Protection Of Sensitive Data Research Articles

The Difficulty of Defining Sensitive Data – the Concept of Sensitive Data in the EU Data Protection Framework

The concept of sensitive data has been a mainstay of data protection for a number of decades. The concept itself is used to denote several categories of data for which processing is deemed to pose a higher risk for data subjects than other forms of data. Suck risks are often perceived in terms of an elevated probability of discrimination (or related harms) to vulnerable groups in society. As a result, data protection frameworks have traditionally foreseen a higher burden for the processing of sensitive data than other forms of data. The sui generis protection of sensitive data (stronger than the protection of non-sensitive personal data) can also seemingly be a necessity from a fundamental rights-based perspective (as indicated by human rights jurisprudence). This paper seeks to analyse the continued relevance of sensitive data in both contemporary and potential future contexts. Such an exercise is important for two main reasons. First, the legal regime responsible for the regulation of the use of personal data has evolved considerably since the concept of sensitive data was first used. This has been exemplified by the creation of the EU's General Data Protection Regulation in Europe. It has introduced a number of requirements relating to sensitive data that are likely to represent added burdens for controllers who want to process personal data. Second, the very nature of personal data is changing. Increases in computing power, more complex algorithms and the availability of ever more potentially complimentary data online mean that more and more data can be considered of a sensitive nature. This creates various risks going forward, including an inflation effect whereby the concept loses its value and also the possibility that data controllers may increasingly seek to circumvent complying with the requirements placed upon the use of sensitive data. This paper analyses how such developments are likely to influence the concept of sensitive data and in particular its ability to protect vulnerable groups form harms. The authors propose a possible interpretative solution: a hybrid approach where a purpose-based definition acquires a bigger role in deciding whether data is sensitive combined with a context-based ‘backstop’ based on reasonable foreseeability.

Internet, culture e religioni. Spunti di riflessione per un web interculturale

SOMMARIO: 1. Sviluppo tecnologico, internet e dinamiche interculturali - 2. I nuovi mezzi di comunicazione sociale nel magistero della Chiesa cattolica - 3. Strategie confessionali e prospettive interculturali: il caso delle app religiose - 4. Il download di una app tra tutela della privacy e sicurezza sociale. Internet, Cultures, Religions. Some insights for an intercultural web. ABSTRACT: The article aims to investigate the relationship between the Internet and religions. Technological evolution has produced important consequences on society and relationships between people, also involving religious denominations. The latter have defined new ways of professing and excercizing their belief: creation of Christian communities on line, Internet as window of knowledge of monastic life or proselytizing tools, propaganda through religious videogames, app for smartphones and tablets. Such tools can contribute to the formation of an intercultural web. The use of the Internet and of modern technologies questions jurists about the protection of sensitive data of religious interest and of social security. Downloading an app on smatphones and tablets allows the provider to access even the user’s sensitive data, including their religious affiliation. This requires the intervention of Italian Data Protection Authority, whose task is to check whether the processing of sensitive data is carried out in compliance with the applicable regulations. The improper use of the Internet can also involve the protection of social security, through the denigration of a particularly weak social group and as a tool of spreading and inciting hatred (hate speech). The legislator is therefore called upon to define the sanctioning capacity of the existing legal systems.

Distributed Memetic Algorithm for Outsourced Database Fragmentation.

Data privacy and utility are two essential requirements in outsourced data storage. Traditional techniques for sensitive data protection, such as data encryption, affect the efficiency of data query and evaluation. By splitting attributes of sensitive associations, database fragmentation techniques can help protect data privacy and improve data utility. In this article, a distributed memetic algorithm (DMA) is proposed for enhancing database privacy and utility. A balanced best random distributed framework is designed to achieve high optimization efficiency. In order to enhance global search, a dynamic grouping recombination operator is proposed to aggregate and utilize evolutionary elements; two mutation operators, namely, merge and split, are designed to help arrange and create evolutionary elements; a two-dimension selection approach is designed based on the priority of privacy and utility. Furthermore, a splicing-driven local search strategy is embedded to introduce rare utility elements without violating constraints. Extensive experiments are carried out to verify the performance of the proposed DMA. Furthermore, the effectiveness of the proposed distributed framework and novel operators is verified.

Distributed logistic regression with differential privacy

In this paper, we focus on the privacy protection of sensitive data and develop a distributed logistic regression that satisfies differential privacy. Distributed differential privacy is achieved by perturbing the distributed algorithm output. Further, to prevent privacy leakage occurring during the computer interaction process, we propose a distributed logistic variable perturbation algorithm based on an alternating direction method of multipliers (ADMM) algorithm. Further, the theoretical bounds of the algorithms are provided. Experiments show that the proposed algorithms can effectively analyze distributed storage data and protect their privacy.

