Privacy Mechanisms Research Articles

Game Theory Based Correlated Privacy Preserving Analysis in Big Data

Privacy preservation is one of the greatest concerns in big data. As one of extensive applications in big data, privacy preserving data publication (PPDP) has been an important research field. One of the fundamental challenges in PPDP is the trade-off problem between privacy and utility of the single and independent data set. However, recent research has shown that the advanced privacy mechanism, i.e., differential privacy, is vulnerable when multiple data sets are correlated. In this case, the trade-off problem between privacy and utility is evolved into a game problem, in which payoff of each player is dependent on his and his neighbors' privacy parameters. In this paper, we first present the definition of correlated differential privacy to evaluate the real privacy level of a single data set influenced by the other data sets. Then, we construct a game model of multiple players, in which each publishes data set sanitized by differential privacy. Next, we analyze the existence and uniqueness of the pure Nash Equilibrium. We refer to a notion, i.e., the price of anarchy, to evaluate efficiency of the pure Nash Equilibrium. Finally, we show the correctness of our game analysis via simulation experiments.

Online advertising: Analysis of privacy threats and protection approaches

Online advertising, the pillar of the “free” content on the Web, has revolutionized the marketing business in recent years by creating a myriad of new opportunities for advertisers to reach potential customers. The current advertising model builds upon an intricate infrastructure composed of a variety of intermediary entities and technologies whose main aim is to deliver personalized ads. For this purpose, a wealth of user data is collected, aggregated, processed and traded behind the scenes at an unprecedented rate. Despite the enormous value of online advertising, however, the intrusiveness and ubiquity of these practices prompt serious privacy concerns. This article surveys the online advertising infrastructure and its supporting technologies, and presents a thorough overview of the underlying privacy risks and the solutions that may mitigate them. We first analyze the threats and potential privacy attackers in this scenario of online advertising. In particular, we examine the main components of the advertising infrastructure in terms of tracking capabilities, data collection, aggregation level and privacy risk, and overview the tracking and data-sharing technologies employed by these components. Then, we conduct a comprehensive survey of the most relevant privacy mechanisms, and classify and compare them on the basis of their privacy guarantees and impact on the Web.

On Binary Decomposition Based Privacy-Preserving Aggregation Schemes in Real-Time Monitoring Systems

In real-time monitoring systems, fine-grained measurements would pose great privacy threats to the participants as real-time measurements could disclose accurate people-centric activities. Differential privacy has been proposed to formalize and guide the design of privacy-preserving schemes. Nonetheless, due to the correlations and high fluctuations in time-series data, it is hard to achieve an effective privacy and utility tradeoff by differential privacy mechanisms. To address this issue, in this paper, we first proposed novel multi-dimensional decomposition based schemes to compress the noise and enhance the utility in differential privacy. The key idea is to decompose the measurements into multi-dimensional records and to achieve differential privacy in bounded dimensions so that the error caused by unbounded measurements can be significantly reduced. We then extended our developed scheme and developed a binary decomposition scheme for privacy-preserving time-series aggregation in real-time monitoring systems. Through a combination of extensive theoretical analysis and experiments, our data shows that our proposed schemes can effectively improve usability while achieving the same level of differential privacy than existing schemes.

Privacy Secured and Share with the Destination in Cloud

Cloud computing refers to applications and services that run on a distributed network using virtualized resources and accessed by common Internet protocols and networking standards. Cloud computing takes the technology, services, and applications that are similar to those on the Internet and turns them into a self-service utility. Without adequate privacy protection, the system can be easily misused, e.g., to track users target them for home invasion. introduce LocX, a novel alternative that provides significantly-improved location privacy without adding uncertainty into query results or relying on strong assumptions about server security. Our key aim is to apply secure user- specific, distance-preserving coordinate transformations to all location data shared with the server. The friends of a user share this user's secrets, so they can apply the same transformation to destination. This allows all location queries to be evaluated correctly by the server, but our privacy mechanisms guarantee that servers are unable to see or infer the actual location data from the transformed data or from the data access. show that LocX provides privacy even against a powerful adversary model, and we use prototype measurements to show that it provides privacy with very little performance overhead, making it suitable for today's mobile devices.

MSieve: Differential Behavioral Privacy in Time Series of Mobile Sensor Data.

Differential privacy concepts have been successfully used to protect anonymity of individuals in population-scale analysis. Sharing of mobile sensor data, especially physiological data, raise different privacy challenges, that of protecting private behaviors that can be revealed from time series of sensor data. Existing privacy mechanisms rely on noise addition and data perturbation. But the accuracy requirement on inferences drawn from physiological data, together with well-established limits within which these data values occur, render traditional privacy mechanisms inapplicable. In this work, we define a new behavioral privacy metric based on differential privacy and propose a novel data substitution mechanism to protect behavioral privacy. We evaluate the efficacy of our scheme using 660 hours of ECG, respiration, and activity data collected from 43 participants and demonstrate that it is possible to retain meaningful utility, in terms of inference accuracy (90%), while simultaneously preserving the privacy of sensitive behaviors.

