Privacy Vulnerabilities Research Articles

Highly Secured Blockchain Based Electronic Voting System Using SHA3 and Merkle Root

Over the course of time, electronic voting has evolved as a substitute for paper ballot voting to decrease redundancies and inconsistencies. Due to the many security and privacy vulnerabilities experienced over time, the past results of e-voting in the last three decades indicate that it has not been very successful. All cryptocurrencies are actually based on block chain. Block chain is based on the principle of distribution and decentralization. It is a continuous and continuously growing ledger that holds, in a secure, chronological and immutable way, a permanent record of all the transactions that have taken place. Value in a block chain can be anything. In the case of cryptocurrencies, it takes the meaning of money or currency. While in a game it takes the form of points or score. The value can take the form of a vote or a ballot while e-voting. The blockchain can be used in this article to pass votes between two parties. In our case, the electorate is one party and the candidate who earns the vote is the other. Without having a controlling central authority body, the block chain can be implemented in a more stable manner in mass electoral voting practise. A voting system that uses a more stable, tamper-proof block chain (immutable to voting modifications either by other voters or by any third party) and is cost-effective.

LPGA: Location Privacy-Guaranteed Offloading Algorithm in Cache-Enabled Edge Clouds

The computation offloading, where Internet of Things (IoT) devices transfers their task to an external cloud, has several advantages such as low energy consumption of IoT devices and fast response time. To maximize these advantages, IoT devices can exploit the nearest edge cloud. However, frequent offloadings to the nearest edge cloud can cause a location privacy vulnerability due to the proximity of the edge cloud from IoT devices, which is a critical issue in smart city IoT applications. To address this problem, we propose a location privacy-guaranteed offloading algorithm (LPGA) in cache-enabled edge cloud environments. In LPGA, an IoT device decides where to offload the task (i.e., edge cloud or central cloud) with the consideration of the privacy level on its location and the cache hit probability. To minimize the generated traffic volume while maintaining low energy outage probability and providing a sufficient level of location privacy, a constrained Markov decision process (CMDP) problem is developed and it is converted into an equivalent linear programming (LP) model to achieve the optimal policy for offloading. Evaluation results demonstrate LPGA can reduce the traffic volume up to 39 percent compared to a central cloud-based offloading scheme while maintaining the energy outage probability below a certain level and providing required location privacy level.

Smart Home Voice Assistants: A Literature Survey of User Privacy and Security Vulnerabilities

Intelligent voice assistants are internet-connected devices, which listen to their environment and react to spoken user commands in order to retrieve information from the internet, control appliances in the household, or notify the user of incoming messages, reminders, and the like. With their increasing ubiquity in smart homes, their application seems only limited by the imagination of developers, who connect these off-the-shelf devices to existing apps, online services, or appliances. However, since their inherent nature is to observe the user in their home, their ubiquity also raises concern of security and user privacy. To justify the trust placed into the devices, the devices must be secure from unauthorized access and the back-end infrastructure tasked with speech-to-text analysis, command interpretation, and connection to other services and appliances must maintain confidentiality of data. To investigate existing possible vulnerabilities, approaches to mitigate them, as well as general considerations in this emerging field, we supplement the findings of a recent study with results from a systematic literature review. We were able to compile a list of six main types of user privacy vulnerabilities, partially confirming previous findings, but also finding additional issues. We discuss these vulnerabilities, their associated attack vectors, and possible mitigations users can take to protect themselves.