IDENTIFICATION AND PREVENTION OF EXPECTED CYBERSECURITY THREATS DURING 2022 FIFA WORLD CUP IN QATAR

Purpose: This research aimed to identify cybersecurity threats expected at the upcoming FIFA World Cup in Qatar in 2022 and assess how they can be prevented.
 Methodology: This was done by adopting a quantitative research design and survey strategy with 167 respondents from Qatar. The respondents were purposively sampled from the event industry, and a Likert scale was used to quantify the responses for further statistical analysis. The quantitative data collected was analysed using the SPSS version 25 for data analysis. A hypothesis was tested as to whether the perceived expected cybersecurity threats are significantly associated with the perceived quality of measures to tackle these threats. The testing was done using multiple methods, including Principal Component Analysis (PCA) and cross-sectional linear regression analysis. Further analysis was done using One-way ANOVA and correlation analysis, as well as, independent samples t-test. Descriptive statistics, such as percentages and frequencies were used, with tables and charts used in presenting the findings.
 Findings: The results revealed high loadings of potential cyberattacks on sponsors, fans, online ticket sales, government and the FIFA website based on the PCA. The regression analysis revealed a statistically significant association between the perception of the cybersecurity risks and perceived quality of measures undertaken to address the cyber threats. The research was limited, however, by not covering technical issues of cybersecurity, including the development of improvements to current security systems, which presents an area for future research with the implementation of machine learning technologies, big data and AI training.
 Contribution: The study provided recommendations for policymakers to invest in technologies for the protection of sensitive data, including online databases and hiring competent specialists in the field of cybersecurity. To address the risks for fans, policymakers are recommended to start a campaign aimed at increasing the awareness of cyberattacks on personal and financial information at large events.

Image steganography with N-puzzle encryption

Security, when referred to the context of data/information, is indeed a very vulnerable and necessary entity at present. Rigorous researches are cropping up for the betterment of the secured globe. Primarily, the term ‘Steganography’ has been in limelight to cater the extreme need of protection of sensitive and confidential data. This paper presents a two level steganographic approach of masking the secret data. This is done to facilitate data hiding and hence ensures a covert communication. On the whole, the targeted goal of this methodology is to maintain a trade-off between payload, imperceptibility and robustness. The first stage of the procedure imposes the Arnold transformation on the carrier image. The output of this stage is a scrambled image. This scrambling of pixel data bits disrupts the normal orientation of the resident pixels. Next, an N-puzzle based technique is applied on the scrambled image to promote a strategy of encryption. The concept of N-puzzle problem stands to be the base of this step. Post this stage, the output generated is a further encrypted image. Thereafter, the insertion technique of Mid Position Value (MPV) is applied to embed bits from the secret image within the above generated form of cover/carrier. After the procedure of insertion, the application of reverse N-puzzle encryption technique followed by the inverse Arnold transform fosters the final stego-image. This, on the whole, results in reverting back to the normal orientation of the original input image. All of the given experimental results highlight the outcome of the whole methodology. On this context, several of the quantitative as well as qualitative benchmark parameters have been analyzed. The results computed shows that the quality is well maintained. The generated stego is imperceptible. It also supports the non-detectability of secret data. The payload promoted in this procedure is quite high. Thus, the trade-off between the security parameters is maintained.

PROTECTOR: Towards the protection of sensitive data in Europe and the US

The evolution of mobile multimedia computing and artificial intelligence represents a significant challenge in terms of real-time data processing and data protection management. It can be seen in the EU and US, where governments are adapting their regulation laws to meet current and future societal requirements. However, existing solutions provide limited capabilities and operate in isolation, focusing on protecting particular rights of citizens. The main contribution of the article at hand is a novel platform, called PROTECTOR, that protects sensitive data of EU and US citizens according to the rights provided by current EU/US data protection regulation laws. Three case studies prove how PROTECTOR deals with several citizen’s rights in two different legislation environments, such as the EU GDPR and the US. Finally, a pool of experiments with a different number of citizens, policies, and data have demonstrated the feasibility of the proposed solution.

