Privacy-preserving Way Research Articles

Reputation and Reward: Two Sides of the Same Bitcoin.

In Mobile Crowd Sensing (MCS), the power of the crowd, jointly with the sensing capabilities of the smartphones they wear, provides a new paradigm for data sensing. Scenarios involving user behavior or those that rely on user mobility are examples where standard sensor networks may not be suitable, and MCS provides an interesting solution. However, including human participation in sensing tasks presents numerous and unique research challenges. In this paper, we analyze three of the most important: user participation, data sensing quality and user anonymity. We tackle the three as a whole, since all of them are strongly correlated. As a result, we present PaySense, a general framework that incentivizes user participation and provides a mechanism to validate the quality of collected data based on the users’ reputation. All such features are performed in a privacy-preserving way by using the Bitcoin cryptocurrency. Rather than a theoretical one, our framework has been implemented, and it is ready to be deployed and complement any existing MCS system.

Black-Box Accumulation: Collecting Incentives in a Privacy-Preserving Way

Abstract We formalize and construct black-box accumulation (BBA), a useful building block for numerous important user-centric protocols including loyalty systems, refund systems, and incentive systems (as, e.g., employed in participatory sensing and vehicle-to-grid scenarios). A core requirement all these systems share is a mechanism to let users collect and sum up values (call it incentives, bonus points, reputation points, etc.) issued by some other parties in a privacy-preserving way such that curious operators may not be able to link the different transactions of a user. At the same time, a group of malicious users may not be able to cheat the system by pretending to have collected a higher amount than what was actually issued to them. As a first contribution, we fully formalize the core functionality and properties of this important building block. Furthermore, we present a generic and non-interactive construction of a BBA system based on homomorphic commitments, digital signatures, and non-interactive zero-knowledge proofs of knowledge. For our construction, we formally prove security and privacy properties. Finally, we propose a concrete instantiation of our construction using Groth-Sahai commitments and proofs as well as the optimal structure-preserving signature scheme of Abe et al. and analyze its efficiency.

EPLQ: Efficient Privacy-Preserving Location-Based Query Over Outsourced Encrypted Data

With the pervasiveness of smart phones, location-based services (LBS) have received considerable attention and become more popular and vital recently. However, the use of LBS also poses a potential threat to user's location privacy. In this paper, aiming at spatial range query, a popular LBS providing information about points of interest (POIs) within a given distance, we present an efficient and privacy-preserving location-based query solution, called EPLQ. Specifically, to achieve privacy-preserving spatial range query, we propose the first predicate-only encryption scheme for inner product range (IPRE), which can be used to detect whether a position is within a given circular area in a privacy-preserving way. To reduce query latency, we further design a privacy-preserving tree index structure in EPLQ. Detailed security analysis confirms the security properties of EPLQ. In addition, extensive experiments are conducted, and the results demonstrate that EPLQ is very efficient in privacy-preserving spatial range query over outsourced encrypted data. In particular, for a mobile LBS user using an Android phone, around 0.9 s is needed to generate a query, and it also only requires a commodity workstation, which plays the role of the cloud in our experiments, a few seconds to search POIs.

A Secure Score Report Implemented in a Spreadsheet without Privacy Concerns

Students’ educational records such as exam score and academic achievement should be considered as sensitive information. According to the federal student privacy law, individual scores should not be posted publicly. If a secure online management system is well-equipped in the school, then it is easy to distribute individual data in a privacy preserving way. However, in general, such a centralized system costs high and is not flexible enough to be used for instant score report after each exam. In this paper, we propose a practical way for an instructor to post students’ individual exam scores online in a single file. By implementing a cryptographic hash function together with score data in an MS Excel file, we demonstrate a score report from which allows each student to retrieve his/her score with his/her own password. Based on our worksheet as a template, it is easy for instructors to write their own score reports without relying on any heavy management systems. Since our score report is implemented in MS Excel worksheets, students find out their scores with Excel program or viewers even in their mobile phones without installing any other programs or apps. Also, it is cryptographically as secure as underlying hash function SHA-256.