Towards a secure ITS: Overview, challenges and solutions

Intelligent Transportation Systems (ITS), the heart of the new revolution of smart transport, has evolved from the well-known Vehicular Ad hoc Networks (VANETs) to become the Internet of Vehicles (IoV). In fact, the increase in the number of vehicles and the newly born technologies have stimulated the new Internet of Vehicles (IoV) or the Internet of Cars. In general, ITS aims at ensuring better traffic efficiency and reducing road accidents. However, due to different limitations and issues, these systems suffer from different security and privacy vulnerabilities. In fact, they are both vulnerable to various types of security and privacy attacks that may result in life-endangering situations. As a result, several solutions were presented to achieve the required levels of security and confidentiality. In this paper, an overview of ITS is presented stating the reasons behind the evolution from Vanet to IoV. Then, the main threats/attacks that threaten ITS are classified according to their (1) security impact and according to the (2) network layer(s) they affect. Solutions for each attack are also well presented. In addition, a security and performance evaluation and summary tables are presented to provide an overview of these surveyed solutions.

ConGradetect: Blockchain-based detection of code and identity privacy vulnerabilities in crowdsourcing

Abstract At present, various types of code vulnerabilities lead to a huge workload of detection. Although multi-party cooperation detection methods can be applied to improve efficiency, common crowdsourcing models are difficult to guarantee the privacy of code and identity. We design a code and identity privacy vulnerability crowdsourcing detection system ConGradetect. The system is built on a blockchain and solves code privacy issues, identity privacy issues, and reward preemption issues during the crowdsourcing detection process of vulnerabilities. In ConGradetect, users have a dynamic fake identity, which ensures that the identity of the user is not exposed, thereby avoiding the problem of information exposure caused by data accumulation. In the meantime, ConGradetect uses a local code granulation tool to perform off-line code cutting for task publishers, and uses proxy re-encryption to allocate task code blocks to ensure that the complete original code is only known to the code owner. When the task is received, a trusted key conversion is performed using smart contract. Further, we propose a method for anonymous verification of the binding relationship between task and user to prevent reward preemption and ensure that task performers can obtain corresponding legal benefits. Finally, we run the system on the Ethereum blockchain and test its performance. After testing, the feasibility of ConGradetect is proved.

Intelligent Adversary Placements for Privacy Evaluation in VANET

Safety applications in Vehicular Ad-hoc Networks (VANETs) often require vehicles to share information such as current position, speed, and vehicle status on a regular basis. This information can be collected to obtain private information about vehicles/drivers, such as home or office locations and frequently visited places, creating serious privacy vulnerabilities. The use of pseudonyms, rather than actual vehicle IDs, can alleviate this problem and several different Pseudonym Management Techniques (PMTs) have been proposed in the literature. These PMTs are typically evaluated assuming a random placement of attacking stations. However, an adversary can utilize knowledge of traffic patterns and PMTs to place eavesdropping stations in a more targeted manner, leading to an increased tracking success rate. In this paper, we propose two new adversary placement strategies and study the impact of intelligent adversary placement on tracking success using different PMTs. The results indicate that targeted placement of attacking stations, based on traffic patterns, road type, and knowledge of PMT used, can significantly increase tracking success. Therefore, it is important to take this into consideration when developing PMTs that can protect vehicle privacy even in the presence of targeted placement techniques.

The Current State of Research, Challenges, and Future Research Directions of Blockchain Technology in Patient Care: Systematic Review.

BackgroundBlockchain offers a promising new distributed technology to address the challenges of data standardization, system interoperability, security, privacy, and accessibility of medical records.ObjectiveThe purpose of this review is to assess the research on the use of blockchain technology for patient care and the associated challenges and to provide a research agenda for future research.MethodsThis review followed the Preferred Reporting Items for Systematic Reviews and Meta-Analysis guidelines. We queried the Cumulative Index of Nursing and Allied Health Literature (CINAHL), PubMed, Excerpta Medica dataBASE (EMBASE), and Web of Science databases for peer-reviewed research articles published up to December 2019 that examined the implementation of blockchain technology in health care settings. We identified 800 articles from which we selected 70 empirical research articles for a detailed review.ResultsBlockchain-based patient care applications include medical information systems, personal health records, mobile health and telemedicine, data preservation systems and social networks, health information exchanges and remote monitoring systems, and medical research systems. These blockchain-based health care applications may improve patient engagement and empowerment, improve health care provider access to information, and enhance the use of health care information for medical research.ConclusionsBlockchain health information technology (HIT) provides benefits such as ensuring data privacy and security of health data, facilitating interoperability of heterogeneous HIT systems, and improving the quality of health care outcomes. However, barriers to using blockchain technology to build HIT include security and privacy vulnerabilities, user resistance, high computing power requirements and implementation costs, inefficient consensus algorithms, and challenges of integrating blockchain with existing HIT. With 51% of the research focused on medical information systems such as electronic health record and electronic medical record, and 53% of the research focused on data security and privacy issues, this review shows that HIT research is primarily focused on the use of blockchain technologies to address the current challenges HIT faces. Although Blockchain presents significant potential for disrupting health care, most ideas are in their infancy.

