Privacy Threats Research Articles

Security and privacy problems in voice assistant applications: A survey

Voice assistant applications have become omniscient nowadays. Two models that provide the two most important functions for real-life applications (i.e., Google Home, Amazon Alexa, Siri, etc.) are Automatic Speech Recognition (ASR) models and Speaker Identification (SI) models. According to recent studies, security and privacy threats have also emerged with the rapid development of the Internet of Things (IoT). The security issues researched include attack techniques toward machine learning models and other hardware components widely used in voice assistant applications. The privacy issues include technical-wise information stealing and policy-wise privacy breaches. The voice assistant application takes a steadily growing market share every year, but their privacy and security issues never stopped causing huge economic losses and endangering users' personal sensitive information. Thus, it is important to have a comprehensive survey to outline the categorization of the current research regarding the security and privacy problems of voice assistant applications. This paper concludes and assesses five kinds of security attacks and three types of privacy threats in the papers published in the top-tier conferences of cyber security and voice domain.

Active Oblivious Transfer-Based Location Privacy Preservation Crowdsensing Scheme

As a special type of location-based service (LBS), crowdsensing becomes more prosperous in people’s daily life. However, during the process of task distribution, the publisher’s and workers’ locations will be revealed to each other, and then their personal privacy is violated. So in this paper, in order to cope with the violation of location privacy in crowdsensing and provide privacy preservation service for both entities, an active oblivious transfer-based location privacy preservation crowdsensing scheme (short for AOTC) has been proposed. In this scheme, the oblivious transfer is used to encrypt the range of sensing grid of workers, and then matching sensing grids with the sensing region of the publisher without decryption. During the whole process, the process of location matching and results sending is disposed of by the entity of workers actively, so does not establish any data aggregation that can be used as the point of attack. As a result, the AOTC can guarantee the personal privacy of both entities in crowdsensing cannot be obtained by each other, and guarantee other workers also difficult to obtain the precise location of any workers. In addition, as workers send the sensing result to the publisher actively this scheme can also increase the probability of workers’ participation potentially. At last, the theoretical privacy preservation ability of AOTC is analyzed in the section on security analysis with three types of privacy threats. Then the performance of AOTC is compared with other similar schemes in both privacy preservation and execution efficiency, so in simulation experiments, comparison results with brief analyses will confirm that the AOTC has achieved the desired effect and will further demonstrate the superiority.

Exploring how experienced and unexperienced professionals use a privacy threat modeling methodology

Online Social Networks (OSNs) have become one of the principal technological phenomena of the Web, gaining an eminent popularity among its users. With the growing worldwide expansion of OSN services, people have devoted time and effort to maintaining and manipulating their online identity on these systems. However, the processing of personal data through these networks has exposed users to various privacy threats. Consequently, new solutions need to be developed for addressing the threat scenarios to which a user is potentially exposed. In this sense, this paper proposes PTMOL (Privacy Threat MOdeling Language), an approach for modeling privacy threats in OSN domain. The proposed language aims to support the capture, organization and analysis of specific privacy threats that a user is exposed to when sharing assets in a social application, also enabling the definition of countermeasures to prevent or mitigate the effects of threat scenarios. The first language version has undergone a preliminary empirical study that identified its validity as a modeling language. The results indicate that the use of the language is potentially useful for identifying real privacy threats due to its exploratory and reflexive nature. We expect to contribute to support designers in making more preemptive decisions about user privacy risk, helping them to introduce privacy early in the development cycle of social applications.

A blockchain-based privacy-preserving auditable authentication scheme with hierarchical access control for mobile cloud computing

Blockchain-based authentication mode, a fundamental solution to prevent unauthorized access behavior, gradually becomes a focus in future distributed mobile cloud computing (MCC) services. However, due to the transparent and immutable characteristics of blockchain, users’ access behaviors are facing huge security and privacy threats. Storing the encrypted data on chain is an effective way to address these issues, but access permission confirmation and update in the form of ciphertext is the main bottleneck. To this end, this paper proposes a blockchain-based unified authentication and hierarchical access control scheme for the MCC environment, which provides both privacy protection and auditability. In the proposed scheme, users can access multiple MCC services with different access permissions using a single credential. To protect the privacy of both users and service providers, while still supporting auditability, the data on the public ledger is blinded using Pedersen commitments. Besides, the proposed scheme provides flexible dynamic updating in encrypted form. Theoretical analysis indicates that the proposed scheme can meet various security and privacy requirements in the MCC environment. Compared with related schemes, it has better communication efficiency. Therefore, the proposed scheme is more suitable for the actual MCC environment.