Towards a Visual Vocabulary for Privacy Concepts

Designing privacy controls that are intuitive for end users involves several challenges. Graphic representations could certainly contribute to tackle such challenges, however, a visual vocabulary for privacy solutions is currently lacking. To contribute to that end, in this paper we report a review of online images related to privacy. We identify graphic representations that illustrate privacy objects, mechanisms and actions, and categorize them according to the concepts covered. Seeking to develop a set of icons to illustrate privacy concepts, we analyze online contents publicly available from social media and extract representations that commonly refer to privacy concepts. The contributions of this paper include: (1) a set of graphics that represent privacy mechanisms, objects and actions; and (2) a vocabulary for such graphic representation. The evidence is drawn from the analysis and discussion of 241 images selected by the authors from ten online image repositories.

Eliciting metrics for accountability of cloud systems

Cloud computing provides enormous business opportunities, but at the same time is a complex and challenging paradigm. The major concerns for users adopting the cloud are the loss of control over their data and the lack of transparency. Providing accountability to cloud systems could foster trust in the cloud and contribute toward its adoption. Assessing how accountable a cloud provider is becomes then a key issue, not only for demonstrating accountability, but to build it. To this end, we need techniques to measure the factors that influence on accountability. In this paper, we provide a methodology to elicit metrics for accountability in the cloud, which consists of three different stages. Since the nature of accountability attributes is very abstract and complex, in the first stage we perform a conceptual analysis of the accountability attributes in order to decompose them into concrete practices and mechanisms. Then, we analyze relevant control frameworks designed to guide the implementation of security and privacy mechanisms, and use them to identify measurable factors, related to the practices and mechanisms defined earlier. Lastly, specific metrics for these factors are derived. We also provide some strategies that we consider relevant for the empirical validation of the elicited accountability metrics.

Location Privacy with Randomness Consistency

Abstract Location-Based Social Network (LBSN) applications that support geo-location-based posting and queries to provide location-relevant information to mobile users are increasingly popular, but pose a location-privacy risk to posts. We investigated existing LBSNs and location privacy mechanisms, and found a powerful potential attack that can accurately locate users with relatively few queries, even when location data is well secured and location noise is applied. Our technique defeats previously proposed solutions including fake-location detection and query rate limits. To protect systems from this attack, we propose a simple, scalable, yet effective defense that quantizes the map into squares using hierarchical subdivision, consistently returns the same random result to multiple queries from the same square for posts from the same user, and responds to queries with different distance thresholds in a correlated manner, limiting the information gained by attackers, and ensuring that an attacker can never accurately know the quantized square containing a user. Finally, we verify the performance of our defense and analyze the trade-offs through comprehensive simulation in realistic settings. Surprisingly, our results show that in many environments, privacy level and user accuracy can be tuned using two independent parameters; in the remaining environments, a single parameter adjusts the tradeoff between privacy level and user accuracy. We also thoroughly explore the parameter space to provide guidance for actual deployments.

PRIVACY POLICY INFERENCE OF USER-UPLOADED IMAGES ON CONTENT SHARING SITES

In recent years online social networking communities have undergone massive explosion. The number of sites as well as kinds of sites have grown and it allows us to communicate with a lot of people across the world. Social networking sites such as Facebook, Flickr, MySpace and LinkedIn, give opportunities to share large amount of personal information. People upload their photos to these sites to gain public attention for social purposes, and thus many public consumer photographs are available online. The proliferation of personal data leads to privacy violation .Risks such as identify theft, embarrassment, and blackmail are faced by user’s .In order to overcome these risks flexible privacy mechanisms need to be considered. An Adaptive Privacy Policy Prediction (A3P) system helps users to compose privacy settings for their images. A two-level framework which according to the user’s available history on the site, determines the best available privacy policy for the user’s images being uploaded. A3P system aims to provide users a hassle free privacy settings experience by automatically generating personalized policies. The A3P system provides a comprehensive framework to infer privacy preferences based on the information available for a given user. .When meta data information is unavailable it is difficult to generate accurate privacy policy. Privacy violation as well as inaccurate classification will be the after effect of manual creation of meta data log information .To provide security for the information, automated annotation of images are introduced which aims to create the meta data information about the images by using K-means clustering, KNN and SIFT descriptors. It results in better security, scalability, efficiency and accuracy.

