Framework for Travel Time Estimation

Estimating the travel time of a path is an essential topic for the intelligent transportation system. It serves as the foundation for real-world applications, such as traffic monitoring, route planning, and taxi dispatching. However, building a model for such a data-driven task requires a large amount of users’ travel information, which closely relates to their privacy and, thus, is less likely to be shared. The not independent and identically distributed (Non-IID) trajectory data across data owners also make a predictive model extremely challenging to be personalized if we directly apply federated learning. Finally, previous work on travel time estimation (TTE) does not consider the real-time traffic state of roads, which we argue, can significantly influence the prediction. To address the above challenges, we introduce GOF-TTE for the mobile user group, generative online federated learning framework for TTE, which 1) utilizes the federated learning approach, allowing private data to be kept on client devices while training, and designs the global model as an online generative model shared by all clients to infer the real-time road traffic state and 2) apart from sharing a base model at the server, adapts a fine-tuned personalized model for every client to study their personal driving habits, making up for the residual error made by localized global model prediction. We also employ a simple privacy attack to our framework and implement the differential privacy mechanism to guarantee privacy safety further. Finally, we conduct experiments on two real-world public taxi data sets of DiDi Chengdu and Xi’an. The experimental results demonstrate the effectiveness of our proposed framework.

An Energy-efficient and Privacy-aware Decomposition Framework for Edge-assisted Federated Learning

Deep Learning (DL) is an essential technology for modern intelligent sensor network and interactive multimedia applications, having problems with user data privacy when training on a central cloud. While Federated Learning (FL) motivates to preserve user privacy, it also causes new problems of lower user terminal usability and training efficiency, which caused substantial energy consumption. This article proposes a novel energy-efficient and privacy-aware decomposition framework to improve user-side FL efficiency under pre-defined privacy requirements with the assistance of Mobile Edge Computing (MEC) and Software Decomposition. It takes the propagation of each neural layer as the migrating unit and considers the tradeoff relationship between privacy and efficiency. We also propose an online scheduling algorithm to optimize the framework’s training performance. Furthermore, we summarize eight privacy-sensitive information classes on which existing privacy attacks base and design configurable privacy preservation mechanisms for each class. Simulations and experiments prove the effectiveness of our framework and algorithm in FL efficiency improvement and the effects of different privacy constraints on the overall training efficiency.

Design of privacy preserving model based on clustering involved anonymization along with feature selection

Healthcare services has become a hug transformation due to the number of disease emerging at presently. Accordingly, enormous amount of data is generated regarding on the patient data. Hence, preserving privacy of patient data is the major concern to meet privacy requirements and to prevent healthcare data from numerous privacy attacks. To protect the information from privacy attack, various studies were performed to safeguard the patient's data but, these methods have several issues when preserving privacy that increases proportionally as the data dimension increased in multiple approaches, which produces less data quality, more information loss and more execution time.Thus, selecting relevant attributes plays an important factor for improving the efficiency of any preserving algorithm. In order to overcome these concerns, in this paper proposed a privacy preserving model based on clustering involved anonymization along with feature selection approaches. The proposed model consist of two phases such as, feature selection and anonymization. In the initial phase, the relevant features are selected using Symmetrical Uncertainty (SU) and the redundant features present in the dataset are removed utilizing Spearman's Correlation Coefficient. In the second phase, the privacy preservation is performed using Utility Preserved Anonymization (UPA) algorithm. Also, the proposed algorithm reduces the dimensionality of data to ease the process of forming clusters for anonymization. The experimental analysis using real time datasets to verifies the effectiveness of the proposed method. The results show high sensitivity (up to 98.63%) and high accuracy (up to 98%), allowing us to claim efficient attribute selection for anonymization. Hence proved the proposed method reduces clustering's complexity by removing the irrelevant attributes effectively.