Data Trusted Sharing Delivery: A Blockchain-Assisted Software-Defined Content Delivery Network

The 6G wireless network aims to forge new spectrum, high technical standards of high time and phase synchronization accuracy, and 100% geographic coverage to connect trillions of devices flexibly and efficiently in the future. However, as connectivity increases and applications become novel, it is a challenge to ensure the privacy and security of networks and applications. Blockchain is seen as a promising technology that can improve efficiency, reduce costs, mitigate security and privacy threats, and establish a trusted data-sharing environment. This paper presents a trusted framework based on block chain technology from the perspective of how to build a trusted software-defined content delivery network. As the peer node of blockchain, SDN (Software Defined Network) controller establishes trust between different regions and a wide range of participants, realizing peer autonomy and flexible business orchestration. The two main purposes of the architecture are to enhance the security of network communications and establish trust relationships between entities in different domains. It includes trusted communication based on routing sandbox, service choreography based on block chain, proxy server selection strategy based on MPC (model predictive control) and optimization consensus based on PBFT. Some simulation experiments verify the effectiveness of the theoretical method.

Visually semantic-preserving and people-oriented color image encryption based on cross-plane thumbnail preservation

Uploading images to the cloud has increasingly become a trend, and users have therefore enjoyed many benefits brought by the cloud. On the other hand, these images may carry a wealth of sensitive information, which threatens privacy. Some traditional encryption schemes, in which the original image with rich information is encrypted into the noise-like image, may be able to deal with privacy threats but give up visual usability. Recently, thumbnail-preserving encryption (TPE) was proposed to balance visual usability and privacy but exposes too much information in the encrypted image. Motivated by this, the existing TPE schemes are analyzed in-depth and the scheme to encrypt the image based on cross-plane thumbnail preservation is proposed. A novel architecture of permutation–substitution matching this scheme is constructed, which can preserve the visually semantic information in the encrypted image to balance usability and privacy, and the balance is people-oriented. Meanwhile, a prototype of the scheme is proposed by using a chaotic system, and experiments are conducted using the prototype to verify the excellent performance of this work, e.g., the visual effect is achieved to preserve the semantics, and it becomes the fastest scheme at present om terms of time cost.

UAS-Borne Radar for Autonomous Navigation and Surveillance Applications

The autonomous navigation of UAS requires, among others, detect-and-avoid capability as a prerequisite for enabling wide-ranging applications, including the transportation of goods and people. This article presents the design, implementation, and experimental results of a UAS-borne radar system detecting drones. The applications of the proposed system include not only detect-and-avoid systems for safe and autonomous navigation of unmanned aircraft systems but also airborne surveillance of malicious drones in controlled or restricted airspace for mitigating security and privacy threats. The system performance in terms of maximum detection range is evaluated through field tests. The experimental results show that the proposed UAS-borne radar can detect a DJI Phantom 4 and a DJI Matrice 600 Pro at a maximum distance of 440 and 500 meters, respectively. The article also provides insights into the system implementation and integration aspects, discusses future research direction, and stresses the need for standardization efforts to benchmark the required performance levels for UAS-borne radars.

Preserving Privacy for Distributed Genome-Wide Analysis Against Identity Tracing Attacks