Adoption of AI-integrated CRM system by Indian industry: from security and privacy perspective

Purpose The purpose of this study is to make an attempt to identify the factors responsible for the adoption of an artificial intelligence (AI)-integrated customer relationship management (CRM) system in Indian organizations with a special focus on security and privacy issues. Design/methodology/approach This study was conducted for the identification of factors responsible for the adoption of the AI-integrated CRM system in Indian organizations focusing attention on security and privacy perspective. For this, the adoption theories and models have been studied. The literature available in this context has also been studied with a focus on security and privacy issues. After the initial study, few hypotheses have been formulated and a conceptual model has been developed. These hypotheses were validated with the help of statistical tools by conducting sample survey with 324 usable responses against 36 questionnaires. Findings The results of this study highlight that of the eight hypotheses conceptually formulated, one hypothesis was not supported as is evident from the application of statistical analysis. This is the influence of perceived ease of use on attitude of the stakeholders intending to use the AI-integrated CRM system in Indian organizations. The results also transpire that the model so provided has achieved 87% explanative power. Research limitations/implications The model so provided has taken the help of the technological acceptance model. It has also used the issues circumscribing menace of security and privacy vulnerabilities. Consideration of the technological acceptance model and aspects of issues of security and privacy has enriched the model rendering its explanative power to 87%. Practical implications The model is simple. Practitioners can execute this model without having any complexity. The policymakers could also get inputs from the model, as it has focused specially on security and privacy issues that could help to enhance the trust of the potential users. Originality/value Not many studies are found covering the adoption of the AI-integrated CRM system by Indian organizations with a special focus on security and privacy aspects. In this light, this study is a novel attempt.

A survey of subscription privacy on the 5G radio interface - The past, present and future

End-user privacy in mobile telephony systems is nowadays of great interest because of the envisaged hyper-connectivity and the potential of the unprecedented services (virtual reality, machine-type communication, vehicle-to-everything, IoT, etc.) being offered by the new 5G system. This paper reviews the state of subscription privacy in 5G systems. As the work on 5G Release 15 – the first full set of 5G standards – has recently been completed, this seems to be an appropriate occasion for such a review. The scope of the privacy study undertaken is limited to the wireless part of the 5G system which occurs between the service provider’s base station and the subscriber’s mobile phone. Although 5G offers better privacy guarantees than its predecessors, this work highlights that there still remain significant issues which need rectifying. We undertook an endeavor to (i) compile the privacy vulnerabilities that already existed in the previous mobile telephony generations. Thereafter, (ii) the privacy improvements offered by the recently finalized 5G standard were aggregated. Consequently, (iii) we were able to highlight privacy issues from previous generations that remain unresolved in 5G Release 15. For completeness, (iv) we also explore new privacy attacks which surfaced after the publication of the 5G standard. To address the identified privacy gaps, we also present future research directions in the form of proposed improvements.