A comprehensive meta-analysis of cryptographic security mechanisms for cloud computing

The concept of cloud computing offers measurable computational or information resources as a service over the Internet. The major motivation behind the cloud setup is economic benefits, because it assures the reduction in expenditure for operational and infrastructural purposes. To transform it into a reality there are some impediments and hurdles which are required to be tackled, most profound of which are security, privacy and reliability issues. As the user data is revealed to the cloud, it departs the protection-sphere of the data owner. However, this brings partly new security and privacy concerns. This work focuses on these issues related to various cloud services and deployment models by spotlighting their major challenges. While the classical cryptography is an ancient discipline, modern cryptography, which has been mostly developed in the last few decades, is the subject of study which needs to be implemented so as to ensure strong security and privacy mechanisms in today’s real-world scenarios. The technological solutions, short and long term research goals of the cloud security will be described and addressed using various classical cryptographic mechanisms as well as modern ones. This work explores the new directions in cloud computing security, while highlighting the correct selection of these fundamental technologies from cryptographic point of view.

Differentially private response mechanisms on categorical data

We study mechanisms for differential privacy on finite datasets. By deriving sufficient sets for differential privacy we obtain necessary and sufficient conditions for differential privacy, a tight lower bound on the maximal expected error of a discrete mechanism and a characterisation of the optimal mechanism which minimises the maximal expected error within the class of mechanisms considered.

Participant Privacy in Mobile Crowd Sensing Task Management

Mobile crowd sensing enables a broad range of novel applications by leveraging mobile devices and smartphone users worldwide. While this paradigm is immensely useful, it involves the collection of detailed information from sensors and their carriers (i.e. participants) during task management processes including participant recruitment and task distribution. Such information might compromise participant privacy in various regards by identification or disclosure of sensitive attributes -- thereby increasing vulnerability and subsequently reducing participation. In this survey, we identify different task management approaches in mobile crowd sensing, and assess the threats to participant privacy when personal information is disclosed. We also outline how privacy mechanisms are utilized in existing sensing applications to protect the participants against these threats. Finally, we discuss continuing challenges facing participant privacy-preserving approaches during task management.

Building a RAPPOR with the Unknown: Privacy-Preserving Learning of Associations and Data Dictionaries

Abstract Techniques based on randomized response enable the collection of potentially sensitive data from clients in a privacy-preserving manner with strong local differential privacy guarantees. A recent such technology, RAPPOR [12], enables estimation of the marginal frequencies of a set of strings via privacy-preserving crowdsourcing. However, this original estimation process relies on a known dictionary of possible strings; in practice, this dictionary can be extremely large and/or unknown. In this paper, we propose a novel decoding algorithm for the RAPPOR mechanism that enables the estimation of “unknown unknowns,” i.e., strings we do not know we should be estimating. To enable learning without explicit dictionary knowledge, we develop methodology for estimating the joint distribution of multiple variables collected with RAPPOR. Our contributions are not RAPPOR-specific, and can be generalized to other local differential privacy mechanisms for learning distributions of string-valued random variables.

Why and How to Use Phonelab

While smartphone app marketplaces have enabled large-scale app-level experimentation, medium-scale experimentation with the platform code implementing the app interface and providing core device services remains difficult for academic researchers. But this is where many of the ideas currently being explored by the mobile systems community must be evaluated---including new networking protocols, security and privacy mechanisms, storage abstractions, and energy management strategies. To enable these experiments, we built and are operating PhoneLab, a 175-smartphone testbed where real users run experimental Android platform builds on their primary devices. We are eager to make PhoneLab useful to the mobile systems community. To aid in this effort, this article discusses why PhoneLab might be useful for your research and provides an overview of how to use the testbed, including examples drawn from our group's current projects.

Inference using noisy degrees: Differentially private $\beta$-model and synthetic graphs

The $\beta$-model of random graphs is an exponential family model with the degree sequence as a sufficient statistic. In this paper, we contribute three key results. First, we characterize conditions that lead to a quadratic time algorithm to check for the existence of MLE of the $\beta$-model, and show that the MLE never exists for the degree partition $\beta$-model. Second, motivated by privacy problems with network data, we derive a differentially private estimator of the parameters of $\beta$-model, and show it is consistent and asymptotically normally distributed - it achieves the same rate of convergence as the nonprivate estimator. We present an efficient algorithm for the private estimator that can be used to release synthetic graphs. Our techniques can also be used to release degree distributions and degree partitions accurately and privately, and to perform inference from noisy degrees arising from contexts other than privacy. We evaluate the proposed estimator on real graphs and compare it with a current algorithm for releasing degree distributions and find that it does significantly better. Finally, our paper addresses shortcomings of current approaches to a fundamental problem of how to perform valid statistical inference from data released by privacy mechanisms, and lays a foundational groundwork on how to achieve optimal and private statistical inference in a principled manner by modeling the privacy mechanism; these principles should be applicable to a class of models beyond the $\beta$-model.