A blockchain based access control scheme with hidden policy and attribute

Attribute-based access control, which can provide fine-grained and flexible privacy protection, is widely used in practice. Traditional attribute-based access control schemes require the intervention of a trusted third party, which will cause single point of failure. Due to its decentralized nature, blockchain is now considered as a promising way to solve the above issue. The basic idea of existing blockchain-based access control schemes is to code the access policy into a smart contract. However, the transparency of the blockchain makes it easier for the adversary to explore the public information to launch a privacy attack. In this paper, we propose an attribute-based access control scheme which benefits from the smart contract technology while ensuring the privacy of attributes and policies. An additive homomorphic cryptosystem is utilized to encrypt attributes and access policies. The scheme uses multiple blockchain nodes to collectively decrypt the data, and uses zero-knowledge proof technology to ensure the correctness of the decryption result. Therefore, the smart contract is able to make the authorization decision without actually seeing attributes or policies. We have implemented the proposed access control scheme on Hyperledger Fabric. Simulation results show that the computation overhead introduced by encryption/decryption and zero-knowledge proof is reasonable.

AFFIRM: Provably Forward Privacy for Searchable Encryption in Cooperative Intelligent Transportation System

With the construction of intelligent transportation, big data with heterogeneous, multi-source and massive characteristics has become an important carrier of cooperative intelligent transportation systems (C-ITS) and plays an important role. Big data in C-ITS can break through the restrictions between regions and entities and then learning cooperatively by sharing data. In addition, the combined efficiency and information integration advantages of big data are conducive to the construction of a comprehensive and three-dimensional traffic information system and can enhance traffic prediction. However, such substantial sensitive data, mainly on the cloud infrastructure, exposes several vulnerabilities like data leakages and privacy breaks, especially when data is shared for cooperative learning purposes. To address this, this paper proposes a forward privacy-preserving scheme, named AFFIRM, for multi-party encrypted sample alignment adopting cooperative learning in C-ITS. By introducing the searchable encryption method, we realize the sample alignment of cooperative learning in the multi-party encrypted data space. AFFIRM ensures encrypted sample alignment under the condition of forward privacy security. We have formally proved that the proposed scheme satisfies both forward security and validity. We have assessed AFFIRM by validating the potential threat of malicious tampering by privacy attackers and malicious personnel search for the aligned sample data and verify it. Finally, we numerically tested and compared AFFIRM against the corresponding ones of some state-of-the-art schemes under various record sizes, servers and processing.

A Decentralized Mechanism Based on Differential Privacy for Privacy-Preserving Computation in Smart Grid

As one of the most successful industrial realizations of Internet of Things, a smart grid is a smart IoT system that deploys widespread smart meters to capture fine-grained data on residential power usage. Unfortunately, it always suffers diverse privacy attacks, which seriously increases the risk of violating the privacy of customers. Although some solutions have been proposed to address this privacy issue, most of them mainly rely on a trusted party and focus on the sanitization of metering masurements. Moreover, these solutions are vulnerable to advanced attacks. In this paper, we propose a decentralized mechanism for privacy-preserving computation in smart grid called DDP, which leaverages the differential privacy and extends the data sanitization from the value domain to the time domain. Specifically, we inject Laplace noise to the measurements at the end of each customer in a distributed manner, and then use a random permutation algorithm to shuffle the power measurement sequence, thereby enforcing differential privacy after aggregation and preventing the sensitive power usage mode informaton of the customers from being inferred by other parties. Extensive experiments demonstrate that DDP shows an outstanding performance in terms of privacy from the non-intrusive load monitoring (NILM) attacks and utility by using two different error analysis.

Top-k sparsification with secure aggregation for privacy-preserving federated learning