Genome-wide analysis has demonstrated both health and social benefits. However, large scale sharing of such data may reveal sensitive information about individuals. One of the emerging challenges is identity tracing attack that exploits correlations among genomic data to reveal the identity of DNA samples. In this paper, we first demonstrate that the adversary can narrow down the sample&#x2019;s identity by detecting his/her genetic relatives and quantify such privacy threat by employing a Shannon entropy-based measurement. For example, we exemplify that when the dataset size reaches 30&#x0025; of the population, for any target from that population, the uncertainty of the target&#x2019;s identity is reduced to merely 2.3 bits of entropy (i.e., the identity is pinned down within 5 people). Direct application of existing approaches such as differential privacy (DP), secure multiparty computation (MPC) and homomorphic encryption (HE) may not be applicable to this challenge in genome-wide analysis because of the compromise on utility (i.e., accuracy or efficiency). Towards addressing this challenge, this paper proposes a framework named <small><inline-formula><tex-math notation="LaTeX">$\upsilon$</tex-math></inline-formula>Frag</small> to facilitate privacy-preserving data sharing and computation in genome-wide analysis. <small><inline-formula><tex-math notation="LaTeX">$\upsilon$</tex-math></inline-formula>Frag</small> mitigates privacy risks by using a vertical fragmentation to disrupt the genetic architecture on which the adversary relies for identity tracing without sacrificing the capability of genome-wide analysis. We theoretically prove that it preserves the correctness of the primitive functionalities and algorithms ranging from basic summary statistics to advanced neural networks. Our experiments demonstrate that <small><inline-formula><tex-math notation="LaTeX">$\upsilon$</tex-math></inline-formula>Frag</small> outperforms secure multiparty computation (MPC) and homomorphic encryption (HE) protocols, with a speedup of more than 221x for training neural networks, and also traditional non-private algorithms and a state-of-the-art noise-based differential privacy (DP) solution in most settings.

Privacy threats and vulnerabilities: Reinvent your privacy engineering practices and win

The ever-changing paradigm of data generation, storage and consumption has led to the exponential growth in data incidents. The year 2021 has been the year of highest data breaches exposing personal information of millions of users. The root cause of these data breaches ranges from vulnerabilities in unprotected databases, misconfigurations in cloud systems, ransomware, malware or slip from marketing service providers. Most organisations have strong privacy organisational functions that are compliance-focused; however, they lack privacy engineering functions focused on embedding privacy into the engineering practices. This paper makes recommendations about privacy engineering best practices that can help prevent, detect and mitigate privacy threats and vulnerabilities and provides information about appropriate privacy and security controls to mitigate the privacy risks. It also provides a practice lab section which serves as a practical playground to apply the above concepts.

SMART CONTRACT IMPLEMENTATION USING BLOCKCHAIN IOV FOR VEHICLE ACCIDENT INVESTIGATION

Recent advancements in digital accident forensics, a conceptual evidence management paradigm developed using smart contracts and interplanetary file system in iov. This paper comprehensively summarizes the Smart contract implementation blockchain framework for vehicle accident investigation in IoV. We investigate comparing some review papers to find the classification of the smart contract. Using blockchain, evidence management provides an immutable and auditable method for investigating and resolving accident cases. Precisely we first investigate the security and privacy threats; therefore, Smart contracts provide effective access control for proof data and reports. On both the public and private Ethereum blockchains, the cost of setting up and executing transactions using smart contracts is assessed. However, we utilized the Inter Planetary File System most efficiently while minimizing memory and execution costs. Finally, we draw open research directions for building future digital-proof management.

SUMO Simulations for Federated Learning in Communicating Autonomous Vehicles

In transportation, a vehicle's route is one of the most private information. However, to mutually learn some phenomena in a city, for example, parking lot occupancies, we might have to reveal information about it. In this paper, we focus on assessing the privacy loss in a vehicular federated machine learning system. For the analysis, we used the Monaco SUMO Traffic Scenario (MoST). We also used the simulation inputs as statistical data to calculate privacy loss metrics. Results show that a vehicular federated machine learning system may pose a smaller privacy threat than individual learning, but its performance is lower compared to a centralized learning approach.&#x0D; Due to the vast amount of data and processing time, we also describe a method to build a Docker image of SUMO together with a software client-server architecture for SUMO-based learning systems on multiple computers.

A survey on Deep Learning Face Synthesis and Animation Techniques Used in Deepfake

From big data analytics to computer vision and human-level control, deep learning has been effectively applied to a wide range of complicated challenges. However, these same deep learning advancements have also been used to develop malicious software that threatens individuals' personal data, democratic processes, and even national security. Apps backed by deep learning have lately appeared, with deepfake being one of the most notable. Deepfake algorithms can create fake images and videos that humans cannot distinguish them from authentic ones. One of the fields that deep learning accomplished major success is face synthesis and animation generation. On the other hand, it can create unethical software called deepfake that presents a severe privacy threat or even a huge security risk that can affect innocent people. This work introduces the most recent algorithms and methods used in deepfake. In addition, it provides a brief explanation of the principles that underpin these technologies and facilitates the development of this field by identifying the challenges and scopes that require further investigation in the future. Index Terms— deep learning; face synthesis; deepfake; face animation; motion transfer.