Optimal Noise Adding Mechanisms for Approximate Differential Privacy

We study the (nearly) optimal mechanisms in $(\epsilon,\delta)$-approximate differential privacy for integer-valued query functions and vector-valued (histogram-like) query functions under a utility-maximization/cost-minimization framework. We characterize the tradeoff between $\epsilon$ and $\delta$ in utility and privacy analysis for histogram-like query functions ($\ell^1$ sensitivity), and show that the $(\epsilon,\delta)$-differential privacy is a framework not much more general than the $(\epsilon,0)$-differential privacy and $(0,\delta)$-differential privacy in the context of $\ell^1$ and $\ell^2$ cost functions, i.e., minimum expected noise magnitude and noise power. In the same context of $\ell^1$ and $\ell^2$ cost functions, we show the near-optimality of uniform noise mechanism and discrete Laplacian mechanism in the high privacy regime (as $(\epsilon,\delta) \to (0,0)$). We conclude that in $(\epsilon,\delta)$-differential privacy, the optimal noise magnitude and noise power are $\Theta(\min(\frac{1}{\epsilon},\frac{1}{\delta}))$ and $\Theta(\min(\frac{1}{\epsilon^2},\frac{1}{\delta^2}))$, respectively, in the high privacy regime.

Extremal mechanisms for local differential privacy

Local differential privacy has recently surfaced as a strong measure of privacy in contexts where personal information remains private even from data analysts. Working in a setting where both the d...

Security and Privacy Mechanisms for Sensor Middleware and Application in Internet of Things (IoT)

1Department of Computer Education, Teachers College, Jeju National University, 61 Iljudong-ro, Jeju-si, Jeju Special Self-Governing Province 690-781, Republic of Korea 2Division of Computer Science, School of Computing, Clemson University, Calhoun Drive, Clemson, SC 29634, USA 3Department of Human Informatics and Cognitive Sciences, Waseda University, 2-579-15 Mikajima, Tokorozawa-shi, Saitama 359-1192, Japan

The application of a personal identification database and risk management mechanism

In the ICT era and take into account the trend toward NPM, Governance has been urging the e-government to provide “active” and “tailored” services. More importantly, in the aged society resulting from the aging baby boomers, the services of a democratic government need to be more satisfactory and timely when a large part of the citizens in any society become old. A system or database containing personal data by which to identify individuals is indispensable when the e-government wants to deliver services. According to Tsai (2005a: 7)’s research: a method of personal identification is used to distinguish the data specific to personal characteristics such as ID cards, credit cards, GCA, signatures, fingerprint, iris scans, blood vessels, etc. The first part assigns data on personal characteristics on the “carrier,” and the second part makes us of a “live” body. Because the “carrier” may be lost and copied, the second method is less risky from the current perspectives of “duplication” technology. Although a “live” body is better than a “carrier,” considering the method of personal identification, there is another issue that must be considered when the e-government wants to collect personal data that relates to the issue of “privacy,” not to mention the development of a means by which to integrate different kinds of personal “live” data into a database. Therefore, in this research, a literature analysis and the political economy approach are used to explore this issue based on demand and supply, problems of privacy, risks, and management mechanisms because determining a method by which to ensure that personal identification data is not leaked and misused is a very serious issue. This also involves the concept of “risk,” as Beck, Giddens, Lash & Urry (1994) mentioned in their discussion of “Risk Society” in the “Second Modernity.” As a result, risk management is vital, especially the recognition of how risk diverges among people. This essay therefore focuses on the following: how to choose a proper personal identification tool, the establishment of a personal identification database and the creation of a set of safe enquiry mechanisms, which includes both inquiry rights and inquiry methods. This inquiry method contains both public usage and personal usage, based on group decisions and self-decisions, respectively. Furthermore there should be laws established to punish offenders. Thus, this paper not only provides a method for using personal identification to benefit people, but also offer cures intended to prevent risk by using a special enquiry mechanism. Consequently, the e-government will be able to actively provide tailored services and provide welfare to the population. More important, this decision making mechanism model could be widely applied to solve similar kind of problems, especially in the diverged era. Besides, this kind of integrative platforms could be applied to different ministries as a basic infrastructure to achieve the aims of openness, transparency, knowledge accumulation, etc. on the part of e-governments.

Privacy, Trust and Social Network Formation

We study in the laboratory the impact of private information revelation on the selection of partners when forming individual networks. Our experiment combines a “network game” and a “public-good game”. In the network game, individuals decide with whom to form a link with, while in the public-good game they decide whether or not to contribute. The variations in our treatments allow us to identify the effect of revealing one’s name on the probability of link formation. Our main result suggests that privacy mechanisms affect partner selection and the consequent structure of the network: when individuals reveal their real name, their individual networks are smaller but their profits are higher. This indicates that the privacy costs of revealing personal information are compensated by more productive links.