Enabling ad-hoc reuse of private data repositories through schema extraction

BackgroundSharing sensitive data across organizational boundaries is often significantly limited by legal and ethical restrictions. Regulations such as the EU General Data Protection Rules (GDPR) impose strict requirements concerning the protection of personal and privacy sensitive data. Therefore new approaches, such as the Personal Health Train initiative, are emerging to utilize data right in their original repositories, circumventing the need to transfer data.ResultsCircumventing limitations of previous systems, this paper proposes a configurable and automated schema extraction and publishing approach, which enables ad-hoc SPARQL query formulation against RDF triple stores without requiring direct access to the private data. The approach is compatible with existing Semantic Web-based technologies and allows for the subsequent execution of such queries in a safe setting under the data provider’s control. Evaluation with four distinct datasets shows that a configurable amount of concise and task-relevant schema, closely describing the structure of the underlying data, was derived, enabling the schema introspection-assisted authoring of SPARQL queries.ConclusionsAutomatically extracting and publishing data schema can enable the introspection-assisted creation of data selection and integration queries. In conjunction with the presented system architecture, this approach can enable reuse of data from private repositories and in settings where agreeing upon a shared schema and encoding a priori is infeasible. As such, it could provide an important step towards reuse of data from previously inaccessible sources and thus towards the proliferation of data-driven methods in the biomedical domain.

Research of hybrid WDM-PON data transmission system with embedded ASE-powered stealth channels for steganography applications

Abstract The frequency spectrum is becoming busier, thereby it might be appealing for more and more, for instance, eavesdroppers to try to gather some valuable data or identify the transmission frequencies for this specific data. To mitigate the possible risks concerning that, not only data encryption but also hiding of the data channels (creation of stealth channels) is necessary. For the success of stealth signal integration, channel spacing, and power customization is required. During this research, in the simulation environment, we show a successful realization of the 8-channel 10 Gbit/s non-return-to-zero on–off keying (NRZ-OOK) modulated wavelength-division-multiplexed passive optical network (WDM-PON) with the embedded additional amplified spontaneous emission (ASE) powered hidden 7-channel 2.5 Gbit/s NRZ-OOK modulated spectrum-sliced data transmission system. Such as a hybrid optical transmission system can be used to improve the protection of sensitive data. Our results show that the introduction of the stealth data transmission system leads to an estimated power penalty below 0.02 dB at the pre-FEC BER level of 10−3, which may be considered as negligible and shows the viability of this hybrid system. The proposed approach can be applied not only in the WDM-PON architecture but also in other types of fiber optical access or metro-access systems.

Privacy preserving online matching on ridesharing platforms

Ridesharing platforms, as typical applications of spatial crowdsourcing, are becoming more and more popular in the era of mobile internet and sharing economy. One of the most fundamental issues on ridesharing platforms is to assign orders to drivers, which can be naturally modeled as online bipartite matching problem. However, conventional online matching algorithms usually lack data privacy protection mechanisms. This has become a serious issue since the spatiotemporal data of passengers is often sensitive. New policies such as EU’s General Data Protection Regulation (GDPR) also enforce protection of sensitive data, which further exacerbate the privacy issues. To deal with the problems, in this paper we propose a framework based on differential privacy (DP) techniques to preserve the privacy of individuals on ridesharing platforms. Specifically, we devise a novel approach to perturb locations in online minimum bipartite matching problem and theoretically show that the performance of the perturbed matching algorithm has the same magnitude with the unperturbed one. Experiments conducted on real datasets have also shown the effectiveness of proposed framework.

Protection of Sensitive Data in Industrial Internet Based on Three-Layer Local/Fog/Cloud Storage

Industrial Internet technology has developed rapidly, and the security of industrial data has received much attention. At present, industrial enterprises lack a safe and professional data security system. Thus, industries urgently need a complete and effective data protection scheme. This study develops a three-layer framework with local/fog/cloud storage for protecting sensitive industrial data and defines a threat model. For real-time sensitive industrial data, we use the improved local differential privacy algorithm M-RAPPOR to perturb sensitive information. We encode the desensitized data using Reed–Solomon (RS) encoding and then store them in local equipment to realize low cost, high efficiency, and intelligent data protection. For non-real-time sensitive industrial data, we adopt a cloud-fog collaborative storage scheme based on AES-RS encoding to invisibly provide multilayer protection. We adopt the optimal solution of distributed storage in local equipment and the cloud-fog collaborative storage scheme in fog nodes and cloud nodes to alleviate the storage pressure on local equipment and to improve security and recoverability. According to the defined threat model, we conduct a security analysis and prove that the proposed scheme can provide stronger data protection for sensitive data. Compared with traditional methods, this approach strengthens the protection of sensitive information and ensures real-time continuity of open data sharing. Finally, the feasibility of our scheme is validated through experimental evaluation.