Big Data Computing: Privacy Risks Management

With the evolving technologies and data exchanges amongst borders, big data privacy issues have become the heated discussion. The big data storage and analysis occurs by cloud infrastructures which pose challenges of security and privacy. This research explains the recent privacy concerns, risks and risk mitigation strategies in heavy data computational environments. The paper has successfully produced the state of art on big data risk management, privacy open research questions, vulnerabilities and threats encountered. The paper provides a deep research on big data analytics, tools, features, users and challenges in big data computing. This state of art constructs a useful case for building new privacy models in industrial big data computing in future.

θ-Sensitive k-Anonymity: An Anonymization Model for IoT based Electronic Health Records

The Internet of Things (IoT) is an exponentially growing emerging technology, which is implemented in the digitization of Electronic Health Records (EHR). The application of IoT is used to collect the patient’s data and the data holders and then to publish these data. However, the data collected through the IoT-based devices are vulnerable to information leakage and are a potential privacy threat. Therefore, there is a need to implement privacy protection methods to prevent individual record identification in EHR. Significant research contributions exist e.g., p+-sensitive k-anonymity and balanced p+-sensitive k-anonymity for implementing privacy protection in EHR. However, these models have certain privacy vulnerabilities, which are identified in this paper with two new types of attack: the sensitive variance attack and categorical similarity attack. A mitigation solution, the θ -sensitive k-anonymity privacy model, is proposed to prevent the mentioned attacks. The proposed model works effectively for all k-anonymous size groups and can prevent sensitive variance, categorical similarity, and homogeneity attacks by creating more diverse k-anonymous groups. Furthermore, we formally modeled and analyzed the base and the proposed privacy models to show the invalidation of the base and applicability of the proposed work. Experiments show that our proposed model outperforms the others in terms of privacy security (14.64%).

User Privacy in Smart Systems: Recent Findings and Countermeasures

Internet of Things (IoT) is a technology that has been readily accepted by users due to the promise of a more exciting and smarter way to carry out their daily lives. Invasive domains like entertainment, lifestyle, and healthcare see the presence of aesthetically and efficient smart devices. But with such a presence, critical user information is being shared over the network and is easily available for misuse. The possibility of profiling a user's behaviour and traceability of service data to a user demographic is viewed as a privacy loss. Such loss of privacy not only infringes on basic rights but is also a breach of user's trust placed in the smart devices. In this paper, we have discussed privacy vulnerabilities typical to the layers of an IoT application and those identified by widely accepted standards like OWASP and BITAG. We have also analyzed the common software security weaknesses which could result in unauthorized access to system privileges or information. Our study discovered that information disclosure makes up the majority of such weaknesses, followed by privileges, permissions and access control weaknesses and credential management. Individual users make up the majority of targets due to their lack of awareness. In agreement with this finding, recent years have seen large scale attacks that were carried out through compromised devices installed in smart homes and small scale premises. Through identification of privacy risks and potential victim characteristics, it could become easier to lay down countermeasures and remedial actions.

Identifying the vulnerabilities of bitcoin anonymous mechanism based on address clustering

The anonymity mechanism of bitcoin is favored by the society, which promotes its usage and development. An adversary should not be able to discover the relation between bitcoin addresses and bitcoin users to ensure effective privacy. However, the relation among bitcoin transactions can be used to analyze the bitcoin privacy information, which seriously jeopardizes the bitcoin anonymity. Herein, we describe the vulnerabilities associated with the anonymity mechanism of bitcoin, including the relation among bitcoin addresses and the relation among bitcoin users. Further, we demonstrate that the existing methods do not guarantee the comprehensiveness, accuracy, and efficiency of the analysis results. We propose a heuristic clustering method to judge the relation among bitcoin addresses and employ the Louvain method to discover the relation among bitcoin users. Subsequently, we construct an address-associated database of historical transactions and implement real-time updates. Extensive experiments are used to demonstrate the comprehensiveness, accuracy, and efficiency of the proposed scheme. Specifically, the proposed scheme reveals the privacy vulnerability associated with the blockchain technology. We expect that our scheme can be applied to improve the blockchain technology.