Privacy Threats in Facial Recognition-Based Identity Verification

Facial recognition technology has gained significant prominence in identity verification systems, providing convenience and security in various domains. However, the widespread adoption of this technology also raises significant concerns regarding privacy threats. This paper presents a comprehensive privacy threat model specifically designed for identity verification based on facial recognition. The model encompasses potential adversary objectives, such as unauthorized access, identity theft, and profiling, and identifies specific privacy threats, including unauthorized data access, biometric data misuse, tracking and surveillance, re-identification attacks, discrimination and bias, and data retention and sharing. To mitigate these threats, the paper proposes several mitigation measures, such as informed consent, transparent data handling, secure data storage and transmission, minimization of data collection, regular audits and assessments, and ethical considerations. By providing a holistic view of privacy threats in facial recognition-based identity verification, this model aims to guide researchers, practitioners, and policymakers in developing and implementing effective privacy protection mechanisms in this rapidly evolving technological landscape

Federated Generative Model on Multi-Source Heterogeneous Data in IoT

The study of generative models is a promising branch of deep learning techniques, which has been successfully applied to different scenarios, such as Artificial Intelligence and the Internet of Things. While in most of the existing works, the generative models are realized as a centralized structure, raising the threats of security and privacy and the overburden of communication costs. Rare efforts have been committed to investigating distributed generative models, especially when the training data comes from multiple heterogeneous sources under realistic IoT settings. In this paper, to handle this challenging problem, we design a federated generative model framework that can learn a powerful generator for the hierarchical IoT systems. Particularly, our generative model framework can solve the problem of distributed data generation on multi-source heterogeneous data in two scenarios, i.e., feature related scenario and label related scenario. In addition, in our federated generative models, we develop a synchronous and an asynchronous updating methods to satisfy different application requirements. Extensive experiments on a simulated dataset and multiple real datasets are conducted to evaluate the data generation performance of our proposed generative models through comparison with the state-of-the-arts.

A Multifactor Ring Signature based Authentication Scheme for Quality Assessment of IoMT Environment in COVID-19 Scenario

The quality of the healthcare environment has become an essential factor for healthcare users to access quality services. Smart healthcare systems use the Internet of Medical Things (IoMT) devices to capture patients’ health data for treatment or diagnostic purposes. This sensitive collected patient data is shared between the different stakeholders across the network to provide quality services. Due to this, healthcare systems are vulnerable to confidentiality, integrity and privacy threats. In the COVID-19 scenario, when collaborative medical consultation is required, the quality assessment of the framework is essential to protect the privacy of doctors and patients. In this paper, a ring signature-based anonymous authentication and quality assessment scheme is designed for collaborative medical consultation environments for quality assessment and protection of the privacy of doctors and patients. This scheme also uses a new KMOV Cryptosystem to ensure the quality of the network and protect the system from different attacks that hamper data confidentiality.

The impact of security and privacy threat modeling on blockchain-enabled-electronic voting system

Blockchain is a decentralized, distributed ledger that records transactions between two parties. A blockchain-based software system is a new and innovative approach to software engineering that uses blockchain technology. This approach has several advantages over traditional software engineering approaches, including improved security and transparency. The most common software engineering approaches are waterfall, agile and hybrid models. Each of these has its strengths and weakness. A blockchain-based system has the advantage of being more secure and transparent than any of these approaches. It also can track changes more accurately, which can improve quality control. Blockchain technologies have incredible potential but also have some problems. One problem is security and privacy issues, which brings into question the resilience of existing security and trust mechanisms. The distributed application (dApp) framework for the proposed electronic voting system is built with the help of blockchain technology in this proposal. As a result, fewer crimes has committed against sensitive data during the electoral process because of immutability, transparency and privacy. Ganache, Metamask and hashing algorithms are used to develop the dApp. The paper's strengths lie in its ability to create and analyze threat models for blockchain-enabled-electronic voting systems and to identify the types of threats using Microsoft STRIDE.

A privacy threat model for identity verification based on facial recognition

The proliferation of different types of photographic and video cameras makes it relatively simple and non-intrusive to acquire facial fingerprints with sufficient quality to perform individuals’ identity verification. In most democratic societies, a debate has been occurring regarding using such techniques in different application domains. Discussions usually revolve around the tradeoffs between utility (security in access control, mobile phone unlocking, payment processing, etc.), usability or economic gain and risks to citizens’ rights and freedoms (privacy) or ethics. This paper identifies the common aspects of different solutions for identity verification based on facial recognition techniques within different application domains. It then performs a privacy threat modelling based on these common aspects to identify the most critical risk factors and a minimum set of safeguards to be considered for their management.