A Novel Approach of Data Content Zeroization Under Memory Attacks

Protecting user’s secret data on the devices like smartphones, tablets, wearable devices etc, from memory attacks is always a challenge for system designers. The most stringent security requirements and protocols in today’s state-of-the-art systems are governed by Federal Information Processing Standards (FIPS). Specifically, it ensures the protection of sensitive data by erasing them from random access memories (RAMs) and associated flip-flip based registers, as soon as security violation(s) is(are) detected. Traditionally, the sensitive data like authentication credentials, cryptographic keys and other on-chip secrets are erased (or zeroized) by sequential write transactions initiated either by dedicated hardware or using software programs. This paper, for the first time, proposes a novel approach of erasing secured data content from on-chip RAMs using conventional memory built-in-self-test (MBIST) hardware in mission mode. The proposed zeroization approach is proved to be substantially faster than the traditional techniques in erasing data content. As it helps in re-using Memory BIST hardware for on-chip data content zeroization, this guarantees to save silicon area and power by removing dedicated conventional hardware from the device. This paper also discusses the micro-architectural implementation and security challenges of using Memory BIST hardware in mission mode and proposes practical solutions to fill the gaps.

MobiGyges: A mobile hidden volume for preventing data loss, improving storage utilization, and avoiding device reboot

Sensitive data protection is essential for mobile users. Plausibly Deniable Encryption (PDE) systems provide an effective manner to protect sensitive data by hiding them on the device. However, existing PDE systems can lose data due to overriding the hidden volume, waste physical storage owing to the “reserved area” for avoiding data loss, and require device reboot when using the hidden volume. This paper presents MobiGyges, a hidden volume-based mobile PDE system, to fill the gap. MobiGyges addresses the problem of data loss by restricting each storage block used only by one volume, and it improves storage utilization by eliminating the “reserved area”. MobiGyges also avoids device reboot by mounting the hidden volume dynamically on-demand with the Dynamic Mounting service. Moreover, we identify two novel PDE oriented attacks, the capacity comparison attack and the fill-to-full attack. MobiGyges can defend against them by jointly leveraging the Shrunk U-disk method and multi-level deniability. We implement the MobiGyges proof-of-concept system on a real mobile phone Google Nexus 6P with LineageOS 13. Experimental results show that MobiGyges prevents data loss, avoids device reboot, improves storage utilization by over 30% with acceptable performance overhead compared with current solutions.

Practical Implementation of Privacy Preserving Clustering Methods Using a Partially Homomorphic Encryption Algorithm

The protection and processing of sensitive data in big data systems are common problems as the increase in data size increases the need for high processing power. Protection of the sensitive data on a system that contains multiple connections with different privacy policies, also brings the need to use proper cryptographic key exchange methods for each party, as extra work. Homomorphic encryption methods can perform similar arithmetic operations on encrypted data in the same way as a plain format of the data. Thus, these methods provide data privacy, as data are processed in the encrypted domain, without the need for a plain form and this allows outsourcing of the computations to cloud systems. This also brings simplicity on key exchange sessions for all sides. In this paper, we propose novel privacy preserving clustering methods, alongside homomorphic encryption schemes that can run on a common high performance computation platform, such as a cloud system. As a result, the parties of this system will not need to possess high processing power because the most power demanding tasks would be done on any cloud system provider. Our system offers a privacy preserving distance matrix calculation for several clustering algorithms. Considering both encrypted and plain forms of the same data for different key and data lengths, our privacy preserving training method’s performance results are obtained for four different data clustering algorithms, while considering six different evaluation metrics.

Towards an Auditable Cryptographic Access Control to High-value Sensitive Data

We discuss the challenge of achieving an auditable key management for cryptographic access control to high-value sensitive data. In such settings it is important to be able to audit the key management process - and in particular to be able to provide verifiable proofs of key generation. The auditable key management has several possible use cases in both civilian and military world. In particular, the new regulations for protection of sensitive personal data, such as GDPR, introduce strict requirements for handling of personal data and apply a very restrictive definition of what can be considered a personal data. Cryptographic access control for personal data has a potential to become extremely important for preserving industrial ability to innovate, while protecting subject's privacy, especially in the context of widely deployed modern monitoring, tracking and profiling capabilities, that are used by both governmental institutions and high-tech companies. However, in general, an encrypted data is still considered as personal under GDPR and therefore cannot be, e.g., stored or processed in a public cloud or distributed ledger. In our work we propose an identity-based cryptographic framework that ensures confidentiality, availability, integrity of data while potentially remaining compliant with the GDPR framework.