Privacy-Preserving Patient-Centric Clinical Decision Support System on Naïve Bayesian Classification.

Clinical decision support system, which uses advanced data mining techniques to help clinician make proper decisions, has received considerable attention recently. The advantages of clinical decision support system include not only improving diagnosis accuracy but also reducing diagnosis time. Specifically, with large amounts of clinical data generated everyday, naïve Bayesian classification can be utilized to excavate valuable information to improve a clinical decision support system. Although the clinical decision support system is quite promising, the flourish of the system still faces many challenges including information security and privacy concerns. In this paper, we propose a new privacy-preserving patient-centric clinical decision support system, which helps clinician complementary to diagnose the risk of patients' disease in a privacy-preserving way. In the proposed system, the past patients' historical data are stored in cloud and can be used to train the naïve Bayesian classifier without leaking any individual patient medical data, and then the trained classifier can be applied to compute the disease risk for new coming patients and also allow these patients to retrieve the top- k disease names according to their own preferences. Specifically, to protect the privacy of past patients' historical data, a new cryptographic tool called additive homomorphic proxy aggregation scheme is designed. Moreover, to leverage the leakage of naïve Bayesian classifier, we introduce a privacy-preserving top- k disease names retrieval protocol in our system. Detailed privacy analysis ensures that patient's information is private and will not be leaked out during the disease diagnosis phase. In addition, performance evaluation via extensive simulations also demonstrates that our system can efficiently calculate patient's disease risk with high accuracy in a privacy-preserving way.

Privacy-Preserving Selective Aggregation of Online User Behavior Data

Tons of online user behavior data are being generated every day on the booming and ubiquitous Internet. Growing efforts have been devoted to mining the abundant behavior data to extract valuable information for research purposes or business interests. However, online users’ privacy is thus under the risk of being exposed to third-parties. The last decade has witnessed a body of research works trying to perform data aggregation in a privacy-preserving way. Most of existing methods guarantee strong privacy protection yet at the cost of very limited aggregation operations, such as allowing only summation, which hardly satisfies the need of behavior analysis. In this paper, we propose a scheme PPSA, which encrypts users’ sensitive data to prevent privacy disclosure from both outside analysts and the aggregation service provider, and fully supports selective aggregate functions for online user behavior analysis while guaranteeing differential privacy. We have implemented our method and evaluated its performance using a trace-driven evaluation based on a real online behavior dataset. Experiment results show that our scheme effectively supports both overall aggregate queries and various selective aggregate queries with acceptable computation and communication overheads.

Efficient and privacy-preserving skyline computation framework across domains

Skyline computation, which returns a set of interesting points from a potentially huge data space, has attracted considerable interest in big data era. However, the flourish of skyline computation still faces many challenges including information security and privacy-preserving concerns. In this paper, we propose a new efficient and privacy-preserving skyline computation framework across multiple domains, called EPSC. Within EPSC framework, a skyline result from multiple service providers will be securely computed to provide better services for the client. Meanwhile, minimum privacy disclosure will be elicited from one service provider to another during skyline computation. Specifically, to leverage the service provider’s privacy disclosure and achieve almost real-time skyline processing and transmission, we introduce an efficient secure vector comparison protocol (ESVC) to construct EPSC, which is exclusively based on two novel techniques: fast secure permutation protocol (FSPP) and fast secure integer comparison protocol (FSIC). Both protocols allow multiple service providers to calculate skyline result interactively in a privacy-preserving way. Detailed security analysis shows that the proposed EPSC framework can achieve multi-domain skyline computation without leaking sensitive information to each other. In addition, performance evaluations via extensive simulations also demonstrate the EPSC’s efficiency in terms of providing skyline computation and transmission while minimizing the privacy disclosure across different domains.