Cybersecurity Misinformation Detection on Social Media: Case Studies on Phishing Reports and Zoom’s Threat

Prior work has extensively studied misinformation related to news, politics, and health, however, misinformation can also be about technological topics. While less controversial, such misinformation can severely impact companies’ reputations and revenues, and users’ online experiences. Recently, social media has also been increasingly used as a novel source of knowledgebase for extracting timely and relevant security threats, which are fed to the threat intelligence systems for better performance. However, with possible campaigns spreading false security threats, these systems can become vulnerable to poisoning attacks. In this work, we proposed novel approaches for detecting misinformation about cybersecurity and privacy threats on social media, focusing on two topics with different types of misinformation: phishing websites and Zoom’s security &amp; privacy threats. We developed a framework for detecting inaccurate phishing claims on Twitter. Using this framework, we could label about 9% of URLs and 22% of phishing reports as misinformation. We also proposed another framework for detecting misinformation related to Zoom’s security and privacy threats on multiple platforms. Our classifiers showed great performance with more than 98% accuracy. Employing these classifiers on the posts from Facebook, Instagram, Reddit, and Twitter, we found respectively that about 18%, 3%, 4%, and 3% of posts were misinformation. In addition, we studied the characteristics of misinformation posts, their authors, and their timelines, which helped us identify campaigns.

A Review on Security and Privacy of Smart Cities

Smart cities are expected to provide better services to citizens and urban environments, and to enhance the quality of their daily life. By utilizing smart technologies, Smart cities can deal with the emerging urbanization issues and promote sustainable development. Despite this, security and privacy issues are considered an obstacle which can impact the success of such emerging technologies and smart systems in smart cities. However, to fully leverage the benefits of smart systems and promote their further development, it's imperative to understand the security and privacy threats that weaken systems and make them vulnerable to be attacked. Motivated by these factors, this literature review provides a useful comprehensive combination of related literatures on smart cities challenges by technically analyzing various results. This review also discusses several components of smart cities such as transportation, governance, people, living, economy, innovative architecture, and associated knowledge and ideas. This paper also aims to critically examine various existing and deploying security and privacy protection methods for smart cities. Finally, we highlight several unresolved challenges and suggest future research possibilities and current security requirements, which may help building secured, privacy-protected, and stable smart cities.

Patient Monitoring System using Blockchain and IoT Technology

Background: Recently, the construction of a smart city has accelerated due to developing technologies such as 5G and the Internet of things (IoT). The IoT is gaining access day by day in the area of the remote monitoring system. Along with smart city concepts, intelligent patient monitoring systems and intelligent health are being developed. Combining the two, here, patients have a nurse navigation system and a doctor emergency call system. IoT improves the effectiveness of medical equipment by providing real-time monitoring of patient health, in which sensors collect data from patients with less human errors. In IoT, the patient's parameters get transmitted through medical devices via a gateway to the centralized system, where it is stored and analyzed. Objective: In this paper, we have proposed an intelligent patient monitoring system for monitoring the patients' health condition automatically through sensors-based connected links. The system is more intelligent that it can be able to detect the critical condition of a patient by processing sensor data and instantly provides a notification to doctors/nurses as well as hospital in-charge personnel. The doctors and nurses get benefited from this system by observing their corresponding patients remotely without visiting to the particular seat of the patient. Methods: An idea has been proposed to use the centralized processing of IoT devices along with the rigid security and privacy of the classical blockchain to overcome the computation expense challenge with blockchain and the security and privacy threat of the IoT systems. We are developing a system in the field of medical care to enhance the functioning of Medicare systems and provide patients with more ease and hassle-free procedures of the Medicare system, i.e., hospitals, laboratories, dispensaries, chemists, druggists, etc. Results: This model helps in getting rid of this issue faced by all of us. There is a separate blockchain of different verified medical stores linked within the networks, which will be managed by the central hub based on their ratings, reviews, and stock availability. Conclusion: The exponential expansion of blockchain technology in healthcare is also astonishing and has a tremendous impact on the industry. By assessing prior activities, the idea is proposed to use a centralized database system with more privacy and security to gap between the healthcare industry and blockchain technologies has been addressed in this paper.