Evaluation of Molecular Genetic Analysis in Criminal Procedure Law in Terms of Protection of Sensitive Personal Data

Although the protection of personal data is a requirement and has a great importance, the diversification of both the data within the scope of personal data and the situations that may cause a violation of the law in terms of protection of this data, makes this protection difficult and necessitates the creation of new legal protection mechanisms. Criminal procedure law is the branch of law which most needs personal data. Molecular genetic analysis is regulated by Articles 78 and thereafter of the Turkish Criminal Procedure Code No. 5271 which is focused on sensitive personal data. Although there are debates on whether or not they should be established in our country, DNA data banks in most countries require different evaluations on the protection of sensitive personal data. In our study, molecular genetic analysis in criminal procedure law is examined in terms of the protection of sensitive personal data and examining firstly Turkish criminal procedure law and then significant comparative law examples. In this regard, the legal regulations related to molecular genetic analysis, the protection mechanisms envisaged in these regulations and the situations reflected in practice are presented and the issues discussed in the judicial decisions are also mentioned. The study was completed by presenting certain important points related to the subject and with specific explanations on whether or not a national DNA database should be established in our country.

ИССЛЕДОВАНИЕ ПОПУЛЯРНЫХ ПРИЛОЖЕНИЙ ДЛЯ ОБМЕНА МГНОВЕННЫМИ СООБЩЕНИЯМИ НА ПРЕДМЕТ СБОРА ЧУВСТВИТЕЛЬНЫХ ДАННЫХ О ПОЛЬЗОВАТЕЛЯХ

Sensitive data of a person, when agreeing with the privacy policy in services that carry out instant messages, are the main subject of protection. The relevance of this article lies in the main aspects of organizing the protection of sensitive user data, since their main and important property is confidentiality. The article discusses procedures related to sensitive data and possible threats to their transfer and use. The purpose of the article is to review and classify current threats to sensitive data of users of the most popular applications on the territory of the Russian Federation, to study and analyze studies that offer various methods of protection against the threats considered in this work.

A Lossless Watermarking Algorithm Based on Line Pairs for Vector Data

With the increasing demand for copyright protection of high-precision and sensitive vector data in Geographical Information System (GIS), research on lossless watermarking has attracted more and more attention. In this paper, a new lossless watermarking method based on line pairs is proposed. Firstly, the points and polygons are unified into the polylines, and then every two adjacent polylines are combined into a line pair. Besides, the storage direction and the interior angle of the line pairs are analyzed. Secondly, the watermark bit is determined by the interior angle of each line pair. Then, the watermark information is embedded by judging whether the storage direction of each line pair and the watermark bit is the same. Finally, experimental results verify that the proposed method works effectively for the data of the points, polylines and polygons, and has good invisibility without damaging the vector data. In addition, compared with the existing algorithm, the proposed method achieves higher robustness against geometric attacks, such as translating, rotating, and scaling the vector data.

Access control mechanism based on image recognition and user level

The rapid development of big data and the Internet has brought enormous challenges to data security. Aiming at protecting the sensitive image data protection and secure access of information, an access control mechanism based on image recognition and user level is proposed. On the one hand, the mechanism is based on deep learning, mining sensitive information in images, realizing hierarchical classification and precise positioning of sensitive areas in images; on the other hand, combining identity authentication to achieve user management based on identity level; The image sensitivity level is mapped with the user identity level, which realizes the user’s access authority control, prevents unauthorized or illegal access of sensitive image information, and effectively protects sensitive image information.

Propuesta de políticas para reducir el riesgo de pérdida de información en la plataforma Cloud office 365 en una empresa comercial

La investigación tuvo como objetivo proponer políticas de seguridad de la información para la protección de datos sensibles de la empresa que utilizan frecuentemente los trabajadores en la plataforma de office 365, segmentando documentos de data sensible por áreas, usuarios determinados y mejorando la seguridad de accesos a sus cuentas de correo, o acceso a dispositivos móviles que no cuentan con limitaciones en el uso de la data organizacional. El estudio se basó en el sintagma holístico, enfoque mixto y en el tipo proyectivo, se aplicaron métodos de recolección cuantitativo y cualitativo. Para ello, se entrevistó a tres usuarios con los cargos respectivos de director, gerente y jefe del área; se extrajeron registros de auditoría con accesos de usuarios desde ambientes externos e internos, el cual nos ayudó a conocer quienes acceden a sus cuentas desde IP's fuera del rango de la oficina. Se evidenció que poseen acceso a sus cuentas y documentos de la empresa, los mismos que pueden ser eliminados y/o descargados porque utilizan los servicios en nube de SharePoint u OneDrive. En conclusión, la información se ve expuesta a ser sustraída y manipulada por usuarios externos, dado que la empresa tiene políticas básicas aplicadas a los usuarios.