Secure and privacy-aware traffic information as a service in VANET-based clouds

The multitude of applications and services in Vehicular Ad hoc NETwork (VANET) and cloud computing technology that are dreamed of in the near future, are visible today. VANET applications are set to explode in the next couple of years as a result of the advancements in the wireless communication technologies and automobile industry. Nevertheless, it is speculated that future high-end vehicles will potentially under-utilize their on-board storage, computation, and communication resources. This phenomenon sets the ground for the evolution of traditional VANET to a rather more applications-rich paradigm referred to as VANET-based clouds. In this paper, we aim at a framework of VANET-based clouds namely VANET using Clouds (VuC) and propose a novel secure and privacy-aware service referred to as Traffic Information as a Service (TIaaS) atop the cloud computing services stack. TIaaS provides vehicles (more precisely subscribers) with fine-grained traffic information from the cloud as a result of subscribers’ cooperation with the cloud in a privacy-preserving way. Legitimate VANET users share their frequent whereabouts information referred to as Mobility Vectors (MV) with the cloud infrastructure through gateways (static Road Side Units—RSUs and mobile vehicles with 3/4 G Internet). The gateways forward coarse-grained traffic information (MVs) from vehicles to the cloud whereas after processing, cloud modules construct and re-forward the fine-grained traffic information along with location-based warnings to the subscribers based on their physical locations and moving directions. The communication among vehicles, gateways, and the cloud infrastructure is carried out in a privacy-preserving way. More precisely vehicles share their MVs with cloud infrastructure anonymously. The MVs are hard to link to the sender, until and unless necessary, otherwise. Similarly every vehicle receives fine-grained traffic information in a privacy-preserving manner. The proposed TIaaS keeps the adversaries at bay from abusing users’ privacy and/or constructing profiles against targeted users. Moreover for location confidentiality and privacy, we also propose a novel location-based encryption technique that keeps the insider and outsider adversaries at bay from manipulating the contents of the message. Furthermore, the proposed TIaaS preserves conditional privacy and with the help of an efficient revocation mechanism, revocation authorities can revoke any node in case of a dispute. The proposed TIaaS also introduces the thin-client concept for vehicles where most of the time-consuming processing is offloaded to the cloud and the processing resources of the vehicles can be used elsewhere, for instance for the critical safety related applications. More precisely the cloud processes the big traffic data (BTD) and produces timely, decisive, and meaningful results.

PSaD: A Privacy-Preserving Social-Assisted Content Dissemination Scheme in DTNs

Content dissemination is very useful for many mobile applications, like instant messaging, file sharing, and advertisement broadcast, etc. In real life, for various kinds of time-insensitive contents, such as family photos and video clips, the process of content dissemination forms a delay tolerant networks (DTNs). To improve the data forwarding performance in DTNs, several social-based approaches have been proposed, most of which leverage mobile users' social information, including contact history, moving trajectory, and personal profiles as metrics to design routing schemes. However, although the social-based approaches provide better performance, the revealing of mobile users' information apparently compromises their privacy. Moreover, users' contents may only be shared with a particular group of users rather everyone in the system. In this paper, we propose the PSaD: a Privacy-preserving Social-assisted content Dissemination scheme in DTNs. We apply users' verifiable attributes to establish their social relationships in terms of identical attributes in a privacy-preserving way. Besides, to provide the confidentiality of contents, our approach enables users to encrypt contents before the dissemination process, and only allows users who have particular attributes to decrypt them. By trace-driven simulations and experiments, we show the performance, privacy preservation, and efficiency of our proposed scheme.

MuDA: Multifunctional data aggregation in privacy-preserving smart grid communications

Privacy-preserving data aggregation has been widely studied to meet the requirement of timely monitoring electricity consumption of users while protecting individual user’s data privacy in smart grid communications. In this paper, we propose a new multifunctional data aggregation scheme, named MuDA, for privacy-preserving smart grid communications. With MuDA, the smart grid control center can compute multiple statistical functions of users’ data in a privacy-preserving way to provide diversiform services. Moreover, MuDA is also designed to resist differential attacks that most secure data aggregation schemes may suffer. Through detailed security and utility analyses, we demonstrate that MuDA preserves users’ data privacy with acceptable noise rate. In addition, extensive performance evaluations are conducted to illustrate that our MuDA scheme is more efficient than a popular aggregation scheme in terms of communication overhead.