“I just shared your responses”

Conversational agents are increasingly becoming integrated into everyday technologies and can collect large amounts of data about users. As these agents mimic interpersonal interactions, we draw on communication privacy management theory to explore people's privacy expectations with conversational agents. We conducted a 3x3 factorial experiment in which we manipulated agents' social interactivity and data sharing practices to understand how these factors influence people's judgments about potential privacy violations and their evaluations of agents. Participants perceived agents that shared response data with advertisers more negatively compared to agents that shared such data with only their companies; perceptions of privacy violations did not differ between agents that shared data with their companies and agents that did not share information at all. Participants also perceived the socially interactive agent's sharing practices less negatively than those of the other agents, highlighting a potential privacy vulnerability that users are exposed to in interactions with socially interactive conversational agents.

Comments on “Dropping Activation Outputs with Localized First-Layer Deep Network for Enhancing User Privacy and Data Security”

Inference based on deep learning models is usually implemented by exposing sensitive user data to the outside models, which of course gives rise to acute privacy concerns. To deal with these concerns, Dong et al. recently proposed an approach, namely the dropping-activation-outputs (DAO) first layer. This approach was claimed to be a non-invertible transformation, such that the privacy of user data could not be compromised. However, In this paper, we prove that the DAO first layer, in fact, can generally be inverted, and hence fails to preserve privacy. We also provide a countermeasure against the privacy vulnerabilities that we examined.

Complementing IoT Services Through Software Defined Networking and Edge Computing: A Comprehensive Survey

Millions of sensors continuously produce and transmit data to control real-world infrastructures using complex networks in the Internet of Things (IoT). However, IoT devices are limited in computational power, including storage, processing, and communication resources, to effectively perform compute-intensive tasks locally. Edge computing resolves the resource limitation problems by bringing computation closer to the edge of IoT devices. Providing distributed edge nodes across the network reduces the stress of centralized computation and overcomes latency challenges in the IoT. Therefore, edge computing presents low-cost solutions for compute-intensive tasks. Software-Defined Networking (SDN) enables effective network management by presenting a global perspective of the network. While SDN was not explicitly developed for IoT challenges, it can, however, provide impetus to solve the complexity issues and help in efficient IoT service orchestration. The current IoT paradigm of massive data generation, complex infrastructures, security vulnerabilities, and requirements from the newly developed technologies make IoT realization a challenging issue. In this research, we provide an extensive survey on SDN and the edge computing ecosystem to solve the challenge of complex IoT management. We present the latest research on Software-Defined Internet of Things orchestration using Edge (SDIoT-Edge) and highlight key requirements and standardization efforts in integrating these diverse architectures. An extensive discussion on different case studies using SDIoT-Edge computing is presented to envision the underlying concept. Furthermore, we classify state-of-the-art research in the SDIoT-Edge ecosystem based on multiple performance parameters. We comprehensively present security and privacy vulnerabilities in the SDIoT-Edge computing and provide detailed taxonomies of multiple attack possibilities in this paradigm. We highlight the lessons learned based on our findings at the end of each section. Finally, we discuss critical insights toward current research issues, challenges, and further research directions to efficiently provide IoT services in the SDIoT-Edge paradigm.

Systematic Review on Security and Privacy Requirements in Edge Computing: State of the Art and Future Research Opportunities

Edge computing is a promising paradigm that enhances the capabilities of cloud computing. In order to continue patronizing the computing services, it is essential to conserve a good atmosphere free from all kinds of security and privacy breaches. The security and privacy issues associated with the edge computing environment have narrowed the overall acceptance of the technology as a reliable paradigm. Many researchers have reviewed security and privacy issues in edge computing, but not all have fully investigated the security and privacy requirements. Security and privacy requirements are the objectives that indicate the capabilities as well as functions a system performs in eliminating certain security and privacy vulnerabilities. The paper aims to substantially review the security and privacy requirements of the edge computing and the various technological methods employed by the techniques used in curbing the threats, with the aim of helping future researchers in identifying research opportunities. This paper investigate the current studies and highlights the following: (1) the classification of security and privacy requirements in edge computing, (2) the state of the art techniques deployed in curbing the security and privacy threats, (3) the trends of technological methods employed by the techniques, (4) the metrics used for evaluating the performance of the techniques, (5) the taxonomy of attacks affecting the edge network, and the corresponding technological trend employed in mitigating the attacks, and, (6) research opportunities for future researchers in the area of edge computing security and privacy.