The proposal of federated learning solves problems of data silos and privacy protection in the field of artificial intelligence. However, privacy attacks can infer or reconstruct sensitive information from the submitted gradient, which causes users’ privacy leakage in federated learning. Secure aggregation (SecAgg) protocol can protect users’ privacy while completing federated learning tasks, but it incurs significant communication overhead and wall clock training time on large-scale model training task. Thus, it is difficult to apply SecAgg in bandwidth-limited federated applications. Recently, Rand-k sparsification with secure aggregation (Rand-k SparseSecAgg) was proposed to optimize SecAgg protocol, while its optimization of communication overhead and training time is limited. In this paper, we replace Rand-k sparsification with Top-k sparsification, and design a Top-k sparsification with secure aggregation (Top-k SparseSecAgg) protocol for privacy-preserving federated learning to further reduce communication overhead and wall clock training time. In addition, we optimize the proposed protocol by assigning clients to different groups in the logical layer, which reduces the upper limit of compression ratio and practical communication overhead in Top-k SparseSecAgg. Experiments demonstrate that Top-k SparseSecAgg can reduce communication overhead by 6.25× as compared to SecAgg, 3.78× as compared to Rand-k SparseSecAgg, and reduce wall clock training time 1.43× as compared to SecAgg and 1.13× as compared to Rand-k SparseSecAgg. Thus, our protocol is more suitable in bandwidth-limited federated applications to protect privacy and complete learning task.

I recognize you by your steps: Privacy impact of pedometer data

In recent years, with the popularity of fitness bands and smartwatches, there has been a surge in the collection of personal physiological data. Tracking activities and fitness levels has become an intrinsic part of many people’s lives. While the deep insight it provides into an individual’s health has multiple benefits, this lifestyle choice comes with the risk of endangering the user’s privacy. Data from these devices has previously been proven capable to identify a person, much like a fingerprint. Most existing privacy attacks rely on fine-grained multi-sensor data. Through our observations we can demonstrate that pedometer data, collected per default by iPhones, even when aggregated to a 15-minute resolution, can be used to identify a user with good precision if sufficient training data is used to create the fingerprints. We also demonstrate that the participant’s data has such a strong individual signal that they can be clustered with high accuracy if they are divided into days.

IMPROVING DIGITAL SECURITY AND PRIVACY OF STUDENTS IN COLLEGES OF EDUCATION: AN ATTITUDINAL CHANGE FRAMEWORK BASED ON COMPETENCE LEARNING MATRIX

The information revolution is affecting every aspect of society including education resulting in a concept known as digital learning or e-learning. One problem of digital learning environments and tools is the security and privacy of the learners. How to ensure the security and privacy of digital learners remains a major challenge leading to exposure among naive students. The objective of the study was to explore digital security and privacy culture among students and to propose a novel framework to enhance the security and privacy culture of students using a framework based on the competence learning theory. The Design Science Research (DSR) was adopted as a research paradigm with quantitative and qualitative data gathered from the implementation of the framework. 300 students from a college of education were purposively sampled for the study. A WhatsApp message was sent to the student requesting their confidential information under pretexting and impersonation to assess how security and privacy conscious they were. A framework was developed and implemented based on the theory of competence learning. The results showed high levels of vulnerabilities among students at 67.67% before the Implementation of the Framework in Round 1. This vulnerability reduced to 1.67% in after the implementation of the framework in Round 2 and further reduced to 0% in Round 3. The paper concluded that the lack of security and privacy awareness of the students made them Unconsciously Incompetent (UI). Exposure to the vulnerability made them consciously incompetent (CI), whiles further rounds of exposures led them to be consciously competent (CC). further exposure will eventually result in unconsciously competent (UC) as students become resistant and or immune to security and privacy attacks. The implication of this study is that, as more students converge in the digital space, the need to build their immunity and resistance against cyber-attacks is critical to avoid exposure. Learning to be security conscious should be consistent and routine to ensure that students have renewed behavior changes to become resistant and immune to online attacks.<p> </p><p><strong> Article visualizations:</strong></p><p><img src="/-counters-/edu_01/0697/a.php" alt="Hit counter" /></p>

Efficient and privacy-preserving decentralized energy trading scheme in a blockchain environment

Blockchain technology provides the possibility for the realization of decentralized energy trading. However, the blockchain confronts privacy risks and efficiency issues, which hinder its application in energy trading. In this paper, to solve this problem, we propose an efficient and privacy-preserving decentralized energy trading scheme in a blockchain environment. We propose an account mapping algorithm to solve the privacy attack problem. We propose a new transaction processing method, which can protect private data and improve execution efficiency by two-layer transaction processing. Finally, we verify the effectiveness of the proposed scheme for privacy protection and trading efficiency of decentralized energy transactions through experiments.