Visualization of trends in subscriber attributes of communities on mobile telecommunications networks

Churn, the decision for a subscriber to leave a provider, is frequently of interest in the telecommunications industry. Previous research provides evidence that social influence can be a factor in mobile telecommunications churn. In our work, presented at ASONAM, we presented a system, called ChurnVis, to visualize the evolution of mobile telecommunications churn and subscriber actions over time. First, we infer a social network from call detail records. Then, we compute components based on an overlay of this social network and churn activity. We compute summaries of the attributes associated with the subscribers and finally, we visualize the components in a privacy preserving way. The system is able to present summaries of thousands of churn components in graphs of hundreds of millions of edges. One of the drawbacks of the original approach was that churn components were sometimes very large, leading to over-aggregation in the summary data. In this extension of the ASONAM paper, we adapt the ChurnVis approach to operate on the output of a community finding algorithm and present new results based on this adaptation.

Investigating the Privacy versus Forwarding Accuracy Tradeoff in OpportunisticInterest-Casting

Many mobile social networking applications are based on a “friend proximity detection” step, according to which two mobile users try to jointly estimate whether they have friends in common, or share similar interests, etc. Performing “friend proximity detection” in a privacy-preserving way is fundamental to achieve widespread acceptance of mobile social networking applications. However, the need of privacy preservation is often at odds with application-level performance of the mobile social networking application, since only obfuscated information about the other user's profile is available for optimizing performance. In this paper, we study for the first time the fundamental tradeoff between privacy preservation and application-level performance in mobile social networks. More specifically, we consider a mobile social networking application for opportunistic networks called interest-casting. In the interest-casting model, a user wants to deliver a piece of information to other users sharing similar interests (“friends”), possibly through multi-hop forwarding. In this paper, we propose a privacy-preserving friend proximity detection scheme based on a protocol for solving the Yao's “Millionaire's Problem”, and we introduce three interest-casting protocols achieving different tradeoffs between privacy and accuracy of the information forwarding process. The privacy versus accuracy tradeoff is analyzed both theoretically, and through simulations based on a real-world mobility trace. The results of our study demonstrate for the first time that privacy preservation is at odds with forwarding accuracy, and that the best tradeoff between these two conflicting goals should be identified based on the application-level requirements.

A lightweight privacy preserving SMS-based recommendation system for mobile users

In this paper, we propose a fully decentralized approach for recommending new contacts in the social network of mobile phone users. With respect to existing solutions, our approach is characterized by some distinguishing features. In particular, the application we propose does not assume any centralized coordination: It transparently collects and processes user information that is accessible in any mobile phone, such as the log of calls, the list of contacts or the inbox/outbox of short messages and exchanges it with other users. This information is used to recommend new friendships to other users. Furthermore, the information needed to perform recommendation is collected and exchanged between users in a privacy preserving way. Finally, information necessary to implement the application is exchanged transparently and opportunistically, by using the residual space in standard short messages occasionally exchanged between users. As a consequence, we do not ask users to change their habits in using SMS.

VehicleView: a universal system for vehicle performance monitoring and analysis based on VANETs

Ranging from large-scale field testing to remote vehicle diagnostics, vehicle performance monitoring and analysis applications rely on the long-term and large-scale collection of in-vehicle sensor data. With wireless vehicular communications, vehicular ad hoc networks provide a promising platform for such applications. In this article, we propose VehicleView to support the large-scale and long-term collection and mining of in-vehicle sensor data. The system architecture and preliminary procedures of VehicleView are proposed based on comprehensive considerations on the common functional, performance, and security requirements of such applications. Supporting various vehicle performance monitoring and analysis applications in a cost-effective, secure, and privacy-preserving way, VehicleView shows great application potential and economic prospects.