CFM: collusion-free model of privacy preserving frequent itemset mining

Although many privacy preserving frequent itemset mining protocols have been proposed to preserve the privacy of participants, most of them are vulnerable against collusion. Usually, these protocols are designed for semi-honest model; where in this model, it is assumed that the participants do not deviate from the protocol. However, in real world, participants may collude with each other in order to falsify the protocol or to obtain the secret values of other parties. In this paper, we analyse the vulnerability of previous privacy preserving frequent itemset mining protocols from privacy point of view, and then, we proposes a new protocol (CFM), which preserves the privacy of participants, even in collusion state. CFM is designed for mining frequent itemsets from homogenous (horizontally partitioned) data, which not only preserves the privacy of participants in collusion states, but also shows better performance in comparison with previous works. In order to achieve this goal, CFM employs a new secret sharing and secret summation scheme, which distributes secret values among participants. Privacy preserving level of CFM is evaluated based on the disclosure of sensitive information.

CFM: collusion-free model of privacy preserving frequent itemset mining

Although many privacy preserving frequent itemset mining protocols have been proposed to preserve the privacy of participants, most of them are vulnerable against collusion. Usually, these protocols are designed for semi-honest model; where in this model, it is assumed that the participants do not deviate from the protocol. However, in real world, participants may collude with each other in order to falsify the protocol or to obtain the secret values of other parties. In this paper, we analyse the vulnerability of previous privacy preserving frequent itemset mining protocols from privacy point of view, and then, we proposes a new protocol (CFM), which preserves the privacy of participants, even in collusion state. CFM is designed for mining frequent itemsets from homogenous (horizontally partitioned) data, which not only preserves the privacy of participants in collusion states, but also shows better performance in comparison with previous works. In order to achieve this goal, CFM employs a new secret sharing and secret summation scheme, which distributes secret values among participants. Privacy preserving level of CFM is evaluated based on the disclosure of sensitive information.

A Survey on Privacy Vulnerabilities in Permissionless Blockchains

Blockchain decentralization not only ensures transparency of transactions to eliminate need of trusting third party, but also makes the transactions of the network to be publicly accessible to all the participating peers in the network. As a result, data anonymity and confidentiality are compromised making several business enterprises and industrialists hesitant to adopt the technology. Although research community has proposed various privacy-preserving solutions for blockchain, however, they still lack in efficiency resulting in distrust of industries in opting for the technology. This study is conducted for contributing to the existing body of knowledge corresponding to privacy in blockchains. The fundamental goal of this study is to delve into privacy vulnerabilities of the blockchain network in a permissionless setting by identifying non-trivial roots of factors causing privacy breach in blockchain and presenting limitation of existing privacy preserving mechanisms. Studies with superficial comparison of privacy preserving techniques are available in literature but a detailed and in-depth analysis of their limitations and causes of privacy breach in blockchain is yet not done. Therefore, in this paper we first present comprehensive analysis of various privacy breaching factors of the blockchain networks. Next, we discuss existing cryptographic and non-cryptographic solutions in literature. We found out that these existing privacy preserving mechanisms have their own set of limitations and hence are inefficient at current point of time. The existing privacy preserving mechanisms need further consideration of the research community before they’re widely adopted and benchmarked. Therefore, in the end, we identified some future directions that need to be addressed to model an efficient privacy preserving mechanism for wider adoption of the blockchain technology.