Foreword for the special issue of selected papers from the 1st ECML/PKDD Workshop on Privacy and Security issues in Data Mining and Machine Learning

The first Workshop on Privacy and Security issues in Data Mining and Machine Learning (PSDML 2010) was organized on September 24, 2010 at Barcelona, Spain, in conjunction with the European Conference on Machine Learning and Principles and Practice of Knowledge Discovery in Databases (ECML PKDD). Privacy and security-related aspects of data mining and machine learning have been the topic of active research during the last decade due to the existence of numerous applications with privacy and/or security requirements. Privacy issues have become a serious concern due to the increasing collection and sharing of personal d ata for purposes like data publishing or data mining. This has led to the development of privacy-preserving data mining and machine learning methods. More general security considerations arise in applications such as biometric authentication, intrusion detection and malware classification. This has led to the development of adversarial learning algorithms, while parallel work in multi-agent settings and in low regret learning algorithms has revealed interesting interplays between learning and game theory. Although significant research has so far been conducted, we are still far from addressing the numerous theoretical and practical challenges that arise in this domain. Firstly, several emerging research areas in data analysis, decision making and machine learning, require new theoretical and applied techniques for the offering of privacy or security. Secondly, there is an urgent need for learning and mining methods with privacy and security guarantees. Thirdly, there is an emerging demand for security applications such as biometric authentication and malware detection. In all cases, the strong interconnections between data mining and machine learning, cryptography and game theory, create the need for the development of multidisciplinary approaches on adversarial learning and mining problems. The aim of the PSDML workshop was to bring together scientists and practitioners who conduct research on privacy and security issues in data mining and machine learning to discuss the most recent advances in these research areas, identify open problem domains and propose possible solutions. The workshop was organized along four core subjects: (a) data privacy and security issues, (b) theoretical aspects of machine learning for security applications, (c) privacy-preserving data mining, machine learning and applications, and (d) security applications of machine learning. The present special issue contains three extended papers that have been selected among the papers presented at PSDML 2010 focusing mainly on the privacy aspects of data mining and machine learning. The first paper by Manas A. Pathak and Bhiksha Raj is titled 'Efficient Protocols for Principal Eigenvector Computation over Private Data'. It presents an efficient secure multiparty computation protocol for computing the principal eigenvector of a collection of data matrices that belong to semi-honest parties, coordinated by a semi-honest arbitrator. The protocol is augmented with randomization, data padding and oblivious transfer to conceal the information which the parties can learn from the intermediate results. The authors provide an analysis of correctness, security and efficiency of the protocol together with experimental results from a prototype implementation. The second paper by Henrik Grosskreutz, Benedikt Lemmen and Stefan Ruping is titled 'Secure Distributed Subgroup Discovery in Horizontally Partitioned Data'. The paper studies the problem of subgroup discovery and presents new secure protocols which support distributed subgroup discovery on horizontally partitioned data. The authors analyze the properties of their top-1 subgroup discovery protocol and prove that it leaks only little information, namely the size of the database and the share of positive records. They also report experimental results which demonstrate the feasibility of the approach by using a prototype implementation of the protocol. The third paper by Gerald Gavin, Julien Velcin and Philippe Aubertin is titled 'Privacy Preserving Aggregation of Secret Classifiers'. This work considers a number of parties, each having its own dataset, who build a private classifier for predicting a binary class variable. The authors develop protocols which allow combining these private classifiers in a privacy-preserving way in order to improve individual predictions. The aggregation is achieved through a secure computation of linear combinations (weighed votes) over the private classifiers. The proposed protocols are shown to be correct and private against any active polynomial adversary. We believe that the selected papers are a good representative of the research in privacy aspects of data mining and machine learning. We hope that you will enjoy reading them.

EnPassant: anonymous routing for disruption‐tolerant networks with applications in assistive environments

ABSTRACTDisruption‐tolerant networking holds a great deal of potential for making communications easier and more flexible in pervasive assistive environments. However, security and privacy must be addressed to make these communications acceptable with respect to protecting patient privacy. We propose EnPassant, a system for using disruption‐tolerant networking in privacy‐preserving way. EnPassant uses concepts from anonymous communications, re‐routing messages through groups of peer nodes to hide the relation between the sources and destinations. We describe a set of protocols that explore a practical range of tradeoffs between privacy and communication costs by modifying how closely the protocol adheres to the optimal predicted path. We also describe the cryptographic tools needed to facilitate changes in‐group membership. Finally, we present the results of extensive trace‐based simulation experiments that allow us to both compare between our proposed protocols and observe the costs of increasing the number of groups and intermediate nodes in a path. Copyright © 2010 John Wiley & Sons, Ltd.

Location-Aware Mobile Intrusion Detection with Enhanced Privacy in a 5G Context

The paper proposes a location-aware mobile Intrusion Prevention System (mIPS) architecture with enhanced privacy that is integrated in Managed Security Service (MSS). The solution is envisaged in a future fifth generation telecommunications (5G) context with increased but varying bandwidth, a virtualised execution environment and infrastructure that allows threads, processes, virtual machines and storage to be migrated to cloud computing services on demand, to dynamically scale performance and save power. 5G mobile devices will be attractive targets for malicious software, and this threat will in some cases change with location. Mobile devices will store more sensitive information and will also be used to a larger extent for sensitive transactions than they typically do today. In addition, a distributed execution environment in itself gives raise to some new security challenges. In order to handle these security challenges, we have proposed the location-aware mIPS architecture, which benefits from a distributed execution environment where processor intensive services can be outsourced to Cloud hosting providers. The mIPS supports querying location threat profiles in a privacy-preserving way, and ensures that mIPS alerts sent to the the first-line MSS are anonymised. We finally perform an analysis of potential strengths and weaknesses of the proposed approach.

Privacy-preserving similarity evaluation and application to remote biometrics authentication

In this paper, a new method for secure remote biometric authentication preventing the vulnerability of compromised biometrics is presented. The idea is based on a public-key cryptographical protocol, referred as zero-knowledge proof, which allows a user to prove that she has surely a valid biometric data without revealing the data. Hence, the scheme is free from the risk of disclosure of biometric data. Even if a malicious administrator has a privilege access to the private database, it is infeasible for him to learn the private template. This paper studies two well-known definitions, the cosine correlation and the Euclidean distance as similarities of given two feature vectors. Both similarities are defined with some multiplications and additions, which can be performed in privacy-preserving way because of the useful property of public-key commitment scheme, additive homomorphism. The estimation based on the experimental implementation shows that the private Euclidean distance scheme archives better accuracy in terms of false acceptance and rejection than the private cosine coloration scheme, but it requires about $$5/2 n \ell$$overhead to evaluate $$n$$-dimension feature vectors consisting of $$\ell$$-bit integers.

Meta methods for model sharing in personal information systems

This article introduces a methodology for automatically organizing document collections into thematic categories for Personal Information Management (PIM) through collaborative sharing of machine learning models in an efficient and privacy-preserving way. Our objective is to combine multiple independently learned models from several users to construct an advanced ensemble-based decision model by taking the knowledge of multiple users into account in a decentralized manner, for example, in a peer-to-peer overlay network. High accuracy of the corresponding supervised (classification) and unsupervised (clustering) methods is achieved by restrictively leaving out uncertain documents rather than assigning them to inappropriate topics or clusters with low confidence. We introduce a formal probabilistic model for the resulting ensemble based meta methods and explain how it can be used for constructing estimators and for goal-oriented tuning. Comprehensive evaluation results on different reference data sets illustrate the viability of our approach.

Asymptotic theory for differentially private generalized β-models with parameters increasing

Modelling edge weights play a crucial role in the analysis of network data, which reveals the extent of relationships among individuals. Due to the diversity of weight information, sharing these data has become a complicated challenge in a privacy-preserving way. In this paper, we consider the case of the non-denoising process to achieve the trade-off between privacy and weight information in the generalized $\beta$-model. Under the edge differential privacy with a discrete Laplace mechanism, the Z-estimators from estimating equations for the model parameters are shown to be consistent and asymptotically normally distributed. The simulations and a real data example are given to further support the theoretical results.